Emails from Website Going to Spam
Contact-form notifications, order confirmations, or other emails your site sends keep landing in spam — or never arrive at all. This is fixable, permanently.
Common signs of this issue
- Form or order emails reliably land in spam/junk — yours and your customers'.
- Customers say they never got their confirmation, receipt, or password reset.
- Emails arrive late, intermittently, or not at all.
- It's noticeably worse for certain providers — Gmail and Outlook especially.
- It got worse recently without any change on your site — inbox providers tightened rules in 2024 and keep tightening them.
Safe checks you can do yourself
None of these require sharing passwords with anyone.
- Send a test from the site (a form submission, a test order) and check the spam folder at the receiving end. Finding it in spam — rather than nowhere — is actually good news: the mail sends, and only reputation/authentication needs fixing.
- Note the From address the site uses. Two red flags: a free address ([email protected]) as the sender, or an address on your domain being sent by a server that has no permission to speak for your domain. Both trip modern filters.
- Find out how the site sends: basic PHP mail (the default — anonymous and distrusted) or an authenticated SMTP/email service. On WordPress, the presence or absence of an SMTP plugin (WP Mail SMTP, FluentSMTP, Post SMTP) answers this.
- Run the free mail-tester check (search "mail-tester"): it gives you a throwaway address, you send your site's email to it, and it scores the message out of 10 with an itemized list of exactly what's failing — SPF, DKIM, content, blacklists. No login needed, and the itemized list is your repair checklist.
- Check whether your domain has SPF and DKIM records covering however the site sends — the mail-tester result shows this, or a free "SPF checker" does. Missing or mismatched records are the most common single finding.
- Ask whether email volume changed — a burst of mail (a newsletter blast from the same server, or a spam-abused form) can damage the sending reputation your ordinary emails ride on.
What this usually means
Modern inboxes demand proof. When your website sends mail claiming to be from your domain, receiving servers check: does this domain's SPF record authorize the sending server? Does the DKIM signature verify? Unauthenticated mail — the default for most websites — fails those checks and gets filtered or silently dropped. Nothing is 'wrong' with your emails; they're simply unvouched-for.
The durable fix has two halves done together: send through an authenticated service (SMTP via your email provider, or a transactional service like Brevo, Postmark, or Amazon SES), and publish SPF/DKIM records so your domain formally vouches for that service. Done once and correctly, deliverability problems largely end — for form mail, receipts, and password resets alike.
Since Gmail and Yahoo began enforcing authentication requirements in 2024, this moved from best-practice to effectively mandatory. Sites that coasted for years on unauthenticated mail are exactly the ones now watching messages vanish.
What not to do
- Don't keep resending and hoping — each spam placement teaches filters your mail belongs there, worsening the reputation you're trying to fix.
- Don't send 'as' an address you don't own (a Gmail From on your website's mail) — it fails the owner's own authentication checks and guarantees filtering.
- Don't guess at DNS records — a malformed SPF record can break deliverability for ALL your domain's email, including your personal mail. Copy exact values from your email service's setup guide, or have it done carefully.
- Don't create multiple SPF records — a domain gets exactly one, with multiple services merged into it; two separate records invalidates both.
- Don't buy 'inbox warmup' or blast services promising to fix reputation — for a small site's transactional mail, authentication is the fix, not volume tricks.
When to get help
Every email that lands in spam is a customer who thinks you ignored them — with receipts and password resets, it makes your business look broken. Setting up authenticated sending plus correct SPF/DKIM is a small, well-defined job (an hour or two for someone practiced) with an objective before/after: the mail-tester score. Ask for a 10/10 and a test to a Gmail address as the acceptance criteria.
Not sure what to do next?
Answer a few short questions and we'll point you to the safest next step — DIY, a freelancer, or a direct review. No passwords required.
Is this a business website? If this issue may be costing you leads, sales, or trust, you may want a direct review instead of trial and error.
Frequently asked questions
What are SPF and DKIM in plain English?
DNS records that let receiving servers verify mail truly comes from your domain: SPF lists which servers may send for you; DKIM adds a cryptographic signature. Without them, your site's mail is unvouched-for and gets filtered.
Why does using a Gmail address as the From cause problems?
Your website's server sending 'as' [email protected] fails Gmail's own authentication rules — only Gmail may send Gmail mail. Send from an address on your own domain, through a service your SPF/DKIM records authorize.
Will marking my emails 'not spam' fix this?
It helps that one inbox slightly, and it's worth doing — but it doesn't fix the authentication failure every other recipient's filter still sees. Treat it as first aid, not the cure.
What's a transactional email service and do I need one?
A service built to deliver automated mail (receipts, notifications) with authentication and reputation handled — Brevo, Postmark, Amazon SES, and similar; most have free tiers covering a small site's volume. It's the most reliable way for a website to send.
What is DMARC and do I need that too?
DMARC sits on top of SPF/DKIM and tells receivers what to do with mail that fails checks — and Gmail/Yahoo now expect at least a basic record. A minimal 'p=none' policy is the standard starting point; see our SPF/DKIM/DMARC guide.
How do I know when it's actually fixed?
Re-run mail-tester (aim for 9–10/10), then send real tests to a Gmail and an Outlook inbox and confirm they land in the inbox proper. Keep an occasional test in your routine — deliverability is a maintained state, not a one-time badge.