Email that went to spam suddenly has one of five causes: a DNS or authentication change, a list or sending change, a linked-domain problem, a blocklist listing, or a complaint spike. Each one leaves a different trace, and each can be confirmed or ruled out in minutes.
The order matters more than the effort. Working the causes in the wrong order wastes days, and changing settings before confirming the problem creates a second problem on top of the first.
Start here: run the Email Header Analyzer on one message you have already sent. It decodes authentication and routing from the raw headers, and it either finds your cause in ninety seconds or rules out the fastest one to fix.
Before changing anything: confirm the drop is real
A reported drop in opens has four possible explanations, and only one of them is a spam problem.
| What you're seeing | What it might actually be |
|---|---|
| Open rate fell sharply this week | Apple Mail Privacy Protection distortion, or a segment change |
| One customer says "I never got it" | A single filtered message, not a domain-wide problem |
| Opens fell but clicks held steady | A tracking or measurement change, not a placement change |
| Mail arriving late to a scattered minority | Greylisting — harmless, and no action needed |
| Opens and clicks both fell together | A genuine placement problem |
Opens falling while clicks hold is not a deliverability event. Clicks come from real humans and cannot be inflated by image pre-loading, which makes click rate the more reliable signal.
Delayed mail is usually not a problem either. Greylisting is a defence where a receiving server temporarily rejects mail from an unfamiliar sender — a "try again later" signal — knowing real mail servers retry and crude spam software often does not. Your platform retries, the mail arrives, and the delay fades as the server learns you. Delayed-but-delivered to a scattered minority with 4xx codes in the log is greylisting. Rejected outright with a 5xx naming a policy or a blocklist is not.
Then run a seed test: send the next campaign to two or three fresh inboxes with no history with your brand — one Gmail, one Outlook, one Yahoo — and look at where each lands without searching. Spam or Junk confirms the problem. The Promotions tab is a different problem entirely, covered in how to stay out of the Gmail Promotions tab.
The five causes of a sudden spam problem
Sudden is the operative word. A gradual slide points to list decay and engagement erosion. A sharp drop over one to three sends points to something that changed on a specific date.
| Cause | Typical trigger | How fast it confirms |
|---|---|---|
| DNS or authentication change | Site migration, host change, DNS edit, rotated DKIM key | Minutes |
| List or sending change | A large import, a re-engagement blast, a volume spike | Minutes |
| Linked-domain problem | A new link shortener, an affiliate redirect, a compromised linked site | Minutes |
| Blocklist listing | Spam trap hit, compromised account, shared IP neighbour | Ten minutes |
| Complaint spike | A campaign that surprised the list, or a bought list | Requires Postmaster Tools |
The first question to answer is: what changed, and when? Fix the date of the first bad send, then look at everything that happened in the 72 hours before it. Sudden problems almost always have a specific cause on a specific day, and the change log is where it is hiding.
The diagnostic order
Eight steps, ordered so the fastest-to-confirm causes come first.
Step 1 — Pause broadcasts to your full list
Every send to an unengaged segment while a domain is already flagged deepens the problem. Pausing for two to three days costs nothing and is the single highest-leverage action available in the first hour.
Keep transactional mail running. Receipts and password resets are expected by the recipient and generate positive signals, and they usually travel a separate path anyway.
Step 2 — Check authentication in Gmail's "Show original"
Send one message to a Gmail address, open it, and use the three-dot menu → Show original.
The summary at the top reports SPF, DKIM, and DMARC as PASS or FAIL. All three should pass, and the DKIM signing domain shown should be yours, not your platform's.
- All three fail — a DNS record was removed or overwritten. Site migrations and host changes are the usual culprit.
- SPF and DKIM pass, DMARC fails — an alignment problem. The visible
From:domain no longer matches the authenticated domain, which happens when a platform reverts to signing under its own domain. - DKIM alone fails — a rotated key whose public half was never republished in DNS.
Paste the same headers into the Email Header Analyzer if you would rather read a plain-English summary than the raw source.
Step 3 — Read your DNS change history
Most DNS providers and hosts keep a change log. Open it and compare the dates against the date of the first bad send.
