How to fix emails going to the spam folder

Emails landing in spam is almost always an authentication or reputation problem — rarely a content problem. This guide gives you the exact steps to fix it, in order of impact.

Step 1: Run a full authentication scan (5 minutes)

Before touching any DNS records, get a baseline. Scan your domain at IntoDNS.ai — it checks SPF, DKIM, DMARC, MTA-STS, BIMI, DNSSEC, and blocklist status in one pass and shows exactly what is broken.

Step 2: Fix SPF (if missing or broken)

A missing or broken SPF record causes immediate spam classification at Gmail, Yahoo, and Microsoft.

Check: Does your domain have a TXT record starting with v=spf1? Count the include: directives — if there are more than 4-5 third-party senders, you likely exceed the 10-lookup limit.

Fix:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Rules:

• List every service that sends email for your domain
• End with -all (hard fail) or ~all (soft fail) — never +all
• Keep DNS lookups under 10 — use SPF Flattening if over the limit

Step 3: Add or repair DKIM

DKIM signs every message with a private key. A missing signature means Gmail treats your domain as unauthenticated.

Check: Does the Authentication-Results header in received mail show dkim=pass?

Fix: Enable DKIM signing in your mail provider (Google Workspace: Admin → Gmail → Authenticate email; Microsoft 365: Admin → Exchange → DKIM). Use 2048-bit keys — 1024-bit is now treated as weak.

After enabling, add the CNAME or TXT record your provider gives you to your domain's DNS. Verification takes 24–48 hours to propagate.

Step 4: Publish DMARC (most impactful single fix)

Without DMARC, Gmail and Yahoo silently downgrade your domain's reputation. DMARC tells receivers what to do with unauthenticated mail — and signals that you take authentication seriously.

Minimum viable DMARC — publish this TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:[email protected]

p=none means monitor-only — no mail is rejected yet. The rua address receives daily aggregate reports so you can see what is failing. After two weeks of clean reports, move to p=quarantine, then p=reject.

Use IntoDNS.ai's DMARC Generator to build the record correctly.

Step 5: Check and fix blocklist status

If your sending IP is on Spamhaus ZEN, Barracuda, or SURBL, every message is flagged regardless of authentication.

Check: Run your sending IP at IntoDNS.ai Blacklist Check.

Fix: Each blocklist has a self-service delist form. Spamhaus delist is usually automatic within 1 hour once the cause (compromised account, open relay, spam complaint spike) is resolved. Barracuda takes 12–24 hours.

Step 6: Fix reverse DNS (PTR record)

Microsoft in particular rejects or junks mail from IPs without a valid PTR record.

Check: Does your sending IP have a PTR record that resolves back to the same IP?

Fix: Log in to your hosting or VPS provider and set the reverse DNS (rDNS) for the sending IP to match your mail server hostname (e.g., mail.yourdomain.com). Then add an A record at mail.yourdomain.com pointing to the same IP.

Step 7: Add MTA-STS (Gmail bonus)

Gmail quietly boosts reputation for domains with a valid MTA-STS policy. It takes about 30 minutes to set up.

Publish _mta-sts.yourdomain.com TXT "v=STSv1; id=20260101" and serve a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Use IntoDNS.ai's MTA-STS Generator to build both.

How long does it take?

| Fix | Time to take effect | |-----|-------------------| | SPF published | 1–24 hours (DNS propagation) | | DKIM signed | Immediately after DNS propagates | | DMARC published | 24–48 hours | | Blocklist delisted | 1–24 hours depending on provider | | PTR record updated | 24–48 hours | | Gmail reputation recovery | 2–4 weeks of clean sends |

What if everything passes but mail still lands in spam?

If SPF, DKIM, DMARC all show pass, check three things:

1. DMARC alignment — does the DKIM d= tag match your visible From domain? Many ESPs sign with their own domain by default, causing alignment failure even when DKIM passes.
2. Sender reputation — register at Google Postmaster Tools. If domain reputation shows "Low" it takes 2–4 weeks of clean, low-complaint sends to recover.
3. List hygiene — sending to stale lists with high bounce rates tanks Gmail's engagement signal for your domain faster than any technical issue.

Run an IntoDNS.ai scan for an instant diagnosis — it covers all of the above in under 3 seconds with specific fix instructions for each failure.