A new client asked me “Why is my email going to spam and ending up in people’s junk folders?”
Is this happening to you? Are your business emails ending up in spam folders? You’re not alone. Email deliverability has become more complex as providers like Google, Yahoo, and Microsoft have tightened security requirements to combat phishing and spam.
The good news: most email deliverability problems come down to three fixable issues. We’ll explain what’s causing your emails to land in spam and how to fix it. Setting these up correctly is the first step in every Microsoft 365 build we do.
SPF, DKIM and DMARC records improve your email deliverability. Keep reading to see why emails go to spam and how to fix it.
Why Your Emails Are Marked As Spam
Email providers use sophisticated filtering systems to protect their users from malicious messages. Every email you send gets scored based on multiple factors. If your score is too high, you land in spam, even if you’re a legitimate business sending normal messages. Here are the three factors that most commonly cause deliverability problems for small businesses:
1. Missing Or Misconfigured Email Authentication
This is the number one reason business emails go to spam. As of February 2024, Google and Yahoo require proper email authentication for all bulk senders. Microsoft began enforcing the same rules for high-volume senders to Outlook.com in 2025. If your domain lacks proper authentication records, your emails will be rejected or sent to spam. Email authentication proves to receiving servers that you’re authorized to send email from your domain. Without it, your emails look identical to phishing attempts and spoofed messages. The three required authentication standards are:
- SPF (Sender Policy Framework): Lists which servers can send email from your domain
- DKIM (DomainKeys Identified Mail): Adds encrypted signature to verify message authenticity
- DMARC (Domain-based Message Authentication, Reporting and Conformance): Tells receiving servers what to do with unauthenticated emails
Solution: Configure SPF, DKIM, and DMARC records for your domain. If you’re using Microsoft 365 or Google Workspace, these platforms provide the tools, but they must be configured correctly. See the detailed implementation guide below.
2. Poor Domain Reputation & Sending Patterns
Your domain builds a reputation over time based on how recipients interact with your emails. Factors that damage your reputation include:
Sudden Volume Spikes: If you normally send 50 emails per day and suddenly send 500, you’ll trigger spam filters. Ramp up sending volume gradually if you’re launching a new campaign.
Low Engagement Rates: When recipients consistently delete your emails without reading them, email providers notice. If your open rates are very low, you’ll be flagged as sending unwanted mail.
Blacklist Issues: If your domain or IP address has been blacklisted in the past (or is currently on a blacklist), your emails will be blocked or sent to spam. Check your domain status at MXToolbox or similar services.
New Domain Age: Brand new domains are treated with suspicion. If your domain was registered recently, expect stricter filtering until you build a positive sending history.
Solutions:
- Send from an established domain (ideally 6+ months old)
- Warm up new sending domains gradually (start with small volumes)
- Monitor your domain reputation using tools like Google Postmaster or Microsoft SNDS
- Keep your email lists clean and remove inactive recipients who never engage
- Check if you’re on any blacklists and request removal if needed
3. Email Content & Formatting
While authentication and reputation are most critical, your email content still matters. Modern spam filters analyze both obvious spam signals and subtle patterns.
Content Issues That Trigger Filters:
- Excessive sales language (“Act Now! Limited Time! FREE!”)
- Multiple exclamation marks and ALL CAPS
- Suspiciously short or poorly formatted messages
- Links to suspicious or newly registered domains
- Too many images relative to text
- Broken or malformed HTML code
- Excessive tracking pixels or hidden content
Professional Email Best Practices:
- Write clear, professional messages with proper grammar
- Use a reasonable text-to-image ratio
- Avoid trigger words commonly used in spam (see SpamAssassin’s trigger word list)
- Send pricing and promotional materials as PDF attachments rather than embedding them in email body
- Use professional email signatures (HTML signatures from Microsoft 365 or Google Workspace are fine)
- Test your emails before sending to large groups
Solution: Focus on legitimate, professional business communication. If you’re sending marketing emails, use proper email marketing platforms (Mailchimp, Constant Contact, etc.) rather than sending bulk messages from your regular business email.
What You Can’t Control
Some email deliverability factors are outside your control:
Recipient’s Personal Settings: Individual users can set aggressive spam filtering or mark your domain as spam manually. You can’t prevent this, but you can minimize it by only sending relevant, requested communications.
ISP Filtering Algorithms: Different email providers use different algorithms. What works with Gmail might not work with Outlook. Focus on following best practices rather than trying to game any specific system.
Third-Party Email Reputation: If you’re using shared hosting or a shared IP address, other users’ poor practices can affect your deliverability. This is one reason we recommend Microsoft 365 or Google Workspace for business email.
