Why your email goes to spam, and how to fix it for good

How a receiver decides

Gmail, Outlook, Yahoo and Proton all run the same basic checks in the first milliseconds: does this sending server have permission to use this domain, is the message signed, and does the domain publish a policy for failures? Fail those and the content barely matters.

SPF: who may send as you

SPF is a short DNS record listing authorised sending servers. The two common mistakes are forgetting to include a service you actually use — so its mail fails — and publishing two SPF records, which invalidates both. There must be exactly one.

DKIM: proof the message was not altered

DKIM adds a cryptographic signature to every outgoing message, checked against a public key in your DNS. If the signature verifies, the receiver knows the message is authentic and unmodified in transit.

DMARC: your instruction for failures

DMARC tells receivers what to do when SPF or DKIM fails, and where to send reports. Start at monitoring only, read the reports for two weeks to catch legitimate senders you forgot, then move to quarantine and finally rejection.

• p=none — monitor and collect reports, change nothing
• p=quarantine — failures go to spam
• p=reject — failures are refused outright

The other half: behaviour

Authentication earns you the right to be judged on merit. After that, reputation is behavioural: send at a steady volume, keep your lists clean, avoid link shorteners in bulk mail, and make unsubscribing trivial. Complaints and dead addresses damage a domain faster than any single message can repair it.

Checking your own domain

The EgreedMail admin console validates all four records against your live DNS and reports per-message delivery status, so a bounce shows the reason the receiving provider gave rather than a generic failure.