Four events break authentication without anyone connecting them to email:
- A website migration to a new host
- A nameserver change
- A CDN or proxy being switched on
- Someone adding a second SPF record for a new tool
A domain may publish exactly one SPF record. A second causes a permanent error, and a permanent error reads as a failure to receiving servers. This is one of the most common causes of overnight authentication collapse, because adding a tool feels unrelated to email.
SPF also breaks silently at ten DNS lookups. Adding a CRM, a helpdesk and a billing system can cross the limit with nothing visible changing. The SPF Lookup Checker counts them, and the Email Domain Scanner confirms MX, SPF and DMARC in one pass.
Step 4 — Check what you're linking to
Every domain you link to lends you its reputation, and borrows yours. A new link shortener, an affiliate redirect, or a linked site that got compromised will move a domain into spam with authentication still passing perfectly.
Look at the last three campaigns before the drop and check whether any introduced:
- A public link shortener — bit.ly, tinyurl and similar. Never use these in bulk email; spammers abuse them constantly and those domains carry the baggage.
- A new affiliate or partner redirect
- A tracking domain change, or click tracking running on your platform's shared domain rather than a subdomain of your own
- A linked site that has since been hacked
This cause is under-diagnosed because nothing about it appears in an authentication check.
Step 5 — Check Google Postmaster Tools
Postmaster Tools reports compliance status, spam rate, and authentication results exactly as Gmail sees them, which no third-party checker can do.
Two readings matter:
- Spam rate — a spike above 0.1% on a specific date names the campaign that caused the problem. Above 0.3% is a crisis, and it costs eligibility for Gmail's mitigation support until the rate holds below the line for seven consecutive days.
- Compliance status — a Pass / Needs Work verdict against Gmail's published bulk sender requirements, with the specific failing requirement attached.
If the dashboard is blank, that is usually volume, not a fault. Below roughly 100 messages a day to personal Gmail addresses the charts stay empty; 300–999 a day starts to be reliable; above 1,000 a day the data becomes properly interpretable. Small senders should rely on the seed test and their own metrics instead.
One trap: once you are being spam-foldered, fewer people see the mail, so fewer people can complain. A falling complaint rate alongside falling opens is bad news, not good.
Step 6 — Check the major blocklists
A listing produces a sharp, dated drop that looks exactly like a reputation collapse. The Domain Blacklist Checker covers the major lists in one pass and rules out an entire cause in a minute.
Check the sending domain and, if you send from a dedicated IP, the IP as well. Spamhaus is the listing that affects delivery most; most others matter far less than the alarming red boxes imply.
Which blocklists actually affect delivery, and what a removal request needs to say, are in email blocklists: how to check and get removed.
Step 7 — Audit what changed on the list
Open the sending platform's activity log for the 72 hours before the first bad send and look for four events:
- A large import. Addresses added in bulk from a spreadsheet, an event, a purchase, or an old file.
- A re-engagement campaign. Mailing dormant subscribers is a deliverability decision before it is a copy decision, and it is one of the most reliable ways to trigger a sudden drop.
- A volume spike. Ten times normal volume in a day reads as a compromised account.
- A new signup source. A form without bot protection can fill a list with submitted addresses within hours, including spam traps — and list-bombing attacks can wreck a reputation overnight.
Bounce rate is the tell for a bad import. A bounce rate above 2% on a send that previously ran under 1% means invalid addresses entered the list recently. On an inherited list, verification routinely removes 5–20%; above 30% means the list was purchased or is very old.
Step 8 — Check whether the account was compromised
A sudden spam problem with no other explanation can mean someone else is sending through the account.
Look for sends nobody scheduled, unfamiliar API keys or connected applications, login activity from unexpected locations, and a volume spike with no matching campaign.
If any appear, rotate the password, enable two-factor authentication, revoke unknown integrations, and contact the platform's support team before attempting any recovery. Recovery cannot begin while the source is still sending.
Read the bounce message, not the bounce rate
The receiving server tells you exactly why it refused a message, in a code most senders never read. The first digit decides urgency.
| Code | Meaning | What it points at |
|---|---|---|
550 5.7.515 |
Microsoft: authentication level not met | Your setup — go to step 2 |
550 5.7.26 |
Gmail: unauthenticated mail rejected | Your setup — go to step 2 |
421 4.7.32 |
Gmail: DMARC alignment | Alignment — go to step 2 |
550 … "listed" / "Spamhaus" |
Blocklist | Go to step 6 |
550 5.1.1 user unknown |
Invalid address | Dirty list — go to step 7 |
451 4.7.1 / "greylisted" |
Temporary defer | No action |
The habit worth building: after every large send, skim ten bounce messages — the text, not the rate. Two minutes, and it is the difference between deleting subscribers who were fine and fixing a DNS record that was silently breaking everything. The Email Deliverability Playbook has the full SMTP decoder in Appendix D, covering every code you are likely to see and the chapter that fixes each one.
