Why business emails land in spam

“Our emails are going to spam” describes a symptom, not a cause. At least four unrelated problems produce it, each needs a different fix, and the usual mistake is to change all four at once and lose the ability to tell which one mattered.

This is the order we work through them, and why that order.

1. The message is not authenticated at all

The first question is whether the receiving server can establish that the message is authorised by the domain it claims to come from. Two mechanisms answer that:

• SPF checks whether the connecting IP address is listed in the DNS of the envelope sender domain — the MAIL FROM address, which is usually invisible to the recipient and often differs from the address shown in the email client.
• DKIM checks a cryptographic signature in the message headers against a public key published in DNS at selector._domainkey.yourdomain.com.

If neither exists, you are relying entirely on the receiving provider’s goodwill. Since early 2024, Gmail and Yahoo have required both SPF and DKIM from anyone sending bulk mail to their users, so “goodwill” is no longer a strategy.

2. Authentication passes, but nothing aligns

This is the case that catches most people, and it is worth understanding properly. DMARC does not ask “did SPF or DKIM pass?” It asks whether SPF or DKIM passed for a domain that matches the one in the visible From header. That match is called alignment.

So a message can look like this and still be rejected:

spf=pass    smtp.mailfrom=mail.sendingplatform.com
dkim=pass   header.d=sendingplatform.com
dmarc=fail  header.from=yourcompany.com

Both checks passed — for the sending platform’s domain, not yours. Nothing passed for yourcompany.com, so DMARC fails, and if your policy is enforcing, the message is quarantined or rejected.

The fix is not to loosen DMARC. It is to make the platform sign with your domain: configure a custom sending subdomain and a DKIM key published in your DNS, which every reputable platform supports.

3. Authentication and alignment are fine, reputation is not

Once the technical identity is established, filtering decisions move to reputation — and there are two separate reputations, which people routinely conflate.

• IP reputation belongs to the address you send from. On shared infrastructure it is partly inherited from other senders on the same IP.
• Domain reputation belongs to you and follows you between providers. It is the one that matters more, and the one you cannot escape by switching platform.

Reputation is driven mostly by recipient behaviour: complaint rate, deletion without reading, and whether people engage. Google Postmaster Tools reports your domain reputation and spam-complaint rate if you verify the domain; Microsoft SNDS reports IP-level data. Both are free, and if you send any volume and have not set them up, that is the next thing to do.

The threshold worth knowing: Gmail expects a spam-complaint rate below 0.3%, measured in Postmaster Tools. Sustained above that, filtering gets markedly worse.

4. Everything checks out and the sending behaviour is the problem

If authentication, alignment and reputation are all clean, look at the pattern of sending:

• Mixed streams. Marketing and transactional mail sharing one domain means a bad campaign takes password resets down with it. Separate them onto different subdomains.
• Volume spikes. A new IP or domain that suddenly sends 50,000 messages looks exactly like a compromised account. Ramp gradually.
• List quality. Purchased lists and old addresses produce hard bounces and spam-trap hits, both of which damage reputation quickly.
• Missing unsubscribe. Bulk senders to Gmail and Yahoo must support one-click unsubscribe via the List-Unsubscribe and List-Unsubscribe-Post headers. Without it, people report the mail as spam instead, which is far more damaging.

How to find out which one you have

Send a message through your real sending path to an address at the provider that is filtering you, and read the raw headers of what arrives. In Gmail, that is Show original. The Authentication-Results line answers categories 1 and 2 outright.

If that line shows dmarc=pass and the message is still filtered, you have a reputation or behaviour problem, and no amount of DNS editing will fix it.

What nobody can do

No consultant, tool or platform can guarantee inbox placement. Providers weight recipient engagement signals that no third party can see or influence. What is achievable is removing every technical reason to filter your mail, and having the reporting in place to see what happens next.