Email authentication

Why do my emails go to spam?

Almost every guide to this question starts with subject lines and spam-trigger words. That is the least important item on the list, and it is sixth.

In order of how much they actually matter: missing or failing SPF, DKIM and DMARC; a sending IP or domain with poor reputation; recipients marking you as spam above a 0.3% complaint rate; sending to addresses that do not exist; no working unsubscribe link; and only then the content of the message. Since 1 February 2024, Gmail has required all three authentication records from anyone sending more than 5,000 messages a day, with one-click unsubscribe and a spam rate under 0.3%; Outlook.com applied the same from 5 May 2025. A domain failing those checks is filtered regardless of how carefully the email is written.

Worked out 2026-09-11 (IST) · mainstream consumer mail providers — Gmail, Outlook.com, Yahoo

The causes, ranked honestly

What actually decides the spam folder
Rank	Cause	How to check	Effort to fix
1	No SPF, DKIM or DMARC, or they fail alignment	Look up the TXT records; read the headers of a test message	An hour
2	Poor domain or IP reputation	Google Postmaster Tools; your provider's dashboard	Weeks of consistent sending
3	Complaint rate above 0.3%	Google Postmaster Tools	Clean the list; fix targeting
4	Sending to dead addresses and spam traps	Bounce rate above ~2% in your provider's stats	Remove hard bounces immediately
5	No working one-click unsubscribe on bulk mail	Check for List-Unsubscribe headers	Your provider usually adds it
6	Content: link shorteners, a single image, mismatched display name	Read the message as a stranger would	Minutes
7	New domain with no sending history	Domain age	Warm up over four to six weeks

The bulk-sender requirements, stated exactly

What Gmail and Outlook.com require
Requirement	Gmail, from 1 Feb 2024	Outlook.com, from 5 May 2025
Applies to senders of	More than 5,000 messages a day to Gmail	More than 5,000 messages a day
SPF	Required	Required
DKIM	Required	Required
DMARC	Required, at least p=none	Required, at least p=none
Alignment	From: must align with SPF or DKIM	Same
One-click unsubscribe	Required, honoured within 2 days	Required
Spam complaint rate	Below 0.3%; aim under 0.1%	Enforced similarly
Valid forward and reverse DNS on the sending IP	Required	Required
TLS on the connection	Required	Required

The ten-minute diagnosis

Send one message from your normal system to a Gmail address you control, open it, and view the original. The headers state plainly whether SPF passed, whether DKIM passed, and whether DMARC passed — three lines that replace an afternoon of guessing. If all three say pass and mail still lands in spam, the problem is reputation or engagement, and no amount of rewording will touch it. If any says fail or none, stop reading about subject lines and fix the record.

Each record is covered in detail: SPF, DMARC, and where they live in TXT records.

Sources: IETF RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC), Google Workspace Email sender guidelines (effective 1 February 2024) and Microsoft’s Outlook.com sender requirements (effective 5 May 2025).

Check your own numbers

Check whether your domain publishes SPF, DKIM and DMARC records at all.

DNS LookupTXT, MX, A and NS records for any domain, live from the resolver.

Frequently asked

I have SPF. Why is my mail still going to spam?

SPF alone is no longer sufficient at the large providers, and it is also the record most likely to be silently broken - two SPF records, or more than ten DNS lookups, both produce a permanent error that receivers treat as having no SPF at all. Check that it actually evaluates to pass rather than merely existing, then add DKIM and DMARC, which are now required alongside it.

Does the word "free" in a subject line send mail to spam?

Not on its own, and not remotely as much as folklore suggests. Modern filters weigh sender reputation, authentication and recipient engagement far above vocabulary. A well-authenticated domain that people open and reply to can write "free" as often as it likes; an unauthenticated domain sending to a cold list will be filtered whatever words it chooses.

How do I check my spam complaint rate?

Google Postmaster Tools reports it for Gmail, which is the number that matters most for consumer mail, and Microsoft has an equivalent service. The threshold to stay under is 0.3% - three complaints per thousand messages - and Google recommends staying below 0.1% as a working target. Above 0.3%, filtering is applied to your whole domain, not just the campaign that caused it.

Is a dedicated IP better than a shared one?

Only above a certain volume. A dedicated IP has no reputation at all to begin with and must be warmed up gradually, which is worse than a well-managed shared pool if you send a few thousand messages a month. Below roughly 100,000 messages a month, a reputable provider's shared IPs will almost always deliver better than your own.

Need email authentication checks inside your own product?

We build SPF, DKIM, DMARC and MX validators as embeddable widgets or a plain JSON API in your branding, wired to your own lead form. Tell us which checks you need and we will send a working demo.