Email Deliverability: Why Authenticated Emails Still Land in Spam

Email deliverability is whether your message reaches the inbox rather than the spam folder, and it is decided by three factors: technical infrastructure, list quality, and sending behaviour. Authentication is one item inside the first factor. Getting it right is necessary, and it is nowhere near sufficient.

That gap explains the most common complaint in email marketing. SPF passes. DKIM passes. DMARC is published. Every checker shows green — and the mail still lands in spam. The records did their job. Their job was never inbox placement.

This guide identifies which of the three factors is broken on your domain, and gives the order to fix them in.

---

The short answer

Authentication is a door key, not an invitation. SPF, DKIM, and DMARC let Gmail verify that a message genuinely came from your domain. They carry no information about whether recipients open, reply, ignore, or report your email — and that behavioural evidence is what decides placement.

Five causes account for nearly every authenticated-but-filtered case:

1. Reputation — the domain has a sending history, and it isn't good
2. Engagement — the list contains people who don't read you
3. List quality — how the addresses were collected is poisoning everything downstream
4. Sending pattern — volume or cadence that reads as automated in the wrong way
5. Alignment — records that pass individually without aligning, a separate failure that looks identical from outside

Each cause has a distinct symptom. The diagnostic table below separates them in about ten minutes.

Check your own domain while you read. The Email Domain Scanner verifies MX, SPF, and DMARC in one pass, and the SPF Lookup Checker counts your DNS lookups against the limit that silently breaks SPF. Both are free, and neither asks for your email address.

---

What email authentication actually proves

Three DNS records do three separate jobs, and precision about them resolves most of the confusion behind "I set it all up and nothing changed."

SPF (Sender Policy Framework) is a DNS record listing which mail servers may send on behalf of a domain. The receiving server checks the sending IP against that list. SPF answers: is this server allowed to send as this domain?

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to each message, validated against a public key in DNS. DKIM answers: did this message come from this domain, and was it altered in transit?

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together and instructs receivers on failure. DMARC answers: if SPF or DKIM doesn't check out, deliver, quarantine, or reject?

None of the three answers the question that decides placement: should this person receive this email?

That question is settled elsewhere, by evidence each provider has been accumulating about your domain for as long as you have been sending. Authentication gets a message evaluated. It does not decide the evaluation.

The one-line version: authentication is identity, not reputation. Passing it means Gmail knows who you are — including when who you are is someone whose mail people delete unread.

DMARC alignment: the failure that looks like a pass

DMARC requires alignment, not merely a pass. The domain in the visible From: address must match the domain that SPF or DKIM validated.

A message whose From: reads hello@yourbrand.com while DKIM signs under mail.esp-provider.com produces a clean SPF pass, a clean DKIM pass, and a DMARC failure — because neither authenticated domain matches the one the recipient sees.

Most sending platforms sign under their own domain until a custom sending domain is configured. That single unfinished setup step accounts for a large share of "but it all says pass" cases.

The setting always lives in the same conceptual place — domain authentication, not campaign settings. In MailerLite it is Account settings → Domains → Add domain; in Klaviyo, Settings → Domains → Dedicated Sending Domain; in Mailchimp, Settings → Domains → Authenticate domain. Until it shows as verified, mail goes out under the platform's identity and DMARC alignment cannot pass regardless of how correct the records look.

Full record syntax and the platform-by-platform paths are in email authentication: SPF, DKIM, DMARC and BIMI. The Email Deliverability Playbook covers the same ground in Chapters 7 and 8, with the exact menu path for every major platform and a worksheet that confirms alignment before you send.

---

The three factors that decide inbox placement

Inbox providers ask one question about every message: do people want this? Hundreds of signals answer it, and nearly all of them roll up into three factors a sender controls directly.

Failing any one factor cannot be compensated by the other two. A perfectly authenticated email to a list of people who never open anything gets filtered. Excellent copy from a domain with no reputation gets filtered.

Factor 1 — Technical infrastructure: can we trust who you are?

• Authentication — SPF, DKIM, and DMARC, aligned. Mandatory for bulk senders at Gmail, Yahoo, and Microsoft since 2024. Failures produce rejection, not filtering.
• Domain and IP reputation — every domain carries a per-provider reputation score. A new domain has none, which differs from having a good one.
• Valid DNS and TLS — forward and reverse DNS must resolve and connections must be encrypted.
• Consistent sending patterns — nothing for a month, then 100,000 messages in a day, reads as exactly what it looks like.

