How to Stop Emails Going to Spam: The 2026 Playbook From 20 Years in SMTP

If your emails are landing in spam, the cause is almost always one of seven things: missing or misconfigured authentication, a damaged sender reputation, a high complaint rate, a dirty or purchased list, a brand-new or cold-warmed domain, a content or link pattern that trips filters, or an SMTP provider that’s quietly making things worse. The fix is to figure out which one, in what order, and stop guessing.

This guide is the playbook. It’s how the SMTP2GO support team actually walks through deliverability cases. You can skim it. You can also work through it top to bottom in an hour. Either way, you’ll know what to check, what to change, and what to ignore.

If you only read one section, read the TL;DR.

TL;DR: The fix list, in priority order

1. Authenticate your sending domain with SPF, DKIM, and DMARC.
2. Meet Gmail and Yahoo’s sender rules – even if you send under 5,000 a day.
3. Watch the five metrics that actually reveal a spam problem.
4. Clean your list and kill complaints at the source.
5. Warm up new domains and IPs gradually, not all at once.
6. Separate transactional mail from marketing mail.
7. Fix the message itself: content, links, formatting, attachments.
8. Decide whether you actually need a dedicated IP.
9. If your SMTP provider is part of the problem, change it.
10. Test, then test again with the right tools.

Now the diagnosis bit.

Quick-diagnose: which thing is actually broken?

Before you start changing anything, narrow down what you’re looking at. Most teams jump straight to the fix and then can’t tell if it worked. Use this table to triage first.

If you don’t know which row is yours yet, run a quick test send with Mail-Tester and check Google Postmaster Tools for your sending domain. Five minutes. That’s the start.

Why your emails go to spam: the seven real causes

Spam filters in 2026 are reputation engines first, content filters second. Gmail, Yahoo, and Microsoft all care more about who you are and how your past emails behaved than they do about whether you used the word “free” in a subject line. The seven real causes:

1. You haven’t authenticated: no SPF, no DKIM, or no DMARC. Or you set them up and never checked alignment.
2. Your sender reputation is bad: high complaints, high bounces, low engagement, or you’re on a blocklist.
3. Your list is dirty: purchased, scraped, ancient, or full of spam traps.
4. You sent too much, too fast, from a cold domain: Gmail can’t tell you from a phisher who just registered the domain yesterday.
5. You mixed your streams: order receipts and weekly newsletters sharing one sending reputation, and the newsletters are dragging the receipts down.
6. Your content or links are tripping filters: URL shorteners, all-image emails, suspicious link patterns, or a sender name that doesn’t match the domain.
7. Your provider is hurting you: bad shared IP neighbours, weak abuse controls, no visibility into what’s happening.
   Now the fixes, in the order they matter.

Spam, Promotions, bounced, blocked – they’re not the same thing

Before you start fixing, make sure you actually have a spam problem. Treating a Promotions tab issue like a spam issue will waste a week.

If recipients are telling you the message arrived “in Promotions,” that’s a different conversation. We wrote about that one here. It’s not a deliverability problem. It’s an engagement problem dressed up as one.

Fix 1: Authenticate your sending domain

This is the single biggest reason “legitimate” email lands in spam in 2026. SPF, DKIM, and DMARC are no longer optional. They’re the price of entry.

SPF (Sender Policy Framework). A TXT record on your domain that lists which servers are allowed to send mail on your behalf. If a message arrives from an IP that isn’t in the SPF record, the receiving server treats it as suspicious. The classic failure mode: you’ve got five tools sending mail (your CRM, your billing app, your support desk, your marketing platform, your CEO’s inbox), and only three of them are in the SPF record. The other two intermittently land in spam, and you spend a month blaming the wrong thing. SPF is also limited to 10 DNS lookups; busy domains blow past this without noticing. Full breakdown here.

DKIM (DomainKeys Identified Mail). A cryptographic signature added to each outbound message. The receiving server fetches your public key from DNS, verifies the signature, and confirms two things: the message really came from you, and nobody tampered with it in transit. Setup is one DNS record per sending source. Misconfigurations usually come down to selector mismatches or the wrong domain being signed. We’ve got a deeper guide here.

DMARC. The policy layer on top of SPF and DKIM. It tells receiving servers what to do when authentication fails (do nothing, quarantine, reject), and where to send you reports. The piece most people miss: alignment. SPF and DKIM can both pass while DMARC still fails, because the domain the user sees in the From header doesn’t match the domain that was actually authenticated. If your DMARC report shows pass rates below 95%, you have an alignment problem, not an authentication problem. Walkthrough here.

