Your emails go to junk for some people but not others because every mailbox provider, and often every business, decides for itself what counts as junk. Outlook, Microsoft 365, Gmail and Yahoo each weigh your SPF, DKIM and DMARC results and your sending history differently, and each recipient's own settings and their company's spam filter add another layer on top.
Each mailbox provider makes its own decision
One email to ten people can pass through several different filters. Each starts from the same checks but reaches its own verdict.
| Provider | What it leans on |
|---|---|
| Outlook.com and Hotmail | SPF, DKIM and DMARC, plus Microsoft's rules for domains sending more than 5,000 emails a day to its consumer addresses |
| Microsoft 365 (business) | A combined check Microsoft calls composite authentication, which mixes SPF, DKIM and DMARC with sender reputation, sender history, recipient history and behaviour |
| Gmail and Google Workspace | Google's sender guidelines: SPF or DKIM for everyone, SPF, DKIM and DMARC for bulk senders, and a low rate of people reporting you as spam |
| Yahoo | Similar rules to Gmail, with the same spam-report limit |
So a gap one provider puts up with can land you in junk at another. A common example: a service sends as you and passes SPF and DKIM, but only for its own domain. Gmail asks ordinary senders for SPF or DKIM, so it may deliver the email. Microsoft 365 may not, because it wants that proof to match the domain in your From address.
Your recipients' own settings
- Safe senders and contacts. In Outlook, people can add you to their safe senders list (in Outlook on the web it's under Settings → Mail, in the junk email settings). Gmail's help says adding someone to your contacts stops Gmail sending their messages to Spam.
- What they've done before. Marking your email as junk, or as not junk, teaches that mailbox. Gmail's help says the more spam people report, the better it gets at spotting similar email.
- Their own rules. A rule or filter someone set up years ago can move your email out of their inbox.
These settings only help the mailbox they're in, and they don't override everything. Microsoft's help says that in Microsoft 365, email it treats as high confidence phishing is always quarantined, whatever the recipient's safe senders list says.
A company's own spam filter
Many businesses add their own filtering on top of Microsoft 365 or Google Workspace. An IT administrator can set stricter anti-spam policies, allow or block senders for the whole company, or put a separate filtering service in front of their mailboxes. So two customers on Microsoft 365 can treat your email very differently.
Forwarding matters too. If a customer forwards their email to another address, SPF breaks, because the forwarding server isn't on your list. DKIM survives forwarding, so set up both.
Different emails, different senders
Sometimes the people missing your email are getting a different email from you. Your mailbox, invoices, newsletter and website form are often sent by different services:
- Your Microsoft 365 mailbox uses your SPF, DKIM and DMARC records.
- Accounting software such as Xero or QuickBooks usually sends from its own address, with yours as the reply-to.
- A newsletter tool or website form sends with your address but from its own servers. It passes DMARC only once it's set up for your domain (most services call this domain authentication).
DMARC needs SPF or DKIM to pass for your own domain, not just the service's. That match is called alignment. If one service is aligned and another isn't, email from the second is the one more likely to land in junk.
Reputation and engagement
Providers also learn from their own users. If people at one provider often report your email as spam, that provider grows wary of you, even if everyone elsewhere is happy to get it. Google asks senders to keep spam reports below 0.3%, and recommends under 0.1%.
A new domain has no history at any provider, so each one starts cautiously. Normal one-to-one email to people who reply builds trust over time.
How to find out what's going on
1. Note which providers are junking you
Look at the addresses of the people who miss your email. Hotmail and Outlook addresses use Outlook.com. A business address could be on Microsoft 365, Google Workspace or something else, so ask them. If everyone missing you is on Microsoft, that often points to authentication, which Microsoft checks closely.
2. Test the email that's going missing
Send that email, from the same mailbox or service, to your private test address. We check SPF, DKIM, DMARC, alignment and each provider's sender rules, then give a separate verdict for Outlook.com, Microsoft 365, Gmail, Google Workspace and Yahoo. If you send through more than one service, test each one.
3. Fix what the report shows
For most small businesses on Microsoft 365, the usual fix is these records plus DKIM:
| Type | Name | Value |
|---|---|---|
| TXT | yourbusiness.com.au | v=spf1 include:spf.protection.outlook.com ~all |
| TXT | _dmarc.yourbusiness.com.au | v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com.au |
Keep only one SPF record, and change the rua address to a mailbox you read. Then switch on DKIM for your domain in the Microsoft Defender portal.
The free test covers one domain every 30 days. Your report stays online for 7 days, and we email you a copy.
Checked against: Microsoft Learn, How email authentication works in Microsoft 365 · Microsoft Learn, Create allowlists · Microsoft Support, Block or allow (junk email settings) · Google Workspace Admin Help, Email sender guidelines · Gmail Help, Report spam in Gmail · Yahoo Sender Hub, Sender Best Practices.