Email going to spam? What to do when business email lands in the spam folder

What have Gmail and Yahoo required of senders since February 2024?

Since February 2024, Google and Yahoo have required basic authentication for all senders, and SPF, DKIM, DMARC, and one-click unsubscribe for bulk senders. Google’s email sender guidelines divide the rules into two groups; those sending more than 5,000 messages per day to Gmail accounts face additional requirements. The basic requirements for all senders are:

• SPF or DKIM authentication for the domain
• Valid forward and reverse DNS (PTR) for sending servers
• Use of TLS connections for transmission
• Keeping the spam rate measured in Postmaster Tools below 0.30%; Google recommends staying below 0.10%
• Messages complying with RFC 5322 and not impersonating a Gmail address in the From header

For bulk senders, Google requires both SPF and DKIM, a DMARC record (the policy may be none), and alignment of the From domain with the SPF or DKIM domain. One-click unsubscribe support is also mandatory for marketing and subscription messages. Yahoo’s sender requirements page lists similar conditions: at least SPF or DKIM for all senders, both for bulk senders, a passing DMARC record containing at least p=none, and honoring unsubscribe requests within 2 days.

A business sending a few dozen quotations and correspondence messages daily is not a bulk sender, but the basic rules for all senders still apply. Although DMARC is not mandatory at this scale, adding it makes sense because it makes the domain harder to use for spoofed messages.

How do you check IP and domain blocklists?

If email still goes to spam with correct records, check whether the sending IP or domain is on a blocklist. Blocklists are databases collecting IP addresses and domains detected sending spam, which many receiving servers consult when filtering.

First find the sending server’s IP address; it appears in Received headers on the “Show original” screen. Then search separately for the IP and domain using query tools from blocklist providers such as Spamhaus. On shared hosting, another account using the same IP may have sent spam, causing a listing without the business itself doing anything wrong.

For a listed IP, the first contact is the hosting company; removal requests are usually made by the server administrator after fixing the source of the problem. For businesses using Google Workspace, sending goes through Google’s servers, so domain reputation is the main concern. Domains sending regularly to Gmail can monitor spam rates and authentication results through Google’s Postmaster Tools; Google notes that data may be incomplete on low-volume sending days.

Content and sending habits: do not send bulk email from a business mailbox

Even when technical settings are complete, sending habits determine domain reputation; bulk messages such as campaigns and newsletters should come from an email marketing service set up for that purpose rather than the business mailbox used for daily correspondence. When the same mailbox sends identical content to hundreds of people, resulting complaints and bounces directly affect quotation and invoice correspondence reputation. Establish these habits for healthy sending:

• Use a separate bulk sending service and, if possible, a subdomain such as bulten.ornekfirma.com; add the service to SPF and set up DKIM signing on behalf of the domain.
• Include only people who have given permission; do not use purchased address lists.
• Include a visible unsubscribe link in every bulk message and honor requests without delay.
• Avoid all-capital subject lines, repeated exclamation marks, and exaggerated promises.
• Include readable text instead of making the message a single large image.
• Links should show the business’s own domain instead of using shortening services.

If bulk sending is planned, list management and structure are handled separately through the email marketing service. Separating daily correspondence from marketing sends is one of the most effective steps for preventing business email from repeatedly landing in spam.

How do you test email going to Gmail spam? Check PASS with Show original

The quickest test is to send a message from the business address to a personal Gmail account and check whether SPF, DKIM, and DMARC results say PASS in Gmail’s “Show original” screen. This screen shows authentication results from the receiving server’s perspective and is read in this order:

1. Send a short test message from the business address to a personal Gmail address.
2. Open it in Gmail; select “Show original” from the More icon next to Reply.
3. Check whether SPF, DKIM, and DMARC rows in the summary at the top of the page say PASS.
4. For detail, look for spf=pass, dkim=pass, and dmarc=pass in the Authentication-Results header.
5. If the result is FAIL, SOFTFAIL, or NONE, recheck the relevant DNS record and repeat the test after changing it.

