Why Authenticated Emails Still Land in Spam

You set up SPF. You set up DKIM. You published a DMARC record. Your ESP shows a green checkmark next to every one of them — and your emails are still landing in spam.

This is the most common complaint in email marketing, and it has a specific answer. Email deliverability is decided by three factors, and authentication is only one of them. Authentication proves who you are. It does not prove that anyone wants your mail. The other two factors — list quality and sending behaviour — are where almost everyone who has already "done the technical stuff" is actually stuck.

Here's how to work out which one is your problem.

---

The short answer

Authentication is a door key, not an invitation. SPF, DKIM, and DMARC let Gmail verify that a message genuinely came from your domain. They say nothing about whether recipients open, reply, ignore, or report your email — and that behavioural evidence is what actually decides placement.

If you're authenticated and still in spam, the cause is almost always one of these:

1. Reputation — your domain has a history, and it isn't good
2. Engagement — you're mailing people who don't read you
3. List quality — how you collected addresses is poisoning everything downstream
4. Sending pattern — your volume or cadence looks automated in the wrong way
5. Alignment — your records "pass" individually but don't align, which is a different failure that looks identical from the outside

The rest of this guide takes each one in turn, and gives you a symptom-to-cause table so you can find yours in about ten minutes.

---

What authentication actually proves

Three records do three separate jobs, and it's worth being precise about them because the confusion behind "I set it all up and nothing changed" usually starts here.

SPF (Sender Policy Framework) is a DNS record listing which mail servers are allowed to send on behalf of your domain. When a message arrives, the receiving server checks the sending IP against that list. SPF answers: is this server allowed to send as this domain?

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to each message. The receiving server validates that signature against a public key in your DNS. DKIM answers: did this message actually come from this domain, and was it altered in transit?

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together and tells receivers what to do when they fail. DMARC answers: if SPF or DKIM doesn't check out, should you deliver, quarantine, or reject?

Notice what none of them answer: should this person receive this email?

That question is decided somewhere else entirely, by evidence Gmail has been collecting about your domain for as long as you've been sending. Authentication gets your message evaluated. It doesn't decide the evaluation.

The one-line version: authentication is identity, not reputation. Passing it means Gmail knows who you are — including when who you are is someone whose mail people delete unread.

The alignment trap

There's a specific failure worth naming here, because it produces exactly the symptom this article is about: everything reports as passing, and mail still fails.

DMARC requires alignment, not just a pass. The domain in your visible From: address has to match the domain that SPF or DKIM validated. If your From: says [email protected] but your ESP is signing DKIM under mail.esp-provider.com, both SPF and DKIM can technically pass while DMARC still fails — because nothing aligns with the domain your recipient actually sees.

Most ESPs default to their own signing domain until you configure a custom sending domain. That single unfinished setup step accounts for a large share of the "but it all says pass" cases.

Where you fix it depends on your platform, but the setting is always in the same conceptual place — domain authentication, not campaign settings. In MailerLite, for example, it's Account settings → Domains → Add domain, which gives you three records to publish: DKIM as a CNAME, SPF as a TXT, and a verification TXT. You then click Authenticate, and Check DNS Records to confirm. Until that's done and showing as authenticated, you're sending under the platform's identity rather than your own — and DMARC alignment cannot pass no matter how correct your other records look.

Check alignment specifically, not just the three green ticks.

Full record syntax, the alignment modes, and a staged DMARC rollout are covered in the email authentication guide.

---

The three factors that decide inbox placement

Inbox providers ask one question about every message they receive: do people want this? They answer it with hundreds of signals, but nearly all of them roll up into three factors you directly control.

The important part: fail any one and the other two can't save you. A perfectly authenticated email to a list of people who never open anything will still get filtered. Beautiful copy sent from a domain with no reputation will still get filtered.

Factor 1 — Technical infrastructure: "Can we trust who you are?"

