Most of the time it is authentication, not content. If your SPF, DKIM or DMARC records are wrong or incomplete, receiving servers treat your mail as suspicious no matter how ordinary the message is.
The four usual causes
- No SPF record, so nothing tells receiving servers which systems may send for you
- SPF over the lookup limit. SPF permits ten DNS lookups; past that the entire record fails while still looking correct in a listing
- DKIM not signing, often because a provider rotated its key and the DNS record was never updated
- No DMARC, which means receiving servers have no instruction and default to caution
Why testing it yourself does not work
Sending to a colleague at the same domain tests almost nothing, because internal mail usually bypasses these checks entirely. You need to know whether authentication passes for an external recipient, which is a different question.
What to check first
The lookup count in your SPF record, because that is the failure that hides best. A record can list all the right senders, be perfectly formed, and fail completely.
This is the short version. The full guide covers it properly: read more.
If there is no SPF record at all, publishing one is the first step.
The headers usually answer this: reading email headers.