If your business emails are going to spam, the cause is almost always technical, not your wording. Gmail and Yahoo now expect every sender to prove that the domain in the From line really sent the message. That proof comes from three DNS records — SPF, DKIM and DMARC. If they are missing, misconfigured, or don’t cover the tool you send from, your mail looks like a forgery and gets filtered.
The fix, in order: check your message headers to see which authentication check fails, set up SPF, DKIM and DMARC on your own domain, stop sending business mail from a free gmail.com address, give people a one-click way to unsubscribe, and keep spam complaints low. Content tweaks like removing “free” from subject lines come last, because they rarely fix the problem on their own.
Step 1: Check the headers before you change anything
Don’t guess. Send a test email from your normal setup to a personal Gmail account, then open it in Gmail on a computer. Next to Reply, click the More menu (three dots) and choose “Show original.” Google’s own help page describes exactly this path for viewing full headers.
At the top of that page Gmail shows a short summary with lines for SPF, DKIM and DMARC, each marked PASS or FAIL, plus the domain each one checked. This is the single most useful diagnostic you have. If all three say PASS and show your own domain, authentication isn’t your problem and you can move on to reputation and complaints. If any say FAIL, or if DKIM passes but for your email provider’s domain instead of yours, that is where to start.
Repeat the test for every tool that sends mail as you: your inbox (Google Workspace, Microsoft 365, cPanel mail), your newsletter tool, your booking or invoicing app, and your online store. Each one needs to be authorized separately. A very common failure is a business that set up SPF for its inbox years ago and later added a newsletter tool that was never added to the record.
SPF, DKIM and DMARC explained in plain English
SPF (Sender Policy Framework) is a TXT record on your domain that lists which servers may send email for it. When a message arrives, the receiving server checks whether the sending server is on that list. You can only have one SPF record per domain, so every sending service has to be merged into it with “include:” entries. Google’s guidelines specifically say to make sure your SPF record includes all email senders for your domain.
DKIM (DomainKeys Identified Mail) adds a digital signature to each message. Your email provider gives you a public key to publish in DNS, and the receiving server uses it to confirm the message really came from your domain and wasn’t changed in transit. Google requires a DKIM key of 1024 bits or longer for mail to personal Gmail accounts and recommends 2048-bit keys where your provider supports them.
DMARC ties the two together. It is a TXT record at _dmarc.yourdomain.com that says what receivers should do when a message fails, and it requires alignment: the domain in the visible From address must match the domain that passed SPF or DKIM. A minimal starting record looks like v=DMARC1; p=none; rua=mailto:reports@yourdomain.com. The p=none policy only monitors, which is enough to meet Google’s and Yahoo’s requirements, and the rua address receives reports showing who is sending mail as you.
What Gmail and Yahoo actually require
Since February 2024, Google’s email sender guidelines apply to everyone who sends to Gmail accounts. All senders must set up SPF or DKIM for their sending domain, have valid forward and reverse DNS (PTR) records for their sending IPs, use a TLS connection, and keep spam rates reported in Postmaster Tools below 0.3%.
Bulk senders — Google says this means sending about 5,000 or more messages to Gmail accounts in a 24-hour period — must do more: set up both SPF and DKIM, publish a DMARC record (Google states the policy can be set to none), align the From domain with either the SPF or DKIM domain, and make marketing and subscribed messages support one-click unsubscribe, along with a visible unsubscribe link in the message body. Google’s monitoring advice is to keep the Postmaster Tools spam rate below 0.10% and to avoid ever reaching 0.30% or higher.
Yahoo’s Sender Hub sets almost the same rules. All senders must implement SPF or DKIM at a minimum and keep their spam rate below 0.3%. Bulk senders must implement both SPF and DKIM, publish a valid DMARC policy of at least p=none that passes, align the From domain, support one-click unsubscribe, and honor unsubscribes within 2 days. Yahoo doesn’t publish a volume number for “bulk,” so the safe approach for a small business is simply to meet the bulk rules from day one.
