Case Studies
Explore our confidential case studies where Xpert Forensics uncovered digital fraud, insider threats, data leaks, and cyber misconduct using advanced forensic tools and investigative techniques. Each case reflects our commitment to precision, discretion, and delivering actionable insights that drive resolution.
Business Emails Going to Spam? Here's How We Diagnosed and Fixed the Problem
Introduction
Email is one of the most important communication channels for businesses. Whether you’re sending proposals, invoices, customer support responses, or marketing campaigns, ensuring your emails reach the recipient’s inbox is essential. However, many organizations face a common challenge: legitimate business emails consistently land in the spam folder.
This case study presents a real world email deliverability investigation for a business domain. By analyzing email headers, authentication records, DNS configuration, and email content, we identified why the emails were being classified as spam and provided practical solutions to improve deliverability.
If you’re experiencing similar issues, this guide will help you diagnose the problem and understand how to fix it.
Understanding How Email Deliverability Works
Before troubleshooting spam issues, it’s important to understand how modern email providers evaluate incoming messages.
When an email is received, providers such as Gmail, Outlook, and Yahoo perform several security and reputation checks, including:
- SPF (Sender Policy Framework)
- DKIM (DomainKeys Identified Mail)
- DMARC (Domain-based Message Authentication, Reporting & Conformance)
- Reverse DNS (PTR)
- Sender IP reputation
- Domain reputation
- Email content analysis
- User engagement
- Blacklist checks
Even if an email passes authentication, poor reputation or suspicious content may still cause it to be delivered to the spam folder.
The Problem
A business using Hostinger Email reported that emails sent from xpertforensics.in were consistently landing in Gmail’s spam folder.
The initial assumption was that the issue involved incorrect DNS records or missing authentication. However, the investigation revealed a different root cause.
Email Authentication Analysis
Component | Status | Analysis |
SPF | ✅ Pass | The sending IP is authorized for the attacker’s own domain. |
DKIM | ✅ Pass | The attacker signed the email using their own domain. |
DMARC | ❌ Not Present | No DMARC validation appears because the sender’s domain doesn’t publish/aligned DMARC. |
TLS | ✅ Yes | Encrypted transport does not imply trust. |
Domain Reputation | ❌ Poor | Suspicious, randomly generated domain. |
Brand Alignment | ❌ Fail | Claims to be a cloud storage provider but uses an unrelated domain. |
Phishing Indicators | ❌ Multiple | Numerous red flags. |
1. Fake Sender Domain
The sender claims: ka##########4
But the actual sending domain is: wy2px9j2v6.stacktrack824.pp.ua
The DKIM domain is: zgOljFmhaw.wy2px9j2v6.stacktrack824.pp.ua
This is a randomly generated subdomain under .pp.ua, which is not associated with any legitimate cloud storage provider. This immediately damages the sender’s reputation.
2. Display Name Spoofing
The display name is: k##########4
The real sender is: 9_148501-ovh-zgOljFmhaw@OJrKAravb.wy2px9j2v6.stacktrack824.pp.ua
This mismatch is a common phishing technique.
3. Misleading Subject Line
We’ve blocked your account!
Your photos and videos will be deleted…
Renew your subscription now!
This contains several high-risk characteristics:
- Fear
- Urgency
- Threat
- Data loss
- Payment request
- Emojis
Spam filters heavily weigh this type of language.
4. Fake Brand Impersonation
The email claims:
- Cloud storage
- Photos
- Videos
- Subscription renewal
But nowhere does it identify a legitimate company. Instead it links elsewhere.
5. Suspicious URL
The button links to: https://storage.googleapis.com/rog25/maloka.html…
Although the domain is: storage.googleapis.com
which belongs to Google Cloud Storage, the object hosted there is controlled by whoever uploaded it. Using trusted cloud providers to host phishing pages is a common technique. Spam filters inspect not only the domain but also the reputation of hosted content and redirect patterns.
6. HTML Template Used in Spam Campaigns
The email contains:
- Table-based HTML
- Inline CSS
- Single CTA button
- Generic footer
- No company address
- No contact information
These are common characteristics of mass phishing templates.
7. Missing Company Identity
Legitimate businesses normally include:
- Company name
- Physical address
- Phone number
- Support email
- Privacy Policy
- Terms
This email contains none of them.
8. Fake Unsubscribe Link
Both buttons point to the same phishing page.
Real newsletters usually have: unsubscribe.example.com or preferences.example.com
Using the same URL for “Update Payment” and “Unsubscribe” is highly suspicious.
9. Random Message-ID
9_148501.WGXYTBZISH…
Generated spam campaigns often use randomized Message-ID values to evade pattern detection.
10. Sender Reputation
Although SPF passed,
it only proves that the attacker is authorized to send mail for their own malicious domain.
SPF does not prove legitimacy. The same applies to DKIM.
Attackers can configure SPF and DKIM correctly on domains they control.
Why Gmail Sent It to Spam
Gmail uses machine learning and hundreds of reputation signals, not just SPF and DKIM.
This email likely scored poorly because of:
- Suspicious domain reputation
- Newly registered or low-reputation domain
- Brand impersonation
- Display name mismatch
- Phishing keywords
- Fear-based language
- Hosted phishing page
- Missing company identity
- Poor recipient engagement history
- Spam campaign fingerprint
How a Legitimate Sender Can Avoid Spam
If you are sending genuine business emails, follow these practices:
1. Use Your Own Domain
Instead of: example123.randomdomain.com
Use: info@yourcompany.com
2. Configure Authentication
Ensure:
- SPF = PASS
- DKIM = PASS
- DMARC = PASS
3. Publish a Strong DMARC Policy
Move from: p=none
To: p=quarantine
and eventually: p=reject
after verifying that all legitimate mail sources are authenticated.