This is the factor most senders fix first, because it comes with a checklist. It is also the factor that is usually already fine by the time someone searches for why their emails are in spam.

Factor 2 — List quality and engagement: do people want your mail?

• Collection method — bot-filled forms, incentive-only signups, and purchased addresses poison everything downstream. This is the single biggest predictor of long-term deliverability, and it is decided before a single message is sent.
• Recipient selection — mailing subscribers inactive for six months tells Gmail that this sender mails people who ignore them. Engagement rate is the strongest single reputation signal available.
• Hygiene — bounces, spam traps, and dead addresses accumulate on every list, including well-built ones.

Authenticated senders who are still struggling should start here. Most of the problem lives in factor two.

Factor 3 — Content and sending behaviour: does this look like spam?

• Formatting and structure — image-only emails, broken HTML, missing plain-text part
• Link reputation — a sender inherits the reputation of every domain linked to
• Sending cadence — volume spikes, irregular schedules, abrupt frequency changes
• Sameness at scale — filters do not punish AI-written text; they punish thousands of near-identical messages with no variation

---

Links: the factor almost nobody checks

Every domain you link to lends you its reputation, and borrows yours. This is the most overlooked item in factor three, and it produces spam placement that survives every authentication fix a sender can make.

Four rules cover it:

• Never use public link shorteners — bit.ly, tinyurl and similar. Anyone can hide anything behind them, spammers do constantly, and those domains carry the baggage.
• Configure a custom tracking domain so click links resolve under your own domain rather than your platform's shared one. A From: at yourbrand.com whose every link points somewhere unrelated looks like phishing.
• Don't over-link. Every additional domain is another reputation you are vouching for.
• Make link text descriptive. "Read the full guide" beats "click here" — for humans, for screen readers, and for filters assessing whether a message is deceptive.

A single bad linked domain can undo good infrastructure, which is why this belongs on the checklist alongside SPF. The Deliverability Playbook Chapter 20 has the full content and design treatment, including the text-to-image balance and the plain-text multipart requirement that corporate gateways check for.

---

Which factor is broken? A symptom-to-cause diagnostic

Match the symptom, check the likely cause, stop when it is found. The ordering puts the fastest-to-confirm causes at the top.

Symptom	Most likely cause	Where to look first
Nothing arrives; delivered count collapsed	Authentication rejection at the server	Bounce logs for 550 5.7.515 or 550 5.7.26
Everything reports "pass" but DMARC fails	Alignment, not authentication	Whether DKIM signs under your domain or the platform's
Gmail opens at 8%, Outlook at 30%	Gmail specifically has flagged the domain	Postmaster Tools compliance status and spam rate
Opens fell from ~25% to ~12% over a few sends	Spam foldering, reputation-driven	Recent sends to unengaged segments; complaint rate
Delivered fine, almost nobody opens	Promotions tab, not spam	Seed test — check the tab, not just the inbox
Delivery delayed by an hour to a scattered minority	Greylisting — harmless	4xx codes in the logs; no action needed
New domain, low volume, immediate filtering	No reputation yet, sent too fast	Volume ramp and the first segment mailed
Bounce rate above 2%	Dirty or inherited list	Signup source and last verification date
Complaint rate above 0.1%	List or expectation mismatch	What was promised at signup versus what gets sent
Clicks look excellent, nobody replies (B2B)	Corporate gateways scanning links	Whether "clicks" arrive seconds after send, on every link
Transactional mail failing while campaigns work	Wrong sending path entirely	Whether the site sends via PHP mail instead of SMTP

Two rows deserve expansion.

Greylisting is not a problem. Some receiving servers temporarily reject mail from unfamiliar senders — a "try again later" signal — knowing real mail servers retry and crude spam software often doesn't. Your platform retries, the mail arrives, and the delay fades as the server learns you. Delayed-but-delivered to a scattered minority with 4xx codes in the log is greylisting. Rejected outright with a 5xx naming a policy or blocklist is not.

