Will emails from a .xyz or .io address go to spam?
Not automatically. Gmail and other filters judge authentication (SPF, DKIM, DMARC) and your sending reputation, not the extension alone. But .xyz carries a bad-neighbourhood tax: Interisle's 2025 data shows about six times the phishing rate of .com, so some filters and cautious customers distrust it. .io is not among the 20 most-abused TLDs.
Updated October 19, 2026 · 5 primary sources, listed below
What spam filters actually check
Inbox placement is decided mostly by authentication and reputation. Google’s Gmail sender guidelines, enforced since February 1, 2024, require every sender to personal Gmail accounts to set up SPF or DKIM and keep the spam rate reported in Postmaster Tools below 0.3%. Senders of 5,000 or more messages a day also need SPF and DKIM, a DMARC record (p=none is acceptable), a From domain aligned with SPF or DKIM, and one-click unsubscribe on marketing mail. None of these rules mention the TLD.
New domains are a bigger risk than odd extensions. A March 2022 post on Spamhaus’s resource hub (written by the XYZ registry) notes that most spam protection companies flag a newly registered domain in any TLD for roughly its first 30 days. Warm up slowly with mail people expect.
Where the extension does hurt: abuse-heavy neighbourhoods
Filters and security teams do score TLDs by how much abuse they host. Interisle’s Phishing Landscape 2025 (May 2024 to April 2025) counts phishing domains per TLD and a phishing score: phishing domains per 10,000 domains registered.
| TLD | Rank by count | Domains registered | Phishing domains | Score per 10k |
|---|---|---|---|---|
| .top | 2 | 3,525,239 | 187,749 | 532.6 |
| .xyz | 4 | 4,219,839 | 73,509 | 174.2 |
| .shop | 5 | 3,321,636 | 50,052 | 150.7 |
| .com | 1 | 154,712,032 | 455,297 | 29.4 |
| .net | 10 | 12,352,692 | 31,743 | 25.7 |
| .org | 16 | 11,185,745 | 24,111 | 21.6 |
Source: Cybercrime Information Center (Interisle), top TLDs by phishing domains, May 2024 to April 2025. .io does not appear in the top 20.
So a .xyz domain is about six times as likely as a .com to be a phishing domain (174.2 vs 29.4 per 10,000). That is why some corporate filters and cautious recipients treat .xyz mail with suspicion even when your own record is clean. Cloudflare’s March 2024 analysis of its 2023 email traffic found TLDs such as .uno, .sbs, .best, .top and .monster had over 95% of their email flagged as spam or malicious. By sheer volume, .com still carried 67% of all spam and malicious email.
Our verdict by extension
- .io: fine for customer email. Not an abuse hotspot; authenticate properly and you will land in the inbox.
- .xyz: workable for a site, risky for cold or transactional email to businesses. If email matters, send from a .com or a ccTLD and keep .xyz for the web.
- Abuse-heavy TLDs (.top and similar): avoid for any domain you send email from.
Worried about other trust signals? See is .xyz legit and .xyz vs .com.
Common questions
What does Gmail actually require?
Since February 2024, every sender to personal Gmail accounts needs SPF or DKIM and a spam rate below 0.3% in Postmaster Tools. Senders of 5,000+ messages a day need SPF and DKIM, a DMARC record (p=none is allowed), From-domain alignment and one-click unsubscribe on marketing mail.
Why does a brand-new domain land in spam?
Most spam filters flag a newly registered domain in any TLD for roughly its first 30 days. Send small volumes to people who expect your mail, then ramp up. This hits a new .com just as much as a new .xyz.
Is .io treated as risky for email?
.io does not appear in Interisle's top 20 TLDs for phishing domains in the May 2024 to April 2025 period. Its reputation is closer to .com than to cheap promotional TLDs.
Which TLDs are actually spammy?
In Cloudflare's 2023 email data, over 95% of messages from TLDs such as .uno, .sbs, .best, .top and .monster were spam or malicious. Interisle's 2025 phishing score puts .top at 532.6 phishing domains per 10,000 registered, versus 29.4 for .com.
Sources
- Interisle Consulting Group, “Phishing Landscape 2025 (May 2024 to April 2025)” (September 1, 2025).
- Cybercrime Information Center (Interisle), “Phishing activity in TLDs, May 2024 to April 2025” (September 1, 2025).
- Cloudflare Blog, “Top-level domains and email phishing threats (Joao Tome)” (March 26, 2024).
- Google Gmail Help, “Email sender guidelines” (February 1, 2024).
- Spamhaus Resource Hub, “XYZ's best practice on new domains and email deliverability (guest post by the XYZ registry)” (March 16, 2022).
Extensions on this page
More straight answers
- Will using a non-.com domain hurt my Google rankings?
- Starting an app in Brazil: should you use .com.br or .com?
- Can I register a .de or .ca domain if I don't live in that country?
- Should I buy the .net and .co versions of my domain to protect my brand?
- Is it risky to build my company on a .io domain because of the Chagos Islands deal?
- How much will a .ai domain cost over 5 years, including renewals?
- Why does my .dev site require HTTPS, and can I turn it off?