Why are my emails going to spam or junk?

Most often, your domain is missing three settings that prove your emails really come from you, called SPF, DKIM and DMARC. Without them, Gmail and Outlook can't tell your emails apart from fakes, so they play safe and send them to junk. You can check for free in a minute, and add the settings yourself through your domain's DNS settings.

Why do my emails always go to clients’ junk folder?

Email was designed long before spam and scams, and anyone can put any address in the “From” line. So when an email arrives saying it’s from you, the receiving service (Gmail, Outlook, your client’s company system) looks for proof. That proof lives in your domain’s DNS settings, the behind-the-scenes records that also point your web address at your website.

There are three pieces of proof:

SPF (Sender Policy Framework) is a list of the services allowed to send email for your domain.
DKIM (DomainKeys Identified Mail) adds a hidden digital signature to every email, which the receiver checks against a key published on your domain.
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do with an email that fails those checks: let it through, send it to junk, or reject it.

If none of these are set up, your emails look exactly like the fakes criminals send in your name. Since February 2024, Google has required everyone who sends to Gmail addresses to have at least SPF or DKIM, and anyone sending 5,000 or more emails a day to Gmail needs SPF, DKIM and DMARC (Google’s email sender guidelines). In May 2025, Microsoft brought in similar rules for anyone sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses (Microsoft).

You don’t need to be a bulk sender for this to matter. Missing settings are one of the most common reasons an ordinary small business lands in junk.

How do I check if my email is set up properly?

The quickest way is the NCSC’s free Email Security Check. Type in your domain (the part after the @ in your email address) and it tells you within seconds whether your anti-spoofing settings are in place. It only uses public information and doesn’t ask for personal details.

If the check says SPF or DMARC is missing, that’s very likely your problem. Work through the steps below.

I use a free Gmail, Hotmail or Outlook.com address. Can I fix this?

Not with these settings. They can only be added to a domain you own, so a free address can’t be fixed this way (Microsoft Q&A). The real fix is email on your own domain, such as you@yourbusiness.co.uk, set up properly from the start.

How do I fix it?

You’ll need two things: access to your email admin (Google Workspace or Microsoft 365), and access to wherever your domain’s DNS settings are managed. That’s usually the company you bought your domain from, or your website host.

Do it in this order: SPF, then DKIM, then DMARC. Change one thing at a time, and check your email still sends before moving on.

Google Workspace

1. Add SPF. At your DNS host, add a TXT record on your domain (the host or name is usually shown as @) with this value:

v=spf1 include:_spf.google.com ~all

If you already have a record starting v=spf1, don’t add a second one: two SPF records break both. Edit the existing one to include include:_spf.google.com instead. If another service also sends email as you (an invoicing app, for example), it needs adding to the same record. Its help pages will give you the include: to add.

2. Turn on DKIM.

Sign in to the Google Admin console at admin.google.com with an administrator account.
Go to Menu › Apps › Google Workspace › Gmail › Authenticate email.
Choose your domain, click Generate new record, then Generate. Keep the 2048-bit key length if your DNS host supports it.
Copy the record name (usually google._domainkey) and the long value into a new TXT record at your DNS host.
Come back and click Start authentication. It can take up to 48 hours for DKIM to start working (Google: set up DKIM).

3. Add DMARC. Once SPF and DKIM are working, add a TXT record named _dmarc with this value, replacing the address with one you check:

v=DMARC1; p=none; rua=mailto:you@yourbusiness.co.uk

p=none means “just report for now”. After a couple of weeks of reports showing your genuine email passes, change it to p=quarantine (send fakes to junk) and later p=reject (refuse them outright). p=reject is what stops criminals sending email in your name.

Microsoft 365

1. Add SPF. At your DNS host, add a TXT record on your domain (@) with this value:

v=spf1 include:spf.protection.outlook.com -all

The same rule applies: only one SPF record per domain, so edit an existing one rather than adding another.

2. Turn on DKIM.

Sign in to the Microsoft Defender portal at security.microsoft.com with an administrator account.
Go to Email & collaboration › Policies & rules › Threat policies › Email authentication settings, then the DKIM tab.
In the row for your domain, switch the toggle to Enabled. An error appears, because the records don’t exist yet. Select OK.
Click the row for your domain to open its details. The Publish CNAMEs section shows two CNAME records, named selector1._domainkey and selector2._domainkey.
Add both CNAME records at your DNS host, exactly as shown.
After a while, go back to the domain’s details and switch on Sign messages for this domain with DKIM signatures (Microsoft: set up DKIM).

3. Add DMARC. Exactly as for Google Workspace above: a TXT record named _dmarc, starting at p=none and working up to p=reject.

Where do I find my DNS settings?

Your DNS settings are usually with the company you bought your domain from. At the common UK ones, such as Ionos, 123-reg and GoDaddy, the steps are similar: sign in, open your list of domains, choose your domain, and look for its DNS settings. GoDaddy calls the list your Domain Portfolio (GoDaddy: add a TXT record). Each of them has a help page called something like “add a TXT record” if you get stuck.

If your domain came bundled with a website builder, the DNS settings are often in that builder’s domain section instead. Not sure who manages your domain? Look it up on a WHOIS service, which shows the registrar.

I’ve done all that and emails still go to junk. What else is there?

Once the three settings are in place, check these:

Ask the recipient to mark you as “Not junk”. That teaches their mailbox to trust you, but it only helps for that one person.
Check what you’re sending. Lots of links, link shorteners, large attachments or a subject line in capitals can all count against you.
Check you’re not on a block list. If your account was ever hacked and used to send spam, your domain or the service’s servers may have been listed. The NCSC check above, or your email provider’s support team, can point you in the right direction.
Give a brand-new domain time. Receivers trust new domains less. Sending normal, steady amounts of email builds a good reputation over a few weeks.