Why your emails land in spam (and how to fix it)

The short version

• Start with three DNS records on your domain: SPF, DKIM and DMARC. They prove to Gmail, Yahoo and Outlook that your mail really comes from you.
• Since February 2024, Gmail and Yahoo require every sender to pass SPF or DKIM. Bulk senders need all three, plus one-click unsubscribe on marketing mail.
• You can check your own setup in about 10 minutes: send a message to a Gmail address, open “Show original”, and look for three passes.
• WordPress contact-form emails are a separate problem: send them through a real mail service, not the web server.

The three records, one line each

DNS is your domain’s address book. You add these records where your DNS is managed, usually your registrar or Cloudflare. Your email provider gives you the exact values (more in our DNS entry).

• SPF (Sender Policy Framework): a list of the servers allowed to send mail for your domain. Google Workspace’s looks like v=spf1 include:_spf.google.com ~all
• DKIM (DomainKeys Identified Mail): a digital signature on each message. Your provider signs the mail, and a public key in your DNS lets receivers check it.
• DMARC: tells receivers what to do when a message fails, and where to send you reports. A safe first record, on the name _dmarc.example.com: v=DMARC1; p=none; rua=mailto:[email protected]

For bulk senders, Gmail and Yahoo also require the domain in your From address to match the domain that passed SPF or DKIM. That match is called alignment.

A domain may have only one SPF record. If you send through more than one service, combine them into one record. Setup steps and common mistakes are in our SPF, DKIM and DMARC guide.

What Gmail, Yahoo, Outlook and iCloud require

As of October 2026. “Bulk” means a large volume of mail to that company’s personal accounts, such as a newsletter list.

With Google Workspace or Microsoft 365, reverse DNS and TLS (set on the sending server) are usually handled for you. Your part is the DNS records.

Google’s guidelines say “more than 5,000 messages per day”; its FAQ says “close to 5,000 messages or more” in 24 hours. Reach it once and Gmail treats you as a bulk sender for good. Microsoft’s support page says 5,000 or more.

Fall short and, since November 2025, Gmail may reject the mail. Outlook.com sends it to Junk and may then reject it with error 550 5.7.515. Google also recommends a spam rate below 0.10%. Details are in our sender rules guide.

The 10-minute self-check

1. From your business address, send a short, normal email to a personal Gmail address you can open.
2. Open Gmail in a web browser and open the message. Next to Reply, click More, then Show original. The full header opens in a new window.
3. Look for the Authentication-Results lines. Google says your mail should pass all three checks, SPF, DKIM and DMARC. For DKIM it should read something like dkim=pass.
4. Check that the passing domain is your own, not only your email provider’s. Google says SPF or DKIM must be aligned with your From address.
5. Fix anything that does not pass (see below), then check again once the DNS change takes effect (timing is in the FAQ below).
6. Repeat steps 1 to 4 with a message sent from your website’s contact form.

What a failed line usually means:

• SPF fails or is missing. The sending service is not in your SPF record, or you have none. Add it to your one SPF record.
• DKIM is missing or shows another domain. Turn on DKIM in your email provider’s admin panel and add the record it gives you. Google says it can take up to 48 hours to start working.
• DMARC fails or is missing. First make SPF or DKIM pass for your own domain, then add a p=none record. Google suggests waiting 48 hours after SPF and DKIM, and moving to quarantine or reject later.

All three pass but mail still lands in spam? Check your domain and sending IP address on Spamhaus’s Reputation Checker. Then set up Google Postmaster Tools, which shows data on your mail to Gmail, including your spam rate. Our spam fixes checklist covers the next steps.

Website form emails are a separate problem

On WordPress, form notifications go through a function called wp_mail(). By default it uses PHP’s built-in mail() on your web server. WordPress says a “sent” result from wp_mail() does not prove the email reached anyone.

The usual fix is an SMTP plugin that sends form mail through your email provider or a sending service. Gravity Forms also advises using your site’s own domain in the From address and putting the visitor’s address in Reply To. Step-by-step help is in the website form emails guide.

Guides in this section

• SPF, DKIM and DMARC: example records, where to add them, and common mistakes.
• Sender rules: each inbox’s rules in detail, plus US CAN-SPAM Act basics (general information, not legal advice).
• Website form emails: host limits, SMTP plugins and sending services.
• Spam fixes: blocklists, Postmaster Tools, warming up a new domain and list hygiene.
• Hire help: when to pay someone and how to give access safely.

Choosing a mailbox for your domain? See our websites and email guide.

Sources: Google: Email sender guidelines, sender guidelines FAQ, Trace an email with its full header, Troubleshoot DMARC issues, Set up SPF, Set up DKIM, Set up DMARC, Postmaster Tools. Yahoo: Sender best practices, Sender FAQs. Microsoft: Outlook.com postmaster policies, Fix error 550 5.7.515. Apple: iCloud Mail postmaster information. Standards: RFC 7208 (SPF), RFC 9989 (DMARC). DNS providers: Namecheap, GoDaddy. WordPress: wp_mail() reference. Gravity Forms: Troubleshooting notifications. Spamhaus Reputation Checker.