If you are asking why are my emails going to spam, the answer is almost always one of three things: broken authentication (missing or misconfigured SPF, DKIM, and DMARC), a sender reputation dragged down by spam complaints and bad list hygiene, and content or sending patterns that trip filters. Fix authentication first, clean your list second, then warm your reputation back up. Inbox placement follows.
That is the honest short version. Now the part nobody at your old ESP bothered to explain.
So why are my emails going to spam? It is almost never "the email looked spammy"
Most people assume spam folder placement is about words. One too many exclamation points, the word "free," a big red button. That is mostly a myth in 2026.
Modern inbox providers (Gmail, Yahoo, Outlook, Apple Mail) decide placement on signals that have very little to do with your copy and almost everything to do with who is sending and how recipients react. They are asking: Is this sender authenticated? Do people open, reply, and keep these emails, or delete and complain? Is the sending domain trusted? Get those right and you can use the word "free" all day. Get them wrong and your beautifully written newsletter still rots in spam.
So we diagnose in that order: authentication, then reputation, then content and sending behavior. Skip the order and you will spend a week rewriting subject lines to fix a DNS problem.
Cause 1: Your authentication is broken (this is the big one)
This is where most deliverability problems live, and it is the most fixable. Three records do the work, and you need all three. They live in your domain's DNS, not inside your email tool, which is exactly why so many people never touch them.
SPF (Sender Policy Framework)
SPF is a DNS TXT record that lists which servers are allowed to send email for your domain. When a provider receives your message, it checks: did this come from a server you authorized? If you switched email platforms, added a new tool (your CRM, your invoicing app, your help desk all send mail too), or never set SPF up, this check fails and you look like a forger. One common trap: SPF allows a maximum of 10 DNS lookups, and stacking too many "include" statements for too many tools silently breaks the whole record.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to every message so the receiving server can confirm the email genuinely came from you and was not tampered with in transit. The receiver looks up your public key in DNS and verifies the signature against it. No signature, a mismatched one, or a key your platform rotated and you forgot to republish, and your trust score drops.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties SPF and DKIM together and tells receivers what to do when a message fails: nothing (p=none), send it to spam (p=quarantine), or reject it outright (p=reject). It also sends you reports on who is sending mail using your domain, including spoofers wearing your name. The reports are how you discover that the "rogue sender" tanking your reputation is your own marketing tool that nobody added to SPF.
Here is why this is not optional anymore. In February 2024, Google and Yahoo started enforcing new requirements for bulk senders (anyone sending more than 5,000 messages a day): valid SPF, DKIM, and a DMARC policy of at least p=none. From November 2025, Gmail tightened the screws further, and non-compliant mail now faces temporary or permanent rejection, not just the spam folder. If you are sending volume without all three configured, you are not "at risk." You are already being filtered.
The fix: publish a correct SPF record, enable DKIM signing in your email platform, and add a DMARC record. Start DMARC at p=none to monitor, read the reports for a couple of weeks until you can confirm every legitimate sending source passes, then move to p=quarantine, and only later to p=reject once you are certain nothing real is failing. This is mostly a one-time setup, and it is core technical SEO plumbing: the same DNS-and-records discipline that keeps a site crawlable keeps your mail trusted. It solves a shocking percentage of "going to spam" problems outright.
Cause 2: Your sender reputation tanked
Authentication proves you are you. Reputation decides whether being you is a good thing. Inbox providers score your sending domain and IP based on how people treat your mail over time, and that score is the difference between landing in the inbox and landing in the abyss. A few things wreck it fast:
- Spam complaints. Google's bulk sender rules say to keep your spam complaint rate below 0.3%, and Google recommends staying under 0.1%. That is roughly one complaint per thousand sends. Cross it consistently and the whole domain gets throttled, not just the campaign that triggered it.
- Spam traps and dead addresses. Emailing addresses that hard-bounce or hit a spam trap (a recycled or planted address used to catch sloppy senders) tells providers you are not maintaining your list. Buying lists is the fastest way to do this to yourself, because purchased lists are seeded with traps on purpose.
- Sudden volume spikes. Going from 200 emails a month to 50,000 overnight from a cold domain looks exactly like a compromised account. Providers throttle first and ask questions later, deferring or bouncing the surge until your pattern looks human again.
- Low engagement. If most recipients never open and many delete on sight, providers learn your mail is unwanted, and they start placing it accordingly even for the people who do want it. Engagement is the signal that quietly governs everything else.
