Why emails land in spam and how to prevent it

Emails go to spam when your email provider's filters see signs that a message might be unwanted or dangerous. Those filters look at the sender's reputation, whether the email comes from a real server, whether links inside it are known to be malicious, and whether the message matches patterns spam usually follows. You cannot control all of these, but you can control several — and doing so keeps your legitimate emails out of spam folders.

The most common reason a real person's emails land in spam is that their email account has been compromised, or their computer has malware that sends spam using their address without their knowledge. The second most common reason is that they are sending from a free email account (like Gmail or Yahoo) to a corporate email system that has strict filters. The third is that they have not set up the technical standards that tell receiving servers the email really came from them.

Key Takeaways

  • Set up SPF, DKIM, and DMARC records if you send email from your own domain — these are technical standards that prove to receiving servers that your emails are genuine.
  • If your personal email account is sending spam you did not write, change your password when ready and run a malware scan on your computer.
  • Avoid sending the same message to many people at once, using all capital letters, or including multiple links — these patterns trigger spam filters.
  • Ask people to add your address to their contacts before you send them something important, because email providers treat messages from known senders differently than strangers.
  • If you send from a free email account to a corporate domain, use a business email account instead, or ask the recipient to check their spam folder the first time.

find your email account so it cannot send spam

If your email account is sending messages you did not write, or if you notice emails going out to people you do not know, your account has been compromised. Stop using it when ready and change your password from a different device — ideally a computer or phone that has not been on the same network as the one you suspect is infected.

After you change your password, run a full malware scan using your operating system's built-in tool or a reputable third-party scanner. On Windows, use Windows Defender (built in). On Mac, use Malwarebytes or Kaspersky. On iPhone or Android, run a scan through your phone's settings under Security. Malware that sends spam from your account will tank your sender reputation, and it takes weeks or months for that reputation to recover even after you remove the malware.

Check your email account's recovery options while you are at it. Go to your account settings and confirm that the recovery email address and phone number are ones you recognize. If someone has added their own recovery email or phone, remove it when ready — that is how attackers lock you out of your own account.

Set up SPF, DKIM, and DMARC if you send from your own domain

If you send emails from an address like contact@yourcompany.com (not a Gmail or Yahoo address), you need to set up three technical standards that tell receiving email servers your messages are real. These are called SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting and Conformance). Without them, many corporate email systems will reject or spam-folder your messages automatically.

SPF is a record you add to your domain's DNS settings that lists which servers are allowed to send email from your domain. DKIM adds a digital signature to every email you send, proving it came from your domain and was not changed in transit. DMARC tells receiving servers what to do if an email claims to be from your domain but fails the SPF or DKIM check.

You set these up through your domain registrar (the company where you bought your domain name) or your email hosting provider. If you use a service like Google Workspace, Microsoft 365, or Mailchimp, they usually provide step-by-step instructions for adding these records. Search for "[your email service] set up SPF DKIM DMARC" and follow the official guide. If you are not sure who hosts your domain, ask your web developer or IT person — they will know.

Avoid patterns that trigger spam filters

Email filters watch for behavior that spam usually follows. If you send the same message to fifty people at once, use all capital letters in the subject line, include five or more links, or ask people to click a link and enter their password, filters will flag it as spam even if you are legitimate.

When you need to send the same message to multiple people, send it to yourself and put everyone else in the BCC (blind carbon copy) field instead of the TO or CC field. This makes the email look like it was sent to one person, not broadcast to many. Avoid phrases that spam commonly uses: "act now", "limited time", "verify your account", "confirm your password", "click here when ready". Use normal sentence case in subject lines, not ALL CAPS. Keep links to one or two per email.

If you are sending a legitimate message that happens to include a link (like a password reset or account confirmation), make sure the link goes to a real domain that matches what you told the recipient to expect. If you are asking someone to log in, send them to your actual website, not a shortened URL or a link that redirects through another service.

Ask recipients to add you to their contacts first

Email providers treat messages from people in your contacts list differently than messages from strangers. If someone has your address saved in their phone or email, their provider is much less likely to spam-folder your message. Before you send something important to someone for the first time, ask them to add your email address to their contacts.

This is especially important if you are sending from a free email account (Gmail, Yahoo, Outlook.com) to a corporate email system. Corporate filters are stricter because they see more spam. A quick text or call saying "I am going to email you from [your address] — can you add me to your contacts?" takes thirty seconds and dramatically increases the chance your email lands in their inbox instead of spam.

Use a business email account when sending to corporate addresses

If you send from a free email account to someone at a company, their email system may filter you out automatically. Corporate email systems use reputation databases that track which email addresses and domains send spam. Free email accounts (especially new ones) have lower reputation scores because spammers use them constantly.

If you send business emails regularly, set up an email account on your own domain instead of using Gmail or Yahoo. This takes a few minutes through any domain registrar or email hosting service. If you cannot set up your own domain, use Google Workspace or Microsoft 365, which are business versions of Gmail and Outlook that have better reputation with corporate filters.

If you are sending just one or two messages and cannot set up a business account, tell the recipient in advance that you are sending from a free email account and ask them to check their spam folder. Many corporate email systems let you whitelist a sender after you receive one message from them, so once they see your first email, they can mark it as "not spam" and future messages will go to their inbox.

Monitor your sender reputation

If you send email regularly from your own domain, check your sender reputation score periodically. Services like Google Postmaster Tools (free, for Gmail recipients), Sender Score, and MXToolbox let you see how email providers view your domain. A score above 80 is good. Below 70 means filters are likely blocking or spamming your messages.

If your score is low, the most common causes are: you are sending to people who did not ask for your emails (they mark you as spam), your domain is new and has no history yet, or your account was compromised and sent spam at some point. If your account was compromised, the reputation will recover slowly over weeks as you send only legitimate emails. If you are sending to people who did not ask for it, stop — that is spam by definition, and no technical fix will help.

Frequently Asked Questions

How long does it take for my sender reputation to improve after I fix a compromised account?

Reputation recovery takes two to eight weeks depending on how much spam was sent and how many people marked you as spam. During that time, send only to people who expect your emails. Avoid sending to large lists or to addresses you have not contacted before. The more legitimate email you send, the faster your reputation recovers.

Can I use a Gmail account to send business emails without setting up my own domain?

Yes, but your emails are more likely to land in spam at corporate companies. If you must use Gmail, set up Google Workspace (the paid business version), which has better reputation than free Gmail. Ask recipients to add you to their contacts before you send important messages. For regular business use, a domain-based email account is much more reliable.

What should I do if someone tells me their emails from me are going to spam?

Ask them to check their spam folder and mark your message as "not spam" — this tells their email provider to trust you going forward. If you send from your own domain, verify that SPF, DKIM, and DMARC are set up correctly. If you send from a free email account, ask them to add your address to their contacts before you send the next message.

Does using a VPN or proxy affect whether my emails go to spam?

Yes — if you send email while connected to a VPN, your email may appear to come from a different country or IP address than usual, which can trigger spam filters. Send email without a VPN active, or configure your email client to connect directly to your email server without routing through the VPN.

Why do emails from my company domain go to spam even though I set up SPF and DKIM?

DMARC may not be configured, or your domain may be new and have no sending history. Add a DMARC record to your domain settings. If your domain is less than a month old, reputation takes time to build — this is normal. Also check that you are sending from the exact domain you set up the records for (not a subdomain like mail.yourdomain.com if you only set up yourdomain.com).