• Authentication — SPF, DKIM, and DMARC, aligned. Since 2024, this is mandatory for bulk senders at Gmail, Yahoo, and Microsoft. Failures now mean rejection, not just filtering.
• Domain and IP reputation — every domain carries a reputation score with each provider. New domains have none, which is not the same as a good one.
• Valid DNS and TLS — forward and reverse DNS must resolve, and connections must be encrypted. Your ESP usually handles TLS; reverse DNS is worth checking if you send from your own infrastructure.
• Consistent sending patterns — nothing for a month, then 100,000 messages in a day, looks like exactly what it looks like.

This is the factor everybody fixes first, because it's the one with a checklist. It's also the one that's usually already fine by the time someone starts searching for why their emails are in spam.

Factor 2 — List quality and engagement: "Do people want your mail?"

• How you collected the addresses — bot-filled forms, incentive-only signups, and anything purchased poisons everything downstream. This is the single biggest predictor of long-term deliverability, and it's decided before you send anything.
• Who you send to — mailing subscribers who've been inactive for six months tells Gmail "this sender mails people who ignore them." Engagement rate is the strongest single reputation signal there is.
• Hygiene — bounces, spam traps, and dead addresses accumulate on every list, including well-built ones.

If you're authenticated and struggling, start here. This is where most of the problem lives.

Signup source quality, segmentation, and the hygiene routine are covered in email list building and hygiene.

Factor 3 — Content and sending behaviour: "Does this look like spam?"

• Formatting and structure — image-only emails, broken HTML, mismatched text-to-link ratios
• Link reputation — you inherit the reputation of every domain you link to, including shorteners and affiliate redirects
• Sending cadence — sudden volume spikes, irregular schedules, and abrupt frequency changes
• Sameness at scale — filters don't punish AI-written text; they punish thousands of near-identical messages with no variation

Content matters less than most people think and more than the "it's all reputation" crowd admits. It's rarely the sole cause, and it's often the accelerant.

---

Which factor is broken? A symptom-to-cause diagnostic

Work down this table. Match your symptom, check the likely cause first, and stop when you find it. This ordering is deliberate — it puts the fastest-to-confirm causes at the top.

Symptom	Most likely cause	Where to look first
Nothing arrives at all; delivered count collapsed	Authentication rejection at the server	Bounce logs for SMTP errors like Microsoft's 550 5.7.515 Access denied
Everything reports "pass" but mail still fails DMARC	Alignment, not authentication	Whether DKIM signs under your domain or your ESP's
Gmail opens at 8%, Outlook at 30%	Gmail specifically has flagged you	Google Postmaster Tools compliance status and spam rate
Opens fell from ~25% to ~12% over a few sends	Spam foldering, reputation-driven	Recent sends to unengaged segments; complaint rate
Delivered fine, but almost nobody opens	Promotions tab, not spam	Seed test — check the tab, not just the inbox
New domain, low volume, immediate filtering	No reputation yet, sent too fast	Volume ramp and who you sent to first
Bounce rate above 2%	Dirty or inherited list	Signup source and last verification date
Complaint rate above 0.1%	List or expectation mismatch	What you promised at signup vs. what you send
Transactional mail (receipts, resets) failing	Wrong sending path entirely	Whether your site sends via PHP mail instead of SMTP

That last row catches more people than you'd expect — order confirmations and password resets fail for structurally different reasons than marketing campaigns do. If that's your situation, WordPress emails not sending covers it specifically.

---

First, confirm it's actually happening

Before changing anything, find out where your emails genuinely land. You don't need paid software for this.

The 60-second seed test:

1. Create two or three fresh test inboxes — one Gmail, one Outlook or Hotmail, one Yahoo if your audience uses it.
2. Subscribe them to your list, or add them in your ESP.
3. Send your next campaign with those addresses included.
4. Open each one and look, without searching.