Google’s DKIM troubleshooting page states that successful authentication appears as dkim=pass in the header, and “body hash did not verify” indicates the message was changed in transit. If DKIM is PASS but DMARC is FAIL, the signing domain usually does not match the From domain. This happens most often with third-party services and is a common reason email goes to spam despite authentication being configured.

Hosting email or Google Workspace? The difference for spam

The main spam-risk difference between these setups is who controls the sending server and its reputation. Hosting email goes through the hosting server, and IP reputation can be affected by accounts sharing it; Google Workspace sends through Google’s infrastructure. Both require correct SPF, DKIM, and DMARC records on the domain.

Hosting email is often sufficient for small teams; what matters is that the server is maintained, supports DKIM, and is clear of blocklists. Provider options and setup steps are separately compared in the how to get business email guide. The effects of server choice on speed and search visibility are also covered in the web hosting selection article. Changing providers because email goes to spam often achieves nothing without correcting the records.

Common mistakes and the correct approach

Most mistakes arise from setting things up once and forgetting them; records are not updated when a new service sends for the domain. The most frequently encountered situations and correct alternatives are as follows:

• Creating two separate SPF records: Do not create a second v=spf1 record for a new service; collect all senders in one record using include:.
• Considering SPF sufficient by itself: Enable DKIM signing too; Google and Yahoo require both for bulk sending.
• Setting DMARC to reject on day one: A legitimate service not yet authenticated, such as invoicing, CRM, or a website form, will have its messages rejected; start with none and proceed according to reports.
• Leaving old records when changing providers: When moving from hosting to Workspace or the reverse, update MX, SPF, and DKIM for the new provider.
• Sending website forms without authentication: Send form notifications through an authenticated SMTP account belonging to the domain.
• Using a Gmail From address in a newsletter tool: Google does not allow impersonating Gmail in the From header; use an address on the business’s own domain.

Do not close the task without sending a test message after a change. Because record propagation can take hours, check the result once more the next day.

A step-by-step checklist if email goes to spam

The following sequence is designed to find the problem with the fewest attempts. Each step relies on the previous result and is followed without skipping:

1. List all services sending email for the domain: email provider, website form, newsletter tool, invoicing or CRM system.
2. Check that DNS contains a single SPF record covering all these services.
3. Enable DKIM signing for the domain in every sending service.
4. Add a DMARC record with p=none and define a report address 48 hours after SPF and DKIM setup.
5. Verify that SPF, DKIM, and DMARC results are PASS using Gmail’s “Show original”.
6. Query the sending IP and domain in blocklists; if listed, start the removal process with the hosting company.
7. Separate bulk sending from the business mailbox and add an unsubscribe link.
8. Monitor DMARC reports for several weeks; if all legitimate sources pass, gradually tighten the policy.

Marking a message “not spam” on the recipient side may fix matters for that person but does not eliminate the root cause. Lasting improvement comes from domain records and consistent sending habits.

When should you consult a specialist?

If email still goes to spam and tests return FAIL after adding records, multiple services send for the domain, the IP is blocklisted, or providers will change, specialist support saves time. An incorrect DNS change can affect incoming email and website access as well as outgoing messages. The checklist above is a sufficient starting point for businesses wishing to configure records themselves.

Since 2019, Maltepe-based Onur Freelance has handled domain-side settings together for websites, hosting, and business email setups. The hosting package including business email costs 2,000 TL annually, the domain costs 1,000 TL, and both together cost 3,000 TL; registrations are made in the business’s name. Package details appear on the hosting prices and domain prices pages. If email will remain with another provider, records can also be examined without changing the existing setup.

Nobody can promise inbox placement; the recipient’s provider always makes the filtering decision. What can be done is complete authentication setup, reputation protection, and regular testing of results.