Proudly Canadian 
Emails landing in spam is one of the most damaging and least visible problems a business can have. Unlike a website going down, which is immediately obvious, spam filtering happens silently. Your emails appear to send successfully, your mail server reports no errors, and you have no idea that the messages you are relying on to reach clients, customers, or colleagues are being quietly discarded.
The causes range from missing DNS records that take ten minutes to add, to deep reputation problems that take weeks of careful work to repair. Most businesses dealing with spam placement are experiencing a combination of several factors at once, and fixing one without addressing the others often produces little improvement.
This guide covers the full picture: how email authentication works and why it matters, how to diagnose what is specifically wrong with your setup, how to fix each component correctly, and what you need to maintain on an ongoing basis to keep your emails reaching the inbox.
Quick Fix Summary
- Publish a correct SPF record that includes all services you send from
- Enable DKIM signing and publish the DNS record provided by your email provider
- Add a DMARC record starting with p=none to begin monitoring
- Check your domain and server IP against major blacklists
- Review your sending patterns and list quality
- Audit your email content for common spam trigger patterns
How Email Filtering Actually Works
To fix a deliverability problem, it helps to understand what receiving mail servers are actually checking when your message arrives. It is not a single filter or a simple keyword scan. Modern spam filtering is a multi-layer scoring system that evaluates technical authentication, sender reputation, recipient engagement history, and content simultaneously.
When your email arrives at Gmail, Outlook, or any other provider, the receiving server runs through a series of checks. It verifies whether your sending IP is authorized to send mail for your domain by checking your SPF record. It validates the DKIM cryptographic signature to confirm the message was not tampered with in transit. It checks your DMARC record to see whether SPF and DKIM are properly aligned with your From domain and what policy you have set. It looks up your domain and IP against reputation databases and blacklists. It scores your content against patterns associated with known spam. It considers how recipients have interacted with previous messages from your domain, including open rates, reply rates, and whether anyone has marked your mail as spam.
The final inbox or spam decision is a weighted combination of all of these signals. A message can pass every technical check and still end up in spam if the domain has a poor reputation. Equally, a perfectly clean domain can have its mail filtered if the content is poorly structured or the sending volume spikes unexpectedly. Understanding which signals are working against you is the starting point for any effective fix.
Step 1: Verify and Fix Your SPF Record
SPF (Sender Policy Framework) is a DNS TXT record that lists every server or service authorized to send email on behalf of your domain. When a receiving server gets a message from you, it checks your SPF record to verify that the sending server's IP is on the approved list. If it is not, the message is treated as potentially fraudulent.
Log into your domain's DNS management panel and look for an existing TXT record at the root of your domain. You should have exactly one SPF record. Multiple SPF records on the same domain are invalid and will cause authentication failures.
A minimal SPF record for a domain that sends only through Google Workspace looks like this:
v=spf1 include:_spf.google.com ~all
If you send through additional services, each one needs its own include directive:
v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all
The ~all at the end is a soft fail, meaning messages from unauthorized servers are accepted but flagged. Using -all is a hard fail that causes stricter rejection of unauthorized senders. Start with ~all if you are not completely certain all your sending sources are listed, then move to -all once you have verified everything.
One important technical constraint: SPF has a limit of 10 DNS lookups. Each include: directive triggers at least one lookup, and some services nest additional lookups inside their own SPF records. If your SPF record exceeds 10 lookups, it will be treated as invalid. Use MXToolbox's SPF checker to count your lookups before publishing any changes.
Step 2: Enable DKIM Signing
DKIM (DomainKeys Identified Mail) works by applying a cryptographic signature to every outgoing message. Your mail server signs the message using a private key, and the matching public key is published in your DNS as a TXT record. The receiving server retrieves the public key from DNS and uses it to verify the signature, confirming that the message genuinely came from your server and was not modified in transit.
DKIM is what allows a receiving server to trust that the message claiming to be from your domain actually is from your domain, even after it has passed through relay servers or forwarding addresses. SPF alone cannot provide this guarantee.
