Email Deliverability Guide: How to Stop Your Emails from Going to Spam

You send an important email to a client and they never receive it. A customer fills out your contact form and the notification never reaches your inbox. Your invoices, order confirmations, and password reset emails disappear into the void. The problem is almost always email deliverability — and it is one of the most overlooked aspects of running a website.

This guide explains why emails fail to deliver and how to fix it systematically.

Why Emails Go to Spam

Email providers like Gmail, Outlook, and Yahoo use sophisticated filtering systems to protect their users from spam. These systems evaluate every incoming email based on sender authentication, sender reputation, content analysis, and recipient behavior. Failing any of these checks can send your legitimate email straight to the spam folder or block it entirely.

The most common reasons business emails end up in spam are missing or incorrect authentication records (SPF, DKIM, DMARC), sending from a shared hosting IP address that has been used for spam by other accounts, using WordPress’s default PHP mail function instead of authenticated SMTP, content that triggers spam filters (excessive links, ALL CAPS, spammy phrases), and a new domain with no sending history.

Email Authentication: SPF, DKIM, and DMARC

Email authentication records are DNS entries that prove your emails are legitimately from your domain. Without them, receiving servers have no way to verify that an email claiming to be from your domain was actually sent by you — and they treat unverified email with suspicion.

SPF (Sender Policy Framework)

An SPF record is a TXT record in your DNS that lists which mail servers are authorized to send email on behalf of your domain. When a receiving server gets an email from your domain, it checks the sending server’s IP address against your SPF record. If the IP is listed, the email passes SPF. If not, it may be marked as suspicious or rejected.

Your SPF record should include every service that sends email using your domain: your email hosting provider (Google Workspace, Microsoft 365), your website’s SMTP service, transactional email services (SendGrid, Mailgun, Amazon SES), and any marketing platforms (Mailchimp, ConvertKit) that send on your behalf.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to your outgoing emails that receiving servers can verify using a public key stored in your DNS. This signature proves that the email has not been modified in transit and was genuinely sent by an authorized system for your domain.

Setting up DKIM involves generating a key pair through your email provider, adding the public key as a DNS TXT record, and configuring your mail server to sign outgoing messages with the private key. Most email providers generate the keys for you and provide the DNS record to add — it is typically a matter of copying and pasting a TXT record into your DNS management panel.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC builds on SPF and DKIM by telling receiving servers what to do when authentication fails. It specifies a policy — none (monitor only), quarantine (send to spam), or reject (block entirely) — and provides an email address where receiving servers send reports about authentication results.

Start with a DMARC policy of “none” and monitor the reports to see who is sending email using your domain. Once you are confident that all legitimate senders pass SPF and DKIM, tighten the policy to “quarantine” and eventually “reject” to fully protect your domain from spoofing.

SMTP Configuration for Websites

WordPress and many other web applications use PHP’s mail() function to send email by default. This function sends email through the web server’s local mail transfer agent, which is often poorly configured, lacks authentication, and sends from a shared IP address that may have a bad reputation.

The solution is to route all website email through a proper SMTP server. For WordPress, install WP Mail SMTP and configure it to send through one of these options:

Your email hosting provider’s SMTP server works if your sending volume is low (under a few hundred emails per day). Google Workspace SMTP or Microsoft 365 SMTP requires OAuth authentication but provides excellent deliverability for business email.

For higher volumes or transactional email, dedicated services like SendGrid, Mailgun, Amazon SES, or Postmark are designed specifically for application email. They provide high deliverability, sending analytics, bounce handling, and dedicated IP addresses. Many offer free tiers sufficient for small business websites.

Sender Reputation

Email providers assign a reputation score to your sending domain and IP address based on your sending history. High bounce rates, spam complaints, and spamtrap hits damage your reputation and reduce deliverability. Building and maintaining a good reputation requires consistent practices.

Only send email to people who have opted in to receive it. Remove bounced addresses immediately — repeatedly sending to invalid addresses is a strong spam signal. Monitor your complaint rate (the percentage of recipients who mark your email as spam) and keep it below 0.1%. If you are sending marketing email, include a clear unsubscribe link and honor unsubscribe requests promptly. Sending from a dedicated IP address (available through transactional email services) isolates your reputation from other senders.

New domains start with no reputation, which means email providers are cautious about your mail. Build your reputation gradually by starting with small sending volumes and increasing over time. Sending thousands of emails from a brand-new domain on the first day is a classic spam pattern that will get you blocklisted quickly.

Content Best Practices

Even with perfect authentication and a clean reputation, certain content patterns trigger spam filters. Avoid using ALL CAPS in subject lines or body text. Minimize the use of exclamation marks and spam-associated phrases like “act now,” “limited time,” and “guaranteed.” Maintain a healthy text-to-image ratio — emails that are mostly images with little text are flagged by many filters.

Include your physical mailing address in marketing emails (required by CAN-SPAM in the US). Use a recognizable sender name and email address that recipients will remember and trust. Send from a consistent address rather than changing it frequently, as recipients may have added your previous address to their contacts.

Testing and Monitoring

Before sending important emails, test your deliverability using tools like Mail Tester, which scores your email on a scale of 1 to 10 based on authentication, content, and blocklist checks. Google Postmaster Tools (for Gmail-specific data) and Microsoft SNDS (for Outlook) provide insight into how those major providers perceive your sending reputation.

After deploying email authentication records, monitor your DMARC reports using a service like DMARC Analyzer or Postmark’s DMARC monitoring. These reports show you every server that sends email using your domain, whether they pass authentication, and help you identify unauthorized senders or misconfigurations.

Set up alerts for deliverability issues. If your bounce rate suddenly spikes or your authentication starts failing, you want to know immediately — not after weeks of lost emails and frustrated customers.

The Checklist

If your emails are going to spam right now, work through this checklist in order: verify your SPF record includes all legitimate sending sources, set up DKIM for every service that sends on your behalf, add a DMARC record starting with a monitoring policy, configure your website to send through SMTP instead of PHP mail, check that your sending IP is not on any major blocklists, review your email content for spam filter triggers, and test with Mail Tester to verify your score.

Email deliverability is not a one-time fix — it requires ongoing attention to authentication, reputation, and sending practices. But getting the fundamentals right eliminates the vast majority of deliverability problems and ensures your business communications reach the people they are intended for.