You send a campaign to 2,000 contacts. Opens crawl in at 4 percent. Nobody replies. Then a client mentions, almost as an aside, that your last three emails were sitting in junk.
The honest answer to “why are my emails going to spam” is rarely your subject line. It is almost always authentication, list quality or engagement history. Since 2024, Gmail, Yahoo and now Microsoft have turned deliverability from good practice into a pass or fail test at the door.
The fixes are unglamorous and mostly free. This guide covers them in the order that moves the needle, in plain English, with the setup steps for Google Workspace and WordPress.
Key takeaways
- Authentication is now a requirement, not a best practice. Missing SPF, DKIM or DMARC records are the single most common cause of spam placement.
- Google treats any domain sending close to 5,000 messages a day to personal Gmail accounts as a bulk sender, but the baseline rules apply to every sender at every volume. NoSpamProxy
- Spam complaint rates should stay below 0.10 percent and never exceed 0.30 percent. That is three complaints per thousand sends before you are in trouble. Google Support
- A stale list costs you more than bad copy. Dead addresses and disengaged subscribers drag every future send down with them.
- Deliverability is a revenue problem. If 30 percent of a nurture sequence never arrives, 30 percent of that pipeline never existed.
Why are my emails going to spam?
Emails land in spam for five reasons: your domain is not properly authenticated, your list contains dead or unconsented addresses, recipients ignore or report your mail, your sending volume jumped suddenly, or your content and formatting look like bulk marketing. Authentication and list quality account for most cases.
Notice what is not on that list. The word “free” in your subject line is not why you are in junk. Modern filters weigh sender reputation far more heavily than individual words.
Reputation is attached to your domain and your sending IP, and it accumulates. Every bounce, every complaint, every ignored email adds up. Every reply, click and “move to inbox” pulls the other way.
That is why the fix is sequential. Get the technical identity right first, because nothing else works until a mailbox provider can confirm you are who you claim to be.
What do Gmail, Yahoo and Microsoft actually require in 2026?
Every sender needs SPF or DKIM configured, valid forward and reverse DNS, a TLS connection and spam complaint rates below 0.10 percent. Bulk senders need more: both SPF and DKIM, a DMARC record, From-domain alignment with SPF or DKIM, and one-click unsubscribe on marketing messages. Google Support
Yahoo introduced near-identical rules across the same period. Microsoft followed for its consumer domains: from 5 May 2025, mail to outlook.com, hotmail.com and live.com from domains sending over 5,000 messages a day must pass SPF, DKIM and DMARC, with non-compliant messages rejected rather than filtered. DMARCian
You can read the current requirements on Google’s email sender guidelines and the accompanying sender guidelines FAQ, and Microsoft’s own announcement for high-volume senders.
“But I only send 400 emails a month.” Fair. The bulk thresholds will not apply to you. The baseline rules still do, and the reputation signals behind them apply to everyone.
What are SPF, DKIM and DMARC in plain English?
They are three DNS records that prove your email is genuinely from you. SPF lists which servers are allowed to send on your behalf. DKIM adds a tamper-proof signature. DMARC tells receiving servers what to do when a message fails either check, and sends you reports. Together they form your domain’s passport.
SPF
A text record in your DNS that names every service permitted to send as your domain: your mail provider, your CRM, your invoicing tool, your booking system. Miss one and its mail starts failing. Most SMEs have three or four senders they have forgotten about.
DKIM
A cryptographic signature added to each outgoing message. The receiving server checks it against a public key in your DNS. If the message was altered in transit, or was never yours to begin with, the check fails.
DMARC
The policy layer. It tells mailbox providers to do nothing (p=none), quarantine or reject messages that fail. Crucially, it also emails you reports showing who is sending as your domain. That visibility alone is worth the ten minutes it takes to publish.
How do I set up authentication on Google Workspace and WordPress?
Both are DNS jobs, done once, taking under an hour. In Google Workspace you generate a DKIM key in the admin console and publish it alongside your SPF and DMARC records at your domain registrar. In WordPress you route mail through a proper SMTP service rather than the server’s default PHP mail function.
Google Workspace
Go to Apps, then Google Workspace, then Gmail, then Authenticate email. Generate the DKIM key and add the TXT record it gives you at your registrar, then turn on authentication. Add an SPF record including _spf.google.com plus every third-party sender. Finally, publish a DMARC record at _dmarc.yourdomain.co.uk starting at p=none with a reporting address.
WordPress
WordPress sites send transactional mail through PHP by default, and it is almost always unauthenticated. Install an SMTP plugin and connect it to a proper sending service. Then add that service to your SPF record and enable its DKIM signing. Contact form notifications landing in your own junk folder is the classic symptom.