How you enable DKIM depends on where your email is hosted. In Google Workspace, go to Admin Console, then Apps, then Google Workspace, then Gmail, then Authenticate email. Select your domain, generate a new DKIM key, copy the TXT record provided, add it to your DNS, and then click Start authentication. The record will be at a host like google._domainkey.yourdomain.com.
In cPanel with Exim, DKIM is often enabled per-domain from the Email section. Look for Email Deliverability or Email Authentication in cPanel and follow the prompts to generate and publish the DKIM record for each domain on your account.
For third-party sending services like Mailchimp, SendGrid, or Mailgun, each service provides its own DKIM DNS records that you add to your domain. This allows them to sign messages with your domain rather than their own, which is essential for DMARC alignment.
After adding the DKIM record, allow up to 48 hours for DNS propagation, then send a test message and inspect the headers for dkim=pass in the Authentication-Results line.
Step 3: Configure DMARC
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy that ties SPF and DKIM together and tells receiving servers what to do when authentication fails. It also introduces reporting, which gives you visibility into how your domain is being used across the internet.
Add a TXT record to your DNS at the host _dmarc.yourdomain.com with the following value to start in monitoring mode:
v=DMARC1; p=none; rua=mailto:[email protected]; fo=1
The p=none tag means no action is taken on failing messages, but reports are still sent. The rua address receives daily aggregate reports in XML format from participating mail providers. These reports tell you which IPs are sending on your behalf and whether SPF and DKIM are passing or failing for each source. The fo=1 tag requests forensic reports whenever either SPF or DKIM fails, giving you more granular failure data.
Review the reports for two to four weeks. During this period you may discover sending sources you forgot about, such as a CRM, a newsletter platform, or a ticketing system, that are sending on your behalf but are not authorized in your SPF record or configured with DKIM. Add them and confirm alignment before tightening the policy.
Once you are confident all legitimate sending sources are covered, move to quarantine:
v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]
Then, once you have monitored quarantine for another few weeks without issues, move to full rejection:
v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]
Reaching p=reject means that any message failing DMARC is outright rejected by the receiving server rather than delivered to spam. This is the most protective configuration and is required to meet the sender requirements introduced by Google and Yahoo in 2024 for high-volume senders.
Step 4: Check Your Domain and IP Reputation
Even with perfect authentication, your emails will go to spam if your domain or sending IP has a poor reputation. Reputation is built over time through consistent, legitimate sending, and it can be damaged quickly by spam complaints, bounces, or blacklisting events.
The first thing to check is whether your server IP or domain appears on any major blacklists. Use MXToolbox Blacklist Check at mxtoolbox.com. Enter your server's IP address and it will check against over 100 providers simultaneously. If you are on shared hosting, the IP listed in your DNS A record is shared with many other accounts, and any one of them sending spam can get that IP listed, affecting everyone on the server.
Google Postmaster Tools at postmaster.google.com is one of the most useful free resources for understanding how Gmail views your domain. After verifying your domain there, you gain access to dashboards showing your domain reputation, IP reputation, spam rate, DMARC compliance, and delivery errors. A domain reputation of Low or Bad from Google's perspective will result in most of your mail going to Gmail spam regardless of how good your authentication is.
If your IP is blacklisted, the path to removal is to first stop whatever caused the listing, then submit a removal request to each provider. Spamhaus has a self-service lookup at spamhaus.org. Microsoft operates a removal portal at sendersupport.olc.protection.outlook.com for Outlook and Hotmail. Barracuda's removal form is at barracudacentral.org. Most providers delist within a few hours to a few days once you have demonstrated the issue is resolved.
Step 5: Review Your Sending Practices
Authentication and reputation cover the technical and historical aspects of your deliverability. Your sending practices determine what happens going forward.
List quality and consent
The single most damaging thing you can do to your sender reputation is send to people who did not ask to hear from you. Recipients who did not opt in are far more likely to mark your message as spam, and spam complaint rates above 0.1 percent will start to damage your reputation with Gmail. Above 0.3 percent, Gmail will begin actively blocking your mail.
