Why Are My Emails Going to Spam?

Mail from your domain landing in junk folders is almost always an authentication problem or a reputation problem, and KPanel can diagnose and fix most of the authentication half for you in a few clicks.

Receiving providers no longer treat unauthenticated mail as merely suspicious: Google and Microsoft both now expect a domain to prove who it is before they will put its mail in an inbox. This guide starts with the one screen that tells you exactly what is wrong, then works outward to reputation, testing, and what to do when a specific provider is blocking you.

Start With the Deliverability Check

Do not guess. KPanel checks your domain's actual published DNS records and scores them.

Sign in to KPanel and click Email in the left sidebar.
Click the mailbox whose domain you want to check.
Open the Deliverability tab, headed "Check your domain's email authentication records."

You get a score out of 100 with a plain verdict (Excellent, Good, Needs work, or Poor) and a row for each of the four records that matter:

Check	What it does
MX Records	Controls where incoming email is delivered.
SPF	Tells receiving servers which servers can send email from your domain.
DKIM	Adds a cryptographic signature to your emails, proving they were sent by you.
DMARC	Tells servers what to do when an email fails authentication checks.

Each row shows Configured, Needs attention or Missing.

Deliverability tab for a mailbox in KPanel

Fixing What Is Missing

Any row that is not Configured offers Auto-fix. Click it and Kapsule publishes the correct record into your DNS zone for you.

Auto-fix only adds what is missing. The confirmation is explicit: "Kapsule will add the missing SPF, DKIM and DMARC records to your DNS zone. Existing records are never changed or removed." Your own records are safe.

After applying, KPanel tells you "Applied successfully. DNS may take 5 to 30 minutes to propagate." Use Re-check once that time has passed rather than reloading immediately and worrying.

Auto-fix can only write to a DNS zone that Kapsule hosts. If your domain answers from another DNS provider, the Deliverability tab shows you the suggested record to publish, and you have to add it there yourself. Nothing improves until that record is actually live in the zone your domain resolves from.

If the tab tells you the domain is unverified, complete the ownership check first: publish the TXT record it shows and click Verify. That check is what stops anyone else claiming your domain for email.

What a New Domain Starts With

A domain registered through Kapsule does not start from nothing. When the zone is created we seed it with a working baseline, including an MX record at priority 10 pointing at mail.kapsulehost.com and a starter SPF record of v=spf1 mx ~all, alongside the A records for the site itself.

If you use a mail provider other than Kapsule, that baseline is not forced on you. Kapsule deliberately does not auto-publish over, or overwrite, a domain's own MX, SPF, DKIM or DMARC records. Point the MX at your provider and set their SPF and DKIM, and those records stay exactly as you left them.

For a proper explanation of what each record actually says and why receiving servers care, read SPF, DKIM and DMARC Explained.

The Four Usual Causes

1. No SPF Record, or a Wrong One

SPF lists the servers allowed to send for your domain. Without it, anything claiming to be you looks equally plausible, and filters treat all of it with suspicion.

The classic self-inflicted version of this is having more than one SPF record on a domain. A domain is allowed exactly one, and publishing two makes both invalid. If you use another service that sends on your behalf, such as a newsletter tool or a CRM, its sending hosts belong inside your single SPF record, not in a second one.

2. DKIM Not Signing

DKIM adds a signature that proves a message was not altered in transit and genuinely came from your domain. Kapsule generates and publishes DKIM keys for domains on our DNS automatically. If the Deliverability tab shows DKIM as Missing on an externally hosted domain, the published key is the problem: use the suggested record.

3. No DMARC Policy

DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails both. A domain with no DMARC record at all is increasingly distrusted by the large providers, regardless of how good the rest of your setup is.

4. A Domain With No Reputation Yet

Even with perfect authentication, a brand new domain has no sending history. Receiving servers have no evidence that people want your mail, so early messages get filtered harder than they will in a month. This is normal, it resolves itself, and the section on warming below covers how to help it along.

Turning On DMARC Protection Properly

Do not hand-write a DMARC policy and hope. KPanel runs a managed ramp that takes your domain from monitoring to full protection safely.

Open Domains in the left sidebar and click your domain.
Go to the Email tab and find the DMARC Protection card.
If it reads "Not enrolled", click Start DMARC Ramp.

The ramp moves your policy from None (Monitoring) through Quarantine to Reject (Full Protection) automatically over 14 days. You get "DMARC protection started. Your policy will ramp over 14 days."

You keep the controls throughout: Pause Ramp, Resume Ramp, and Roll Back to None.

Jumping straight to a reject policy is the fastest way to make your own legitimate mail disappear. Any service that sends as your domain and is not yet covered by SPF or DKIM, an invoicing tool, a booking system, a CRM, will start being rejected outright rather than filtered. That is exactly why the ramp starts at monitoring: it gives you two weeks of evidence before anything is enforced.

