Why Are My Business Emails Going to Spam? (Google Workspace and Microsoft 365)

When your everyday company email (from Google Workspace or Microsoft 365, not a newsletter tool) goes to spam, the cause is almost always authentication on your own domain. Most often DKIM was never switched on for your domain, SPF is missing or broken, or there's no DMARC record. Fix those three, check that nothing else is sending as your domain without permission, and most business mail problems go away.

Signing up for Workspace or Microsoft 365 and pointing your MX records at it gets mail flowing. It does not finish the setup that proves to other providers the mail is really from you. That last step is manual, easy to skip, and the reason people search "why is my company email going to spam" a few weeks after launching a domain.

What's actually happening

Receiving providers like Gmail, Outlook.com and corporate filters check three things on every message:

• SPF: is the server that sent this message listed in the sending domain's SPF record?
• DKIM: does the message carry a valid cryptographic signature from your domain?
• DMARC: does SPF or DKIM pass for the same domain that's in the From address, and what should happen if not?

Google requires every sender to have at least SPF or DKIM, and senders of 5,000 or more messages a day to Gmail need all three. Microsoft's consumer Outlook.com service applies similar rules to high-volume senders. You probably don't send 5,000 emails a day from Gmail, but the filters still weigh authentication heavily, and unauthenticated mail from a small domain with little history is exactly what spam looks like.

The common causes, most likely first

1. DKIM was never turned on for your domain

This is the big one. Neither platform signs mail with your domain's DKIM key until an admin sets it up:

• Google Workspace has you generate a key in the Admin console and publish it as a TXT record. Until you do, your mail isn't signed with your domain. Third-party write-ups note Google applies its own default signature on a gappssmtp.com domain, which doesn't help your DMARC.
• Microsoft 365 says plainly that "no DKIM signing occurs for outbound mail from custom domains" until you publish two CNAME records and enable signing.

Without DKIM on your domain, your mail is leaning entirely on SPF, and SPF breaks the moment a message gets forwarded.

2. SPF is missing, duplicated or over the lookup limit

Your SPF record needs to include your mail platform. The standard records are:

Google Workspace:  v=spf1 include:_spf.google.com ~all
Microsoft 365:     v=spf1 include:spf.protection.outlook.com -all

Problems show up when other tools get added. Your CRM, help desk, invoicing app and website form all want an include:. Two things go wrong:

• Someone adds a second SPF record instead of editing the first. Microsoft's docs are explicit that multiple SPF records cause a permerror, which means SPF fails for everything.
• The record goes past 10 DNS lookups. Each include:, a, mx, exists and redirect counts, including nested ones. Past 10, SPF fails with a permanent error.

The SPF analyzer counts your lookups for you. For the details on fixing an overloaded record, see SPF 10 DNS lookup limit and flattening.

3. No DMARC record

Without DMARC, receivers have no instructions for your domain and no proof that anyone is watching it. A p=none record with a reporting address is a fine start. It costs nothing, and the reports show you every service sending as your domain. More on that in What is DMARC?

4. Other services sending as your domain without authentication

Your newsletter platform, CRM sequences or billing system might be sending with your company's From address but without DKIM for your domain. Those messages fail DMARC, generate complaints, and drag down the domain your people use for everyday mail. If you're unsure what's out there, DMARC reports will tell you. DMARC fail: why it fails and how to fix it walks through the alignment issues.

5. A compromised mailbox or a mass send from a normal inbox

If one account was phished and used to send spam, or someone used a regular Workspace or 365 mailbox to blast a few thousand prospects, the domain's reputation takes the hit. Microsoft 365 routes outbound mail it judges to be spam through a separate high-risk delivery pool and can restrict the user from sending entirely (they get a 5.1.8 bounce). Google's guidance is also clear that sending volume should grow gradually, not in bursts.

6. A brand-new domain

If the domain is only weeks old, it has no reputation yet, and some filters treat new domains with suspicion on principle. That's its own topic: Why is email from my new domain going to spam?

How to fix it, step by step

1. Check what's published now. Run your domain through the email authentication checker. You want one SPF record, a DKIM key for your platform's selector (google for Workspace by default, selector1 and selector2 for Microsoft 365), and a DMARC record.
2. Turn on DKIM.
   • Workspace: Admin console, then Menu, Apps, Google Workspace, Gmail, Authenticate email. Generate a 2048-bit key if your DNS host supports it, add the TXT record, then click Start authentication. Google says it can take up to 48 hours to start working.
   • Microsoft 365: Defender portal, Email & collaboration, Policies & rules, Threat policies, Email authentication settings, DKIM tab. Publish the two CNAME records it gives you, then enable signing for the domain.
3. Fix SPF. Merge any duplicate records into one, include every legitimate sender, and keep the total at 10 lookups or fewer.
4. Publish DMARC. Start with something like v=DMARC1; p=none; rua=mailto:dmarc@example.com. The DMARC generator builds the record.
5. Authenticate every other service that sends as your domain, with DKIM on your domain wherever the service supports it.
6. Rule out a compromised account. In Microsoft 365, check the Restricted entities page and sign-in logs. In either platform, look for forwarding rules and sent mail nobody remembers sending. Reset passwords and enforce multi-factor authentication.
7. Ask a few recipients to mark you "Not spam." Real engagement from people who know you helps, slowly.

How to confirm it's fixed

Send a message from your business account to a personal Gmail address and an Outlook.com address you control. In Gmail, open the message, choose Show original, and look for SPF: PASS, DKIM: PASS and DMARC: PASS, with your own domain shown for DKIM. Paste the headers into the header analyzer if you want them decoded. (How to read an email header explains what each line means.)

Authentication passing doesn't mean the spam folder problem ends that same day. Filters adjust over days to weeks as mail keeps arriving clean.

How to keep it from coming back

• Treat your SPF record as shared infrastructure. Anyone adding a sending tool should check the lookup count first.
• Read your DMARC reports, or at least skim them monthly. New unauthenticated sources show up there before they cause trouble.
• Send bulk mail (newsletters, prospecting) from a proper sending platform, ideally on a subdomain, not from employees' mailboxes.
• Keep multi-factor authentication on for every account.

For the wider list of reasons mail lands in spam, see Why are my emails going to spam?

When to get help

If authentication passes everywhere and your company mail still goes to spam, the issue is reputation or content, and that takes more digging than a DNS fix. That's a good point to get in touch.

FAQ

Why are my business emails going to spam but not my Gmail ones?

Your personal Gmail address sends on gmail.com, which Google authenticates and which has an enormous reputation. Your business domain has to earn both, and until you set up DKIM, SPF and DMARC for it, it can't.

Does Google Workspace or Microsoft 365 set up DKIM automatically?

Not for your custom domain in most cases. Google's setup page notes some domains bought through Google partners come with it already, but otherwise you generate the key yourself. Microsoft 365 requires you to publish two CNAME records and enable signing per domain.

My emails pass SPF, DKIM and DMARC. Why are they still in spam?

Authentication proves who you are, not that people want your mail. Sudden volume, cold outreach, complaints, a blocklisting or a recently compromised account can all put authenticated mail in spam. See Why are my emails suddenly going to spam?

Can I just ask recipients to whitelist me?

It helps for those specific people, and asking a few regular contacts to mark you "Not spam" is reasonable. It doesn't fix anything for everyone else, so do it alongside the authentication fixes, not instead of them.