Incoming Mail Going to Spam

You are expecting an email (an invoice, a calendar invite, a quote) and it never shows up. The sender insists it was sent, and the same message may even arrive normally at a Gmail or Outlook.com address you own. In almost every case like this the message was delivered: it is sitting in the server-side spam folder of your mailbox.

This guide covers the incoming direction: mail sent to you being flagged. If your own outgoing mail is going to other people’s spam folders, see Setting Email DNS Records instead.

First: check the spam folder in webmail

The spam folder lives on the server, and the most reliable way to see it is webmail:

1. Log into webmail for your mailbox (your control panel’s webmail link, or ask your provider for the URL).
2. Open the Spam or Junk folder in the folder list.
3. If the missing message is there, select it and use Move to Inbox (or drag it to the Inbox).

Moving a message out of the spam folder does two things: your mail client can now see it, and it also trains the filter that this sender is legitimate, so future messages from them score better.

POP3 only downloads the Inbox: If your mail client is configured with POP3, it fetches the Inbox and nothing else. The server-side spam folder is invisible to it, so flagged mail silently accumulates there for months. Check webmail, and consider switching the account to IMAP, which syncs all folders including Spam.

Why legitimate mail gets flagged

When a message arrives, the filter checks whether the sending domain proves it authorized the message. That proof comes from the sender’s own DNS records:

• SPF: a DNS record listing the servers allowed to send mail for the domain. Many companies simply never published one.
• DKIM: a cryptographic signature. It must be signed with the sender’s own domain; a signature from the mail provider’s default domain (common with unconfigured Google Workspace or Microsoft 365 tenants) does not count as alignment.
• DMARC: ties the two together. When SPF is missing and DKIM is not aligned, the message fails DMARC evaluation.

A message that fails these checks looks exactly like a spoofed message, because spoofed messages fail them the same way. The filter cannot tell an unconfigured legitimate sender from a forger, so the message gets a high spam score and is filed to the spam folder instead of the Inbox.

Typical real-world cases:

• A company on Google Workspace or Microsoft 365 that never published SPF or set up DKIM for its domain.
• Calendar invitations and notifications sent “on behalf of” such a domain by the platform.
• Mail from web forms, CRMs, or newsletter tools sending as a domain that has not authorized them.

How to confirm it

Open the flagged message in webmail and view its full headers (usually More → View Source or Show Original). Look for the authentication summary, for example:

Authentication-Results: ...
  spf=none (no SPF record) smtp.mailfrom=partner-domain.com;
  dkim=pass header.d=partner-domain-com.20240101.gappssmtp.com;
  dmarc=fail (p=none) header.from=partner-domain.com

spf=none or dmarc=fail on the sender’s domain confirms the cause. If you are not sure how to read the headers, open a support ticket and attach the message: we can tell you exactly why it scored.

The permanent fix is on the sender’s side

Nothing on your mailbox or on our servers is broken, so there is nothing to “repair” here. The sender’s IT (or their hosting provider) needs to:

1. Publish an SPF record for their domain covering their mail provider (for Google Workspace that is v=spf1 include:_spf.google.com ~all).
2. Enable DKIM signing for their own domain in their mail platform’s admin console, and publish the DKIM key in their DNS.
3. Optionally publish a DMARC record once both pass.

This fixes their deliverability everywhere, not just with us. Our Setting Email DNS Records guide describes the same records from the sender’s perspective and is safe to forward to them.

What you can do meanwhile

1. Move the messages from Spam to Inbox in webmail (this also trains the filter).
2. If the account uses POP3, switch it to IMAP so the spam folder is visible in your client, or make a habit of checking webmail.
3. If mail from an important correspondent keeps being flagged and they cannot fix their DNS quickly, open a support ticket. We can safely adjust the scoring for a specific trusted correspondent while they fix their records.