Why Your Emails Land in Spam - And How to Fix It Permanently

You sent a proposal. The client never saw it. A transactional email never arrived. Your marketing campaign had a 12% open rate - down from 32% twelve months ago.

In almost every case, the root cause is one of five fixable infrastructure problems. This guide walks through each one with the diagnostic commands and fixes you need to resolve them permanently.

1. No DMARC Policy (or a Policy Set to none)

DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving mail servers what to do with emails that fail SPF and DKIM checks. Without it - or with it set to p=none - you have no protection and some providers will quietly downgrade your deliverability.

Diagnose it:

dig TXT _dmarc.yourdomain.com

You should see a record like:

"v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; pct=100"

If you see nothing, or p=none, you have work to do.

Fix it:

Start with p=quarantine and move to p=reject only after reviewing your DMARC aggregate reports for 2–4 weeks. Jumping straight to p=reject on a poorly-configured domain will break legitimate mail.

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=s; aspf=s"

Set up a DMARC aggregate reporting inbox and review it weekly. Tools like Google Postmaster Tools and Dmarcian make this readable.

2. SPF Configured but Not Aligned

SPF (Sender Policy Framework) tells receivers which IP addresses are authorised to send email for your domain. The common mistake: you have SPF configured correctly, but it's not aligned with your DMARC policy.

Diagnose it:

dig TXT yourdomain.com | grep spf

Check that your sending providers (Google Workspace, Microsoft 365, Mailchimp, Postmark, etc.) are all included. Then verify alignment by checking a raw email header - the Return-Path domain should match your From domain.

Fix it:

Audit every service that sends email on your behalf. Add them all to your SPF record:

yourdomain.com  TXT  "v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net ~all"

Keep your SPF record under 10 DNS lookups. Flattening tools can help if you're over the limit.

3. DKIM Keys Not Rotated - Or Missing Entirely

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outbound email. If you set it up years ago and never rotated the keys, some providers treat old keys as a risk signal. If you're missing it entirely, you're leaving deliverability on the table.

Diagnose it:

Check your DKIM selectors (you should know which ones your provider uses - e.g., google._domainkey, selector1._domainkey, s1._domainkey):

dig TXT google._domainkey.yourdomain.com

Send a test email to mail-tester.com and check the DKIM result.

Fix it:

Enable DKIM in your sending platform settings. For Microsoft 365:

1. Go to Microsoft Defender > Email & Collaboration > Policies & Rules > Threat Policies > DKIM
2. Toggle DKIM on for your domain
3. Copy the CNAME records and add them to your DNS

Rotate keys at least annually. For high-volume sending, consider rotating every 3–6 months.

4. Shared IP Reputation Contamination

If you're using a shared IP address (common with entry-level plans on Mailchimp, Klaviyo, Postmark, etc.), your sender reputation is partially shared with other senders on the same IP pool. One bad actor on the pool can affect your deliverability.

Diagnose it:

Check your outbound mail headers to find the sending IP, then check it against reputation databases:

# Extract IP from email header (look for the last "Received: from" before your server)
# Then check:
# - Spamhaus ZEN: https://check.spamhaus.org/
# - MXToolbox Blacklist Check: https://mxtoolbox.com/blacklists.aspx

Fix it:

For business-critical transactional email (receipts, password resets, contracts), move to a dedicated IP with your sending provider. Most providers offer this from ~$20–$50/month.

For marketing email, segment your lists rigorously. Sending to engaged subscribers (opened in last 90 days) from a shared IP is far safer than blasting cold lists.

5. Cold Sending Behaviour

Even with perfect technical configuration, sending sudden high volumes to cold or stale lists triggers spam filters. Gmail and Outlook's machine-learning filters look at engagement history - and a sudden spike from a domain that hasn't sent much is a red flag.

Diagnose it:

Review your sending history. Have you:

• Not sent in 3+ months, then sent to your full list?
• Added thousands of new contacts and mailed them immediately?
• Sent 10,000 emails from a brand new domain?

Fix it:

Warm up new IPs and domains gradually:

Start with your most engaged subscribers. Engaged openers pull your reputation up before you expose the domain to the riskier portion of your list.

Bonus: Implement BIMI for Maximum Trust

Once your DMARC is at p=reject, you're eligible for BIMI (Brand Indicators for Message Identification). BIMI shows your brand logo in the inbox next to your email - in Gmail, Apple Mail, and Yahoo - before the recipient even opens it.

This requires:

• DMARC at p=reject (100% policy)
• A Verified Mark Certificate (VMC) from a CA like DigiCert (~$1,500/year)
• An SVG logo in the correct format
• A default._bimi DNS record

We implemented BIMI for a Dubai agency client in 2023. Their open rate increased 22% in the first 90 days after deployment.

Quick Reference: Email Deliverability Checklist

• DMARC at p=reject with aggregate reporting enabled
• SPF aligned with DMARC, all senders included, under 10 lookups
• DKIM enabled, keys under 2 years old
• Dedicated IPs for transactional email
• List hygiene: remove bounces and unengaged subscribers quarterly
• Sending volume warmed appropriately for new domains/IPs
• BIMI configured with VMC (optional but recommended for brand visibility)

If you need help auditing your email infrastructure or implementing DMARC → BIMI, book a free discovery call or read about our Email Infrastructure & Deliverability service.