Emails going to spam? A 7-step fix checklist

The short version

• Fix authentication first. Gmail and Yahoo require SPF or DKIM from every sender, and bulk senders need SPF, DKIM and DMARC.
• Check your domain on the Spamhaus blocklist checker, and set up Google Postmaster Tools to see your Gmail spam rate.
• Keep complaints low. Gmail and Yahoo want a spam rate below 0.3%, and Google recommends staying below 0.10%.
• Grow volume slowly, mail only people who asked, and make unsubscribing one click. BIMI (your logo in the inbox) is optional and comes last.

Work through the steps in order. Inbox rules below are as of October 2026.

Step 1: fix authentication first

Three short text records in your domain’s DNS (the settings that connect your domain to services) prove your mail is really from you:

• SPF lists the servers allowed to send for your domain.
• DKIM adds a digital signature to each message.
• DMARC tells inboxes what to do with mail that fails those checks, and where to send reports.

Since February 2024, everyone sending to personal Gmail accounts must use SPF or DKIM, have valid forward and reverse DNS, and send over a secure (TLS) connection. Google treats you as a bulk sender once you send close to 5,000 messages to personal Gmail accounts in 24 hours, and that label is permanent. Outlook.com has required SPF, DKIM and DMARC since May 5, 2025 from domains sending more than 5,000 emails a day. Its failing mail goes to Junk and may be rejected with error 550 5.7.515.

1. Send a message to a Gmail address and open it. Next to Reply, click More, then “Show original.” In the Authentication-Results line, look for spf=pass and dkim=pass.
2. If SPF fails, check that your domain has exactly one SPF record. Two SPF records break the check, and so does a record that needs more than 10 DNS lookups.
3. Turn on DKIM in your email provider’s admin panel and add the record it gives you. In Google Workspace it can take up to 48 hours to start working.
4. Add DMARC last. Google advises waiting 48 hours after SPF and DKIM, starting with p=none (report only), then moving to quarantine or reject over time.
5. Send from an address at your own domain, the same domain SPF or DKIM passes for. Gmail and Yahoo call this alignment and require it from bulk senders.

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

The exact records for Google Workspace and Microsoft 365, and where to add them at Cloudflare, Namecheap, GoDaddy, Squarespace and Porkbun, are in our SPF, DKIM and DMARC guide. If only your website’s contact form mail goes missing, see why website form emails go missing.

Step 2: check blocklists

A blocklist is a list of domains and IP addresses that mail servers use to filter or refuse mail. Spamhaus runs several: the SBL (Spamhaus Blocklist), XBL (Exploits Blocklist), PBL (Policy Blocklist) and DBL (Domain Blocklist).

1. Open the Spamhaus Reputation Checker and look up your domain.
2. Look up your sending IP address too, if you run your own mail server or pay for a dedicated IP.
3. If you send through a shared service such as Google Workspace, Microsoft 365 or a newsletter tool, the sending IP is that company’s to fix, so contact its support.
4. If your own domain or IP is listed, fix the cause before anything else: a hacked mailbox, a web form spammers abuse, or a list you did not build yourself.

Step 3: watch Postmaster Tools and SNDS

Gmail and Outlook.com offer free reporting tools that show how the inbox sees you.

1. Follow Google’s Postmaster Tools setup steps to add your domain.
2. Open the Compliance status dashboard. It shows whether your mail meets Gmail’s sender requirements.
3. Watch the spam rate. Below 0.3% is required; below 0.10% is what Google recommends.

Step 4: warm up new domains and IPs slowly

Google tells senders to start with a low volume to engaged users and increase slowly, and warns against sudden spikes if you have no history of sending large volumes. A brand-new domain has no history, so send its first campaigns to your most active customers, not your whole list.

With a dedicated IP (a sending address used only by you), follow your sending service’s schedule:

• Mailgun: start with 100 emails on day one and raise daily volume by 20%.
• SendGrid: its automated warm-up runs 41 days, and an IP unused for more than 30 days should be warmed again. Free and Essentials accounts use shared IPs and need no warm-up.
• Amazon SES: warms standard dedicated IPs for you over 45 days.