The fix: make unsubscribing easy (Gmail and Yahoo now require one-click unsubscribe via the list-unsubscribe header, and you must honor it within two days, so this is mandatory anyway). Suppress hard bounces and chronic non-openers. Stop emailing people who have not engaged in 6 to 12 months. And never, ever buy a list. A smaller list that wants to hear from you beats a big one that reports you. This is also why the structure of your sends matters: well-built highest-revenue email flows target people who just raised their hand, which keeps engagement high and reputation healthy almost by accident.
Cause 3: Content and sending patterns that trip filters
Authentication and reputation are 90% of the play. The last 10% is hygiene that quietly hurts you:
- Link and image problems. Shortened URLs (bit.ly and friends), links to domains with bad reputations, or an email that is one giant image with almost no text all raise flags. Filters cannot read an image, so an all-image email reads as an email hiding its contents.
- Misleading subject lines. "RE:" on a cold email, fake "you won" hooks, anything that overpromises and underdelivers trains recipients to complain, and complaints feed straight back into Cause 2.
- Broken or missing plain-text version. A proper email has both an HTML and a plain-text version. Missing the plain-text part looks lazy to filters and breaks the email for anyone whose client blocks HTML.
- No physical mailing address or unsubscribe link. CAN-SPAM requires both. Skipping them is both illegal and a deliverability penalty.
The fix: balance text and images, use your own domain for links, write subject lines you would be comfortable defending to the recipient's face, and include a working unsubscribe link and a real mailing address in every send. Boring, but it adds up.
How to diagnose your own deliverability in 15 minutes
Before you change anything, find out where you stand:
- Check your authentication. Run your domain through a free SPF/DKIM/DMARC checker (MXToolbox and similar tools do this in seconds). If any of the three are missing or failing, you found your problem.
- Send a test through a placement tester. Tools like Mail-Tester score a single email and tell you exactly what is failing, from authentication to content flags, with a number you can re-test against after each fix.
- Read your platform's deliverability dashboard. Your ESP reports spam complaint rate, bounce rate, and engagement. If complaints are creeping toward 0.3% or hard bounces are above 2%, that is your list talking, not your copy.
- Set up Google Postmaster Tools and Yahoo Sender Hub. These show you your domain reputation and spam rate straight from the source, for free. If you send any real volume to Gmail and Yahoo, you should be watching these. They are the only place you see the score the inbox providers keep on you.
If all three authentication records pass, your complaint rate is low, and you are still in spam, the problem is usually reputation recovering slowly. That takes consistent good sending over time, not a single fix.
The honest part: some of this is a slow climb
Authentication is a same-day fix. Reputation is not. If you have been spraying a purchased list from a cold domain for months, your domain reputation is damaged, and providers do not forgive instantly. Recovery means weeks of clean, low-volume, high-engagement sending to rebuild trust, sometimes warming a fresh sending domain or subdomain from scratch: start small, send only to your most engaged contacts, and ramp volume gradually so the providers see a steady, wanted sender instead of a firehose.
Anyone who promises to "get you out of spam by Friday" is selling you something, and overpromising on timelines is one of the agency red flags worth walking away from. The real path is fix the foundation now, then earn the reputation back. We would rather tell you that up front than collect a retainer and watch your numbers not move.
Where this fits with the rest of your marketing
Email is the highest-ROI channel you own, but only if it lands. A deliverability problem is not a small technical annoyance; it is your owned audience going dark. If you are sending campaigns and flows that nobody sees, the fix is upstream of better copy or prettier templates. It is the plumbing. It is also the kind of silent leak that shows up downstream: if your owned channels go quiet at the same time as your organic numbers, it is worth ruling out the obvious before you panic, the same way you would diagnose why your website traffic is dropping before blaming the algorithm.
That is exactly the kind of unglamorous, foundational work most agencies skip because it does not photograph well in a deck. We do not skip it. Deliverability discipline is built into how we run email marketing and the automated flows underneath it, because a well-built flow placing orders at around 2% versus roughly 0.16% for a broadcast blast (Klaviyo 2026 benchmarks, 183,000+ brands) is worth nothing if it never reaches the inbox.
Stuck in the spam folder? Let's get you out.
If your emails are not landing and you are tired of guessing why, we will run a real deliverability audit: authentication, reputation, list health, the whole stack, and tell you straight what is broken and what it takes to fix it. No jargon, no "it's complicated," no retainer for work that does not change outcomes.
Run a free audit or email us at admin@moonsauceagency.com. Not sure whether to hire help for this at all? Start with our guide on how to choose a marketing agency. No pitch, no pressure.
Sources for the authentication and complaint-rate figures cited above: Mailgun: Yahoogle bulk sender requirements, Security Boulevard: Google and Yahoo updated email authentication requirements.
