Field note · 2026-10-15 · DME Computer Services
Why are my emails going to spam
Spam placement is a pile of checks, not a verdict on your writing. Authentication, the complaint rate, TLS, and a PTR record are the ones the mailbox providers publish. Start there.
A customer says the invoice went to spam. You can rewrite the subject all afternoon and still miss the reason. Get one copy of the headers, and look up the domain's records. The guidelines below were read on 2026-10-15.
What Gmail publishes
Email sender guidelines split the rules. Starting 1 February 2024, anyone sending mail to Gmail accounts has to set up SPF or DKIM, publish valid forward and reverse DNS (a PTR record) for the sending domain or IP, send over TLS, keep the spam rate reported in Postmaster Tools below 0.3%, and format messages to RFC 5322. The page says mail that misses the requirements might not be delivered as expected, or might be marked as spam.
Senders of more than 5,000 messages a day to Gmail accounts have a stricter list: SPF and DKIM, and DMARC. The DMARC policy can be none. For direct mail, the From domain has to align with the SPF domain or the DKIM domain. Marketing mail and subscribed mail have to support one-click unsubscribe, and a visible unsubscribe link in the body. That one-click rule is in the bulk section of the page. It is not a demand that a three-person company add it to a personal reply.
The 0.3% figure is Gmail's complaint threshold in Postmaster Tools, not a measurement of your industry. If you do not send enough mail for that tool to show a rate, do not invent one. Look at the headers of a message that was filed.
What a DMARC failure asks the receiver to do
p=none does not ask anyone to spam-folder the message. p=quarantine does. Microsoft's DMARC page says a quarantine request can land in junk, in a quarantine, or in the inbox with a mark, and that the destination system decides. p=reject asks them to refuse it. They do not all obey.
The same page says outbound mail from Microsoft 365 that fails DMARC at a destination, when your policy is already quarantine or reject, is routed through the high-risk delivery pool. If you tightened p= while a real sender was still failing, the mail you wanted can start looking like bulk risk. That is a publishing problem, not a copy problem.
Forwarding breaks SPF, because the forwarder is not in your list. DKIM often still passes. DMARC passes if either aligned check passes. RFC 7489 is the rule. A domain with SPF and no DKIM will watch forwarded copies fail and then get treated however the receiver treats a DMARC failure.
Read one message before you edit DNS
In Gmail, open the message and use Show original. In Microsoft 365, the header docs are on Microsoft Learn, and you can paste them into the Message Header Analyzer. Read the Authentication-Results header your receiver added. RFC 8601 defines it. A sender can put a fake copy in the message. Use the one that names the host that checked it.
- dmarc=fail, or no SPF and no DKIM. Fix the records before you rewrite the offer. The setup order is How to set up DMARC.
- spf=pass for a domain that is not your From domain, or dkim=pass with d= set to a vendor. The check passed for someone else. DMARC does not treat that as you.
- dmarc=pass and the message is still in spam. Authentication is not the gap. Look at the complaint rate in Postmaster Tools if you send enough for it to report, at whether the mail was wanted, and at a sudden change of sending IP. Do not publish p=reject to solve a complaint problem. Reject tells receivers what to do with failures. It does not make wanted mail more wanted.
What to do with the domain
/check reads MX, SPF, DMARC, and five common DKIM selectors once. It stores nothing. A missing DMARC record, an SPF record that ends in +all, or no SPF record is a reason receivers are not being given an instruction. It is not a sighting of the message your customer filed.
The $9 report is that lookup as a PDF, with a step for each unfinished row. It requires a license key. If checkout is not connected, the page says Coming soon. It will not explain a complaint rate. It does not see the message.
If the records are the gap and you want them published and watched, DMARC setup is DME Computer Services in Omaha. $199 is one Google or Microsoft domain. $499 is three domains or extra senders. The work includes 30 days of reading aggregate reports. It does not include rewriting your invoices. Contact info@dmeomaha.com.
