Why are my emails going to spam? A fix for small businesses

When a small business's emails land in spam, there are usually two causes: the domain doesn't prove the messages really come from you (SPF, DKIM and DMARC are missing or broken), or the domain has no good sending history yet. You can see the first problem in a minute with the email security checker, which also gives you the records to fix it. The second improves as you send mail that people expect and want.

How Gmail, Outlook and Yahoo decide

Mail providers weigh many signals, but they fall into three groups.

• Authentication: can you prove it's you? Three short records in your domain's DNS (the public directory of your domain) do this. SPF lists the servers allowed to send as your domain. DKIM adds a signature to each message that receivers can check. DMARC says what to do with messages that fail, and requires that the domain SPF or DKIM checked matches the one in the From line. Our guide DMARC in one day explains each one in detail.
• Reputation: how has your mail behaved? Providers remember your domain and the servers you send from. Messages that people open and reply to help. Messages that get marked as spam, or that bounce because the address doesn't exist, hurt.
• The message itself. Filters also look at the content and links, but no single word sends you to spam. Fix authentication and reputation first.

The Gmail and Yahoo rules since February 2024

In February 2024, Gmail and Yahoo started enforcing written rules for everyone who sends to their users, with extra ones for bulk senders.

Requirement	All senders	Bulk senders
Authentication	SPF or DKIM	SPF and DKIM
DMARC	Not required	A record of at least p=none, with the From domain aligned with SPF or DKIM
Sending servers	Valid forward and reverse DNS	Same
Spam complaints	Below 0.3%	Below 0.3%
Unsubscribe	Not required	One-click unsubscribe on marketing mail, honored within 2 days

Google counts you as a bulk sender once you send close to 5,000 messages or more in one day to personal Gmail accounts, and that status never expires. Yahoo doesn't publish a number. A spam rate of 0.3% means 3 complaints per 1,000 messages; Google recommends staying under 0.1%. According to Google's FAQ, since November 2025 Gmail enforces the rules more strictly, and mail that doesn't meet them can be temporarily or permanently rejected.

If you send through Google Workspace, Microsoft 365 or a newsletter service, they take care of the server side (reverse DNS and encrypted connections). The records in your domain's DNS are your job.

Common mistakes

Two SPF records

Every service's setup page says "add this TXT record", so after the second service you have two lines that start with v=spf1. The SPF standard, RFC 7208, treats that as an error: receivers consider SPF broken for all your mail, not just the new service. There must be one record, with every service's include: inside it.

More than 10 DNS lookups

Each include, a, mx, exists or redirect in your SPF costs a DNS lookup, and so do the ones inside each provider's own record. Over 10, SPF fails. It happens easily when you add a mailbox provider, a newsletter tool, an invoicing app and a store. Remove services you no longer use, or move newsletters to a subdomain such as news.example.com, which has its own SPF record.

Sending from a Gmail account "as" your domain

A common setup: a free Gmail account, with "Send mail as" set to sales@example.com and Gmail's own server as the outgoing server. The message looks right, but it leaves with Gmail's hidden return address and Gmail's DKIM signature. Neither matches example.com, so DMARC fails, and some recipients see "on behalf of" next to your name. Send through the outgoing server of whoever hosts your domain's email, or use a business mailbox on your domain with DKIM turned on.

The reverse fails too: a newsletter or invoicing tool set to send "from" yourshop@gmail.com. Google's rules tell senders not to use a Gmail address in the From line for mail that doesn't go out through Gmail. Use an address at your own domain.

A brand-new domain

A domain registered last week has no history, and filters are careful with it, because scams use brand-new domains all the time. Set up SPF, DKIM and DMARC before the first message. Start with normal day-to-day mail to people who know you, and grow the volume over a few weeks. Don't send a campaign to a big imported list in the first days.

Step by step with the email security checker

1. Open the email security checker and type your domain, the part after the @. The lookups go from your browser to Cloudflare's public DNS service, and eThorns stores nothing.
2. Look at the MX row and the line under "Copy-ready records". The tool recognizes common email providers from your MX records (the ones that say where your mail is delivered) and tailors its suggestions.
3. Read the SPF row. It flags a second SPF record, shows how it ends (~all or -all are fine), and counts DNS lookups out of 10, including the ones inside your providers' records. If it suggests a new record, it has merged yours into one and added your provider's include if it was missing. Replace your existing record with it; don't add a second one.
4. Read the DKIM row. If no DKIM key is found, the tool shows how to turn it on for common providers. For other services, such as a newsletter tool, look in their settings for "authenticate your domain" and type the selector they give you in the optional field.
5. Read the DMARC row. If there is none, copy the suggested p=none record, which only monitors, and follow the DMARC guide to move to quarantine and reject later.
6. After saving changes, confirm them in the DNS lookup tool: choose TXT and check that exactly one line starts with v=spf1. New records can take minutes to a few hours to appear.
7. Send a test to a personal Gmail account, open it and choose "Show original". SPF, DKIM and DMARC should say PASS. If SPF and DKIM pass but DMARC fails, the service is signing with its own domain instead of yours: turn on its domain authentication.

Build a good reputation

• Send only to people who asked for your mail. Never buy lists: they are full of old addresses and people who will mark you as spam.
• Remove addresses that bounce.
• Put a clear unsubscribe link in every marketing email and honor it quickly. People who can't unsubscribe often press "Report spam" instead.
• Send at a steady pace. A sudden jump from 20 to 5,000 messages looks suspicious.
• Check that your website's contact form sends through your email provider, not through the web server itself, which usually isn't in your SPF.

Checklist

• One SPF record, with 10 DNS lookups or fewer, ending in ~all or -all.
• DKIM turned on in every service that sends as my domain.
• A DMARC record at _dmarc, at least p=none.
• No mail sent through a personal Gmail account as my domain.
• A test message showing SPF, DKIM and DMARC PASS.
• Lists built with permission, with a working unsubscribe link.

Frequently asked questions

I send only a few emails a day. Do these rules apply to me?

The basic ones do: SPF or DKIM, valid server DNS and a low spam rate apply to every sender. The stricter rules start at bulk volumes. Having all three records is still the simplest way to be trusted.

Everything is green in the checker, but my mail still goes to spam. Why?

Then the problem is probably reputation or content: a new domain, complaints, or links to a site with a bad reputation. Look at "Show original" in Gmail to confirm the checks pass, and ask a few recipients to move your message to the inbox and reply.

Can changing my SPF break my email?

Only if you remove a service that still sends for you, or leave two records. Before saving, check that every current service's include is in the single record.

Does eThorns see my domain?

No. The email security checker and DNS lookup ask Cloudflare's public DNS service directly from your browser. Nothing is sent to eThorns or stored.

Try it

• 2.2Email securityCheck a domain's SPF, DKIM, DMARC, MTA-STS, BIMI and DNSSEC, and get copy-ready DNS records for what's missing or wrong.
• 2.4DNS lookupLook up any domain's DNS records (A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV) or the reverse DNS of an IP, with TTLs and DNSSEC validation.