Why are operational emails from G Suite hosted forms going to Outlook spam even after fixing SPF and DKIM?

Summary

Operational emails from G Suite hosted forms may land in Outlook spam despite correct SPF and DKIM due to a multitude of factors. These encompass sender reputation issues linked to shared G Suite IPs and sending volume, the quality of email content (spam triggers, poor coding), the location of hosted assets, missing DMARC records, problems with DNS configuration, similarities in email code to spam messages, a lack of recipient engagement, how email is being changed in transit, and Outlook's stringent filtering policies based on user-defined rules. Setting up feedback loops with Microsoft and actively monitoring email headers are also crucial for pinpointing and addressing deliverability problems.

Key findings

  • Sender Reputation Woes: G Suite's shared IP addresses might negatively impact sender reputation.
  • Content is King: Poorly coded email with spammy content can be caught by spam filters.
  • Azure hosting issues: If using Azure hosting ensure you change the domain you point to in the email
  • DMARC essential: DMARC is an important step to instructing receiving mail servers how to handle emails.
  • DNS issues: Ensure your DNS records are set correctly, with properly sized keys and all sources listed in SPF
  • Code similarity flagged: If spammers also use similar code for generating emails, it might contribute to spam filters flagging the emails as spam.
  • Feedback Loops critical: Microsoft's feedback loops provide essential data on why emails are marked as spam.
  • Engagement metrics: Outlook considers sender reputation, content, and user complaints beyond SPF/DKIM, and user engagement is a key factor to get into the Inbox.

Key considerations

  • Enhance Reputation: Focus on warming up a dedicated IP or leveraging a reputable email service.
  • Improve Content: Remove spam trigger words, fix HTML and remove broken links.
  • Ensure correct image DNS: Consider using a dedicated domain for image CDN rather than Azure.
  • Use DMARC: Implement DMARC.
  • Check DNS: Validate all DNS entries.
  • Code differences: Ensure code is unique so it doesn't match any known spam patterns
  • Set up Feedback Loops: Setup FBL with microsoft.
  • Analyze Email Headers: Use email header analysis to investigate what filters are flagging your emails.

What email marketers say
9Marketer opinions

Operational emails from G Suite hosted forms may land in Outlook spam despite correct SPF and DKIM due to factors beyond basic authentication. These include sender reputation (impacted by G Suite's shared IPs and sending volume/engagement), content quality (spam trigger words, poor coding, broken links), asset hosting locations, missing DMARC records, incorrect DNS configurations, and strict Microsoft filtering policies. User engagement and feedback loops are also crucial for deliverability.

Key opinions

  • Sender Reputation: G Suite's shared IP addresses can have a negative impact on sender reputation due to the sending practices of other users on the same IPs.
  • Content Matters: Spam trigger words, poor HTML coding, and broken links can cause emails to be flagged as spam, even with proper authentication.
  • Asset Hosting: The location of hosted assets (e.g., images) can affect deliverability, potentially triggering spam filters if associated with spammy content.
  • DMARC is Essential: Implementing DMARC is necessary in addition to SPF and DKIM to instruct receiving mail servers on how to handle emails that fail authentication checks.
  • Microsoft's Strictness: Microsoft is known for its strict filtering policies, requiring precise message header configurations and reverse DNS entries.
  • Spam Scoring: Checking your spam score helps reveal potential issues in your emails and how those might be interpreted by spam filters (e.g. using SpamAssassin).
  • Feedback Loops: Feedback Loops help provide data for diagnosing and addressing deliverability issues as they are reported by users.

Key considerations

  • Monitor Reputation: Regularly monitor your sender reputation using tools like Google Postmaster Tools and take steps to improve it by maintaining consistent sending volume and high engagement rates.
  • Improve Content Quality: Avoid spam trigger words, ensure clean HTML coding, and fix broken links to improve email content quality and avoid spam filters.
  • Implement DMARC: Set up a DMARC record to instruct receiving mail servers on how to handle emails that fail SPF and DKIM checks, and actively monitor DMARC reports.
  • Check DNS Records: Verify that SPF, DKIM, and reverse DNS records are correctly configured and up to date.
  • Consider Dedicated IP: If deliverability remains an issue, consider warming up a dedicated IP address or using a reputable third-party email sending service.
  • Message Headers: Tweak the message headers to contain all the proper fields.
  • Set up Feedback Loops: Set up feedback loops with providers, especially with Microsoft.
Marketer view

Email marketer from DigitalOcean tutorials explains that the DNS records have to be correct. Make sure the SPF record includes all possible sources of email from your domain, and DKIM keys are set up correctly. Ensure that the DKIM key size is adequate (2048 bits is now recommended).