4. Use Professional Subject Lines
Avoid:
URGENT!!
ACCOUNT BLOCKED!!
YOUR DATA WILL BE DELETED!!
Instead use:
Your Monthly Account Statement or Action Required: Update Your Billing Information
5. Include Company Information
Every business email should contain:
- Company name
- Website
- Physical address (if applicable)
- Support email
- Contact phone number
6. Avoid Spam Trigger Words
Examples include:
- Free
- Winner
- Urgent
- Act Now
- Click Here
- Congratulations
- Limited Time
- Guaranteed
Use clear, factual language instead.
7. Warm Up Your Domain
Send emails gradually to build a positive reputation:
- Start with low volumes.
- Send to recipients who expect your messages.
- Encourage replies and engagement.
- Avoid purchased mailing lists.
How to Fix Email Authentication Issues
The first step in resolving email deliverability problems is identifying which authentication component has failed.
1. SPF Failure
Symptoms
- SPF = FAIL
- Emails rejected or sent to spam
- Unauthorized sending server
Common Causes
- Missing SPF record
- Multiple SPF records
- Incorrect sending server
- Third-party service not included
Solution
Create a single SPF record that includes every authorized sending service.
Example: v=spf1 include:_spf.mail.hostinger.com ~all
If you also send mail through Google Workspace:
v=spf1 include:_spf.mail.hostinger.com include:_spf.google.com ~all
Only one SPF record should exist. After updating DNS, verify using Gmail’s “Show Original” or an SPF lookup tool.
Expected result: SPF = PASS
2. DKIM Failure
Symptoms
- DKIM = FAIL
- Invalid DKIM signature
Common Causes
- Missing DKIM key
- Incorrect selector
- DNS propagation issues
- Corrupted DNS record
Solution
- Enable DKIM in your email hosting panel.
- Publish the generated DKIM record.
- Wait for DNS propagation.
- Send another test email.
Expected result: DKIM = PASS
3. DMARC Failure
Symptoms
- DMARC = FAIL
Common Causes
- SPF and DKIM both fail
- Domain alignment failure
- Missing DMARC record
Solution
Create a DMARC record:
Host:
_dmarc
Value:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Once everything functions correctly, strengthen the policy.
v=DMARC1; p=quarantine;
Later:
v=DMARC1; p=reject;
Expected result:
DMARC = PASS
4. Reverse DNS (PTR) Failure
Symptoms
- Emails frequently go to spam
- SMTP rejection
- Poor sender reputation
Solution
Ask your hosting provider to configure the PTR record so that the sending IP resolves back to your mail server hostname.
5. Blacklisted IP Address
Symptoms
- Email rejected immediately
- Bounce messages mentioning Spamhaus, SpamCop, Barracuda, etc.
- Consistent spam folder placement
Solution
- Check blacklist databases.
- Remove the cause of the listing.
- Request delisting.
- Consider changing your outbound mail server if necessary.
6. Poor Domain Reputation
Symptoms
Authentication passes but emails still go to spam.
Solution
Build trust gradually.
- Send emails consistently.
- Avoid bulk emailing.
- Encourage recipients to reply.
- Remove inactive contacts.
- Monitor bounce rates.
- Never purchase email lists.
7. Spam-Like Email Content
Common Triggers
- Blank subject
- Excessive CAPITAL LETTERS
- Too many hyperlinks
- Image-only emails
- Large attachments
- Misleading subject lines
- Promotional keywords
Best Practices
- Write meaningful subjects.
- Include relevant content.
- Keep formatting professional.
- Include both HTML and plain text versions.
- Add a professional signature.
8. Incorrect MX Records
Symptoms
- Unable to receive emails
- Delivery failures
- SMTP errors
Solution
Verify your MX records with your hosting provider and remove any outdated or conflicting entries.
9. DNS Propagation
Symptoms
Authentication still fails after updating DNS.
Solution
Allow up to 48 hours for DNS propagation before testing again.
Email Deliverability Checklist
Before sending important business emails, verify the following:
Component | Expected Status |
SPF | PASS |
DKIM | PASS |
DMARC | PASS |
Reverse DNS (PTR) | Configured |
MX Records | Correct |
TLS Encryption | Enabled |
Blacklist Status | Clean |
Domain Reputation | Good |
Subject Line | Present |
Professional Signature | Added |
Email Content | Meaningful |
SMTP Configuration | Correct |
Best Practices for Long-Term Inbox Placement
To maintain strong email deliverability over time:
- Regularly monitor your DNS records.
- Review DMARC reports for authentication failures.
- Send emails only to recipients who expect them.
- Avoid spam-triggering language and excessive links.
- Keep your mailing lists clean and up to date.
- Monitor sender reputation using reputable deliverability tools.
- Send emails consistently rather than in irregular, high-volume bursts.
- Test important emails before sending them to customers.
Conclusion
This email demonstrates that passing SPF and DKIM does not guarantee that an email is legitimate or will be delivered to the inbox.
Although the message successfully authenticated using the attacker’s own domain, it exhibited multiple phishing indicators, including a suspicious sender domain, display name spoofing, a fear-based subject line, brand impersonation, and malicious links hosted on a public cloud platform.
These factors, combined with the sender’s poor reputation and deceptive content, allowed Gmail’s security systems to correctly identify the message as spam. This case highlights that modern email providers rely on a combination of authentication, sender reputation, content analysis, domain trust, and machine learning to detect phishing attempts.
Therefore, organizations should view SPF, DKIM, and DMARC as essential security controls, but not as the sole indicators of email legitimacy or successful inbox placement.