Step 5: clean your list

• Mail only people who opted in. Google and Yahoo both say not to buy email lists or use sign-up boxes that come already checked.
• Remove addresses that bounce (mail that comes back as undeliverable). Google says to unsubscribe people after multiple bounces; Yahoo says to remove invalid addresses promptly.
• Every so often, ask quiet subscribers whether they still want your emails. Google also suggests you consider unsubscribing people who do not open or read your messages.
• Send at a steady rate. Google says to avoid sending in bursts, and a sudden blast to an old list is that kind of spike.

Step 6: make unsubscribing easy

Gmail and Yahoo require bulk senders to offer one-click unsubscribe on marketing mail. The standard, RFC 8058, uses two message headers that let the inbox show its own Unsubscribe button. Your DKIM signature must cover them.

List-Unsubscribe: <https://example.com/unsubscribe?id=123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

1. Open one of your marketing emails in Gmail, choose “Show original,” and look for both headers. If they are missing, ask your newsletter tool how to turn them on.
2. Keep a visible unsubscribe link in the footer too. Gmail and Apple require one from bulk senders.
3. Process unsubscribes fast. Google says within 48 hours and Yahoo says within 2 days. US law allows 10 business days, but the inbox rules are stricter.

Step 7: keep the content honest

The CAN-SPAM Act sets the US rules for commercial email, and it covers business-to-business email too. The FTC’s main rules include:

• No false or misleading header information, such as the From name.
• No deceptive subject lines.
• Identify the message as an ad.
• Include your valid physical postal address.
• Tell people how to opt out, and honor opt-outs within 10 business days.
• Stay responsible for anyone sending on your behalf.

Each email that breaks the law can bring a civil penalty of up to $53,088, an amount the FTC says stays unchanged for 2026. This is general information, not legal advice. More in our sender rules guide.

Optional: show your logo with BIMI

BIMI lets supporting inboxes show your logo next to your messages. It does not fix spam, so do it last. Its specification is still an IETF draft.

• DMARC at enforcement. Your policy must be p=quarantine or p=reject; p=none does not qualify.
• A logo file in SVG Tiny PS format, a restricted kind of SVG image.
• A mark certificate for Gmail. A VMC (Verified Mark Certificate) needs a registered trademark (or a government mark). A CMC (Common Mark Certificate) covers a logo that is not trademarked. Google’s BIMI help accepts either and shows a checkmark only with a VMC; the BIMI Group’s sender FAQ says Gmail requires a VMC. Check Google’s page before you buy.
• A yearly renewal. Mark certificates last at most 398 days. The BIMI Group lists DigiCert, GlobalSign and SSL.com as issuers, and Sectigo said in February 2026 that it offers them too. Ask for a price quote.

One mismatch: Google’s BIMI page still asks for pct=100 in your DMARC record, though the newest DMARC standard, RFC 9989 (May 2026), removed the pct tag. For Gmail, follow Google’s page.

Still in spam after all seven steps? See hiring email help, or start over with the 10-minute self-check on the email deliverability hub.

Sources: Google: Gmail sender guidelines, sender guidelines FAQ, full message header, check if a message is authenticated, Postmaster Tools, Postmaster Tools dashboards, old interface deprecation, set up DKIM, set up DMARC, set up BIMI. Yahoo: sender best practices. Microsoft: Outlook.com postmaster policies, SNDS. Apple: iCloud Mail postmaster information. Spamhaus: Reputation Checker, blocklists. Warm-up: Mailgun, SendGrid, Amazon SES. Standards: RFC 7208 (SPF), RFC 8058 (one-click unsubscribe), RFC 9989 (DMARC), BIMI draft. BIMI: BIMI Group sender FAQ, certificate issuers, DigiCert on VMC and CMC, Sectigo announcement. FTC: CAN-SPAM compliance guide, 2026 penalty notice.