Reading Your DMARC Reports

Once mail is flowing, receiving providers send back aggregate reports, and KPanel collects them on the same Email tab of your domain under DMARC Reports.

You get a pass rate, the message counts, and a per-source-IP breakdown of the top senders using your domain, with pass and fail columns.

The footnote on that card is the whole diagnostic technique in one line: "A failing source is usually a legitimate sender that isn't authorised yet (add it to SPF or set up DKIM) or someone spoofing your domain." Work down the failing sources by volume. Recognise the sender and authorise it; do not recognise it, and you have just found somebody forging your domain.

Reports arrive a few times a week rather than instantly, so give it several days before concluding there is nothing to see.

Warming a New Sending Domain

If you have just started sending from a new domain:

Start small. A few dozen messages a day in the first week is plenty.
Send to people who will actually engage. Replies and opens from real correspondents are the strongest positive signal there is.
Avoid bulk sends to cold lists in the first few weeks. Nothing damages a young domain faster.
Watch bounces. A high bounce rate tells receiving servers your list is not clean.
Keep sending consistently. A domain that sends five messages one day and two thousand the next looks compromised.

A Kapsule mailbox is built for genuine business correspondence. Marketing campaigns and large mailing lists belong on a dedicated bulk sending service with its own list management and unsubscribe handling. Running a campaign through a normal mailbox risks the reputation of every message you send, including the ones that matter.

If your domain has been used to send spam in the past, whether by you or by somebody who compromised it, reputation recovery takes considerably longer, and there is no shortcut.

Testing Your Deliverability

Two free tools tell you more in five minutes than a week of guessing:

Mail Tester at mail-tester.com. It gives you a one-off address, you send it a real message, and it scores that exact message for authentication, formatting and spam signals.
The MXToolbox email header analyser. Paste the full headers from a message that landed in spam and read how each server along the path handled it.

Sending a Test Yourself

Open webmail from KPanel with Open Webmail on the mailbox page, or go to webmail.kapsulehost.com. See Accessing Your Email via Webmail.
Send a plain, ordinary message to a Gmail or Outlook address you control. Do not craft a test that looks like marketing.
If it lands in spam, open it and read the raw headers. In Gmail that is the three-dot menu, then Show original, where the SPF, DKIM and DMARC results are listed explicitly.

Test with a message that looks like your real mail, not with the word "test" in the subject and one line of body. Short, contentless messages from a new domain are themselves a spam signal, and you will end up chasing a problem you created in the test.

What Trips Filters Beyond Authentication

Once authentication is green, the message itself matters:

A subject in all capitals, or stuffed with exclamation marks and currency symbols
A message that is one large image with almost no text
Link shorteners, or a display link whose text does not match its destination
A mismatch between the From address and the domain that actually sent the message
Attachments in executable or macro-enabled formats
Recipients who have previously marked your mail as spam, which is a per-recipient signal you cannot argue with

If a Specific Provider Is Blocking You

Google and Gmail. Google Postmaster Tools at postmaster.google.com gives domain owners real data on delivery errors, spam rate and domain reputation for mail sent to Gmail. Verify your domain there and read the spam rate first.

Microsoft, Outlook and Hotmail. Use Microsoft SNDS to see sending reputation and to file a delisting request.

Anyone else. Almost every provider runs a postmaster or abuse page describing its own process. Search for the provider's name plus "postmaster".

Blacklists

If legitimate mail is being rejected outright rather than filtered into a junk folder, check whether the domain or the sending address is listed. The MXToolbox blacklist check at mxtoolbox.com/blacklists.aspx queries the major lists at once, and each listing links to that list's own delisting process.

Kapsule operates the sending infrastructure, so if you suspect a listing at the network level rather than on your own domain, that is ours to investigate. Open a support ticket with the exact bounce message, including the full error text, and the time it happened.

Troubleshooting

The Deliverability tab says "Managed by Kapsule". Your mailbox is on a built-in Kapsule subdomain, whose records live on a shared parent zone we keep current. There is nothing for you to configure. Point a custom domain at the mailbox if you want a per-domain panel.

Auto-fix ran but the score has not moved. DNS takes 5 to 30 minutes to propagate. Wait, then use Re-check. If it still has not moved, your domain is probably answering from DNS that Kapsule does not host.

My mail reaches Gmail but not Outlook, or the other way around. Providers weigh signals differently and maintain separate reputations. Check the relevant provider's own postmaster tool rather than changing your DNS again.

One recipient never gets my mail, everyone else does. That is usually a rule or a block on their side, or their organisation's mail gateway. Ask them to check their junk folder and their blocked senders list.

Incoming mail is being filtered, not outgoing. Different problem entirely. The Spam filter tab on the mailbox governs what arrives; see Email Not Receiving.

Everything is green and mail still goes to spam. Reputation takes time and engagement. Keep volumes modest, keep sending to people who reply, and re-check the DMARC reports in a couple of weeks.