B2B click rates are frequently fiction. Corporate gateways — Mimecast, Proofpoint, Barracuda, Microsoft Defender — open every URL in a sandbox before delivery, which your platform logs as a click. On B2B lists this manufactures click rates that look excellent and mean nothing, often registering within seconds of send, sometimes on every link including the unsubscribe. If your engagement segmentation is click-based and half your clicks are robots, your engaged segment is partly a sandbox. Lean on replies, meetings, and site sessions instead.

Transactional mail deserves separate attention — order confirmations and password resets fail for structurally different reasons than marketing campaigns, covered in WordPress emails not sending.

---

How to confirm emails are landing in spam

Locating the mail comes before changing anything, and it requires no paid software.

The 60-second seed test:

1. Create two or three fresh test inboxes — one Gmail, one Outlook or Hotmail, one Yahoo if the audience uses it.
2. Subscribe them to the list, or add them in the sending platform.
3. Send the next campaign with those addresses included.
4. Open each one and look, without searching.

The result maps directly to the problem:

• Primary inbox — healthy.
• Promotions tab (Gmail) — delivered but largely invisible, with open rates roughly halved. Not a reputation emergency. See how to stay out of the Gmail Promotions tab.
• Spam or Junk folder — an active reputation problem, and the first thing to fix.
• Nothing arrives — critical. Non-compliant bulk mail is rejected at the server by Gmail and Microsoft.

Two caveats govern the result. Test with inboxes that have no history with the brand — a personal Gmail that opens everything always shows the inbox, which is a false positive. And seed inboxes carry no engagement history, so they run pessimistic. Real subscribers who want the mail often place better than seeds suggest.

A seed test is a smoke alarm, not a precision instrument.

Google Postmaster Tools: the provider's own verdict

Google Postmaster Tools is free and reports compliance status, spam rate, and authentication results exactly as Gmail sees them. No third-party checker carries the same authority, because no third party is making the filtering decision.

Google retired the Domain Reputation and IP Reputation grades in September 2025. The High / Medium / Low / Bad ladder no longer exists, and what replaced it is more useful — a plain Pass / Needs Work compliance verdict against Gmail's published requirements, alongside spam rate, authentication pass rate, encryption, delivery errors, and feedback loop data.

One thing catches out small senders: Postmaster needs volume before it shows anything. Below roughly 100 messages a day to personal Gmail addresses the charts are usually blank; 300–999 a day starts to be reliable; above 1,000 a day the error and reputation data becomes properly interpretable. A blank dashboard is not a broken dashboard.

Yahoo offers a comparable Sender Hub. Microsoft offers SNDS, plus JMRP, which emails you a copy of every Outlook complaint so the complainer can be suppressed immediately. Gmail has no per-complainer feedback loop at all — the aggregate spam rate is the substitute, which is exactly why watching it is not optional.

Reading each chart properly is in how to read Google Postmaster Tools, and the ten-minute weekly routine that uses it is Chapter 27 of the Playbook.

---

Delivery rate versus deliverability

These two metrics are constantly confused, and the confusion is why placement problems go undetected for weeks.

Delivery rate measures whether the receiving server accepted the message. That is its entire meaning. It carries no information about which folder the message entered.

Deliverability — precisely, inbox placement — measures whether the message reached the inbox where someone might read it.

Sending platforms report the first, label it "delivered," and display 99%. Every one of those messages can be sitting in spam, because a message routed to the junk folder was still delivered. Senders sit at 99% delivered and 55% inbox placement for years without noticing.

The number that carries diagnostic weight is open rate split by provider. Gmail at 8% while Outlook sits at 30% is not a copy problem. It is Gmail specifically deciding something about the domain.

---

The thresholds that trigger filtering

These are the lines providers themselves draw. They apply regardless of industry, list size, or content quality.

Metric	Healthy	Warning	Emergency
Spam complaint rate	Under 0.05%	0.05–0.1%	Over 0.1% (0.3% = crisis)
Bounce rate	Under 1%	1–2%	Over 2%
Unsubscribe rate	Under 0.3%	0.3–0.5%	Over 0.5%
Delivery rate	Over 99%	98–99%	Under 98%
Authentication	All pass and aligned	Any warning	Any fail

A metric outside the healthy column is a real problem regardless of what an industry benchmark says.

