Why your emails land in spam, and what you can actually control
Email spam filters look at three things: whether your message comes from a real, trusted sender; whether the content looks like marketing or phishing; and whether your email address or domain has a history of sending spam. You cannot control what a recipient's email provider does, but you can control how you send, what you send from, and what your email setup looks like to the outside world. Most of the time, legitimate emails end up in spam because the sender's domain is not properly configured — not because the content is bad.
The good news is that the setup takes an hour or two, costs nothing, and works across all email providers. The bad news is that it requires access to your domain's settings, which means you need to own or manage the domain you are sending from. If you are using a free Gmail or Outlook address, the provider has already done most of this work for you, and your mail is unlikely to land in spam unless you are sending in bulk or your account has been compromised.
Key Takeaways
- Set up SPF, DKIM, and DMARC records in your domain's DNS settings — these tell email providers that you own the domain and that your messages are legitimate.
- Use a consistent sender name and address, and avoid spam trigger words like "free," "act now," "limited time," and excessive punctuation or capitalization.
- Send from a dedicated domain or subdomain rather than a free email address, because providers trust established domains more than generic ones.
- Monitor your sender reputation using free tools like Google Postmaster Tools or MXToolbox, which show whether your domain is blacklisted or flagged as suspicious.
- If your account has been hacked or used to send spam, change your password when ready and run a security scan on your computer.
Set up SPF, DKIM, and DMARC to prove you own your domain
These three records live in your domain's DNS settings and tell email providers that messages from your domain are really from you. SPF (Sender Policy Framework) is a list of servers allowed to send mail from your domain. DKIM (DomainKeys Identified Mail) adds a digital signature to each message. DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together and tells providers what to do if a message fails the checks.
To set these up, log into your domain registrar (GoDaddy, Namecheap, Google Domains, or wherever you bought the domain) and find the DNS or advanced settings section. You will add three new records: one SPF record, one DKIM record, and one DMARC record. The exact steps vary by registrar, but they all have guides. If you use an email service like Mailchimp, ConvertKit, or Klaviyo to send newsletters, those services provide the exact records you need to paste in — you do not have to write them yourself.
After you add the records, wait 24 to 48 hours for them to propagate across the internet. You can check whether they are working using MXToolbox (mxtoolbox.com) — search for your domain and run the SPF, DKIM, and DMARC checks. All three should show as passing. If one fails, go back to your registrar and double-check that you pasted the record correctly.
Use a real domain instead of a free email address
Email providers trust domains that have been around for a while and have a good sending history. If you send from yourname@gmail.com or yourname@outlook.com, the provider sees you as one of millions of free account holders, and your mail gets more scrutiny. If you send from yourname@yourbusiness.com, the provider sees an established domain with skin in the game.
You do not need to be a large company to own a domain. A .com domain costs $10 to $15 per year. Once you own it, you can set up email forwarding (so mail sent to yourname@yourdomain.com lands in your Gmail inbox) or use a service like Zoho Mail or Proton Mail to host actual email accounts on your domain. Either way, you are sending from a domain you control, which is what spam filters care about.
If you are already sending from a free address and want to switch, do it gradually. Update your contacts and social media profiles with the new address, and set up forwarding from the old one so you do not miss anything. After a few months, you can stop checking the old account.
Avoid spam trigger words and suspicious formatting
Spam filters scan the subject line and body of your message for words and patterns that show up in phishing emails and marketing spam. Words like "free," "act now," "limited time," "click here," "verify your account," and "confirm your password" are red flags. Excessive capitalization, multiple exclamation marks, or dollar signs also trigger filters.
This does not mean you cannot write naturally or use emphasis. It means being aware that certain combinations raise suspicion. If you are sending a legitimate message about a free offer, say "no cost" instead of "free." If you want urgency, say "available through Friday" instead of "limited time offer." If you need someone to click a link, say "here is the link" instead of "click here now."
Keep your subject line short and specific. "Project update for March" is better than "URGENT: READ THIS NOW!!!" Avoid using URL shorteners like bit.ly or tinyurl.com in important emails — they look suspicious to filters. Use the full URL instead, or use a branded link through your own domain.
