Why are my emails going to spam?

Emails landing in recipients' spam folders is frustrating, but usually fixable. The root cause is almost always one of: missing email authentication records (SPF, DKIM, DMARC), suspicious sending patterns, or content that triggers spam filters.

Quick fixes

For Flashcloud-hosted email (sent through our mail server), we configure SPF and DKIM automatically when you add a domain. So baseline authentication is handled.

If your emails are still going to spam:

• Add a DMARC record (we don't add it by default — see below).
• Audit your content — spam-trigger words, all-caps subject lines, lots of emojis, excessive links.
• Check sending volume — sudden bursts of email look like spam to recipient mail servers.
• Confirm your domain isn't blacklisted at mxtoolbox.com/blacklists.

SPF (Sender Policy Framework)

SPF tells receiving mail servers "these IPs are allowed to send email for my domain."

For Flashcloud-hosted email, we set up SPF automatically when you add a domain. The TXT record looks like:

v=spf1 +mx +a +ip4: ~all

If you also send email from another service (Mailchimp, SendGrid, Google Workspace), you need to add their sending IPs/domains to your SPF. Edit your DNS in Domains → DNS → find the SPF record → add includes:

v=spf1 +mx include:_spf.google.com include:sendgrid.net ~all

Each service's docs show what to add. Don't have multiple SPF records for the same domain — combine them into one with multiple include: directives.

DKIM (DomainKeys Identified Mail)

DKIM cryptographically signs outgoing emails. Recipients can verify the signature against a public key in your DNS, proving the email actually came from your domain.

We set up DKIM automatically. To verify:

1. Go to Domains → click your domain → DNS.
2. Look for a TXT record at default._domainkey (or similar).

If it's missing, open a ticket and we'll regenerate it.

For email sent through external services (Mailchimp, SendGrid, etc.), they each have their own DKIM key — follow their setup docs to add it.

DMARC (Domain-based Message Authentication)

DMARC tells receiving mail servers what to do with emails that fail SPF or DKIM checks. Without DMARC, behavior is at the recipient's discretion (often: deliver to spam).

We don't add DMARC automatically because it can break delivery if SPF/DKIM aren't bulletproof first. Once you've confirmed SPF and DKIM are working:

1. Go to Domains → click your domain → DNS.
2. Add a TXT record:
   • Name: _dmarc
   • Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

p=none means "monitor only, don't reject failing emails." This is the safe starting point. After a few weeks of monitoring (DMARC reports come to the rua= address), you can tighten to p=quarantine (send failures to spam) or p=reject (reject failures outright).

Content triggers

Even with perfect authentication, certain content patterns get flagged:

• All-caps subject lines ("FREE LIMITED OFFER!!!").
• Excessive punctuation ("Click here!!!!!").
• Spam-trigger words ("free," "winner," "act now," "click here," "buy now").
• Heavy use of emojis (one or two is fine; ten triggers filters).
• HTML-only emails with no plain-text alternative.
• Image-only emails with little or no text.
• Suspicious URLs — shortened links (bit.ly), URLs with IP addresses instead of domains, links to recently-registered domains.
• From-name spoofing — pretending to be someone else.

For business and personal email, this rarely applies. For mass mailings (newsletters, marketing), use a dedicated email service (Mailchimp, ConvertKit, Beehiiv) — they have built-in spam scoring tools.

Sending patterns

Sudden volume changes alarm recipients:

• First time sending from a new domain — recipients have no history with your domain; expect higher initial filtering.
• Sudden spike — going from 10 emails/day to 1000/day looks like a compromised account.
• Sending to many addresses at once — high BCC counts trigger filters.

For ramp-up: send small volumes consistently for a few weeks before scaling. For mass campaigns: use a dedicated email service that has good "warming" practices.

Blacklists

Sometimes your domain or IP gets onto a public blacklist due to past abuse (or a previous owner of the IP). Check at:

• mxtoolbox.com/blacklists — checks 80+ blacklists.
• hetrixtools.com/blacklist-check — alternative.

If listed, the blacklist's site has a removal request form. Most allow self-service delisting once the abuse is confirmed resolved.

If you're listed because of our mail server's IP (not your domain specifically), open a ticket and we'll work with the blacklist on your behalf.

When it's a recipient-side problem

Sometimes your email is fine, but the recipient's spam filter is being aggressive. Test by:

• Sending the same email to yourself at Gmail, Outlook.com, Yahoo, ProtonMail. Compare which deliver to inbox vs spam.
• Asking the recipient to check their spam folder and mark your emails as "Not Spam" — this teaches their filter your domain is safe.
• For business communication, asking the recipient to add your address to their contacts.

If only one specific recipient has issues and others don't, it's a recipient-side problem, not a deliverability issue on your side.

Power-user note

For serious email deliverability work — bulk newsletters, transactional emails at scale — use a dedicated email service:

• Postmark, SendGrid, Mailgun, Resend — for transactional email (password resets, order confirmations).
• Mailchimp, ConvertKit, Beehiiv — for marketing campaigns.

These services have invested heavily in IP reputation, deliverability tooling, and feedback loops. Trying to compete with their inbox-rate from a single hosting account is uphill.