Complaint rate deserves specific attention. Google's guidance is to keep spam rates below 0.1% and never reach 0.3%. Crossing 0.3% costs eligibility for Gmail's mitigation support until the rate holds below the line for seven consecutive days. Complaint rate is also the best early warning available — it moves before revenue does.

One trap worth knowing: once you are being spam-foldered, fewer people can complain, because fewer people see the mail. A falling complaint rate alongside falling opens is bad news, not good.

Industry benchmark ranges for opens and clicks are in email marketing benchmarks — and one warning about reading them anywhere: click rates are usually quoted against delivered, while many platforms report click-to-open. If your platform reports CTOR, expect roughly 3–4× the published click figures, and don't mistake that for outperformance.

---

Sender reputation: the thing authentication cannot buy

Sender reputation is a score each provider maintains about a domain, built from how recipients have historically behaved toward its mail. Opens, replies, deletions without opening, moves to spam, moves out of spam, and unsubscribes all accumulate into it.

Authentication is the price of admission. Reputation is what gets a sender seated.

Three properties of reputation explain most confusing cases:

A new domain has no reputation, which is not the same as a good one. With no history, providers apply caution by default. Sending 5,000 messages on day one from a domain that has never sent anything reads as exactly what a spammer would do. Warm-up exists for this reason, and it takes three to six weeks done properly.

Reputation is per-provider. Gmail's opinion and Microsoft's are separate, formed from separate evidence, and frequently differ sharply. Microsoft is notably stricter with newer domains and slower to forgive.

Reputation is earned back slowly and lost quickly. One aggressive send to a large unengaged segment can undo months.

The mechanism is worth internalising: engagement rate is the strongest single input to reputation. The most effective deliverability fix available to most senders is therefore not technical. It is mailing fewer people, more of whom want to hear from them.

The arithmetic makes the case. A 20,000-person send at 12% opens puts the message in front of 2,400 people and damages reputation. A 6,000-person send to engaged subscribers at 40% opens puts it in front of 2,400 people and improves reputation. Same reach today, opposite trajectory tomorrow.

Put a number on your own gap. The Deliverability Revenue Calculator models what a ten- and twenty-point open-rate improvement is worth against your actual list size and order value. It is the same calculation as Worksheet 1.1 in the Playbook, and it is usually the number that decides whether this work gets scheduled.

---

The order to fix deliverability in

Sequence matters more than effort, because some fixes cannot take effect until earlier ones do.

1. Confirm the problem and locate it. Seed test plus Postmaster Tools. Spam, Promotions, and outright rejection need different responses.

2. Stop making it worse. Pause broadcasts to the full list for two to three days. Every send to an unengaged segment while already flagged deepens the hole.

3. Fix authentication properly, including alignment. Verify that DKIM signs under your own domain, that SPF has one record rather than several left over from a migration, and that alignment passes. In 2026 this alone resolves a large share of sudden spam problems.

4. Clean the list. Remove invalid addresses and suppress subscribers with no engagement in 180+ days. On an inherited list, verification routinely removes 5–20%; above 30% means the list was purchased or is very old.

5. Rebuild positive signals deliberately. Send only to 30-day openers. Plain, personal, reply-inviting emails outperform designed campaigns here, because replies are among the strongest positive signals available.

6. Widen back out gradually. 30-day openers, then 60, then 90, watching complaint rate at each step. A rise means stop and hold.

7. Resume normal sending with monitoring. The mistake that undoes a successful recovery is returning straight to the sending pattern that caused the problem.

How long this takes, honestly: Promotions-tab fixes can show within one or two sends. Mild spam foldering usually clears in two to three weeks. Genuine reputation repair takes four to eight weeks of good behaviour, and severe damage takes the full eight even done perfectly. If your spam rate crossed 0.3% at Gmail, add the seven-day hold below the line before mitigation support resumes. Anyone promising an overnight fix for a damaged reputation is selling something.

Emails that went to spam overnight follow a different, more urgent sequence — covered in why your emails suddenly went to spam.

---

What this article deliberately leaves out

This page is the complete diagnosis. It tells you which of the three factors is broken and the order to address them in.

