Email rejected as spam: check evidence and sending practices

What does this mean?

A spam-policy rejection can involve authentication, reputation, message content or recipient policy. Passing SPF, DKIM and DMARC is useful but does not promise inbox placement. The recipient’s full rejection text is the starting point for identifying which layer objected.

What should I check first?

Keep the full bounce and note whether the problem affects all recipients or one provider. Inspect the sending account for compromise, unexpected queued mail or sudden volume changes. If you suspect compromise, follow the provider’s account recovery process instead of continuing to send tests.

How can I diagnose the cause?

Check delivered test headers for SPF, DKIM and DMARC results and the domains evaluated. Review the source of your address list, consent, unsubscribes and complaints if this is bulk mail. Website forms can be abused to generate unsolicited messages, so inspect their limits and logs as well.

How do I fix it safely?

Repair confirmed authentication problems using provider-issued records and secure affected accounts. Stop unsolicited or compromised sending and follow the rejecting provider’s documented remediation process. Do not move the same problematic campaign between providers to evade filtering, or assume removing one keyword fixes reputation.

Verify the fix and know when to contact your provider

Keep configuration copies before edits and monitor controlled retests. Ask the sending provider for the exact outbound IP and rejection analysis when DNS is correct. Supply timestamps, redacted message IDs and full diagnostics. A recipient may also have a deliberate local policy that your provider cannot override.

Work through these checks in order

1. Check sent-mail and queue activity for unexpected messages or an abrupt volume increase. If compromised sending is suspected, secure the account through the provider before sending more tests.
2. Inspect real receiver authentication results, then review consent, complaints and unsubscribe handling for bulk mail. A DNS pass cannot compensate for an unsolicited or abused sending workflow.
3. Use the rejecting provider’s documented review process after correcting the identified issue. Keep the rejection code and timestamps, and do not evade the block by rotating the same campaign through new senders.

Which tool can help?

SPF DNS record checker · DKIM public record checker · DMARC DNS record checker · SMTP error lookup

DNS tools show one resolver’s public answers. Record explainers do not authenticate a message, and calculators do not monitor a server. Use the evidence alongside your provider’s logs.