Is your list quietly killing your deliverability?
Usually, yes. A list that has not been cleaned in two years contains dead mailboxes, role addresses and possibly spam traps. Sending to them tells mailbox providers you do not know who your audience is, and that reputation damage follows you into every subsequent campaign, including your best-performing ones.
Three habits fix it. Verify addresses before any large send. Remove hard bounces immediately, not eventually. Apply a sunset policy: suppress anyone who has not opened or clicked in six to twelve months.
That last one feels wrong. You are deleting people you paid to acquire. But a smaller engaged list outperforms a bloated dead one on revenue every time, because more of it arrives.
Consent matters too. In the UK, the rules on who you may email sit under PECR, and the ICO’s guidance on electronic mail marketing is the reference point.
Which content and formatting choices still trigger filters?
Filters now flag structural signals more than vocabulary: a single large image with almost no text, shortened or mismatched links, a display name that does not match the sending domain, no plain-text version, and a missing or buried unsubscribe link. Salesy phrasing matters far less than most people assume.
Engagement is the real content test. If subscribers open and click, filters relax. If they ignore you, filters tighten, regardless of how clean your HTML is.
Which is a content strategy problem as much as a technical one. Emails that earn a reply are built on something worth reading, which is the same discipline behind good content marketing generally. If you are rebuilding your programme from the ground up, our guide on using email marketing to nurture leads and drive sales covers the sequencing side.
Do email warm-up tools actually work?
Partially, and with caveats. Warm-up services that exchange mail between artificial inboxes create engagement signals from accounts that will never buy from you. They can help a genuinely new domain establish a baseline. They cannot repair a domain with a real complaint history, and they do not replace real recipients.
The reliable version is manual. Start a new domain at low volume with your most engaged contacts and increase gradually over several weeks. Boring, slow, effective.
Two more myths worth retiring. Sending from a personal Gmail address for business mail does not improve deliverability, it damages credibility and control. And buying a “cleaned” list does not make it consented.
The 12-point deliverability fix checklist, ordered by impact
- Publish SPF, DKIM and DMARC for your sending domain and confirm all three pass.
- Align your From domain with SPF or DKIM so DMARC passes.
- Set up Google Postmaster Tools and check your spam rate weekly.
- Remove hard bounces immediately and verify the list before any large send.
- Apply a sunset policy for contacts inactive for six to twelve months.
- Add one-click unsubscribe headers plus a clearly visible unsubscribe link.
- Use a real, monitored From address and an honest sender display name.
- Send marketing from a subdomain, keeping your root domain for day-to-day mail.
- Ramp volume gradually on any new domain, IP or platform.
- Keep a sensible text-to-image ratio and avoid link shorteners.
- Segment by engagement and mail your cold segment less often, not more.
- Once DMARC reports are clean, move the policy from
p=nonetoquarantine.
Work top down. Points one to three fix the majority of cases.
Frequently asked questions
How do I check my domain reputation?
Start with Google Postmaster Tools, which shows spam rate, domain reputation and authentication results for mail sent to Gmail. Add Microsoft’s SNDS for Outlook data. Free DNS lookup tools will confirm whether your SPF, DKIM and DMARC records are published and valid. Check monthly, and always before a large campaign.
Does buying email lists kill deliverability?
Yes, and quickly. Bought lists contain dead addresses and spam traps, and recipients who never asked for your mail complain at high rates. Under UK PECR rules, bought lists also cannot satisfy the soft opt-in exemption for marketing to individuals. The reputation damage typically outlasts any short-term gain by months.
What DMARC policy should SMEs use?
Start at p=none with a reporting address so you can see who is sending as your domain without disrupting legitimate mail. Review reports for four to six weeks, fix any sender failing alignment, then move to p=quarantine. Progress to p=reject only once you are confident every legitimate sending service passes.
Why do my emails land in the Promotions tab rather than spam?
Promotions is not a penalty, it is categorisation. Gmail sorts commercial mail there based on formatting and content signals: heavy HTML templates, multiple images, tracking-heavy links. Plainer, more personal emails from a recognised sender are more likely to reach the primary tab. Placement in Promotions still counts as delivered.
How long does it take to recover from spam placement?
Expect four to eight weeks of consistent good behaviour. Fix authentication first, then cut the list back to engaged contacts and send at reduced volume. Reputation recovers on evidence, not on time passing alone, so a single large send to a stale list mid-recovery will reset your progress.
Stop losing revenue to the junk folder
Deliverability is not a technical detail. It is the difference between a nurture sequence that generates enquiries and one that quietly disappears.
If you are not sure whether your domain is authenticated, or your open rates have been sliding without explanation, we can audit it and tell you exactly what needs fixing.