What to do once the cause is found
The fix depends on which cause turned up, and the recovery pattern is common to all of them.
Fix the cause first. Republish the missing record, remove the imported addresses, drop the bad linked domain, submit the delisting request, or shut down the compromised access. Recovery attempted before the cause is fixed simply restarts the damage.
Then rebuild positive signals. Send only to subscribers who opened or clicked in the last 30 days. Keep the messages plain, personal, and worth replying to — replies are among the strongest positive signals a sender can generate. Watch the complaint rate at every step.
Then widen back out gradually. 30-day openers, then 60, then 90, checking complaint rate before each expansion. A rise means stopping and holding at the previous segment.
Expect the following, honestly: DNS propagation is usually minutes and occasionally up to 24 hours, and once the records resolve authentication works immediately on the next message sent. Promotions-tab fixes show within one or two sends. Mild spam foldering usually clears in two to three weeks. Genuine reputation repair takes four to eight weeks, and severe damage takes the full eight even done perfectly. If your spam rate crossed 0.3% at Gmail, add the seven-day hold below the line.
The full three-factor model behind these steps is in email deliverability: why authenticated emails still land in spam.
Four mistakes that make it worse
Changing several things at once. Fixing five things simultaneously means never learning which one was broken, and the next occurrence starts from zero.
Switching sending platforms. Reputation attaches primarily to the sending domain, and the domain moves with you. A platform switch during a crisis reproduces the problem on a new bill and adds a warm-up period on top.
Mailing the full list to "test whether it's fixed." Each such send is another negative data point during the exact window when the ratio needs to shift positive.
Buying a new domain. A fresh domain has no reputation, which is not the same as a good one. It also abandons whatever positive history the original domain still holds. The honest test before burning a domain: can you name the specific cause of the damage? If not, a new domain inherits it within a month.
The fork where the expensive mistakes happen. Deciding whether to fix the current domain, rebuild on a new subdomain, or start over is where senders lose the most time — abandoning domains that were recoverable, or spending months on domains that are gone. The Email Deliverability Playbook has a decision table for exactly that fork in Chapter 24, mapping eight situations to an action and a realistic timeline, alongside the day-by-day recovery protocol and a copy-paste blocklist removal request.
Frequently asked questions
Why did my emails suddenly go to spam?
A sudden change has five possible causes: a DNS or authentication change, a list or sending change, a linked-domain problem, a blocklist listing, or a complaint spike. Fix the date of the first bad send and examine what changed in the 72 hours before it. Migrations, bulk imports, and re-engagement campaigns are the most frequent triggers.
Can one bad campaign ruin sender reputation?
One aggressive send to a large unengaged segment can cause a measurable reputation drop, which is the classic Black Friday pattern. It is recoverable, and recovery takes weeks of deliberate rebuilding rather than days.
How long does recovery from a spam problem take?
DNS propagation is usually minutes and occasionally up to 24 hours, and authentication works on the next message sent once records resolve. Mild spam foldering clears in two to three weeks. Genuine reputation repair takes four to eight weeks, and severe damage takes the full eight even done perfectly.
Does a website migration affect email deliverability?
Frequently. Moving hosts, changing nameservers, or switching on a CDN can drop or overwrite the DNS records that authenticate email, and nothing in the migration process flags it. Re-verify SPF, DKIM, and DMARC after every DNS change.
Why did opens drop but clicks stay the same?
That pattern points to measurement rather than placement. Apple's Mail Privacy Protection pre-loads images for Apple Mail users, so reported opens shift with audience mix. Clicks come from real humans and are the more reliable signal.
Why are my emails arriving an hour late?
That is usually greylisting — a receiving server temporarily rejecting mail from an unfamiliar sender, knowing real mail servers retry. Your platform retries automatically and the delay fades as the server learns you. Delayed-but-delivered with 4xx codes needs no fix.
