Why Are My Cold Emails Going to Spam? A 10-Minute Diagnosis

Cold emails go to spam for a handful of reasons: broken or missing authentication, a recent change to your sending setup, a sudden jump in volume, a poor list, recipients marking you as spam, or content that looks like bulk mail. You can work through these in about 10 minutes if you check them in the right order. Start with the cheapest and most mechanical causes, then move to the ones that need judgement.

One honest caveat first. Nobody can tell you from the outside exactly why a particular message hit spam. What you can do is rule causes in or out quickly.

What can you actually see from the outside?

Some of this diagnosis is public and some is private. Knowing which is which saves you time.

A DNS check can read your domain’s public records: SPF, DMARC and MX. It can’t see DKIM reliably, and it can’t see inbox placement, complaint rates, bounces or your list. Those live inside your sending tool, your mailbox provider’s dashboards and your own data.

So the first few minutes are about records anyone can read. The rest is about your own numbers.

Minutes 1 to 3: are your authentication records in order?

Authentication is how receiving servers decide whether you’re really who you say you are. It’s the first thing I’d check, because it’s binary and fixable.

Run your sending domain through the free SPF, DMARC and MX check. It reads your live DNS with no sign-up. Then look for these problems:

• No SPF record, or two of them. A domain should have exactly one v=spf1 record. Two records is a PermError, which means SPF fails outright. This often happens when someone adds a new tool’s record instead of merging it into the existing one.
• Too many lookups. SPF allows at most 10 DNS-querying terms (include, a, mx, ptr, exists, redirect). Every sales tool you add tends to bring an include. Go past 10 and SPF breaks. More on SPF here.
• No DMARC record. It lives at _dmarc.yourdomain.com. Even p=none counts as a valid starting point, but p=none only monitors. It doesn’t stop anyone spoofing you.
• No rua= address. Without it you get no aggregate reports, so you can’t see who’s sending as you.

Here’s what a healthy-looking DMARC record can look like. This is an example only, using example.com:

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Don’t copy that into production. Take the exact values from your own DNS provider or email platform’s admin console.

DKIM needs a different test

DKIM adds a cryptographic signature to your mail. A public check can’t confirm it reliably, so it shows as “Not tested”. To check it yourself, send a message from the exact tool and address you use for outreach to a personal Gmail account. Open it, choose “Show original”, and look at the SPF, DKIM and DMARC results. You want to see a pass for DKIM and for at least one aligned method.

Alignment is the bit most people miss. The domain in the visible From address has to match the domain that passed SPF or DKIM. A tool can pass DKIM on its own domain and still fail DMARC for yours.

Minute 4: what changed recently?

Deliverability rarely falls off a cliff for no reason. Ask what’s different from the last time it worked.

Say your team added a new sequencing tool last month. Maybe it sends from your main domain, but nobody added it to SPF or set up its DKIM. Or someone moved DNS providers and a record didn’t come across. Or a new domain was bought for outreach and never got any records at all.

Check for a new tool, a new domain or mailbox, a DNS change, or a changed From address. Also look at any bounce messages. A 550 5.7.26 from Gmail points to authentication. A 550 5.7.515 from consumer Outlook means non-compliance with Microsoft’s bulk sender rules. A 550 5.7.509 means the mail failed DMARC on a domain publishing p=reject.

Minute 5: did your volume jump?

Mailbox providers watch patterns. A domain that sent a few hundred messages a week and suddenly sends thousands looks odd, and odd gets filtered.

Look at your sending history by day. If you’ve added reps, added mailboxes or switched on a big new sequence, that’s your suspect. Slow the sending down and bring it back up gradually.

Volume also changes which rules apply. Gmail’s stricter requirements, in effect since 1 February 2024, apply to senders of more than 5,000 messages a day to Gmail accounts: SPF and DKIM, a DMARC record, and one-click unsubscribe on marketing and subscribed mail. Microsoft’s consumer Outlook rules from 5 May 2025 use the same 5,000 a day line. Below those lines you still need SPF or DKIM for Gmail, and a bad reputation will hurt you at any volume.

Minutes 6 and 7: is the list the problem?