Prune your list regularly. Remove addresses that have not opened any of your last ten to fifteen emails. These inactive recipients add very little value and significantly increase your risk of hitting spam traps, which are addresses maintained by blacklist providers specifically to catch senders with poor list hygiene.
Sending volume and warm-up
If you are starting with a new domain or a new IP address that has no sending history, do not send to your full list immediately. Mail providers interpret a sudden spike in volume from an unknown sender as a strong spam signal. Start by sending to your most engaged recipients at low volume, perhaps a few hundred per day, and increase gradually over several weeks. This process, known as IP warming or domain warming, builds a positive sending history before you scale up.
Engagement signals
Mail providers track how recipients interact with your messages over time. High open rates, replies, and forwards are positive signals. Low open rates and high deletion-without-opening rates are negative ones. Segment your list and send to engaged subscribers more frequently while reducing frequency for those who have not engaged recently. A smaller, more engaged list is significantly more valuable from a deliverability standpoint than a large, disengaged one.
Step 6: Audit Your Email Content
Content filtering is a smaller part of the deliverability picture than it used to be, since authentication and reputation signals now carry more weight. But it still contributes to your overall spam score, and certain patterns will reliably trigger filters regardless of your authentication setup.
Avoid subject lines and body content that are heavy with all-caps words, excessive punctuation, or phrases that are strongly associated with spam in training datasets. Words like FREE, GUARANTEED, ACT NOW, and CLICK HERE appear frequently in spam and may add points to your spam score. This does not mean you can never use these words, but using many of them together in the same message, especially in the subject line, increases your risk.
Keep your HTML to text ratio balanced. An email that is almost entirely images with very little text, or one that has no plain text alternative version, looks suspicious to filters. Use a reasonable amount of actual text content and always include a plain text version of your emails alongside the HTML version.
Keep link counts reasonable. Legitimate business emails do not typically contain twenty different URLs. If your email contains a high number of links, especially links pointing to multiple different domains, it raises the spam score. Focus on one or two clear calls to action rather than scattering links throughout the message.
You can test how your email scores before sending using tools like mail-tester.com. Send a test message to the address provided and the tool scores your email out of ten, showing which specific factors are contributing to your spam risk.
Ongoing Monitoring
Email deliverability is not something you configure once and forget. Your reputation is a living measurement that changes based on every message you send, and the deliverability landscape changes as providers update their filtering systems. Google and Yahoo introduced mandatory authentication requirements for bulk senders in 2024, and similar requirements from other providers are likely to follow.
Set up Google Postmaster Tools if you have not already and check the dashboards regularly. Monitor your DMARC aggregate reports either directly or through a tool like MXToolbox DMARC Analyzer, Postmark, or Dmarcian. Run a periodic blacklist check on your server IP every few weeks. Review your bounce rates and complaint rates after each send campaign, since a sudden spike in either is an early warning sign of a reputation problem in progress.
If you use a cPanel hosting environment, keep an eye on your Exim mail queue as well. A suddenly large queue can indicate that outgoing mail is being deferred or rejected by receiving servers, which is often a sign that your IP reputation has deteriorated or that you have been listed somewhere.
When to Contact Support
If you have implemented SPF, DKIM, and DMARC correctly, verified your IP is not blacklisted, reviewed your content and sending practices, and your emails are still going to spam with specific providers, the issue may require header-level diagnosis to determine exactly where in the delivery chain the message is being filtered and why.
Email headers contain a complete record of every server the message passed through and every authentication check that was performed. Reading them correctly can reveal issues like a relay server breaking DKIM signatures, a forwarding configuration disrupting SPF alignment, or a specific provider's filtering system flagging a pattern that is not obvious from the outside.
Open a support ticket from your client area and include a copy of the full email headers from a message that went to spam, along with the sending domain and the receiving provider where the issue is occurring. Our team can perform a full deliverability audit, identify which specific signals are working against your inbox placement, and recommend the precise changes needed.
Gotekky
Need help deciding what to do next?
Tell us what you are seeing and what outcome you need. We will identify whether a managed service, scoped project or paid technical assessment is the right next step.