Emails Going to Spam After Moving to Microsoft 365 or Google Workspace?

Moving to Microsoft 365 or Google Workspace should make your email more reliable. If your emails started going to spam the week you moved, the new provider is rarely at fault. The usual cause is that the records on your domain still describe the old set-up.

Your emails now leave from a different company’s servers. Receiving providers check your domain’s DNS records to see whether those servers are allowed to send for you.

If the records still point at the old host, or the new provider’s signing was never switched on, your emails look unverified. Unverified email from a business domain goes to spam, and increasingly gets refused.

Work through the causes below in order. The first three account for most cases.

SPF is the list of servers allowed to send email for your domain. After a move it needs to name the new provider.

A complete record for a business that only sends through Microsoft 365 is v=spf1 include:spf.protection.outlook.com -all.

Two mistakes are common. The first is leaving the old host’s entry in place and never adding the new one. The second is adding a second SPF record next to the old one. A domain may only have one SPF record, and two make both invalid.

This is the one most often missed, because email works without it.

Both providers sign your emails from day one, but with their own domain rather than yours. Microsoft 365 uses an address ending in onmicrosoft.com. Google uses one ending in gappssmtp.com. The signature is valid, but it does not match your From address, so it does not count towards DMARC.

Microsoft 365:

1. Sign in to the Microsoft Defender portal at security.microsoft.com as an administrator.
2. Go to Email & collaboration, then Policies & rules, then Threat policies, then Email authentication settings, and open the DKIM tab.
3. Select your own domain, not the one ending in onmicrosoft.com, and choose ‘Create DKIM keys’.
4. Add the two CNAME records it shows you (selector1._domainkey and selector2._domainkey) to your domain’s DNS. Copy the values exactly as shown.
5. Return to the portal and turn on ‘Sign messages for this domain with DKIM signatures’.

Google Workspace:

1. Sign in to the Admin console at admin.google.com.
2. Go to Apps, then Google Workspace, then Gmail, then ‘Authenticate email’.
3. Select your domain and choose ‘Generate new record’.
4. Add the TXT record it shows you, named google._domainkey, to your domain’s DNS.
5. Return to the Admin console and choose ‘Start authentication’.

DNS changes can take up to 48 hours to be seen, though an hour is more typical.

If your domain has no DMARC record, add one. Start with v=DMARC1; p=none; rua=mailto:you@yourcompany.co.uk, which monitors without blocking anything.

If your domain already had a strict policy (p=quarantine or p=reject) before the move, that is likely the direct cause. The policy is telling providers to send anything that fails to spam, and your new provider’s emails are failing until causes 1 and 2 are fixed.

My guide to SPF, DKIM and DMARC explains how the three work together.

Your staff mailboxes moved. Other things that send email as your domain often did not:

• the contact form on your website
• an office scanner or printer that emails scans
• accounts, booking or CRM software that sends invoices and reminders
• a newsletter tool

These may have relied on the old host, or were never authorised at all. List everything that sends email as your domain. Each one needs adding to your SPF record, giving its own DKIM set-up, or both.

For website forms, see Contact form not sending emails?.

Microsoft 365 gives every user a second address ending in onmicrosoft.com. If a mailbox was set up in a hurry, that can end up as the address emails are sent from.

Microsoft limits how much email can be sent from onmicrosoft.com addresses, and recipients’ filters treat them with suspicion. Check that each user’s main address is on your own domain.

A domain that has just started sending from new servers has no track record there. Normal one-to-one email is fine. A sudden mailshot to your whole customer list from a brand-new set-up is the pattern spam filters look for.

Send newsletters and bulk announcements through a proper mailing service, not from a staff mailbox. Both Microsoft 365 and Google Workspace are built for person-to-person email and restrict bulk sending.

1. Send a normal email from your business address to a personal Gmail address and an Outlook.com address.
2. Open each one and view the full headers. My guide to reading email headers shows where to find them.
3. Find the Authentication-Results line. You want spf=pass, dkim=pass with your own domain next to it, and dmarc=pass.

If DKIM shows onmicrosoft.com or gappssmtp.com instead of your domain, cause 2 is your problem.

Once the records are right, new emails pass their checks within hours. Your reputation with each provider recovers more slowly, usually over one to three weeks of normal sending.

You can speed it up. Ask regular contacts to mark your email as ‘Not spam’ and add you to their contacts. Both actions tell the provider your email is wanted.

A new mailbox has a new spam filter that knows nothing about who you deal with. Expect it to be over-cautious for the first few weeks.

Check the spam folder (Junk Email in Outlook) daily at first, and mark genuine emails as ‘Not junk’. On Microsoft 365, an administrator should also check the quarantine in the Defender portal, where some messages are held before they reach any mailbox.

If you have not moved yet, my guide to switching email provider without losing emails includes a checklist that avoids most of this.

Need help fixing this?

I provide:

• Free initial assessment
• Clear explanation of the issue
• Fixed-price solutions
• UK-based support

Tell me which provider you moved to and when, and I’ll check your domain’s records and tell you what was missed.