1. Authentication: SPF, DKIM and DMARC
Unauthenticated mail is the most common reason for spam placement. Check that:
- SPF includes every service that sends for your domain;
- DKIM signing is enabled at each sending service;
- a DMARC record exists, and the visible From domain aligns with SPF or DKIM.
Details in SPF, DKIM and DMARC explained; check the records with DNS Record Lookup.
2. Reverse DNS of the Sending Server
If you run your own mail server, its IP address needs a PTR record that matches a hostname pointing back to the same address. See Reverse DNS and PTR records.
3. Blacklists
Check the sending IP address with the Spam Database Lookup. If it is listed, follow how to get delisted. On shared hosting, other customers on the same server may have caused the listing.
4. Bulk Sender Requirements
Since 2024, Gmail and Yahoo require senders of large volumes to authenticate with SPF, DKIM and DMARC, to offer one-click unsubscribe in marketing mail and to keep spam complaint rates low (Google asks to stay below 0.3%, ideally under 0.1%). Even small senders benefit from meeting these rules.
5. Sending Practices and List Quality
- Send only to people who asked for your emails. Purchased lists hit spam traps.
- Remove addresses that bounce and people who never open your mail.
- Increase volume gradually on a new domain or IP address (“warming up”).
- Make unsubscribing easy; otherwise recipients press “Report spam”.
6. Content
- Avoid link shorteners and links to domains with a bad reputation.
- Do not send image-only emails; include real text.
- Keep the From name and address consistent and recognizable.
- Make sure links point to your own domain where possible.
7. Domain Reputation
New domains have no reputation yet, and domains that were previously used for spam carry a bad one. Check the domain’s age with WHOIS Lookup. Google Postmaster Tools shows how Gmail sees your domain once you send enough volume.
Quick Diagnostic Order
- Send a test to a Gmail account and open “Show original”: it shows SPF, DKIM and DMARC results.
- Fix any authentication failure first.
- Check PTR and blacklists.
- Then review content and list practices.