Why your email lands in spam

Email lands in spam when mailbox providers decide it is unauthenticated, non‑compliant or unwanted. The main drivers are failed SPF, DKIM or DMARC alignment, high complaint rates, broken reverse DNS, and list practices that signal risk. Fixing it means authenticating the domain correctly, meeting Gmail and Yahoo’s 2024 rules, and keeping complaints well under 0.3%.

This picks up from a domain and mailbox that can already send mail, with access to the domain’s DNS and, if you host email with us, your Hostworld cPanel account. If you run your own mail server on a VPS, you should be able to reach it over SSH.

Before you start

• Know where DNS is hosted. If we host your DNS, set your domain’s nameservers at your registrar to ns1.serverworld.uk, ns2.serverworld.uk, ns3.serverworld.uk and ns4.serverworld.uk. If another provider hosts DNS, have access to create and edit TXT records.
• Have cPanel access for your domain if your mail is on Hostworld shared, reseller or WordPress hosting. You will use cPanel’s Email Deliverability and Email Routing tools.
• If you send from a VPS, you will need control of the outbound IP and its reverse DNS. If you need us to update PTR on a Hostworld IP, open a support ticket.
• Gmail and Yahoo published sender rules in 2024. If you send to them in volume, you must meet those rules. Even low‑volume senders should follow them because they improve placement.

Risks and common pitfalls

• Publishing DMARC with p=quarantine or p=reject before all legitimate sources pass SPF or DKIM alignment will block your own mail. Roll out DMARC in stages, starting with p=none and monitoring reports.
• SPF has a hard 10‑lookup limit. Chaining multiple includes can cause a permerror, which breaks DMARC if you rely on SPF for alignment.
• Rotating or removing an in‑use DKIM selector from DNS before your mail software switches to the new selector causes signatures to fail during the overlap. Plan the change and verify signing in headers first.
• Setting Email Routing in cPanel to the wrong mode can make the server deliver locally when it should send out, or refuse mail it should accept. Check MX records and routing before switching.
• Changing nameservers or moving DNS without migrating MX, SPF, DKIM and DMARC will disrupt delivery and authentication.
• Deleting or misconfiguring reverse DNS on the sending IP causes deferrals, spam placement or rejections at major providers.
• New domains and IPs must be warmed. Ramping volume too quickly triggers rate limits and harms reputation with Gmail.
• Using URL shorteners in bulk mail is treated as risky by Gmail and can hurt inboxing.
• Ignoring one‑click unsubscribe processing for bulk mail makes you non‑compliant. Gmail and Yahoo expect unsubscribe requests to be honoured promptly.

Step 1: Check you meet Gmail and Yahoo’s 2024 rules

Before changing anything, compare your current setup to the mailbox requirements published by Gmail and Yahoo in 2024.

• Publish SPF and DKIM for the From domain.
• Publish a DMARC record. A policy of p=none is allowed to start, but alignment against SPF or DKIM must pass for the domain in the From header.
• Use TLS in transit. Gmail requires TLS for bulk traffic.
• Have valid forward and reverse DNS. The PTR should match an FQDN that forward‑resolves to the same IP and points into your domain.
• Keep user‑reported spam rates under 0.3 percent. Aim for under 0.1 percent at Gmail.
• Support one‑click unsubscribe on marketing or subscription mail using the RFC 8058 headers. Gmail requires it and wants requests processed within 48 hours. Yahoo has the same one‑click expectation for bulk traffic. Transactional messages do not need one‑click at Yahoo.
• Use an FQDN in the SMTP greeting and send RFC‑compliant messages.
• Understand shared IPs pool reputation. Other senders on the same IP can impact you, which Gmail calls out directly.

Step 2: Fix SPF, DKIM and DMARC in cPanel first

SPF and DKIM prove who is allowed to send and that the message was not altered. DMARC tells receivers which authenticated domain to trust and how to treat failures. Get these right before looking at content.

In Hostworld cPanel, the Email Deliverability interface audits SPF and DKIM for your domain and can auto‑repair them when your DNS is hosted on the same cPanel server. It also shows reverse DNS status for the server’s outbound IP. If DNS is elsewhere, the screen will show exactly which TXT records to publish at your DNS host.

DMARC must align the domain in the visible From header with the domain that passed either SPF or DKIM. For first deployment, publish a DMARC record with a policy of p=none so delivery is not changed while you monitor results.

What to publish and why

• SPF: Authorises your legitimate senders. Keep includes under the 10‑lookup limit. If you use several providers, consolidate where you can.
• DKIM: Cryptographically signs messages. cPanel generates 2048‑bit DKIM keys by default, which is stronger than 1024‑bit keys.
• DMARC: Aligns the From domain with SPF or DKIM. Start with p=none. Later you can move to quarantine or reject once you are confident all good mail authenticates and aligns.

If you need the click‑by‑click for our panel workflow, see our how‑to for Email Deliverability in cPanel. If you cannot locate it or something does not match your screen, open a support ticket and we will confirm the exact records for your domain.

Step 3: Check DMARC alignment of the From domain

DMARC looks at the domain in the From header. That domain must align with either the domain that passed SPF or the domain in the DKIM signature that passed. If you send through a third‑party platform, set it to sign with your domain’s DKIM and, if possible, to use a custom bounce domain that belongs to you so SPF can also align. Without alignment, DMARC will fail even if raw SPF or DKIM show “pass”.

Step 4: Confirm reverse DNS and the SMTP greeting FQDN

Mailbox providers require valid PTR that forward‑confirms to the same IP and points into your domain. The name you present in the SMTP greeting must be a fully‑qualified domain name. Mismatches here are a common reason for spam placement and connection deferrals.