Can a bulk import send my emails to spam?
Yes. Imported addresses raise bounce rate, can contain spam traps, and have no engagement history with your domain. A bounce rate above 2% on a send that previously ran under 1% indicates invalid addresses entered the list recently.
Why is my Google Postmaster Tools dashboard empty?
Usually volume rather than a fault. Below roughly 100 messages a day to personal Gmail addresses the charts stay blank, 300–999 a day starts to be reliable, and above 1,000 a day the data becomes properly interpretable.
What to do next
Pause broadcasts, then run the "Show original" check in Gmail. Those two actions take five minutes and either identify the cause or rule out the fastest one to fix.
If authentication passes, open your DNS change log and your sending platform's activity log side by side and compare both against the date of the first bad send.
Free: The 60-Minute Email Authentication Fix — the checklist that verifies SPF, DKIM, DMARC, and alignment on your own domain.
The complete recovery procedure: The Email Deliverability Playbook — the day-by-day protocol, the fix-or-rebuild decision table, removal request templates, and the full SMTP error decoder.
Related guides
- Email deliverability: why authenticated emails still land in spam — the full three-factor model
- Email blocklists: how to check and get removed — ruling out a listing
- Email authentication: SPF, DKIM, DMARC and BIMI — fixing a broken record
- How to read Google Postmaster Tools — finding the campaign that caused it
- Email bounce rate: what's normal and how to fix it — diagnosing a bad import
- How to stay out of the Gmail Promotions tab — if it isn't spam after all
Free tools used in this guide
The short version
- Pause broadcasts to your full listStop sending to unengaged segments for two to three days. Keep transactional mail running, since receipts and password resets generate positive signals.
- Check authentication in Gmail's Show originalSend one message to Gmail, open it, and use the three-dot menu then Show original. SPF, DKIM, and DMARC should all read PASS, and the DKIM signing domain should be yours.
- Read your DNS change historyCompare the change log against the date of the first bad send. Migrations, nameserver changes, CDN activation, a second SPF record, and crossing ten DNS lookups all break authentication.
- Check what you're linking toLook for public link shorteners, new affiliate redirects, tracking running on a shared domain, or a linked site that has been compromised. Authentication checks never reveal this cause.
- Check Google Postmaster ToolsLook at spam rate for a spike above 0.1% on a specific date, and at the compliance verdict. A blank dashboard usually means low volume rather than a fault.
- Check the major blocklistsCheck the sending domain, and the IP as well if you send from a dedicated IP. Spamhaus is the listing that affects delivery most.
- Audit what changed on the listLook in the 72 hours before the first bad send for a large import, a re-engagement campaign, a volume spike, or a new signup source.
- Check whether the account was compromisedLook for unscheduled sends, unfamiliar API keys, unexpected login locations, and volume spikes with no matching campaign.
Free: The 60-Minute Email Authentication Fix
A no-fluff checklist to set up SPF, DKIM & DMARC correctly and pass Gmail & Yahoo's sender requirements.
Muhammad Basim has worked in digital marketing since 2013, focused on email deliverability and AI-assisted content production. He is the author of the Email Deliverability Playbook and the Email Copywriting Playbook, and has run 100+ email campaigns for ecommerce brands, coaches, and B2B senders. He writes about email, SEO, WordPress, and AI — with a bias toward what can be tested over what sounds good.
Related Articles
How to Read Google Postmaster Tools
Google Postmaster Tools is a free dashboard reporting how Gmail treats mail from your domain, and since 2025 it no longer reports a reputation grade — it reports compliance, spam rate, and a plain-language verdict on whether Gmail's users want your email. No third-party checker carries the same authority, because no third party is making […]
Email Verification Tools: Which Are Worth Paying For
Email verification checks whether an address can receive mail, and it cannot tell you whether anyone behind it wants yours. That distinction decides whether the spend is worth it, because a verified address that never opens damages your reputation exactly as much as it did before you paid to confirm it exists. Verification solves one […]
Email Spam Traps: How to Find and Remove Them
A spam trap is an email address that exists only to catch senders with poor list practice, and no tool can tell you whether one is on your list. Traps accept mail silently. They do not bounce, they do not complain, and they do not appear in any report until the damage is already done. […]