What you see maps directly to what's wrong:

• Primary inbox — good.
• Promotions tab (Gmail) — technically delivered, largely invisible. Expect open rates roughly halved. Not a reputation emergency. See how to stay out of the Gmail Promotions tab.
• Spam or Junk folder — an active reputation problem. Fix it before you do anything else.
• Nothing arrives — critical. Non-compliant bulk mail is now rejected at the server by Gmail and Microsoft. Check your bounce logs for SMTP errors.

Two caveats that matter. Test with inboxes that have no history with your brand — your personal Gmail that opens everything you send will always show the inbox, which is a false positive. And because seed inboxes have no engagement history, they run slightly pessimistic. Real subscribers who love you often place better than seeds suggest.

Treat the seed test as a smoke alarm, not a precision instrument.

The professional-grade check

Set up Google Postmaster Tools. It's free, and it shows your compliance status, spam rate, and authentication results as Gmail itself sees them.

One update worth knowing: Google retired the old Domain Reputation and IP Reputation grades in September 2025. If you remember the High / Medium / Low / Bad ladder, it's gone. What replaced it is more useful — a plain-language Pass / Needs Work compliance verdict against Gmail's actual published requirements, alongside the spam-rate chart that was always the more diagnostic number.

Yahoo offers a comparable Sender Hub. Microsoft has SNDS.

Reading each chart properly, and what to do at each threshold, is covered in how to read Google Postmaster Tools.

---

What "delivered" in your dashboard actually means

Here's the distinction that causes more confusion than any other metric in email.

Delivery rate means the receiving server accepted the message. That's all. It says nothing about which folder it went into.

Deliverability — or more precisely, inbox placement — means the message reached the inbox where someone might read it.

Your ESP reports the first one, calls it "delivered," and shows you 99%. Meanwhile every one of those messages could be sitting in spam. A message routed to the junk folder was still delivered. This is why "my dashboard says 99% delivered" and "my emails go to spam" are both true at the same time, and why so many senders don't discover a problem for weeks.

The number that actually tells you something is your open rate broken down by provider. Gmail at 8% while Outlook sits at 30% is not a copy problem. It's Gmail specifically deciding something about you.

---

The numbers that decide

These are the lines providers themselves draw. They apply to everyone, regardless of industry, list size, or how good your content is.

Metric	Healthy	Warning	Emergency
Spam complaint rate	Under 0.05%	0.05–0.1%	Over 0.1% (0.3% = crisis)
Bounce rate	Under 1%	1–2%	Over 2%
Unsubscribe rate	Under 0.3%	0.3–0.5%	Over 0.5%
Delivery rate	Over 99%	98–99%	Under 98%
Authentication	All pass and aligned	Any warning	Any fail

If you're outside the healthy column on any row, that's a real problem no matter what your industry benchmark says. Fix it before optimising anything else.

On the complaint rate specifically: Google's published guidance is to keep spam rates below 0.1% and to never let them reach 0.3%. Cross 0.3% and you lose eligibility for Gmail's mitigation support until your rate holds below the line consistently. Complaint rate is also the best early-warning signal you have — it moves before your revenue does.

Are your engagement numbers actually bad?

Context, before you panic. These are orientation ranges, not grades.

Business type	Typical open rate	Typical click rate (of delivered)
Ecommerce / retail	25–35%	1.5–3%
Creator / newsletter	35–50%	3–8%
Coaching / courses	30–45%	2–6%
B2B / SaaS	25–40%	2–5%
Nonprofit	30–40%	2–4%
Transactional (receipts, resets)	60–90%	Varies

Anything below 60% on transactional mail suggests a delivery problem, not an engagement one — nobody ignores their own password reset.

How to actually use these numbers:

• Compare yourself to yourself first. Your own 90-day trend beats any industry average. A newsletter that opened at 48% and now opens at 31% has a problem, even though 31% still looks respectable on this page.
• Segment before judging. Your full-list open rate is an average of your superfans and your zombies. Look at your last-90-day engaged segment separately. If that is sliding, you have a genuine placement problem. If only the full-list number is sliding, you have list decay.
• Split by provider. Provider-level splits are the single most diagnostic view your ESP offers, and most people never open that report.