Stop sending business mail from a gmail.com address
If your newsletter or invoices go out “from” yourname@gmail.com but are actually sent by a third-party tool, they fail authentication by design. You don’t control gmail.com’s DNS, so you can’t add your tool to its SPF record or sign with its DKIM key. Google’s guidelines warn senders not to impersonate Gmail From headers and say Gmail will use a DMARC quarantine policy, which means those messages are likely to be filtered.
The fix is to send from an address on a domain you own, such as hello@yourbusiness.com, and authenticate that domain. A free address is fine for replying to individual customers from Gmail itself, but anything sent through a marketing, booking or store tool should use your own domain.
New domains, sudden volume and shared IPs
Mailbox providers judge senders on history. A domain registered last week with no sending record is treated cautiously, and Google’s guidelines advise avoiding sudden volume spikes if you don’t have a history of sending large volumes. If you just moved to a new domain or imported a large list, start by emailing your most engaged contacts, then grow the volume over several weeks.
Your reputation is also shared with whoever sends from the same server. Google notes that the activity of all senders on a shared IP affects the reputation of every sender on that IP. Cheap shared hosting mail is a frequent source of trouble; a reputable email provider with proper DKIM signing on your domain usually fixes it.
To watch your reputation directly, verify your domain in Google Postmaster Tools. Its dashboards show your compliance status with Google’s sender requirements, the percent of messages users mark as spam, and the percent of mail passing SPF, DKIM and DMARC. Low-volume senders may see gaps, since Google omits data on low-volume days.
Spam complaints and missing unsubscribe links
Every time a recipient clicks “Report spam,” your domain’s reputation takes a hit. Google says plainly that user spam reports can lower your domain’s reputation over time. Complaints usually come from people who don’t remember signing up, can’t find a way out, or were added from a bought or scraped list.
Concrete fixes: only email people who opted in, and send a welcome message right away so they recognize you. Add a visible unsubscribe link and the one-click List-Unsubscribe headers (most email tools add these automatically if you enable them). Process unsubscribes quickly — Yahoo asks for 2 days. Remove contacts who haven’t opened anything in months, and never import purchased lists. Making it easy to leave is the cheapest way to stay out of the spam folder, because an unsubscribe doesn’t hurt you and a spam report does.
Links, attachments and content: check them last
Content matters less than most people think, but it can tip a borderline message into spam. Public link shorteners are widely used by spammers, so filters treat them with suspicion; link to your own domain instead. Google’s guidelines say links in the message body should be visible and easy to understand, so avoid hiding destinations behind vague “click here” text.
Attachments, especially on a first contact or bulk send, raise risk because they are a common malware vector. Link to a file on your website instead of attaching it. Keep one purpose per message — Google advises against mixing content types, such as adding promotions to a receipt. Use a real From name, a clear subject, and a plain-text version alongside the HTML. These steps help, but if your headers show authentication failing, no rewrite of the subject line will fix it.
A quick checklist to stop emails going to spam
1. Send a test to Gmail, open “Show original,” and confirm SPF, DKIM and DMARC all PASS for your own domain. 2. Merge every sending service into a single SPF record. 3. Turn on DKIM signing for your domain in each tool, using a 2048-bit key where offered. 4. Publish a DMARC record starting at p=none and read the reports. 5. Send business mail from your own domain, not gmail.com. 6. Enable one-click unsubscribe and honor opt-outs within 2 days. 7. Verify your domain in Postmaster Tools and keep the spam rate under 0.10%. 8. Grow volume gradually and prune inactive contacts. 9. Replace shortened links and attachments with links on your own site.
If you’re starting from scratch, a domain of your own is step one. OneSol Max includes a done-for-you website on your own domain ($1 for the first month, then $29/month), which gives you a real business address to send from. You’ll still need to set up SPF, DKIM and DMARC for whichever email provider you use — no tool can promise inbox placement, but following the steps above is what Gmail and Yahoo actually ask for.