What it does not contain is the procedure — and that distinction is deliberate rather than coy:

• The 14-day implementation plan that turns the seven steps above into scheduled 30-minute blocks
• The 100-point audit scorecard that produces a number and a grade, so you can measure the same domain again in a month and prove the change
• The fix / rebuild / start-over decision table for the fork where most expensive mistakes get made — people abandon domains that were recoverable, or spend months on domains that are gone
• Ten copy-paste templates — re-engagement sequence, re-permission email, blocklist removal request, the client audit report
• The SMTP error decoder, so a bounce message tells you whether to delete a subscriber or fix a DNS record
• Five role-specific playbooks for ecommerce, creators, coaches, agencies, and cold outreach
• The chapters this article has no room for at all — corporate B2B gateways, peak-season survival, domain architecture, accessibility law, and the monitoring rhythm

The Email Deliverability Playbook → — 36 chapters, one purchase, no subscription.

---

Frequently asked questions

Why are my emails going to spam even with SPF and DKIM set up?
Authentication proves identity, not desirability. SPF and DKIM confirm that a message genuinely came from your domain, and they carry no information about whether recipients want it. Placement is decided mostly by sender reputation and engagement history. Check DMARC alignment first, then examine who has been receiving the mail.

What is a good email deliverability rate?
No provider publishes an inbox placement target, and no sender can measure their own precisely — seed tests approximate it. The figures that are real are the metric thresholds: delivery rate above 99%, spam complaint rate under 0.05% and never reaching 0.1%, bounce rate under 1%, and unsubscribe rate under 0.3%. Above those lines is a warning, not a pass.

Is deliverability the same as delivery rate?
No. Delivery rate measures whether the receiving server accepted a message. Deliverability measures whether it reached the inbox. A message sitting in the spam folder counts as delivered, which is why dashboards show 99% delivery during a placement crisis.

How long does it take to fix email deliverability?
Authentication fixes take effect within 24 to 48 hours of DNS propagation. Mild spam foldering clears in two to three weeks. Genuine reputation repair takes four to eight weeks, because it requires accumulating new positive engagement evidence to outweigh the old.

Will changing my ESP fix a spam problem?
Usually not. Reputation attaches primarily to the sending domain, and the domain moves with you. Switching platforms without fixing the underlying list and engagement problems reproduces the same result on a new bill, with a warm-up period added on top.

Does sending less often improve deliverability?
Frequency itself is neutral; mismatch with expectations is what hurts. For a domain already flagged, sending less to fewer, more engaged people is among the fastest available fixes. Offering a preference centre — monthly instead of weekly — recovers subscribers who would otherwise leave or complain.

Do spam trigger words still matter?
Far less than the folklore suggests. Modern filters are classifiers trained on behaviour rather than keyword blocklists. Spammy patterns still hurt — all-caps subject lines, excessive punctuation, deceptive claims — but they hurt by generating low opens and high complaints from real people, not because a word list caught them.

Can one bad campaign ruin my sender reputation?
A single aggressive send to a large unengaged segment can cause a measurable reputation drop, which is the classic Black Friday pattern. It is recoverable, and recovery takes weeks of deliberate rebuilding, which is why the send is rarely worth it.

---

What to do next

Run the seed test. It takes a minute and identifies which of the three factors is actually in play.

Then run your domain through the Email Domain Scanner and check the result against the alignment section above. Between them, those two checks cover factor one completely and cost nothing.

Free: The 60-Minute Email Authentication Fix — a checklist for verifying SPF, DKIM, DMARC, and alignment on your own domain in under an hour.

The complete system: The Email Deliverability Playbook — 36 chapters, 10 copy-paste templates, a 14-day implementation plan, a 100-point audit scorecard, an SMTP error decoder, and role-specific playbooks for ecommerce, creators, coaches, agencies, and cold outreach. Written for people who would rather fix this once than pay a monitoring subscription forever.

---

Related guides

• Email authentication: SPF, DKIM, DMARC and BIMI — the full technical setup
• Why your emails suddenly went to spam — the urgent version of this diagnosis
• Email blocklists: how to check and get removed — if a listing is suspected
• How to stay out of the Gmail Promotions tab — delivered but invisible
• Which email service actually delivers? — platform comparison on deliverability
• Email list building — fixing factor two at the source
• Email copywriting — what happens after reaching the inbox

Free tools used in this guide

• Email Domain Scanner · SPF Lookup Checker · Email Header Analyzer · Domain Blacklist Checker · Deliverability Revenue Calculator