Why your emails land in spam

Four things decide your fate

Mailbox providers are not reading your email and judging its tone. They are running a filter and a reputation model. Four inputs dominate the outcome:

• Authentication. Can the provider verify that this message really came from your domain, and that nobody altered it on the way?
• Reputation. What is the historical record of the domain and the sending IP, and how do other recipients treat mail from it?
• Engagement. Do recipients open it, click it, reply to it, or rescue it from the spam folder?
• Complaints. How many recipients press "report spam", as a proportion of delivered mail.

SPF: a list of who is allowed to send for you

SPF is a DNS record — a TXT record on your domain — listing the servers permitted to send mail on your behalf. When a message arrives, the receiving server looks up the domain in the envelope's return path, checks whether the sending server appears in that list, and records a pass or fail.

Two things trip people up. First, SPF authenticates the envelope sender, which is often not the address your recipient sees in their inbox — so SPF passing does not by itself prove the visible From address is legitimate. Second, the lookup has a hard limit: each include: can spawn more lookups, and there is a small cap on the total. Every tool you connect that sends as you adds lookups, and once you exceed the cap the whole record fails rather than partially working. Aim for the hard-fail qualifier once you are sure the list is complete; the soft-fail version is a reasonable intermediate state, not a destination.

DKIM: a signature that proves nothing changed

DKIM puts a cryptographic signature on each message. Your sending system signs it with a private key; the matching public key lives in DNS under a selector you choose. The receiving server verifies the signature against the message it actually received.

The common failure is a mismatch. Your email platform signs with its own domain while your From address shows yours, so it verifies — but not for you. The signature has to be on the domain your recipients see. Most platforms let you add a custom sending domain and will hand you the DNS records; do that, rather than accepting the shared default.

DMARC: what to do when the other two fail

DMARC is a policy, published in DNS, that ties SPF and DKIM together and tells the receiving provider what to do with mail that fails both. It also has to align: the domain that passed authentication must match the domain in the visible From header, or the result does not count.

DMARC has three policy settings. p=none asks providers to deliver anyway and send you reports. p=quarantine asks them to send failing mail to spam. p=reject asks them to refuse it outright. There is also a subdomain policy, which matters more than most people realise, because a subdomain with no DMARC record of its own is an open door for spoofing.

A DMARC record also lets you request aggregate reports: XML files, sent daily, listing who is sending as your domain, from which IPs, and how much of it authenticates. Those reports are unreadable by hand and easily parsed by a monitoring tool. They are also the only way to find out what you do not know about your own domain — forgotten marketing tools, a website contact form, an invoicing system, someone's personal mail client.

The order to set this up in

Doing this in the wrong order breaks live mail. The sequence that works:

• Inventory your senders. Every system that sends mail from your domain, including the ones nobody remembers. This is the step people skip, and the one that causes outages.
• Publish SPF with every known sender included and a soft-fail qualifier. Verify each sender still delivers.
• Enable DKIM on your own domain for each sender, and confirm the signatures verify.
• Publish DMARC at p=none with a reporting address. Change nothing yet, and watch the reports for several weeks.
• Fix the alignment problems the reports reveal, one sender at a time.
• Move to p=quarantine, then after a clean period to p=reject. Add a subdomain policy once you know what legitimately sends from subdomains.

Domain reputation is the asset you are building

Reputation attaches to the sending domain and the sending IP. It is built slowly over months and damaged quickly over days. A provider that has seen a year of wanted mail from your domain will give you the benefit of the doubt; one that has seen three weeks of complaints will not.

Two structural decisions matter. First, separate your mail streams: transactional messages — receipts, password resets, booking confirmations — should not share a sending domain or IP with bulk marketing. If marketing damages reputation, you do not want password resets going to spam. Second, decide between shared and dedicated IPs deliberately. Shared infrastructure is fine and cheaper at low volume; a dedicated IP gives you control and requires enough consistent volume to keep it warm.

Warm-up: earn the volume

A new domain or IP has no reputation, so providers watch what happens when it sends. Warm-up is the process of starting small and increasing volume as the signals stay clean. Send first to the people most likely to engage — recent buyers, active subscribers, people who opted in this month. Increase gradually over weeks, not days. Watch bounces, complaints and inbox placement at every step, and stop increasing if any of them degrade.

