GuidesSpam troubleshooting

SPF, DKIM and DMARC pass, but the email still lands in spam

Authentication proves that a message is really from you. It does not tell the filter whether anyone wants it. Here is what else decides, in the order worth checking, and how to recognise each cause.

Updated 5 October 202610 min read

In short

Passing SPF, DKIM and DMARC proves who sent a message. Gmail states that authentication alone does not guarantee delivery.
Check in this order: one recipient or everyone, one provider or all, sending history, complaints, the message itself, the IP address.
A new domain or mailbox has no reputation yet. Time, small volumes and real correspondence build one; a warmup helps with this cause only.
Gmail wants the share of messages reported as spam below 0.1% and never at 0.3%. At 40 emails a day to Gmail addresses, one report is 2.5%.
Test the message by sending a plain version first and adding links, signature and tracking back one at a time.

If SPF, DKIM and DMARC pass and your email still lands in spam, authentication is no longer the problem: it proves that a message really comes from your domain, not that anyone wants it. Gmail's help says it plainly: "Because spammers can also authenticate mail, authentication by itself isn't enough to guarantee your messages can be delivered." What decides now is the recipient's own settings, your history as a sender, complaints, the content and links of the message, and the IP address it left from. Check them in that order, because the first ones are the quickest to rule out.

First, confirm the pass in a copy that arrived

Look at a copy of the message that actually reached a mailbox, not at a dashboard or a test score. In its raw headers, the Authentication-Results line should say spf=pass, dkim=pass and dmarc=pass, and the domain after header.from should be yours. How to open and read that line is explained in How to read email headers when a message lands in spam. If one of the three is missing, or names your mailing service where your own domain should be, authentication is still the problem (see DMARC fails but SPF and DKIM pass), and this page comes later.

The six checks, in order

Check	You recognise it by	Who can fix it
1. One recipient or everyone?	Fresh test mailboxes get the email in the inbox; one person or one company does not.	The recipient or their administrator
2. One provider or all?	Inbox at Yahoo and Outlook, spam at Gmail, or the other way round.	You, by that provider's rules
3. No sending history	A new domain or mailbox, a long pause, or a sudden jump in volume.	You, with time
4. Complaints	The spam rate in Postmaster Tools is near 0.1% or above, or it drops to zero overnight.	You, with your list
5. The message itself	A plain test message reaches the inbox; the real one does not.	You
6. The IP address	The sending address belongs to your provider; it is on a blocklist; bounces mention it.	Your email provider

1. Is it one recipient, or everyone?

Send the exact message to mailboxes you control at Gmail, Outlook.com and Yahoo. Use new accounts that have never exchanged mail with your domain, and do not click "Not spam" in them, because that teaches the filter. If these receive your email in the inbox and one customer does not, the cause sits with that recipient.

All three providers let recipients overrule the general filter:

Gmail sends your mail to Spam for a recipient who reported an earlier message ("Emails from the same sender might be sent to the Spam folder in the future") or who unsubscribed and still got mail. In organisations, "your admin might set controls to mark certain emails as spam" (Gmail Help).
Yahoo writes that a user "may have specifically blocked certain domains and email addresses", and that such rules override its own filter (Sender Hub FAQ).
Outlook.com users keep a Blocked Senders list and can choose to accept mail only from contacts and safe senders (Outlook.com Postmaster).

The fix is on their side and takes a minute. Gmail tells its users that removing a message from Spam, or adding the sender to their contacts, stops it from happening again. Ask a customer to do that once. It is not a method for a whole mailing list.

2. Is it one provider, or all of them?

The test mailboxes also show whether one provider treats you differently. Each describes its own filter in its own words:

Provider	What it says decides	Look at
Gmail	Spam reports from users, which "can lower your domain's reputation" over time, alongside the sender guidelines.	Checks 3 and 4
Outlook.com, Hotmail	Filters "are influenced by a number of factors related to the sending IP, domain, authentication, list accuracy, complaint rates, content and more". The junk complaint rate is "one of the principal factors" (Postmaster).	Checks 4 and 6
Yahoo, AOL	"We usually do not redirect mail to the Spam folder for poor reputation alone", but for reputation combined with complaints, obfuscated URLs, an IP without proper reverse DNS, or a message that breaks the standards (FAQ).	Checks 4, 5 and 6

If every provider files you as spam, the cause travels with you or with the message. Read on.