The Bottom Line
Email authentication is non-negotiable. If you’re experiencing deliverability problems, start there. Proper SPF, DKIM, and DMARC configuration will solve the majority of spam folder issues for legitimate business email.
DMARC, DKIM And SPF Records: Improve Email Security Today
DKIM, DMARC and SPF Records, when configured properly, will improve your spam score, increase email deliverability, stop ending up in junk folders, and reduce phishing and impersonation emails from your domain.
Why These Tools Matter
In July 2023, Microsoft changed Exchange Online to honour DMARC reject and quarantine policies by default. In February 2024, Google, Yahoo and other major providers announced these email security controls are now required. This industry-wide shift marks a significant step forward in email security, making all our communications safer.
These three tools work together to create a robust email security framework:
- Sender Policy Framework (SPF)
- DomainKeys Identified Mail (DKIM)
- Domain-based Message Authentication, Reporting and Conformance (DMARC)
You’ll want to implement them in this specific order, as DMARC requires both SPF and DKIM to be in place for maximum effectiveness.
You can use your Sender Policy Framework, DKIM and DMARC tools in tandem to reduce phishing emails, reduce impersonation emails, reduce domain spoofing, and protect your business.
Your Sender Policy Framework (SPF)
Sender Policy Framework (SPF) is an anti-spam approach whereby the email sender’s domain is scored for threat risk.
When you set up SPF, you specify which servers are authorized to send mail on behalf of your domain. Any email sent from servers not listed in your SPF record can be rejected or sent to spam, protecting both your organization and others from spoofed emails that appear to come from your domain.
You have likely received a phishing email at some time which appeared to be from one organization, but in fact was a spoofed email from a malicious sender. These emails are utilizing Sender Address Forgery, and this is exactly what a DNS SPF record fights against.
Key Benefits Of SPF:
- Blocks unauthorized servers from sending emails that look like they’re from you (imitating or spoofing domain)
- Helps your legitimate emails reach their destination (improving email deliverability rates)
- Protects your organization’s reputation (by reducing the risk of your domain being used in phishing attacks against others)
Solution: Create an SPF record for your domain. Most businesses ask their IT provider to set this up.
DKIM (DomainKeys Identified Mail): Adding A Digital Signature
DKIM adds a crucial layer of security through a digital signature. It works by adding a signed header to each email message, which is:
- Signed with a private key at the mail server level
- Verified to ensure the email is authorized by the sending domain
- Checked by recipient servers to confirm authenticity
When the email is received, the recipient’s incoming email server checks the DKIM signature to confirm that a message was in fact sent from the authorized domain.
DKIM records help improve the deliverability of your outgoing emails by authenticating you and your domain as trusted senders.
Key Benefits Of DKIM:
- Provides cryptographic verification of email content
- Ensures emails haven’t been tampered with during transmission
- Significantly improves your email deliverability rates
- Helps establish your domain as a trusted sender
DMARC: Bringing It All Together
You can think of DMARC as an attestation that your Sender Policy Framework and DKIM records are legitimate.
DMARC is an email validation tool that protects your domain and email addresses from being used in email phishing and spoofing campaigns and protecting your domain security.
Key Benefits Of DMARC:
- Gives you visibility into who is sending email from your domain
- Lets you control how unauthorized emails are handled
- Provides reports to help you monitor potential security issues
DMARC builds on SPF and DKIM and adds a reporting functionality to allow you to gain insight into who is sending email on your behalf. Publishing a DMARC record into your DNS record will give you visibility into and control over your email communications.
This in-depth explanation of DMARC is perfect for more technical readers. For business owners, your key takeaway is to ensure you have domain protection tools such as SPF, DMARC and DKIM in place.
Getting Started
For those comfortable with technical implementation, Microsoft provides a comprehensive guide for setup of DMARC in Microsoft 365. However, given the critical nature of these security controls and their impact on email delivery, many organizations choose to work with experienced IT partners for implementation.
We are based in Toronto and work with fully managed clients across Canada.
Beyond Basic Email Security
This is by no means an exhaustive list of spam reduction or email security tools.
While SPF, DKIM, and DMARC form the foundation of modern email security, they’re part of a broader security strategy. These tools represent essential, effective actions you can take today to significantly improve your email security posture.
Get Expert Help
TUCU Managed IT Services in Toronto has been helping small businesses and nonprofits secure their email communications since 2003. As Microsoft 365 specialists, we can help implement these critical email security controls properly.
SPF, DKIM and DMARC setup and monitoring are part of the fully managed IT we provide. If you are looking for an IT partner who looks after this for you, book a discovery call.