July 2024 - DigitalOcean
Marketer view

Email marketer from Stackoverflow suggests implementing a feedback loop with Microsoft (if volume justifies it) to understand why emails are being marked as spam. Implementing DMARC is also essential.

April 2024 - Stackoverflow
Marketer view

Email marketer from Sender notes that content plays a vital role. Using spam trigger words, having poor HTML coding, and including broken links can all contribute to emails being flagged as spam. They suggest testing your email content using spam checking tools before sending.

May 2024 - Sender.net
Marketer view

Email marketer from Email on Acid explains that you need to check your spam score. This helps reveal potential issues in your emails and how those might be interpreted by spam filters. Tools like SpamAssassin offer insight.

July 2024 - EmailonAcid
Marketer view

Email marketer from Neil Patel suggests monitoring your sender reputation using tools like Google Postmaster Tools, and addresses factors beyond just SPF and DKIM. Focusing on consistent sending volume, engagement metrics (open rates, click-through rates), and removing unengaged subscribers is crucial for maintaining a positive sender reputation and avoiding spam folders.

October 2024 - Neil Patel
Marketer view

Email marketer from Email Geeks shares an experience where the location of their asset library (specifically, the domain) caused deliverability issues. Renaming the library's domain from “<https://companyassets.azureedge.net>…” to <https://companyassets.companycdn.com>…” resolved the problem.

November 2023 - Email Geeks
Marketer view

Email marketer from Reddit User responds that G Suite's shared IP addresses might have a poor reputation due to other users' sending practices. Suggests warming up a dedicated IP address or using a reputable third-party email sending service to improve deliverability. Also, check the IP isn't on any blocklists.

April 2024 - Reddit
Marketer view

Email marketer from Mailjet explains that transactional emails, despite being automated, must adhere to deliverability best practices. They recommends ensuring proper list hygiene, monitoring bounce rates, and segmenting your email list to send more targeted and relevant emails. Also, they suggest ensuring your sending IP is not blacklisted.

October 2021 - Mailjet
Marketer view

Email marketer from SuperUser forum responds that Microsoft is strict. You may need to tweak the message headers to contain all the proper fields. Also, consider checking for reverse DNS entries for your sending IP address.

January 2023 - SuperUser

What the experts say
5Expert opinions

Operational emails from G Suite hosted forms may land in Outlook spam despite correct SPF and DKIM because of factors like code similarity with spam emails, Azure image hosting with unchanged domains, low recipient engagement, poor sender reputation, problematic email content, and the absence of feedback loops. Addressing these issues is crucial to improve deliverability.

Key opinions

  • Code Similarity: If spammers use similar code for email generation, legitimate emails may be flagged as spam.
  • Azure Image Hosting: Hosting images on Azure and not changing the domain may cause deliverability problems.
  • Engagement is Key: Even with proper authentication, low recipient engagement can cause emails to be filtered as spam. Authentication is NOT deliverability.
  • Feedback Loops: Microsoft feedback loops provide data on why emails are marked as spam.
  • Holistic Outlook Filtering: Outlook considers content, sender IP/domain reputation, and user complaints, in addition to SPF/DKIM.

Key considerations

  • Code Uniqueness: Ensure your email code is distinct to avoid similarity with spam emails.
  • Image Hosting: Consider using a dedicated or different domain for hosting images.
  • Boost Engagement: Improve recipient engagement by sending relevant content and maintaining a clean email list.
  • Implement Feedback Loop: Set up a feedback loop with Microsoft to identify and address deliverability issues.
  • Monitor Reputation: Monitor sender IP and domain reputation and ensure email content doesn't trigger spam filters.
Expert view

Expert from Email Geeks suggests that if spammers also use similar code for generating emails, it might contribute to spam filters flagging the emails as spam.

