Emails going to spam: causes at Gmail, Outlook and Yahoo

Your SPF, DKIM and DMARC checks pass and your mail still lands in spam. Authentication shows who sent the message. The receiver then uses its spam filter to judge whether the recipient wants it.

Does passing SPF, DKIM and DMARC keep mail out of spam? No. They're the minimum a receiver requires. Spam placement depends on complaints, your list, the content and your domain's history.

1. Find out which receivers are filtering you. Send the same message to a Gmail, an Outlook.com and a Yahoo mailbox you control. Note where each one lands. A problem at one receiver has one cause. A problem at all three is usually the list or the content.
2. Read Google Postmaster Tools. Verify your domain, then open the spam rate and domain reputation dashboards. This is the one place a receiver shows you its own numbers.
3. Check who asked for this mail. Pull the addresses that bounced, the ones that unsubscribed, and the ones you added from a purchase or an export. Stop sending to every one of them.
4. Check the content and links. Open the message in a plain client. Look at the link domains, the image-to-text ratio, the subject and the display name.
5. Check the sending IP on the blocklists. Receivers that use a blocklist filter everything from a listed address, however good your list is.

Spam filtering and rejection

A rejection comes back as a bounce with a code such as 550 5.7.1, and the sender gets told. Spam placement sends you no notice. The receiver accepts the message and files it where the recipient rarely looks.

If you've got a bounce, our bounce and error pages cover the codes one by one. The rest of this page is about mail that was accepted and then vanished.

If you publish a DMARC policy of p=quarantine, you're asking receivers to file failing mail as spam, so a DMARC failure can look like filtering. Check the dmarc= result in the received message's Authentication-Results header before you look anywhere else. The free email header analyzer reads it from a paste of the headers. If it says fail, fix that first. Our quarantined email guide covers that case.

Gmail

Google publishes its spam rate threshold. Its sender guidelines tell every sender to keep the spam rate reported in Postmaster Tools below 0.3 percent, and to aim below 0.1 percent. The rate counts messages delivered to engaged recipients' inboxes that those recipients then marked as spam.

In the original version of Postmaster Tools, Google grades your domain in the domain reputation dashboard. Google has said it will retire that dashboard, and the new version does not show a grade. Google's dashboard definitions say a High reputation means a history of very low spam rates, and a Low one means a history of sending a significant volume of spam. A Low or Bad grade means Gmail expects spam from you and files accordingly.

Some Gmail rules put mail in spam whatever else the message gets right. Gmail's spam explanations say that if someone sends an email after you unsubscribe, their emails go directly to Spam. They also say that once a recipient reports a sender, later emails from the same sender might be sent to the Spam folder. A better subject line doesn't change either rule. Stop mailing the people who opted out.

Dashboards can be empty on days your volume is low, because Google withholds data to protect users' privacy. A domain that sends a few hundred messages a day may never see a reputation grade. That's normal for a small sender.

Outlook and Yahoo

Yahoo's sender requirements ask for SPF and DKIM, a DMARC policy of at least p=none, and an aligned From domain. They also want a spam rate below 0.3 percent and a one-click unsubscribe honoured within two days. If you miss one, Yahoo filters your mail before it looks at anything else.

Microsoft applies the same shape of rule to Outlook.com, Hotmail and Live, and enforces it with a rejection rather than a filter. Our 550 5.7.515 page has the details. For mail that Outlook accepts and files as junk, read the compauth= value in the Authentication-Results header. A fail there means Microsoft's composite check marked the message as spoofed, even if SPF and DKIM each passed.

Microsoft and the blocklists rate IPs rather than domains. Our domain reputation guide covers each system's own lookup.

Complaints and list quality

A complaint is a recipient pressing the spam button. Recipients press it when they don't remember asking for your mail, when unsubscribing looks harder than reporting, and when the mail keeps coming after they left. Each of those is a list problem.

Put a working one-click unsubscribe on every marketing and subscription message. RFC 8058 defines it: a List-Unsubscribe header with an HTTPS address, a List-Unsubscribe-Post header carrying List-Unsubscribe=One-Click, and a DKIM signature that covers both headers. Google requires it from bulk senders and Yahoo requires it from everyone it counts as bulk. Process the request within two days.

Remove hard bounces after the first one. A receiver watches how often you send to addresses that don't exist, and a high rate looks like a bought or scraped list. Our bounce guide says which codes mean the address is gone.

Send to people who asked, at the rate they expected. People on a list you haven't mailed in a year have forgotten you. Warm it back up in small batches and drop the addresses that don't open anything.

Content and links

Gmail lists an empty subject or an empty body as a spam signal in its own right, because spammers send those. Give every message a real subject and a real body.

Look at every link domain. Tracking links on a shared domain carry the reputation of everyone else using that domain. If your platform offers a branded tracking domain, use it. A link shortener has the same problem, on a domain anyone can use.

Keep the display name and the address consistent. A display name that reads like a well-known brand over an address that doesn't match is the pattern filters use to spot impersonation. Gmail describes it as an address that looks very similar to a known sender.

Filters treat a message that's one large image with a line of text as an attempt to hide content. Put the words in the body as text.

Shared IPs and new domains

On a shared sending pool, the IP's reputation is the average of every customer on it. Another customer's bad sending can put your mail in spam. Ask your platform which pool you're on and whether a dedicated IP is available at your volume.

A domain that started sending last week has no history. Receivers treat a burst of mail from an unknown domain with suspicion. Start with low volume to engaged recipients and grow it over several weeks.

Check the sending IP against Spamhaus and the other lists. Our Spamhaus delisting guide shows which list has you and what each one wants fixed before removal.

DMARC reports

An aggregate report tells you which sources passed and failed, and what the receiver did with the failures. It doesn't say whether a passing message reached the inbox or the spam folder. No receiver reports placement in DMARC.

A source you don't recognise, sending as your domain and failing, drags your domain's reputation down while your own mail passes. On a paid plan we email you the first time a source fails DMARC, and the weekly digest shows the reported results by source. Your first domain is free.

Testing a fix

After a change, send a fresh message to the test mailboxes from the same platform and the same address. A test from your personal account doesn't test the marketing platform.

Read Postmaster Tools again after a week of sending. Reputation moves on volume over time, so a single clean day won't shift the grade. Keep the complaint rate down for several weeks and the grade improves.