Quick verification from a terminal:

dig +short TXT example.com | grep -i spf
dig +short TXT default._domainkey.example.com
dig +short TXT _dmarc.example.coma

What this looks like in practice. David Rousseau at Les Musees de la civilisation de Quebec called out DKIM and SPF optimisation specifically when they brought SMTP2GO in to lift the delivery rate on their CRM mail. That’s the typical pattern. The organisation has been sending for years, the tools were never authenticated correctly, deliverability drifted, and the fix turned out to be five DNS records.

Fix 2: Meet Gmail and Yahoo’s sender rules – even if you send under 5,000 a day

In February 2024, Google and Yahoo rolled out mandatory sender requirements for bulk senders (anyone sending more than 5,000 messages a day to either provider). Microsoft has since signalled similar tightening. The rules aren’t going away. Here’s the short version.

For bulk senders (>5,000/day to gmail.com or yahoo.com):

• SPF and DKIM both required. Not one or the other. Both.
• DMARC required, at minimum p=none, with alignment.
• Spam complaint rate below 0.10%, never crossing 0.30% for any sustained period. Above that, Google starts diverting your mail to spam regardless of authentication status.
• One-click unsubscribe for marketing/promotional mail (RFC 8058). The header-based version, not just a footer link.
• Unsubscribes processed within two days.
• Valid forward and reverse DNS on your sending IPs.
• TLS encryption in transit.
• From header alignment with the authenticated domain.

Source: Google’s sender guidelines; Yahoo’s sender hub. We’ve also done a SMTP2GO-specific walkthrough here.

The thing nobody tells you about the 5,000/day threshold. A lot of senders see “bulk senders” and assume the rules don’t apply because they only send 200 a day. Wrong move. Gmail still expects SPF or DKIM at any volume, and accounts that fail those at low volume get filtered just as aggressively. The 5,000/day line is for the strict enforcement. Below it, you’re still on the same path; you just have more rope.

Honestly, this is the part most teams underestimate. The complaint-rate ceiling is harder to maintain than it sounds. A 5,000-recipient send with five spam-button clicks puts you at 0.10% exactly. That’s a normal Tuesday for some lists. Building in a buffer matters.

Fix 3: Watch the five metrics that actually reveal a spam problem

The old advice “track open rates and click rates” is half-useless now. Since Apple Mail Privacy Protection launched in iOS 15 (September 2021), opens for Apple Mail users are essentially pre-fetched, which means open rate as a deliverability signal is noise. You can still use it for engagement trends, but if you’re using it to diagnose spam, you’re using the wrong dashboard.

These are the five that actually move:

Delivery rate ≠ inbox placement. A 99.8% delivery rate means 99.8% of messages were accepted by the receiving server. It says nothing about whether they ended up in the inbox or the spam folder. Confusing the two is the most common conversation we have in support tickets.

For monitoring, use Google Postmaster Tools for Gmail visibility, Microsoft SNDS for Outlook/Hotmail, and MXToolbox for blocklist checks. Inside SMTP2GO, the Activity dashboard rolls all of this up into one view per sending domain or sub-account.

Fix 4: Clean your list and kill complaints at the source

A complaint rate above 0.30% will get you filtered. There’s no DNS record that fixes it. The cause is upstream.

Three rules, then we move on.

Never send to an address you didn’t earn. Purchased lists, scraped lists, “co-registration” lists, list trades — they’re spam-trap factories. Even one or two pristine spam traps on your list (addresses that never belonged to a real person) is enough to land you on a major blocklist. More on the spam trap landscape here.

Suppress hard bounces immediately and run a sunset policy. If a subscriber hasn’t opened or clicked in 90-180 days, they’re a liability, not an asset. Either run a re-engagement send and suppress the non-responders, or just suppress them. Their continued presence on your list is dragging down your engagement signals and lighting up complaint risk.

Make the unsubscribe obvious, and process it fast. People who can’t find the unsubscribe button hit the spam button instead. One click. Visible. Header-based for promotional mail (RFC 8058 again). We wrote up the practical version here.

The case that proves it. Alistair Higham at JWK Solicitors came to SMTP2GO after their domain had been blacklisted. The blacklisting wasn’t a mystery; it was the accumulated weight of years of unmanaged list and complaint behaviour. Moving providers gave them a clean reset on infrastructure, but the underlying list hygiene was what had to change.

Fix 5: Warm up new domains and IPs gradually

A domain that registered yesterday and sent 50,000 messages today looks exactly like a phishing operation. Filters know this. They throttle hard.