3. Does your domain have a history yet?

A new domain or mailbox has no reputation at all, and filters are careful with the unknown. Microsoft says so about IP addresses: ones not used before "typically don't have any reputation built up in our systems. As a result, emails from new IPs are more likely to experience deliverability issues." Google asks senders to "start with a low sending volume to engaged users, and slowly increase the volume over time", and to avoid "sudden volume spikes if you do not have a history of sending large volumes".

You recognise this cause by the calendar. The domain was registered or the mailbox created a few weeks ago. Or it sat quiet for months and then sent a campaign. Or mail to people you already correspond with arrives, while a first message to a stranger does not.

The cure is time and ordinary correspondence: send little, to people who answer, and raise the volume gradually (see how many emails per day per inbox). This is also the one cause a warmup addresses. With WarmupBay your mailbox exchanges short emails with other participants' mailboxes in a shared pool. Some are answered, and warmup mail that lands in spam is taken out again. It starts with 3 emails a day and adds one a day, up to 10 a day for free, or up to 30 while a badge on your website stays visible. That gives a new mailbox a steady record of activity. It does not change how real recipients react to your real emails, which is what checks 4 and 5 are about, and no service can guarantee the inbox.

4. Are people marking you as spam?

Complaints are the signal the providers name most often. Gmail asks senders to keep the share of messages reported as spam below 0.1% and never to reach 0.3%. It calculates the rate daily, and its FAQ says that rates above 0.1% already "have a negative impact on email inbox delivery for bulk senders". Yahoo sets its limit at 0.3%. Both figures are as of October 2026.

At small volumes the arithmetic is harsh. 0.1% is one report per thousand messages. If you send 40 emails to Gmail addresses in a day and one recipient clicks "Report spam", that day stands at 2.5%.

Where to look:

Gmail: the Spam rate dashboard in Postmaster Tools, with two caveats Google states itself. Days with little mail may be missing. And the rate counts only reports on mail that reached the inbox, so "if Gmail automatically sends a significant number of your messages to spam, the rate shown in the dashboard might seem low". A rate that falls from high to zero is bad news.
Yahoo: the Complaint Feedback Loop, which sends you a report for each complaint against your DKIM domain.
Outlook.com: the Junk Email Reporting Program and SNDS, for whoever owns the sending IP addresses.

Do not use open rates as a substitute. Google writes that it "doesn't track open rates" and that "low open rates aren't necessarily an accurate indicator of deliverability or spam classification issues".

What helps is a smaller, better-chosen list, a first message that makes clear why you are writing to this person, and an obvious way to say no. Google makes the same point about mailing lists: unwanted messages without one-click unsubscribe "are more likely to be reported as spam".

5. Is it the message itself? Send a plain one

Google suggests the test itself: when problems persist at low volume, "try sending a blank test message and see if it experiences issues". Applied to spam placement:

Send your test mailboxes a short plain-text email from the same address: two sentences, no links, no signature image.
If it reaches the inbox, add the parts of your real message back one at a time: the signature, the links, the tracking, the full text.
The step at which it moves to spam names the cause. If even the plain message goes to spam, the message is not your problem. Go back to checks 3 and 4.

What the providers single out:

Links. Google lists "Internet links" as content that increases "the possibility of messages being treated as spam". Its error messages include one for unsolicited email "containing one of your URL domains", so a link's domain carries a reputation of its own. It follows that a shared link shortener or tracking domain brings other senders' reputation into your message. To avoid a fraud warning, Microsoft asks for "valid, reputable URLs" in standard form, without IP addresses.
Your own website. Google advises senders to check that their domain, and the domains they link to, are not listed as unsafe in Safe Browsing.
Anything hidden or misleading. "Don't use HTML and CSS to hide content in your messages." No subject starting with Re: or Fwd: unless it is a real reply, and a display name that names the sender and nothing else.
Not word lists. None of the three providers' sender documents contains a list of forbidden words. Replacing "free" with a synonym is not something any of them asks for.