Check reverse DNS from the command line

The following commands query reverse DNS for an IP address. Replace 203.0.113.10 with your sending IP.

• Linux or macOS: This uses dig to look up a PTR.

dig +short -x 203.0.113.10

• Windows: This uses nslookup to look up a PTR.

nslookup 203.0.113.10

If the PTR is missing or does not map back to the same IP when you resolve it forward, ask us to correct it. For Hostworld IPs, open a support ticket with the IP and the hostname you want to use.

Step 5: Verify TLS in transit

Gmail requires bulk mail to be delivered over TLS. Your sending software should negotiate STARTTLS to recipients automatically. To see that your server offers TLS, you can test an SMTP STARTTLS handshake.

• Linux or macOS: This connects to your mail server on port 25 and starts TLS. Replace mail.example.com with your server name.

openssl s_client -starttls smtp -connect mail.example.com:25 -crlf -quiet

• Windows: If you have OpenSSL installed, use the same command in PowerShell or Command Prompt. If not, test from another system that has it.

You should see a TLS certificate chain and a negotiated cipher. If your software cannot negotiate TLS to large receivers, delivery can be rate‑limited or filtered.

Step 6: Add one‑click unsubscribe for bulk mail

Bulk marketing or subscription mail must include the header‑based one‑click mechanism described in RFC 8058. Gmail requires both List‑Unsubscribe and List‑Unsubscribe‑Post headers, and they expect you to process unsubscribe requests within 48 hours. Yahoo expects one‑click on bulk mail too. Transactional mail is exempt at Yahoo.

The mechanism works by adding an HTTPS URL in the List‑Unsubscribe header and a corresponding List-Unsubscribe-Post: List-Unsubscribe=One-Click header. Mail clients can then perform a background HTTP POST to unsubscribe the user without extra steps. Configure this in your email platform. If your platform cannot add RFC 8058 headers, sending bulk mail from it is a bad idea.

Step 7: Keep complaints under 0.3% and manage your lists

Gmail treats a spam rate of 0.3 percent or higher as harmful. Their target is under 0.1 percent. Yahoo has the same 0.3 percent threshold. To stay below it:

• Use permission‑based lists. Avoid purchased data.
• Make unsubscribe obvious in the body as well as in headers.
• Suppress complainers quickly. Yahoo recommends enrolling in their complaint feedback loop and separating marketing and transactional streams by IP or DKIM domain.
• Send at a predictable cadence. Sudden spikes look risky.

In Gmail Postmaster Tools you can see spam rate and sender reputations for your domain and IPs, as well as a compliance status view for the 2024 requirements. Fix anything in red before you mail again at volume.

Step 8: Avoid forwarding traps, SPF lookup overflows and shorteners

• Forwarding breaks SPF and can break DKIM. SPF is path‑based and fails after most forwards. DKIM can also fail if intermediaries modify the message. ARC is designed to pass on prior authentication results so receivers can make an informed decision about forwarded mail. If you often forward, rely on DKIM alignment for DMARC and choose intermediaries that implement ARC.
• Do not exceed SPF’s 10‑lookup limit. Each include, a, mx, ptr, exists and nested include counts. Flatten or consolidate before going live.
• Avoid URL shorteners in bulk mail. Gmail treats them as a risk signal because they hide the destination.

Step 9: Warm new domains and IPs gradually

New domains and IPs have no track record. Gmail advises slow volume ramp‑up with consistent content and cadence, while you watch for rate limits and reputation changes. Start with your most engaged recipients. Increase volume step by step as your spam rate and reputation remain healthy in Postmaster Tools.

Step 10: Use cPanel Email Routing correctly

In cPanel, Email Routing must match where mail for your domain actually lives. If you set Local Mail Exchanger when your MX points elsewhere, your server may hold mail that should have been delivered out. If you set Remote when you do host the mailbox locally, your server may reject mail it should accept. Check your MX records first, then set Email Routing accordingly.

Step 11: Monitor reputation and compliance, then enforce DMARC

Register your domain with Gmail Postmaster Tools. Use it to track domain and IP reputation, authentication pass rates, TLS status, spam rate, error types and the compliance status for the new sender requirements.

Once SPF, DKIM and DMARC alignment pass for all your legitimate mail and your spam rate stays well below 0.3 percent, advance your DMARC policy from p=none to quarantine or reject. Do it in stages and monitor after each change. Enforcing DMARC without this work will cause good mail to be blocked.

Step 12: Understand shared IP reputation and when to isolate

Gmail warns that reputation is pooled on shared outbound IPs. If you send from a shared platform, the behaviour of other senders on that IP can affect you. If your content, authentication and list hygiene are strong but your inbox placement is still held back by a shared IP, consider isolating your sending. A Hostworld VPS lets you operate your own outbound IPs and mail stack. See Linux VPS and our VPS guides if you are evaluating that route.

Step 13: Optional extras for trust signals

BIMI can help recognition in the inbox once you have DMARC at quarantine or reject and a validated logo certificate. It does not replace authentication or list hygiene, but it can improve brand display at Gmail.

What next

If you host your domain with us, use cPanel’s Email Deliverability to repair SPF and DKIM, then publish DMARC with p=none and confirm alignment passes. If you send at volume, add one‑click unsubscribe and register Gmail Postmaster Tools to watch spam rate and compliance status. Move DMARC to quarantine or reject only after your results stay clean.

Considering moving bulk sending to your own IPs for full control? Start with a small VPS and build from there. See Linux VPS and browse our VPS guides for what running your own stack involves. If you need us to set or adjust reverse DNS on a Hostworld IP, or you want us to review your SPF, DKIM or DMARC plan before you publish, open a support ticket.

Next in the series: configure Email Deliverability in cPanel and verify SPF, DKIM and DMARC records end to end.