← Scan your domain

Why Are Your Emails Going to Spam?

If your signup confirmations, password resets, or invoices are landing in spam - or worse, never arriving at all - it's almost always a DNS configuration problem, not a code problem. Here are the most common causes, in order of impact.

Why this happens

critical

No SPF record - email providers can't verify you're the sender

SPF is a DNS record listing which servers are authorised to send email from your domain. Without it, Gmail and Outlook see email from your domain as unverified and apply aggressive spam filtering. Setting it up is a single DNS record change.

How to Add an SPF Record →
critical

No DMARC record - your domain has no email policy

DMARC tells email providers what to do when they receive email from your domain that fails SPF or DKIM checks. Without DMARC, providers give your domain lower trust scores. Gmail and Yahoo have required DMARC since 2024 for reliable inbox delivery.

How to Add a DMARC Record →
high

DKIM not configured - emails have no cryptographic signature

DKIM adds a digital signature to every email you send, proving it came from your authorised server and wasn't tampered with in transit. Without DKIM, Gmail can't cryptographically verify your email is genuine - even if SPF passes.

How to Set Up DKIM →
critical

Mail server IP is blacklisted

Email providers check real-time blacklists (Spamhaus, Barracuda, SpamCop) before accepting mail. If your server's IP is listed - which often happens on shared hosting - every email you send is silently dropped or spam-foldered. No error, no bounce, just silence.

How to Check and Fix a Blacklisted IP →
high

DMARC is set to monitor only (p=none)

A DMARC record with p=none collects reports but doesn't enforce anything. Spoofed emails still get delivered, and your domain has a weaker trust score with inbox providers than one with p=quarantine or p=reject.

How to Enforce DMARC →
critical

No spoofing protection - anyone can send email as your domain

Without SPF, DKIM, and DMARC working together, phishing emails can be sent from your domain and delivered to your customers' inboxes. This damages your brand and gets your domain permanently blacklisted by major providers.

How to Prevent Email Spoofing →
high

General email deliverability issues - multiple factors affecting inbox placement

Email deliverability depends on more than just SPF and DKIM. Sender reputation, IP warming, list hygiene, complaint rates, and sending infrastructure all contribute to inbox placement. If you're passing authentication checks but still landing in spam, dig deeper.

Full Email Deliverability Guide →

Not sure which of these apply to your domain?
Run a free scan - 26 checks in under 10 seconds.

No signup. No install. Just enter your domain.

Frequently asked questions

Why do my emails work fine from Gmail but not from my app?
When you send from Gmail, Google handles all email authentication for you automatically. When your app sends email (password resets, notifications, invoices), it sends directly from your domain and needs SPF, DKIM, and DMARC configured for your specific sending service (Resend, Postmark, SendGrid, etc.). These are separate configurations.
Why are my password reset emails going to spam?
Transactional emails like password resets are automated bulk sends, which email providers scrutinise more heavily. Missing DKIM alone can push all transactional email to spam. Missing SPF or a blacklisted IP makes it worse. Use a dedicated transactional email service (Resend, Postmark) and set up SPF + DKIM + DMARC for guaranteed delivery.
How do I test if my emails will be delivered?
Send a test email to mail-tester.com - it gives your email a score out of 10 and shows exactly what's failing. GlockApps and Mailtrap also offer inbox testing across major providers. For DNS records specifically, use mxtoolbox.com/emailhealth.aspx.
How long does it take to fix email deliverability?
DNS changes (SPF, DKIM, DMARC) propagate within 0-48 hours. Once propagated, Gmail and Outlook apply them immediately. You should see improvement within 24-48 hours. Domain reputation recovery after a blacklisting can take 1-4 weeks. Getting delisted from Spamhaus usually takes 24-72 hours after submitting a removal request.
Do I need all three - SPF, DKIM, and DMARC?
Yes. SPF proves which server sent the email. DKIM proves the email content is authentic. DMARC ties them together and tells providers what to do when they fail. All three together are what Gmail and Yahoo now require for reliable delivery. Each one alone provides only partial protection.
My emails were landing in inboxes before - why did they suddenly start going to spam?
Common causes: your sending IP got blacklisted (especially on shared hosting), a spike in complaint rates flagged your domain, your DNS records were accidentally changed or expired, or your email provider changed something in their infrastructure. Check your DMARC reports for authentication failures and mxtoolbox.com for blacklist status.

Fix guides

How to Add an SPF Record How to Add a DMARC Record How to Set Up DKIM How to Check and Fix a Blacklisted IP How to Enforce DMARC How to Prevent Email Spoofing Full Email Deliverability Guide

Other common problems

Why Isn't Your Website Showing in Google? Why Do Your Links Look Bad When Shared? Why Does Your Website Say "Not Secure"? Why Is Your Website Loading Slowly? Why Is Your Website Broken on Mobile? Why Are Your Secrets or API Keys Exposed? Why Doesn't www.yourdomain.com Work? Why Do Your Broken Links Show a Bare Error Page?