Check your sender reputation and blacklist status
Email providers keep lists of domains and IP addresses known for sending spam. If your domain or the server you send from lands on one of these lists, your mail will be blocked or filtered automatically. You can check this for free using Google Postmaster Tools (postmaster.google.com) or MXToolbox (mxtoolbox.com).
With Google Postmaster Tools, you add your domain and see your reputation score, authentication status, and any complaints from Gmail users. With MXToolbox, you search your domain or IP address against dozens of blacklists and get a report showing whether you are listed anywhere. If you are listed, the report tells you which blacklist and usually how to request removal.
If you find yourself on a blacklist, the first step is to figure out why. Did your account get hacked and used to send spam? Did you send a bulk email to an old list with many invalid addresses? Did you send to people who did not ask for your mail? Once you fix the underlying problem, you can request removal from the blacklist — most have a form on their website.
find your email account if it has been compromised
If your email account has been hacked, spammers can send mail from your address without your knowledge, which damages your sender reputation and gets your domain blacklisted. Signs of compromise include emails in your sent folder that you did not write, password reset emails you did not request, or contacts telling you they got spam from you.
If this happens, change your password when ready to something long and random — at least 16 characters, with uppercase, lowercase, numbers, and symbols. Enable two-factor authentication on your email account so that even if someone has your password, they cannot log in without a code from your phone. Check your account recovery options (phone number, backup email, security questions) and update them to information only you know.
Run a full antivirus scan on your computer using Windows Defender (built into Windows) or Malwarebytes (free version available). Malware on your computer can steal passwords or send spam through your email without changing your password. After the scan, check your email forwarding rules and connected apps — go to Settings and look for anything you did not set up. Delete anything suspicious.
What to do if legitimate mail is still landing in spam
Even with SPF, DKIM, and DMARC set up correctly, some of your mail might still land in spam. This usually means the recipient's email provider is being extra cautious, or the recipient has not marked your address as trusted. Ask them to check their spam folder, mark your email as "not spam," and add your address to their contacts. Once they do this, future mail from you should land in their inbox.
If you are sending newsletters or bulk mail, ask subscribers to confirm their email address and add you to their contacts before you send the first message. This warm-up period helps build trust with their email provider. If you are sending to a large list, use a service like Mailchimp or ConvertKit instead of your regular email account — these services have infrastructure and reputation management built in, and they handle the technical setup for you.
If you are sending to a business or government organization and your mail keeps bouncing, call them and ask whether they have a whitelist or a specific process for receiving external email. Some organizations block all outside mail by default and require you to register your domain or IP address first.
Frequently Asked Questions
Do I need all three of SPF, DKIM, and DMARC, or just one?
SPF and DKIM do most of the work, and many providers will accept mail with just one of them. DMARC ties them together and tells providers what to do if something fails, so it is worth setting up all three. The extra five minutes is worth the reliability gain.
How long does it take for SPF and DKIM to start working?
The records usually propagate within 24 to 48 hours, but it can take up to 72 hours in rare cases. Email providers may also take a few days to fully trust your domain even after the records are live. If your mail is still landing in spam after a week, check that the records are set up correctly using MXToolbox.
What if my email provider hosts my domain and I do not have access to DNS settings?
Contact your email provider's support team and ask them to set up SPF, DKIM, and DMARC for you. Most providers like Google Workspace, Microsoft 365, and Zoho Mail can do this in minutes. Provide them with your domain name and they will handle the rest.
Can I fix spam problems if I use a free Gmail or Outlook address?
Free addresses have limited options because you do not own the domain. The best you can do is keep your account find, avoid spam trigger words, and do not send in bulk. If you send newsletters or business mail regularly, buy a domain and set up email forwarding or a hosted account — it costs less than $20 per year and solves most spam problems.
If I am on a blacklist, how long does removal take?
Most blacklists remove you within 24 to 48 hours of your request, but some take longer. Google's blacklist usually clears within a few hours. Spamhaus and other major lists can take a few days. Check the blacklist's website for their specific removal process and timeline.