Why business emails go to spam, and how to fix it

Business emails can go to spam because of authentication problems, sending reputation, recipient complaints or message content. Start with authentication: set up SPF and DKIM for every system that sends as your domain, publish DMARC, and check the results in a received message. Then look at reputation, complaints and how bulk mail is sent.

I have worked in IT and development since 1998, and this guide includes a case from Rizonetech’s own domain: our website’s form notifications failed DMARC until we changed how the site sent mail. The rules below are Google’s, Yahoo’s and Microsoft’s own, read on 12 October 2026.

Why does business email go to spam?

Spam filters weigh several signals at once. The main ones are:

• Authentication: whether SPF, DKIM and DMARC show that the message comes from the domain in the From address.
• Reputation: the record of the sending server and domain.
• Complaints: how often recipients mark your mail as spam.
• Content and format: misleading subjects, suspicious links or unexpected attachments.

Authentication is a useful starting point, because you can read the results in any message you send. Missing or incorrect authentication can contribute to filtering, so check the actual SPF, DKIM and DMARC results before deciding which setting needs repair.

What do SPF, DKIM and DMARC each prove?

Each record answers a different question:

• SPF lists the servers allowed to send mail for a domain.
• DKIM adds a digital signature, made with a key that belongs to a signing domain, showing the message was not changed on the way.
• DMARC checks that the domain in the visible From address matches a domain that passed SPF or DKIM, and publishes how you would like receivers to handle mail that fails.

That matching is called alignment. Under the current DMARC standard, RFC 9989, a DMARC pass needs at least one passing SPF or DKIM result whose domain is aligned with the From domain. Relaxed alignment accepts a subdomain of the same organisation’s domain; strict alignment needs an exact match. So SPF can pass for someone else’s domain while DMARC still fails.

DMARC can also ask receivers to send you aggregate reports. That only happens if your DMARC record names an address, and receivers choose whether to send them. Receivers can also handle a message differently from the policy you publish.

What changed with Gmail, Yahoo and Outlook?

All three set minimum rules for senders, with stricter rules for bulk senders.

Every sender to personal Gmail accounts (@gmail.com and @googlemail.com). Since 1 February 2024, Google’s sender guidelines require SPF or DKIM for your domain, valid forward and reverse DNS for the sending servers, TLS, and a spam rate below 0.3% in Google Postmaster Tools. Google advises keeping it below 0.10%. Since November 2025, Gmail has been rejecting more mail that does not meet these rules. The rules do not cover mail to Google Workspace accounts.

Bulk senders. If you send close to 5,000 messages a day to personal Gmail accounts, Google also requires both SPF and DKIM, a DMARC record (a policy of none is enough), alignment, and one-click unsubscribe on marketing mail. Yahoo also requires bulk senders to use SPF, DKIM and aligned DMARC, but publishes no numerical bulk threshold. For marketing and subscribed messages, both require one-click unsubscribe and a visible unsubscribe link in the body, and Yahoo asks that unsubscribes are honoured within two days. For 5,000 or more messages a day to its consumer addresses, Outlook.com requires SPF and DKIM to pass, a DMARC record and alignment, and rejects non-compliant mail with error 550 5.7.515; Microsoft’s postmaster page dates these rules from 5 May 2025.

Check the requirements of the providers you send to, and authenticate each sending service even when your volume is low.

Why does website or app mail fail when Outlook mail gets through?

Because each system that sends as your domain needs its own setup. Your Microsoft 365 or Google Workspace mail can pass, while your website, invoicing tool or CRM fails.

This happened on our own domain. Before rizonetech.com launched, a test of the website’s contact form to a Gmail inbox was sent through the web host’s mail relay. Gmail’s result was:

• spf=pass for the relay’s own domain, bounces.wpdatacenter.com, which is not aligned with rizonetech.com;
• no DKIM signature at all;
• dmarc=fail (p=NONE) for header.from=rizonetech.com.

Gmail delivered this test despite its DMARC failure, and our policy requested no enforcement. Moving to quarantine or reject before fixing the sender could have caused legitimate notifications to be filtered or refused. We moved the site’s mail to SMTP2GO, a sending service, with rizonetech.com verified there. The next test showed:

dkim=pass header.i=@rizonetech.com header.s=s654416
spf=pass smtp.mailfrom=bounce.…@em654416.rizonetech.com
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=rizonetech.com

DKIM now signs as rizonetech.com, and the SPF domain is a subdomain of rizonetech.com, so both align with the From address under relaxed alignment.

Microsoft 365 has the same trap. Microsoft says that no DKIM signing happens for outbound mail from a custom domain until you set it up, and DKIM only helps DMARC when the signing domain aligns with the From address.

