Mail landing in spam almost never has one single cause — it's usually one broken link in a chain of authentication checks, plus whatever the receiving mailbox provider's own spam filter decides on top of that. The fastest way to find the actual problem is to check that chain in order, rather than guessing. This walks through it.
The Order That Actually Narrows It Down
- Mail Health Check — runs MX, SPF, DKIM, DMARC, and a blacklist check together and gives a plain verdict. Start here rather than checking each one by hand; it tells you which specific link is broken before you dig further.
- SPF — confirms which servers are authorized to send as your domain. A missing sender here is the single most common cause of a legitimate email failing authentication.
- DKIM — confirms the message wasn't altered in transit and was actually signed by your domain. Needs the exact selector your provider signs with; check your provider's docs if you don't already know it.
- DMARC — confirms a policy exists and check how strict it is. This is what actually tells receiving servers what to do when SPF or DKIM fails, and where failure reports get sent.
- DNS Blacklist Checker — even with clean authentication, a domain or sending IP listed on a major DNSBL will get filtered aggressively. Worth checking last, since it's the one cause that isn't fixed by a DNS record change alone.
What Each Failure Actually Means for the Inbox
SPF fails — the receiving server sees a message claiming to be from your domain, sent from a server your SPF record doesn't list. Depending on your DMARC policy, this ranges from a minor spam-score penalty to outright rejection.
DKIM fails — either the message was altered in transit (rare, usually a forwarding rule rewriting headers) or the signature doesn't match because the wrong selector was used or the key was never published. Functionally similar impact to an SPF failure on its own.
No DMARC record — SPF and DKIM can both be configured correctly and still leave spoofing wide open, since nothing tells receiving servers what to do when a message fails both. Many providers now silently downrank domains with no DMARC record at all, regardless of whether SPF/DKIM themselves pass.
Listed on a blacklist — this overrides everything else. A domain or IP on a major DNSBL gets filtered or rejected regardless of how clean its SPF/DKIM/DMARC setup is, since the block happens before content or authentication is even evaluated.
When It's Not Authentication At All
If Mail Health Check comes back clean across the board, the cause is usually reputation or content, not configuration: a newly created domain with no sending history, a sudden spike in volume, spam-trigger language or excessive links in the message body, or low recipient engagement (opens/replies) on past sends. These build up over time and aren't something a single DNS record fixes — the SPF/DKIM/DMARC chain is the floor, not the whole picture.
Frequently Asked Questions
Why does my email go to spam even though I never had this problem before?
The most common cause is a DNS or hosting change that quietly broke SPF, DKIM, or DMARC — a new mail provider, a migrated domain, or an added sending tool (marketing platform, CRM, helpdesk) that was never added to the SPF record. Mailbox providers also adjust their spam filters continuously, so a domain with no recent changes can still start scoring worse purely on sender reputation.
Do I need SPF, DKIM, and DMARC all three?
For reliable inbox placement, yes. SPF alone is easy to spoof around (it only checks the sending server, not the visible From address). DKIM alone proves the message wasn't altered but not who's allowed to send it. DMARC is what actually ties the two together and tells receiving servers what to do when they disagree — without it, SPF and DKIM are informational rather than enforced.
I have SPF, DKIM, and DMARC set up. Why is mail still landing in spam?
Authentication passing is necessary but not sufficient. Sender reputation (IP and domain history), a domain flagged on a DNS blacklist, spammy content patterns, a low sending volume from a brand-new domain, and low recipient engagement all factor into modern spam filtering independently of SPF/DKIM/DMARC. Check DNS Blacklist Checker next if authentication checks out clean.
What does a DMARC policy of "none" actually do?
It monitors only — reports get sent, but nothing is done differently to the mail itself, meaning DMARC isn't actually enforcing anything yet. "quarantine" routes failing mail to spam; "reject" blocks it outright. Most domains start at none while confirming every legitimate sending source is correctly authenticated, then move to quarantine or reject.
Can one email service (like a CRM or invoicing tool) break deliverability for my whole domain?
Yes. Every service that sends mail "from" your domain needs to be included in your SPF record and configured to sign with DKIM. A single unlisted sender doesn't just fail for that one tool — it can also drag down the domain's overall authentication pass rate, which affects how every other sender from the same domain gets scored.
Run Mail Health Check against your domain to see all five checks together, or jump straight to SPF, DKIM, DMARC, or the DNS Blacklist Checker if you already know which link you're chasing.