6. Whose IP address did it leave from?

If you send through Google Workspace, a web host or an email service, the address your mail leaves from belongs to them, and other customers use it too. Google: "The activity of any senders using a shared IP address affects the reputation of all senders for that shared IP address." Yahoo says the same and suggests asking the host for a dedicated address.

You recognise it when bounces mention the IP address, as in Gmail's "very low reputation of the sending IP address" or Outlook.com's 550 SC-001, or when a blocklist such as Spamhaus lists the address in the top Received line. You cannot repair somebody else's address, so send the evidence to your provider. If you run your own mail server, check two basics: a reverse DNS record that matches the server's name, which all three providers ask for, and an encrypted (TLS) connection, which Gmail requires.

Your own domain still counts. Yahoo notes that authenticating with SPF, DKIM and DMARC gives a domain "a consistent reputation", whichever IP the mail is sent from.

After the fix: how long it takes, and what not to do

Change one thing at a time and give it days. Google says that after reducing spam reports you should "wait up to 7 days" for the rate to come back into range, and that "it can take time for improvements in spam rate to reflect positively on spam classification". Microsoft expects a new IP to be "fully ramped within a couple of weeks or sooner". None of the three publishes how long a damaged domain reputation takes to recover; the figures you find elsewhere are estimates.

A fresh domain is not a shortcut. It has no history, which puts you back at check 3. When the six checks are behind you and SPF, DKIM and DMARC are in place, you can start a free warmup for the mailbox and keep sending small.

Questions people ask

My mail-tester score is 10/10. Why does Gmail still put me in spam?

Because the score comes from a different filter. mail-tester says it runs a default installation of SpamAssassin and writes in its own FAQ: "All spam filters work differently. What may pass in mail-tester, might not in your own office inbox." A perfect score tells you the technical basics are right. It cannot see your reputation at Gmail or how recipients reacted to earlier mail.

Why does only my first email to a new contact go to spam, while replies arrive?

A first message comes without any history between you and that person. Google says that messages sent from an address in the recipient's contacts are less likely to be marked as spam, and Microsoft 365 can show a notice on first contact that reads "You don't often get email from" followed by your address. Once someone has answered you or saved your address, later messages start from a better position.

Does it help when recipients click "Not spam"?

For that recipient, yes. Gmail's help says that after a message is removed from Spam, future emails from that sender will not go there. Google also counts such messages as delivered to the inbox when it calculates your spam rate. It is a reasonable request to a customer who is missing your mail, and not something to ask of a whole list.

Do Gmail's sender rules apply when I write to company addresses on Google Workspace?

No. Google states that its email sender guidelines do not apply to messages sent to Google Workspace accounts, only to personal Gmail accounts ending in gmail.com or googlemail.com. Mail to a company on Workspace is still filtered, and the company's administrator can add rules of their own. If you send from Workspace, the guidelines apply to your mail to personal Gmail accounts.

Can I ask Google, Microsoft or Yahoo to whitelist my domain?

No. Google says it does not accept allowlist requests from email providers, Yahoo says it has no whitelisting program, and Outlook.com says it operates no allow list. What exists are support forms for senders who already follow the rules: Report delivery issue in Google's Postmaster Tools for verified domains, Yahoo's Sender Support Request and Outlook.com's deliverability support. None of them promises the inbox.

Is the Promotions tab the same as spam?

No. Promotions is one of the categories of the Gmail inbox, which Google describes as the place for deals, offers and other promotional emails. The message was delivered, and the recipient can drag it to Primary. Complaints, reputation and the checks on this page concern the Spam folder, not the tab a delivered message is sorted into.