A workable warm-up cadence for a new dedicated IP, sending to a list that’s already opted-in and engaged:

• Days 1-3: 50/day per provider
• Days 4-7: 250/day
• Week 2: 1,000/day
• Week 3: 5,000/day
• Week 4: 25,000/day
• Weeks 5-6: ramp to full volume

That’s a generous schedule. You can move faster if your engagement holds; you have to slow down if your bounce or complaint rate starts climbing. On a shared IP at SMTP2GO, the warm-up is shorter because the IP already has sending history attached to it; that’s the trade-off. Our high-volume warm-up guide goes deeper and covers when you actually need the warm-up at all.

The same principle applies to a domain that’s been dormant. If you haven’t sent for six months and you suddenly blast 100,000 messages, you’re cold-warming whether you meant to or not. Treat it like a new domain.

Fix 6: Separate transactional and marketing mail

This is the fix nobody talks about and everyone needs.

If your password resets, order confirmations, shipping notifications, and security alerts share a sending domain with your weekly newsletter, then your weekly newsletter’s complaint rate is dragging down the deliverability of every receipt you send. One bad campaign and the receipts go to spam too. That’s not a hypothetical; that’s a Tuesday in support.

The fix is structural. Use subdomains:

• mail.example.com for marketing
• notify.example.com or tx.example.com for transactional
• support.example.com for support replies

Each subdomain has its own DKIM, its own DMARC alignment, and over time its own reputation. The transactional reputation stays clean even if a marketing campaign goes sideways. SMTP2GO sub-accounts make the operational side of this easy — different streams, different sending limits, different IP pools if you need them. Background on the pattern here.

Why it matters at the extreme. Miguel Mercado Canales at GlaxoSmithKline uses SMTP2GO to send environmental condition notifications to about 20 colleagues across manufacturing operations. When the next shift comes on, those emails need to be in the inbox before they walk in the door. If those alerts shared reputation with a marketing send to 200,000 prospects, the alerts would be the ones that broke first. They don’t share. That’s the point.

Fix 7: Fix the message itself

Content matters less than it used to, but it still matters. The patterns that hurt you in 2026:

• All-image emails. No text, just a giant JPEG. Filters can’t read it, recipients can’t read it on screen readers, and the image-to-text ratio is so skewed that the message looks like an attempt to hide content. Aim for roughly 60% text, 40% image.
• URL shorteners. Bit.ly, t.co, tinyurl. They mask the destination, which is exactly what phishers do. Use a branded tracking domain instead, or just use the full URL.
• Mismatched link text. Displaying one URL while linking to another. Filters score this hard.
• Inconsistent From identity. “Bob from Acme” one week, “[email protected]” the next, “[email protected]” the week after. Pick one and stick to it.
• Excessive subject-line punctuation, ALL CAPS, or emoji stacks. This is the boring obvious one. Filters got past simple keyword matching years ago, but stacking signals still triggers a higher score.
• Attachments larger than a few MB. If the file’s big, link to it. Don’t attach it.

The myth worth debunking: images do not cause spam by themselves. Single-image emails do. An email with a hero image, some text, a CTA, and a footer is fine. An email that’s literally one large image with no HTML text is not. Big difference.

Shared vs dedicated IP

If you’ve been told you need a dedicated IP to fix deliverability, slow down. Usually you don’t.

The honest answer for most senders: start on shared. SMTP2GO’s shared pools are actively monitored, with strict acceptance criteria for who can send through them. If you grow past 100K consistent monthly volume, then dedicated makes sense. Until then, you’re paying for control you don’t need and accepting warm-up risk you don’t have to.

When your SMTP provider is part of the problem

Sometimes the issue isn’t your DNS, your list, or your content. It’s that your provider is quietly dragging you down. Six warning signs:

1. You can’t see who’s complaining. No complaint reporting, no Feedback Loop integration with major ISPs.
2. Shared IP pools that include senders you wouldn’t want as neighbours. No clear acceptance criteria. You’re on a pool with cold-email outreach companies and grey-hat affiliate networks.
3. No alerts when reputation drops. You find out from a customer that emails went missing.
4. DKIM/SPF setup is documented as “follow these 14 steps,” not automated. Bigger setup means more misconfigurations.
5. Support response time measured in days, not hours. Deliverability emergencies don’t wait for tickets.
6. No separation between transactional and marketing. Everything’s one stream with one reputation.
   If two or more of those describe your current setup, the provider is part of the problem. Not all of it. But part.

This is what migration sometimes looks like. Dennis Mathew at ThinkPorch moved to SMTP2GO from AWS SES specifically because SES support took too long to resolve issues. SES is excellent infrastructure; what it’s not is a managed deliverability service. The two aren’t the same product. Knowing which one you actually need is the bit most teams skip when they pick a provider.

