Self-hosted email can be delivered to a recipient’s server and still land in spam—or be rejected outright. The receiving provider makes that decision using more than SPF, DKIM, and DMARC: it also considers the sending IP and domain’s reputation, recipient complaints, message content, sending patterns, and local filtering rules. Passing authentication is important, but it does not guarantee inbox placement.
Why is my self-hosted email going to spam?
The most common causes are an authentication failure, missing or mismatched reverse DNS, a weak or damaged sender reputation, unwanted or complaint-generating mail, and recipient-side filtering. These causes can overlap. A correct MX record for receiving mail, for example, does not prove that the IP used to send mail has valid reverse DNS.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
Google’s guidance says authenticated messages are less likely to be rejected or marked as spam; it does not promise inbox delivery. Microsoft likewise identifies authentication failures and poor IP or domain reputation as separate reasons legitimate mail can be flagged.
Why does Gmail mark my self-hosted email as spam?
Google’s published sender requirements apply to mail sent to personal Gmail accounts. Since February 1, 2024, all senders must authenticate with SPF or DKIM, have valid forward and reverse DNS for sending domains or IPs, use TLS, keep their reported spam rate below 0.3%, and format messages according to RFC 5322. Google recommends staying below 0.1%: it says rates above that can negatively affect bulk mail delivery, with greater negative impact at 0.3% or higher.
#1 Best Overall
Senders that send more than 5,000 messages per day to Gmail accounts have additional requirements: SPF and DKIM, a DMARC record, alignment of the visible From domain with SPF or DKIM, and one-click unsubscribe for marketing and subscribed messages. This is Google’s threshold, not a universal cutoff used by every provider. Google recommends SPF, DKIM, and DMARC for all domains, even when a sender is not subject to its bulk-sender requirements. See Google’s email sender guidelines and its sender guidelines FAQ for current details.
How to diagnose a self-hosted email spam problem
Start with one affected message. A complete message header and the exact SMTP response help distinguish rejection from spam-folder delivery and show which checks the receiver performed.
Recommended Free Tools
- Identify the recipient and sending IP. Note which provider or organization received the message, whether it was rejected or placed in spam, when it happened, and the public IP that actually sent it. Save the full headers and any SMTP error response.
- Read the authentication results. In the received message’s
Authentication-Resultsheader, check SPF, DKIM, and DMARC. SPF must cover the actual sending system and its envelope-sender domain. DKIM must validate for the intended signing domain. For DMARC, a passing SPF or DKIM result alone is not enough: at least one authenticated domain must align with the domain in the visible From address under DMARC rules. - Check reverse DNS for the outbound IP. Look up the PTR record for the IP that sent the message, then confirm that the returned hostname’s A or AAAA record resolves back to the same IP. This forward-confirmed reverse DNS check is distinct from your domain’s MX record. If PTR is missing or incorrect, ask the provider that controls the IP—often an ISP, host, or address owner—to set or correct it.
- Inspect the response and sender reputation. Keep the exact SMTP error code; Google documents temporary rate limits and blocking errors associated with DNS problems. For Gmail, Google Postmaster Tools can report authentication, spam feedback, and IP or domain reputation when data is available. Check the IP and domain for reputation or blocklist problems before changing servers or addresses.
- Review recipients, content, and sending behavior. Stop sending to people who did not opt in, remove invalid addresses, honor opt-outs, and avoid sudden volume spikes. Microsoft lists excessive links, URL shorteners, form tags, embedded scripts, and image-only messages as content characteristics associated with false positives. These are clues, not a guaranteed checklist: removing one link or changing one phrase cannot ensure delivery.
- Investigate the recipient’s filtering path. If the problem occurs only at one Microsoft 365 organization, its transport rules, antispam policies, blocked-sender lists, or a security service in front of Microsoft 365 may affect the outcome. Administrators can inspect
Authentication-Results,X-Forefront-Antispam-Report, message trace, and applicable policy overrides.
Check that SPF, DKIM, and DMARC describe the mail you actually send
SPF: authorize every real sending system
Publishing an SPF record is not enough if it omits the self-hosted server or a legitimate third-party sender. Verify the envelope-sender domain used for SPF and ensure the record covers each authorized sending system. Avoid publishing conflicting SPF records for the same domain.
DKIM: verify the signature, not just the DNS key
Enable DKIM signing for outgoing mail and check that a received message’s signature validates. Google requires a DKIM key of at least 1024 bits for delivery to personal Gmail accounts and recommends 2048 bits where supported.
DMARC: check alignment with the visible From address
DMARC evaluates whether the authenticated SPF or DKIM identity aligns with the domain recipients see in the From header. A message can pass SPF yet fail DMARC if the authenticated domain does not align. Google requires a DMARC record for senders exceeding its Gmail bulk threshold; its guidance allows a policy of p=none. Use the complete message header and DMARC report data to identify alignment problems.
How to check whether your mail server’s PTR record is correct
Check the public IP used for outbound SMTP, not merely the hostname in a web control panel or the server’s MX record. The required pattern is: the IP’s PTR lookup returns a hostname, and a forward A or AAAA lookup of that hostname returns the same public IP. Google’s sender guidelines and FAQ describe this requirement and identify missing or mismatched PTR as a potential cause of temporary rate limits or blocking. If the lookup fails, the IP provider generally needs to change the reverse DNS.
Why email can still go to spam after all checks pass
Authentication and DNS establish important identity and routing signals; they do not erase the effect of reputation, recipient feedback, content, or provider-specific filtering. Google says frequent spam reports lower domain reputation and can make future messages more likely to be marked as spam. Send only to people who opted in, confirm addresses, provide an easy way to unsubscribe, and avoid abrupt sending bursts. Build volume gradually, beginning with engaged recipients, while monitoring responses and reputation.
For Gmail, Google recommends keeping the reported spam rate below 0.1% where possible and says it should never reach 0.3% or higher. Those are Gmail’s figures, not universal thresholds. If a recipient identifies a legitimate message as spam, they can mark it as not spam where appropriate; continue monitoring actual delivery and complaint data rather than treating that action as a guaranteed fix.
Best Value
Microsoft 365 may flag a message because of the recipient’s own rules or blocked-sender list even when the sender’s configuration is sound. A third-party security service in front of Microsoft 365 can also obscure the original sending IP and contribute to authentication failures if the environment is not configured to preserve it. If delivery fails at only one organization, ask its administrator to review the message trace and filtering path before assuming the server is universally misconfigured. Microsoft’s anti-spam protection FAQ explains these false-positive causes and investigation points.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallShould you keep self-hosting outbound email?
Self-hosting gives you control over configuration, but you are also responsible for maintaining valid authentication and DNS, managing sending volume and complaints, and monitoring reputation. When deciding whether to keep sending directly or use a managed outbound relay, compare:
- Whether you can obtain a stable outbound IP with correct PTR and forward DNS.
- Whether you can maintain SPF, DKIM, and DMARC and inspect authentication results.
- Whether you can monitor reputation, complaints, delivery errors, and sending volume.
- The operational work required to maintain the server and respond to provider-specific filtering.
- Whether any relay’s sending practices and configuration support the recipient providers’ current requirements.
A relay may reduce some operational burden, but it does not guarantee inbox placement or remove the need to meet recipient-provider requirements.
What to do next
Use the headers, SMTP response, outbound IP, and recipient provider’s diagnostics to find the failing layer. Correct authentication or DNS errors first; then address reputation, recipient consent, sending behavior, message characteristics, or recipient-side policy as the evidence indicates. Filters differ by provider, and fixing a technical fault may not immediately restore reputation or inbox delivery.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
