Email going to spam: what to check

A mail provider decides where to put a message based on several signals: whether it is confirmed as coming from your domain, the reputation of the server’s address and of the domain, what is in the message itself, and how recipients respond to your emails. Start with the first one — it takes five minutes to check.

1. Look at the message headers

Send a message to your own Gmail or Outlook.com mailbox and open its raw headers. In Gmail, use the ⋮ menu → “Show original”. In Outlook.com, open the message, then ⋯ → View → “View message source”.

Find the Authentication-Results line. It should contain spf=pass, dkim=pass and dmarc=pass. Gmail shows these three results in a separate table at the top.

2. SPF, DKIM and DMARC

• SPF — a list of the servers that are allowed to send mail on behalf of your domain.
• DKIM — a signature added to the message with your domain’s key, which shows that the message has not been forged.
• DMARC — what to do with messages that fail these checks, and where to send reports.

In cPanel, the first two are set up with a button, and DMARC is a single record: Protecting your email from spam: SPF, DKIM and DMARC. To check that the records exist:

dig +short TXT example.co.uk                     # SPF: a v=spf1 … string
dig +short TXT _dmarc.example.co.uk              # DMARC: v=DMARC1 …
dig +short TXT default._domainkey.example.co.uk  # DKIM, with cPanel’s default selector

Common SPF mistakes:

• the domain has two v=spf1 records — there must be only one, so merge them;
• the SPF record does not include a mailing service, CRM or website that also sends email in your name;
• more than ten nested include lookups — the whole check then fails.

3. The server’s address

If mail is sent from your own server, its IP address must have a PTR record that matches the A record: PTR records. The address must also not be on any blocklists: An IP address on a blocklist.

4. The message itself, and mailings

• a message that is entirely an image, or consists only of links, or uses link shorteners;
• .exe or .js attachments, or password-protected archives;
• a mailing to a bought or old list: “This is spam” complaints quickly damage a domain’s reputation;
• no unsubscribe link.

Gmail requires anyone sending more than 5,000 messages a day to its users to have SPF, DKIM and DMARC, one-click unsubscribe and a complaint rate below 0.3%. It is better to send mailings to your customers through a mailing service — see Limits on sending email for more.

5. Checking tools

• mail-tester.com — send a message to the address it gives you and get a score, with an explanation of each problem.
• Google Postmaster Tools — the complaint rate and compliance with Gmail’s requirements, when you send a lot of email.

The message did not arrive at all

If the sender receives a bounce message, the reason is usually written in it. A mention of SPF or DMARC means you should check the domain’s records; blocked using means a blocklist; has exceeded the max emails per hour means the sending limit on the hosting account has been reached.