This is where most cold email trouble actually lives. Authentication gets you through the door. A bad list gets you thrown out.

Open your sending tool and look at bounce rates. Hard bounces mean the address doesn’t exist, and sending to lots of them tells providers you don’t know who you’re mailing. Check where the list came from, how old it is and whether it was verified.

In Australia there’s a legal side too. Under the Spam Act 2003, commercial emails need consent (express or narrowly inferred, and you must be able to prove it), accurate sender identification, and a working unsubscribe honoured within 5 working days. Inferred consent from a published address only holds if it was published for that person or role, has no “no unsolicited messages” notice beside it, and your message relates to their role. This is general information, not legal advice. ACMA explains the rules in more detail.

Minute 8: are people complaining?

Every time someone clicks “Report spam”, your reputation takes a hit. For Gmail, Google says to keep the spam rate in Postmaster Tools below 0.10% and never let it reach 0.30%.

If you send to Gmail addresses, set up Google Postmaster Tools for your sending domain. It only shows data once you have enough volume, so a blank dashboard doesn’t mean you’re fine. Also check your tool’s own unsubscribe and complaint numbers. A visible, working unsubscribe link usually costs you less than a spam report does.

Minutes 9 and 10: does the message look like spam?

Content is the last thing I’d blame, not the first. Still, it matters once everything above is clean.

Read your email as a stranger would. Then check for these:

• Lots of links, or link shorteners and tracking domains you don’t control.
• Images instead of plain text, or heavy HTML templates.
• The same message sent to hundreds of people with only the first name changed.
• A vague or pushy subject line, or a missing sender signature and business details.
• Attachments in a first email.

Short, plain-text, one-link emails sent to a relevant person tend to behave better than polished campaigns. That’s an observation about how filters work in general, not a promise.

What if everything checks out?

Then the cause is probably reputation, and reputation takes time to repair. Pause the riskiest sequences, clean the list, cut volume, and send only to people who are likely to want the message. Test again from a clean mailbox after a few days.

A clean DNS check won’t guarantee the inbox. It just removes the cheap, fixable reasons, so you can focus on the harder ones.

Summary

• Check authentication first: one SPF record, under 10 lookups, a DMARC record with reporting, and DKIM confirmed by sending a test to Gmail and viewing the original.
• Ask what changed recently: a new sending tool, domain, mailbox or DNS edit is the most common cause of a sudden drop.
• Look at your own data for volume jumps, bounce rates and complaints. A public DNS check can’t see those.
• Fix list quality and consent before rewriting copy, and keep Gmail spam rate below 0.10%.
• Nobody can guarantee inbox placement, so aim to remove the fixable causes one by one.

Frequently asked questions

Why are my cold emails going to spam all of a sudden?

Something usually changed. Look for a new sending tool, a DNS edit, a new mailbox or domain, or a jump in sending volume. Check your SPF and DMARC records first, then your bounce and complaint numbers.

Can I check if my cold emails will land in spam before I send them?

Not with certainty. A DNS check can confirm your SPF, DMARC and MX records are set up properly, but nobody can test inbox placement reliably in advance. The best proxy is sending a test to your own Gmail and Outlook accounts and checking the authentication results.

Do I need DMARC to send cold emails?

If you send more than 5,000 messages a day to Gmail accounts, you need a DMARC record, and the same applies to consumer Outlook addresses. Below that, it’s not strictly required, but I’d still publish one. It also helps you see who else is sending as your domain.

Should I send cold email from my main company domain?

Many teams use a separate domain for outreach so that any reputation damage doesn’t hit their everyday business email. That’s a judgement call, not a rule. Whichever you choose, set up SPF, DKIM and DMARC properly for the domain you send from.

Is cold emailing legal in Australia?

It can be, but the Spam Act 2003 sets conditions: you need consent (express or narrowly inferred) that you can prove, accurate sender identification, and a working unsubscribe honoured within 5 working days. This is general information, not legal advice, so check ACMA’s guidance or speak to a lawyer for your situation.

This article is general information, not legal or technical advice for your specific setup. Have the person who manages your DNS review any change before you make it.