How to tell a forged From address from a mailbox someone else opened is Is my email domain being spoofed?
Sources
Free check · nothing stored
See the records you have now
The checker reads MX, SPF, DMARC, and five common DKIM selectors once. It does not send a message, it does not read DMARC reports, and it does not keep the domain.
From the directory
DNS checkers and DMARC report readers. None of them see the inside of a recipient's spam folder.
- CategoryDMARC, SPF, and DKIMTools that read DMARC reports or help you publish SPF, DKIM, and DMARC so other people cannot send mail as your domain.
- CategoryFree checkersTools with a check or a plan you can use without paying. Trials are not listed here unless a lasting free tier was on the vendor page.
- CategoryEmail security gatewaysFilters and monitors aimed at inbound mail: phishing, spoofing, and account takeover. Not every product here sits in the mail path. The notes say which is which.
- ToolMXToolboxPublic DNS and mail lookups, including MX records and blacklist checks.
- ToolEasyDMARCDMARC monitoring with public record checkers and printed prices for the paid plans.
- TooldmarcianDMARC deployment and monitoring, with a 30-day trial and a public domain check.
- ToolPostmark DMARCA free weekly DMARC email from Postmark, plus a paid digest at $14 a domain.
The other notes
- How to set up DMARC (step by step)Publish one SPF record and DKIM first. Then a DMARC record at p=none, read the reports, and only then move to quarantine and reject.
- SPF vs DKIM vs DMARC explainedSPF lists who may send. DKIM signs the message. DMARC checks that one of them matches the From address and tells receivers what to do on failure.
- Is my email domain being spoofed? How to tellRead Authentication-Results on a real message and, if you asked for them, the DMARC reports. A DNS lookup alone does not prove an attack today.
- How to set up DMARC in Microsoft 365Publish Microsoft's SPF include, copy both DKIM CNAMEs from the Defender portal, then add DMARC at p=none and move to reject only after the reports are clean.
- Google Workspace SPF/DKIM/DMARC setupAdd Google's SPF include, generate a DKIM key in the Admin console, and publish DMARC at p=none. Do not paste the strict-alignment sample on day one.
- What is BIMI and do I need itBIMI is an inbox logo for mail that already passes DMARC at quarantine or reject. Gmail also wants a logo certificate. Most small domains can skip it.
- How to spot invoice fraud and business email compromiseA new bank account in an invoice email is unconfirmed until you call a number you already had. DMARC does not stop a lookalike name or a stolen mailbox.
Questions
Short answers to the questions this note is for. The paragraphs above are the longer version.
- If I rewrite the subject line, will it leave spam?
- Sometimes the wording is the problem. Often it is not. Check Authentication-Results and the DNS records first. A message that fails DMARC, or that has no SPF and no DKIM, can be filed as spam while the sentences are fine.
- We are under 5,000 messages a day. Can we ignore Gmail's rules?
- No. Google's sender guidelines, starting 1 February 2024, apply SPF or DKIM, a valid PTR record, and TLS to anyone sending to Gmail accounts. The 5,000-a-day line adds SPF and DKIM together, plus DMARC. The DMARC policy on that line can be none.
- SPF passes. Why is the message still in spam?
- SPF checks the envelope sender, not the From address a person sees. DMARC fails the SPF result unless those domains align. A pass for someone else's domain does not authenticate you. Complaints, a missing PTR, or a missing TLS session are separate from SPF.
- Does p=none keep us out of spam?
- No. p=none asks for reports and does not ask receivers to quarantine or reject. Receivers can still file the message as spam for other reasons. Quarantine is the policy that asks them to treat a DMARC failure as suspicious, which often means the spam folder.
- Will the free check tell me why one message was filed?
- No. /check reads the DNS records once and stores nothing. It does not see the message, the complaint rate, or the receiving mailbox. For one message you need the headers. For a pattern of complaints, Gmail points you at Postmaster Tools.