Sending an email does not automatically mean it will land in the recipient’s inbox.

Receiving mail platforms such as Microsoft 365, Gmail, and other providers evaluate each message on various signals before deciding whether it:

• lands in the inbox;
• ends up in junk email;
• is placed in quarantine;
• or is completely rejected.

Why does a mail server decide that my message is spam?

Spam filters look at much more than just words like "free" or "promotion".

They analyse, among other things:

• whether the sender is technically correctly authenticated;
• the reputation of the sending domain;
• the reputation of the sending infrastructure;
• how many messages are sent;
• how recipients interact with previous messages;
• whether addresses are valid and up to date;
• the content and structure of the message;
• links and attachments;
• signals that resemble phishing or spoofing.

1. Check SPF

SPF stands for Sender Policy Framework.

Via a DNS record, you specify which mail servers are allowed to send email on behalf of your domain name.

This way, a receiving mail server can verify whether a message from, for example:

was actually sent via an authorised server.

Think for example of:

• CRM software;
• accounting software;
• webshops;
• newsletter platforms;
• ticketing systems;
• printers and scanners;
• marketing tools.

2. Use DKIM

DKIM stands for DomainKeys Identified Mail.

DKIM adds a cryptographic signature to outgoing email. The receiving mail server can verify via DNS whether this signature is valid.

This proves that:

• the email was indeed signed on behalf of the relevant domain;
• relevant parts of the message have not been undesirably altered in transit.

3. DMARC makes the whole much stronger

DMARC stands for Domain-based Message Authentication, Reporting and Conformance.

DMARC builds on SPF and DKIM and helps determine what receiving mail servers should do when a message cannot be correctly authenticated on behalf of your domain.

DMARC can be set with policies such as:

• none – mainly monitoring;
• quarantine – suspicious messages are preferably treated separately;
• reject – reject messages that do not comply.

Why are SPF, DKIM and DMARC so important?

Modern mail providers use email authentication as an important signal when evaluating senders.

Correct configuration helps to:

• make spoofing of your domain more difficult;
• give receiving mail servers more trust in legitimate messages;
• better distinguish erroneous or fraudulent senders;
• better protect your domain reputation.

4. Your reputation plays an important role

Email platforms build up a reputation profile of senders over time.

This reputation can be negatively affected when:

• many messages are marked as spam;
• you send large volumes of unsolicited email;
• many addresses do not exist and messages bounce;
• an account is hacked and starts sending spam;
• your sending pattern suddenly changes drastically;
• your mailing lists are poorly maintained.

5. Do not send newsletters from a regular mailbox

Microsoft 365 is primarily designed for normal business communication.

Using a regular Microsoft 365 mailbox to suddenly send thousands of marketing emails or newsletters is not a good idea.

Large mailings can:

• trigger spam detection;
• hit sending limits;
• affect reputation;
• cause a user to be temporarily unable to send emails.

6. Keep mailing lists clean

If you regularly send to old, incorrect or non-existent email addresses, you will get many bounces.

This is a bad signal for spam filters.

Therefore:

• remove addresses that permanently bounce;
• do not buy random lists of email addresses;
• only mail people for whom you have a legitimate reason;
• make unsubscribing easy for marketing communications;
• keep addresses and consent up to date.

7. The content of your email also matters

Even with perfect DNS configuration, a message can still be classified as spam.

Watch out for, for example:

• an extremely high number of links;
• suspicious shortened URLs;
• links to domains with a poor reputation;
• unusual attachments;
• messages that strongly resemble phishing;
• misleading subject lines;
• aggressive or unwanted marketing mail.

8. Also check systems that send mail on your behalf

A common mistake is that Microsoft 365 is perfectly configured, but other applications are not.

For example:

• a website that sends quotes;
• a webshop;
• an accounting package;
• a CRM;
• a ticketing system;
• a scanner;
• a marketing platform.

If such an application sends emails with:

then that sending method must also fit correctly within your SPF, DKIM, and DMARC configuration.

9. A hacked account can damage your reputation

When a Microsoft 365 account is hacked, attackers sometimes try to use it to send large amounts of phishing or spam.

Microsoft therefore also monitors outgoing email for suspicious patterns.

When an account sends a conspicuously large or suspicious amount of email, Microsoft can take measures to protect the rest of the infrastructure and reputation.

10. Don’t just ask the recipient to put you on an allowlist

When one customer does not receive your message, it may seem tempting to simply ask them to put your email address or domain on a safe list.

This can help in a specific situation, but it should not replace solving the underlying cause.

If multiple recipients treat your mail as spam, you should first investigate:

• SPF;
• DKIM;
• DMARC;
• mail headers;
• reputation;
• bounces and error messages;
• sending behaviour;
• used mail platforms.

How do I find out why a specific email ends up in spam?

This usually requires technical investigation.

A specialist can look at, among other things:

• the full email headers;
• SPF results;
• DKIM validation;
• DMARC alignment;
• mail flow and message trace;
• error codes and non-delivery reports;
• the sending server used;
• domain and IP reputation;
• any blocks;
• the content and links in the message.

Have your email domain professionally configured

Email is one of the most important communication tools for a company. A poorly configured mail environment can affect both deliverability and security.

A professional configuration therefore looks at more than just one DNS record.

It must check, among other things:

• which systems send mail on behalf of your domain;
• whether SPF is correct;
• whether DKIM is correctly applied;
• whether DMARC is correctly set up;
• whether all legitimate sending flows are aligned;
• how marketing mail is sent;
• whether outgoing spam and compromised accounts are monitored;
• whether your domain is sufficiently protected against spoofing.

Do you have a concrete problem now?

Are you a FLEXAMIT customer and important messages are suddenly rejected, systematically end up in spam, or do you receive an error message?

Summary