What if your WordPress contact form sends nothing at all?

That is a different problem. If no message reaches anyone, not even the spam folder, the form may never be handing mail to a sending service. Our WordPress contact form checks cover that side. If the sending service shows the message as sent but it lands in spam, read the received message’s headers and the service’s logs, as below.

How can you check one message?

Send a message to a personal Gmail or Outlook.com address and view its headers. In Gmail, open the message, then next to Reply choose More, then Show original. Find the Authentication-Results line and read three results:

1. spf= shows whether SPF passed, and smtp.mailfrom shows the domain it passed for.
2. dkim= shows whether DKIM passed. The signing domain is header.d, or d= in the message’s DKIM-Signature header.
3. dmarc= shows the DMARC result for header.from.

DMARC passes when at least one of SPF or DKIM passes for a domain aligned with the From address. Do this for each system that sends as your domain: your mailbox, your website, your invoicing and your newsletter tool. The free Email health check reads your domain’s SPF, DKIM, DMARC, MTA-STS, TLS reporting and BIMI records in your browser, so you can see what is published before you test.

What else sends mail to spam?

Authentication is necessary but not always enough. Other causes to check:

• A shared sending service with a poor reputation. Mail sent through a server that other senders have abused carries their record.
• Newsletters sent from an ordinary mailbox. Bulk mail belongs on a proper sending platform with its own authentication and unsubscribe handling.
• Complaints. If recipients mark your mail as spam, Gmail counts it. Google Postmaster Tools shows the spam rate and authentication results for mail to personal Gmail accounts, once you verify your domain. A low-volume domain may see little or no data, and a blank dashboard or a low spam rate does not prove your mail reaches the inbox. Use received headers, your sending service’s logs and what recipients tell you alongside it.
• Content and formatting. Misleading subjects, suspicious links and unexpected attachments can trigger filtering even when authentication passes.

How do you fix it without blocking your own mail?

Work in stages, so you see problems before you ask receivers to act on them:

1. List every system that sends as your domain: mailbox, website, invoicing, CRM, newsletter tool.
2. Set up SPF and DKIM for each one, with the sending domain aligned to yours. Publish only one SPF record at each sending hostname. SPF allows at most ten evaluated terms that trigger DNS lookups, including those inside nested includes, so use a checker that follows them.
3. Publish DMARC with p=none and an address for reports. On 11 October 2026 we pointed rizonetech.com’s reports at dmarc@rizone.tech, which needs a small authorisation record on rizone.tech because the address is on another domain.
4. Read the reports. They usually arrive as compressed XML files, so use a report viewer or ask whoever manages your domain. Compare the sending IP addresses and SPF and DKIM domains with your list of senders, investigate each failure, and test occasional mail such as monthly invoices.
5. Check forwarding and mailing lists. Forwarding can break SPF, and a mailing list that changes messages can break DKIM, so a direct test can pass while these routes fail. RFC 9989 cautions domains whose users post to mailing lists about p=reject. Investigate these results before you tighten the policy.
6. Move to p=quarantine, then p=reject, once your normal sending cycle, including monthly and occasional mail, passes. Check the reports and test important mail after each step.

A staged rollout reduces the risk of blocking legitimate mail, but nothing removes it entirely. Keep reading the reports after you reach enforcement, because a new tool that sends as your domain will fail until it is set up.

FAQ

Do I need DMARC if I am not a bulk sender?

Google and Yahoo require it only from bulk senders, but it is still worth publishing. DMARC lets you request how receivers handle mail that fails authentication, and reports from participating receivers help you find the systems sending as your domain, though they are not a complete list. Start with monitoring and confirm your legitimate senders before requesting enforcement.

Why do my emails go to spam even though SPF passes?

SPF passing alone does not guarantee inbox delivery. Check the dmarc= result first: SPF may have passed for your sending service’s domain rather than yours, so it does not align. If DMARC passes, look at reputation, complaints and content.

How long does it take to fix email going to spam?

There is no fixed repair time. Saving a DNS change can be quick, but cached records and sending-service verification can delay its effect, so confirm the change in a newly received message. Moving DMARC to enforcement safely takes as long as your normal sending cycle, so monthly and occasional mail is covered. A poor reputation takes longer to recover, through consistently authenticated mail and few complaints.

What should you do next?

Run the free Email health check on your domain, then test one message from each system that sends as you. For the technical detail, read our DNS and email security whitepaper. If you would rather have it set up and watched, DNS Shield covers DNSSEC, SPF, DKIM and DMARC for your domain.

Published 16 June 2026. Last updated 12 October 2026.