Never warm up with your oldest, coldest segment; that teaches a provider your mail is unwanted. And keep the volume steady. A domain that sends consistently is easier to trust than one that is silent for five weeks and then sends a hundred thousand messages on a Tuesday.

List hygiene: the unglamorous half

• Hard bounces are permanent. The address does not exist. Remove it immediately, on the first bounce, automatically. Continuing to mail a hard-bounced address is one of the clearest signals of a sender who does not manage their list.
• Soft bounces are temporary — a full mailbox, a greylisting server. Retry briefly, then suppress the address if it keeps failing. Repeated soft bounces are hard bounces in slow motion.
• Spam traps exist only to catch bad senders. Some are published and never opt in to anything; others are abandoned addresses recycled after years of inactivity. You cannot identify them in advance. The defence is to mail only people who opted in, and to stop mailing people who never engage.
• Sunset the disengaged. Someone who has not opened or clicked in a long period is not a subscriber in any meaningful sense. Run a re-engagement sequence, and if there is no response, stop mailing them. A smaller engaged list out-delivers a larger one that includes the quiet.

Confirmed opt-in — the double opt-in covered in our SMS guide — is the strongest hygiene measure available, because it removes typos and trap addresses before they enter the list.

Engagement signals, and what you can measure

Providers increasingly weight engagement: whether recipients open, click, reply or rescue your message from spam. This is why clean segmentation beats raw volume.

There is a complication. Open tracking has become unreliable, because mailbox providers now proxy or block tracking pixels and some pre-fetch images. An "open rate" is a directional signal at best, not a measurement. Treat clicks and replies as the hard signals and opens as a soft one.

What you can act on: click and reply rates by segment, complaint rates, bounce rates, and how providers categorise your mail. Sending to seed inboxes at the major providers gives a rough read on placement — inbox, tab or spam — and is worth running before every large send.

Why buying a list damages deliverability permanently

A purchased list contains three kinds of address. A few belong to people who might plausibly be interested. Many are stale. And some are traps, placed there precisely to identify senders who mail people who never opted in. There is no filter that separates the three. When you send, you receive a spike in complaints from people who do not recognise you, and a spike in hard bounces from addresses abandoned years ago. Providers read both as evidence, and they do not forget.

The consequences compound. Complaint rates rise, so the provider starts routing your mail to spam. Once some mail goes to spam, engagement falls, which pushes the next send further towards spam. Blocklists pick up the sending IP, affecting every other business sharing it. Recovery is slow and open-ended, and often the fastest route back is a new sending domain and a warm-up from zero — abandoning the reputation you spent a year building.

There is also the legal layer. Unsolicited marketing email to people in the EU is illegal, in the same way cold SMS is: consent is required under the ePrivacy Directive as implemented nationally, and the GDPR governs the data itself. Under the GDPR you must also tell people where you got their data — "we bought it" is an answer that invites a complaint rather than closing one. The narrow existing-customer exception some member states allow is limited to similar products and customers who gave you their details directly. It does not transfer to a purchased list, and it does not cover people who never dealt with you.

No commercial list is worth a domain reputation. The list is a one-off cost; the reputation is what makes every future campaign possible.

Where most people get this wrong

The most common error is treating deliverability as a copywriting problem. When mail goes to spam, the instinct is to rewrite the subject line and remove the word "free". Sometimes that helps at the margin. Almost always, the real causes are that a sender is missing from the SPF record, that the DKIM signature is not aligned with the visible From domain, or that the list includes a large segment of people who never asked to hear from you. Fix the plumbing and the list before you fix the prose.

The second is measuring success by delivery. "Delivered" only means the receiving server accepted the message. It says nothing about the inbox, the promotions tab, or the spam folder. A campaign with a near-perfect delivery rate and a placement problem looks fine in most dashboards, right up until you look at revenue.

The short version

• SPF, DKIM and DMARC in that order, starting DMARC at p=none with reports before you enforce anything.
• Align DKIM with the domain your recipients actually see. A signature on someone else's domain does not protect you.
• Separate transactional and marketing sending, then warm up slowly on your most engaged contacts.
• Remove hard bounces on the first bounce, and sunset subscribers who have not engaged in a long time.
• Never buy or rent a list. It is illegal in the EU without consent, and it damages the domain reputation your whole business depends on.