Your important email went to spam: a first-hour triage
One message you needed read ended up in someone's junk folder. A calm, ordered check of what to do in the first hour, from getting it seen to finding the cause.
On this page(9 sections)
A customer says they never got your invoice. A candidate swears your offer email did not arrive. Then someone checks and finds it in the spam folder. This is one of the most common email problems, and the first reaction is usually to start changing DNS records. That is the wrong first step.
This post is a triage for the first hour. It is ordered on purpose: first get the message seen, then work out whether this is a one-off or a pattern, then look for the cause. Doing it in that order keeps a small problem from turning into a big one.
Minute 0 to 10: get the message read
The person is waiting. Everything else can wait a little.
- Tell them it is there. Reply through another channel, such as a call or a chat message: "I sent it at 10:14 from billing@. Please check your spam or junk folder."
- Ask them to mark it as not spam. This teaches their provider that the sender is wanted. It is the single most useful thing a recipient can do, and it often fixes the next message too.
- Ask them to add you to their contacts. Many providers treat known contacts more kindly.
- If they cannot find it, send the content another way. Attach the invoice to a fresh message from a different address, or share a link. Do not send the same message five times. Repeats look like spam and make things worse.
Minute 10 to 25: find out what the receiving side saw
Do not guess. Ask for the facts that exist.
- Ask for the full headers of the spam copy. In Gmail it is "Show original", in Outlook it is "View message source". You want the
Authentication-Resultsline and anyX-Spamstyle headers. - Look at the authentication verdicts. You are looking for
spf=pass,dkim=passanddmarc=pass. If any of them saysfail,softfailornone, you probably have your answer. The plain-English guide to SPF, DKIM and DMARC explains what each result means. - Check that the visible From domain lines up with the domain that signed and sent the mail. A mismatch is a common cause. The explainer on From, Reply-To, envelope sender and Return-Path shows where each address lives.
- Note the provider. Gmail, Outlook and a small company's own filter all behave differently, and you want to know which one decided.
If you cannot get headers, you can still send a test message to a mailbox you control at the same provider and read its headers yourself.
Minute 25 to 40: is it one message or a pattern?
A single message in spam might be about that message. Several in a week is about you.
Ask three questions:
- Did the same recipient get your earlier messages in the inbox? If yes, something about this message changed.
- Do other people at the same provider have the same trouble? Ask a colleague or a friendly customer.
- Did anything change recently? A new sending tool, a new domain, a new template, a sudden increase in volume, or a link shortener in the body are all common triggers.
If other recipients are fine and only this one landed in spam, it may be that recipient's own filter, or a rule they set long ago. In that case, the earlier steps are usually all you need.
Minute 40 to 60: look at the message itself
Content matters less than people fear, but some things do raise suspicion.
- Very little text and one big image. Filters read text. A message that is mostly an image gives them little to work with.
- Links that do not match the sender. A message from your domain that links only to a different domain, or to a shortened URL, looks unusual.
- An attachment type that is often abused. Archives and macros-enabled files are the usual suspects. A link to the document is safer.
- Odd formatting. All-capital subject lines, many exclamation marks and broken HTML add up.
- A first message to a stranger with a "re:" subject. Fake threads are a known spam trick, and filters know it.
Read your message once as a cautious stranger would. If it would make you hesitate, rewrite it.
Check your sending reputation
If this is a pattern, look at the bigger picture:
- Is the domain new? A domain with no history needs to build trust slowly. The notes on warming up a new domain give a sensible schedule.
- Do you have Gmail's view of your domain? Google Postmaster Tools shows reputation and spam rate for the mail you send to Gmail users.
- Are you seeing rejections as well as spam placement? The error codes described in Gmail rejections, 4xx and 5xx tell you whether the problem is temporary or permanent.
- Is a list-style or bulk message going out from the same domain as your personal mail? Marketing complaints can drag down the reputation that your one-to-one mail relies on.
What to avoid
Some responses feel active but do harm.
| Tempting | Why it backfires |
|---|---|
| Resending the same message repeatedly | Looks like spam and adds complaints |
| Asking the recipient to lower their spam settings | Unsafe for them, and it does not fix your side |
| Changing five DNS records at once | You cannot tell which change helped, and you may break working mail |
| Switching sending domains in a panic | You lose any reputation you had and start again |
| Buying a "deliverability boost" | There is no shortcut, and some services make it worse |
Make the next one less likely
After the incident, spend twenty minutes on prevention:
- Confirm that SPF, DKIM and DMARC pass for every system that sends as your domain. Include your billing tool, your support desk and any form plugin.
- Send important one-to-one mail from a real person's address rather than a no-reply address. Replies are a strong sign of a wanted message.
- Keep the message plain. Short text, one or two links, and a clear subject.
- Write the incident down. Note the provider, the date, the verdict and what fixed it. A short log helps you spot a pattern much earlier.
If you read mail through Koltrix, an assistant connected over MCP can help you find the thread and draft a reply asking the recipient to check their junk folder. As always, you read and send the draft yourself.
A short checklist
- Tell the recipient by another channel, and ask them to mark the message as not spam.
- Send the content a different way if it is urgent, once, not repeatedly.
- Get the full headers and read the SPF, DKIM and DMARC verdicts.
- Compare the visible From domain with the signing domain.
- Decide whether it is one message or a pattern.
- Review the message the way a cautious stranger would.
- Check domain age, reputation tools and rejection codes if it keeps happening.
- Change one thing at a time, and write down what you did.
Key takeaways
A message in the spam folder is rarely a mystery once you have the headers. Get the person their message first, ask for the facts second, and only then change anything. Most cases come down to a failed authentication check, a young domain or a message that looks unusual, and each of those has a calm, ordinary fix.
Start with Koltrix
Your domain, one inbox, and an API that sends.
A team inbox where AI sorts and drafts (nothing is sent without your click), plus the transactional API and SMTP relay your product sends with. 7 days free, no card.