March 2023 - Email Geeks
Expert view

Expert from Word to the Wise (Dennis Dayman) emphasizes the impact of email content and sender reputation on Outlook's filtering decisions. He suggests that Outlook considers various factors beyond SPF/DKIM, including the content of the email, the sender's IP and domain reputation, and user complaints. It's important to monitor your reputation and ensure your email content is not triggering spam filters.

December 2023 - Word to the Wise
Expert view

Expert from Email Geeks clarifies that the issue isn't necessarily hosting images on Azure itself, but rather hosting images on Azure and not changing the domain you point to in the email that caused delivery problems.

January 2023 - Email Geeks
Expert view

Expert from Spam Resource (Laura Atkins) explains that engagement is a critical factor. Even with proper authentication (SPF, DKIM), if recipients consistently don't open or interact with emails, Outlook will likely filter them to spam. Content relevance and maintaining a clean list are essential. In summary, Authentication is NOT deliverability.

March 2025 - Spam Resource
Expert view

Expert from Word to the Wise (Steve Jones) recommends setting up a feedback loop with Microsoft. This allows senders to receive reports about when their emails are marked as spam by recipients, providing valuable data for diagnosing and addressing deliverability issues. This will require you to provide a abuse@ email account.

March 2024 - Word to the Wise

What the documentation says
5Technical articles

Even with properly configured SPF and DKIM, operational emails from G Suite hosted forms may still land in Outlook spam due to various factors. Outlook's filters evaluate emails based on content, sender reputation, and user behavior. SPF may fail with intermediate mail servers, and DKIM signatures can break if messages are altered in transit. Also, DMARC is essential for handling emails that fail SPF/DKIM, and analyzing email headers can provide valuable insights into filtering reasons.

Key findings

  • Outlook's Holistic Filtering: Outlook's Junk Email Filter considers sender reputation, content, and user behavior, even with SPF and DKIM.
  • DMARC Importance: DMARC provides added security and improves deliverability by instructing mail servers on handling emails that fail SPF/DKIM.
  • SPF Limitations: SPF may fail if intermediate mail servers forward emails without proper authorization.
  • DKIM Fragility: DKIM signatures can break if messages are altered during transit or if DNS entries are incorrect.
  • Header Analysis: Analyzing email headers (specifically `X-Spam-Status` and `Authentication-Results`) is helpful for pinpointing the reasons for spam filtering.

Key considerations

  • Improve Sender Reputation: Take steps to improve sender reputation to avoid being flagged by Outlook's filters.
  • Implement DMARC: Implement DMARC to provide instructions on how to handle emails that fail SPF/DKIM.
  • Ensure SPF Accuracy: Verify that SPF records include all authorized sending sources and account for intermediate mail servers.
  • Maintain DKIM Integrity: Ensure DKIM signatures remain valid throughout transit and that DNS entries are correct.
  • Analyze Email Headers: Analyze email headers to identify the reasons behind spam filtering and adjust accordingly.
Technical article

Documentation from Microsoft Support explains that Outlook's Junk Email Filter automatically evaluates messages for spam characteristics. Several factors can cause emails to be marked as spam, including the sender's reputation, content, and whether the recipient has marked similar emails as junk in the past. Even with SPF and DKIM set up, content or user-defined rules can still trigger spam filtering.

October 2024 - Microsoft Support
Technical article

Documentation from DKIM indicates that DKIM failures can happen if the message is altered in transit, causing the signature to no longer match. Forwarding and changes by mailing lists can cause this. Also, having the wrong DNS entries can cause this.

December 2022 - DKIM
Technical article

Documentation from RFC notes that SPF is a technical method to prevent sender address forgery. It might fail if intermediate mail servers forward the email, but are not explicitly permitted to send emails on behalf of the domain. Also, having an SPF record is one part, the email server has to be configured to respect and check it.

November 2024 - RFC
Technical article

Documentation from SANS ISC answers that you need to analyze your email headers. Viewing the email headers can provide valuable insight into why the email may be getting flagged. They explain the importance of the `X-Spam-Status` and `Authentication-Results` headers to determine what triggered the spam filter.

July 2022 - SANS ISC
Technical article

Documentation from Google Workspace Admin explains the importance of DMARC in addition to SPF and DKIM. DMARC allows you to instruct receiving mail servers on how to handle emails that fail SPF and DKIM checks, providing an added layer of security and improving deliverability by preventing email spoofing.

April 2024 - Google Workspace Admin Help

No related resources found.