And Mark Shaw at StoredTech has been using SMTP2GO since 2011 to power email from phone systems, copiers, printers, and a long tail of business devices that can’t authenticate via OAuth, can’t do TLS 1.3, and can only speak basic SMTP. Those devices got harder to deliver from every year as ISPs tightened. The reason they still work is because the provider sits between them and the modern internet’s authentication requirements, and handles the messy middle.

Tools we’d actually use this week

Short list. No padding.

• Google Postmaster Tools Gmail-side reputation, complaint rate, authentication pass rates. Mandatory if you send any meaningful Gmail volume.
• Microsoft SNDS  Same idea for Outlook/Hotmail.
• MXToolbox  Blocklist lookups, DNS record verification, SMTP diagnostic.
• Mail-Tester  Send a test email to a temporary address, get a score on authentication, content, blocklist status, and HTML quality. Quick sanity check.
• dmarcian DMARC report aggregation and parsing. Free tier is generous.
• GlockApps  Inbox placement testing across providers. Worth running before a major send.

Inside SMTP2GO, the Activity tab gives you everything in one place: delivery, bounces, complaints, opens (where the data is reliable), clicks, and reputation status per sending domain.

Troubleshooting and what to do

FAQs

Why are my business emails going to spam?
The most common cause in 2026 is missing or misconfigured email authentication (SPF, DKIM, DMARC), followed by a damaged sender reputation from complaints or bounces. Start by verifying authentication, then check Google Postmaster Tools for your sending domain.

Why are my emails going to spam even with SPF and DKIM?
Usually one of three things: DMARC isn’t set up or isn’t aligned (the From domain doesn’t match the authenticated domain), your complaint rate is above 0.10%, or your domain reputation has dropped from a recent volume spike or list quality issue. SPF and DKIM pass at the technical layer doesn’t guarantee inbox placement; reputation does.

Do I need DMARC if I send fewer than 5,000 emails a day?
Yes. Gmail and Yahoo’s strict enforcement applies above 5,000/day to their domains, but DMARC is still a strong signal at lower volume and protects you against spoofing regardless of send size. Set it to p=none at minimum so you start receiving reports.

What spam complaint rate is too high?
Google’s target is below 0.10% and a hard ceiling of 0.30%. Above 0.30% sustained, you can expect filtering. Above 0.10% rolling, you’re at risk and should be tightening.

Is the Gmail Promotions tab the same as spam?
No. Promotions is still inbox; it’s just a sorted view. If your emails land there, the deliverability is working; the engagement positioning isn’t. Different problem, different fix.

Will a dedicated IP stop my emails going to spam?
Probably not. A dedicated IP fixes a specific problem (your shared pool reputation is poor and you have the volume to maintain your own) but it doesn’t fix authentication, list hygiene, complaints, or content issues. If you have those problems, a dedicated IP just gives you sole ownership of them.

How long does it take to recover sender reputation?
Domain reputation recovery in Gmail Postmaster usually takes 2-4 weeks of consistent good behaviour after the underlying cause is fixed. IP reputation recovers faster on shared (you blend in) and slower on dedicated. Blocklist removal varies — some delist on automated review within 24-48 hours, others require manual application.

Should I separate transactional and marketing emails?
Yes, on different subdomains. Mixing them means one bad marketing campaign can drag down delivery of your password resets and order confirmations. Use mail.example.com for marketing and notify.example.com for transactional, each with its own DKIM and DMARC.

Can URL shorteners cause spam filtering?
Yes. Generic shorteners (bit.ly, t.co, tinyurl) hide the destination, which is a phishing pattern. Use a branded tracking domain or full URLs. Bit.ly use specifically has been associated with elevated filter scores at multiple major providers.

My emails work fine in Outlook but go to spam in Gmail. Why?
Most likely a Gmail-specific reputation issue. Check Google Postmaster Tools first. Common causes: a recent complaint spike from Gmail users, DMARC alignment failures (Gmail enforces alignment harder than Microsoft), or a sender-domain-specific listing.

Need a hand? Try SMTP2GO free – up to 1,000 messages a month, no card required. Or book time with our deliverability team if you’d rather talk it through.

About the author

Simon Slade

Co-Founder at SMTP2GO • Website

Simon is a co-founder of SMTP2GO, launched in 2006 out of Christchurch, New Zealand. The idea was simple: a reliable way to send email from anywhere, even when local networks were blocking the usual ports. Twenty years on, SMTP2GO delivers for 35,000+ businesses across 130+ countries. SMTP2GO is ISO 27001 certified, GDPR compliant, an M3AAWG member, and a five-time Deloitte Technology Fast 500 company.