- Your mail is not authenticated. The receiving server cannot confirm the message really came from your domain. Usually a record is missing, a new tool (CRM, invoicing, newsletter, website form, help desk, even a scanner) was never added to it, or the SPF record grew past its limit and silently broke for everything.
- The message looks like spam. Link shorteners, many images and few words, capital letters, a signature with six logos, attachments nobody asked for, or a subject written like an advert. Filters score each of these.
- Your domain's reputation took a hit. A mailbox was compromised and sent spam for a weekend, someone sent a 400-recipient update from Outlook with everyone in Bcc, or your mail goes out through a shared server with a bad neighbour.
- The recipient's side. A rule, a full mailbox, a forward to a personal address, or a filter that once learned your address as junk. Less common than people think, and only the recipient can fix it.
Why your company email lands in spam, and how to fix it for good
The four reasons business email ends up in the junk folder, what SPF, DKIM and DMARC actually do, what Gmail and Outlook now require from every sender, and a check you can run in 20 minutes.
8 minute readUpdated
The short answer
Nine times out of ten the cause is authentication: your domain is not telling the world which services may send mail as you, or a new tool was added without updating those records. Gmail and Outlook now expect SPF, DKIM and a DMARC record from every sender, and they quietly send mail to spam when something fails. Fix the records, turn on DKIM in every tool that sends as your domain, start DMARC at monitoring, and most delivery problems disappear within a day or two.
Four reasons, in order of likelihood
What SPF, DKIM and DMARC actually do
All three are small text records in your domain's DNS. Nobody at your company sees them, but every mail server you write to checks them.
| Record | In plain words | What goes wrong without it |
|---|---|---|
| SPF | A list of the services allowed to send email as your domain, for example Microsoft 365 and your invoicing tool. | Mail from a service not on the list fails. A list with more than ten lookups fails for everything. |
| DKIM | A digital signature added to each message, proving it came from your domain and was not altered on the way. | Messages arrive unsigned and look no different from a forgery. |
| DMARC | Your instruction to receivers: what to do when a message claiming to be you fails the checks above, and where to send reports. | Receivers guess, and anyone can send mail in your name without you knowing. |
One detail matters: alignment. The domain in the From address people see must match the domain that passed SPF or DKIM. A newsletter tool that sends as your domain but signs with its own domain passes DKIM for itself and still fails DMARC for you.
What Gmail, Outlook and Yahoo now require
Since 2024 the big mailbox providers publish rules instead of guessing, and in late 2025 Google stepped up enforcement with more rejections. Their published requirements, as of October 2026:
| Requirement | Gmail (every sender) | Outlook.com and Yahoo |
|---|---|---|
| SPF and DKIM | Both set up | Both set up for anyone sending about 5,000 messages a day or more; strongly expected from everyone else |
| DMARC record | Published, at least p=none | Published, at least p=none, aligned with SPF or DKIM |
| From domain aligned | Yes, with SPF or DKIM | Yes |
| Reverse DNS and TLS | Required | Expected |
| Spam complaint rate | Under 0.3 percent, aim for 0.1 | Kept low; Microsoft watches reputation closely |
| One-click unsubscribe | Marketing mail from bulk senders | Marketing mail from bulk senders |
These rules formally cover mail sent to personal Gmail, Outlook.com and Yahoo addresses. In practice Microsoft 365 and Google Workspace apply the same checks to business mailboxes, so the fix is the same whoever your customers use.
The 20-minute check
- List everything that sends as your domain. Microsoft 365 or Google Workspace, the CRM, invoicing and payroll tools, the newsletter platform, the website's contact form, the help desk, calendar and booking tools, and that one printer that scans to email. Most domains have five to eight.
- Read your SPF record. There must be exactly one. It should include every service from the list, stay under ten DNS lookups, and end with -all or ~all. A second SPF record, or an eleventh lookup, fails everything.
- Turn on DKIM everywhere. In Microsoft 365 it is in the Defender portal under Email authentication settings; in Google Workspace under Apps, Google Workspace, Gmail, Authenticate email. Every third-party tool has its own DKIM setting that gives you two or three DNS records to add.
- Publish DMARC at monitoring level. A record with p=none and a reporting address changes nothing yet, but within days the reports show every service sending as you, including the ones you forgot and anyone impersonating you.
- Send a test and read the result. Email a personal Gmail account, open the message, choose Show original, and look for SPF: PASS, DKIM: PASS and DMARC: PASS. Outlook.com shows the same in the message headers. One FAIL tells you exactly which record to fix.
- Tighten DMARC in steps. After two to four weeks of clean reports, move to p=quarantine, then p=reject. At reject, nobody can send mail in your name and receivers trust yours more.
Problems that look like authentication but are not
- A compromised mailbox. If delivery dropped overnight, check the sign-in logs and inbox rules of the affected accounts before anything else. Attackers add a rule that hides replies and send spam from the real account.
- Bulk mail from a normal mailbox. Outlook and Gmail are built for conversations, not campaigns. Updates to hundreds of contacts belong in a proper tool, sent from a subdomain such as news.yourcompany.com so a bad day there does not touch your main domain.
- Heavy signatures and link shorteners. Fewer images, no shortened links, and text that reads like a person wrote it.
- A brand-new domain. Domains with no history are treated with suspicion for the first weeks. Start with low volumes and real conversations.
- Bought or scraped lists. Complaint rates above 0.3 percent remove you from the providers' good books for a week at a time, and no record fixes that.
Keep it in order
- Add every new tool that sends email to SPF and DKIM on the day it is set up
- Read the DMARC reports monthly, or have someone read them for you
- Keep marketing and transactional mail on their own subdomains
- Watch the complaint rate in Google Postmaster Tools and Microsoft's sender tools
- Review who can create inbox rules and forwards, because those are the first things an attacker changes
FAQ
Questions people ask
Short answers to what founders and finance leads ask us most.
Ask us something elseUsually one of four things: a new tool started sending as your domain without being added to SPF, the SPF record crossed the ten-lookup limit, a mailbox was compromised, or a provider stepped up enforcement, as Google did in late 2025. The 20-minute check above finds which.
Yes. Google now expects a DMARC record from every sender writing to Gmail addresses, and Outlook.com expects it from larger senders. A record at p=none changes nothing and costs nothing, and it is the only way to see who is sending as you.
Not at p=none. Problems only appear if you jump to quarantine or reject before every legitimate service is passing, which is why we read the reports for a few weeks first.
Yes. The records live in your domain's DNS and apply to whichever platform and tools send your mail. Only the place where you turn on DKIM differs.
Because Microsoft 365 is in your SPF and DKIM and the CRM is not, or the CRM signs with its own domain instead of yours. Each tool has a DKIM setting that fixes it.
Records can be corrected in a day for most domains. Walking DMARC up to reject safely takes a few weeks of reading reports, and a damaged reputation recovers over weeks of clean sending.
How SF3 Technologies helps
We find every service sending as your domain, repair SPF, turn on DKIM in Microsoft 365, Google Workspace and each tool, publish DMARC and walk it up to reject while reading the reports, so your email arrives and nobody can send in your name. The records stay in your DNS and your tenant, under your control.
Sender requirements are as published by Google and Microsoft in October 2026 and change over time. Check each provider's current sender guidelines before relying on a threshold.