And one caution on open rates generally: Apple's Mail Privacy Protection inflates them by pre-loading images for a large share of recipients. Open rate is now a directional signal, not a measurement. Clicks on your engaged segment and revenue per email sent are the numbers that survive contact with reality.

---

Why reputation is the thing authentication can't buy

This is the heart of it.

Sender reputation is a score each provider maintains about your domain, built from how recipients have historically behaved toward your mail. Opens, replies, deletions without opening, moves to spam, moves out of spam, unsubscribes — all of it accumulates.

Authentication is the price of admission. Reputation is what actually gets you seated.

Three things follow from that, and they explain most of the confusing cases:

A new domain has no reputation, which is not the same as a good one. With no history, providers apply caution by default. Sending 5,000 messages on day one from a domain that has never sent anything reads as exactly what a spammer would do. This is why warm-up exists, and why "I set up authentication perfectly on my brand-new domain and everything went to spam" is completely normal rather than mysterious.

Reputation is per-provider. Gmail's opinion of you and Microsoft's are separate, formed from separate evidence, and can differ sharply. This is why the provider split matters so much diagnostically.

Reputation is earned back slowly and lost quickly. One aggressive send to a large unengaged segment can undo months. Recovery is measured in weeks, and it works by rebuilding positive evidence — sending to people who genuinely want your mail until the ratio shifts back.

The mechanism is worth internalising: engagement rate is the strongest single input to reputation. Which means the most effective deliverability fix available to most senders isn't technical at all. It's mailing fewer people, more of whom want to hear from you.

That feels backwards. Sending to a smaller segment to improve results sounds like giving up reach. But the arithmetic is straightforward — a 20,000-person send at 12% opens puts your message in front of 2,400 people and damages your reputation. A 6,000-person send to engaged subscribers at 40% opens puts it in front of 2,400 people and improves your reputation. Same reach today, opposite trajectory tomorrow.

---

The order to fix things in

Sequence matters here more than effort does. Fixing things in the wrong order wastes weeks, because some fixes can't take effect until earlier ones do.

1. Confirm the problem is real, and locate it. Seed test plus Postmaster Tools. Know whether you're in spam, in Promotions, or being rejected outright — these need different responses. Don't skip this. A surprising number of "deliverability crises" turn out to be Promotions-tab placement or an Apple MPP artifact.

2. Stop making it worse. Pause broadcasts to your full list. Every send to an unengaged segment while you're already flagged deepens the hole. This is the single highest-leverage thing you can do in the first hour, and it costs nothing.

3. Fix authentication properly — including alignment. Not just "the records exist." Verify that DKIM signs under your domain, that SPF has one record rather than several left over from a migration, and that DMARC alignment passes. Full setup walkthrough →

4. Clean the list. Remove invalid addresses. Suppress subscribers with no engagement in 180+ days. This will feel like deleting your business. It isn't — you're removing people who were never going to buy and were actively costing you placement with the people who might.

5. Rebuild positive signals deliberately. Send only to your most engaged segment. Plain, personal, reply-inviting emails outperform designed campaigns here. Replies are among the strongest positive signals available to you.

6. Widen back out gradually. Expand from 30-day openers to 60-day to 90-day, watching complaint rate at each step. If it rises, stop and hold.

7. Then, and only then, resume normal sending — with monitoring. The mistake that undoes a successful recovery is going straight back to the sending pattern that caused the problem.

Most recoveries take three to six weeks. Anyone promising faster is either selling something or hasn't done one.

A note on what's not in this article. The day-by-day recovery schedule, the segment-widening thresholds, the blocklist removal request templates, the 100-point audit scorecard, and the role-specific playbooks for ecommerce, creators, coaches, agencies, and cold outreach are in The Email Deliverability Playbook. What's above is the complete diagnosis. The book is the complete procedure.

---

Frequently asked questions

Why are my emails going to spam even with SPF and DKIM set up? Because authentication proves identity, not desirability. SPF and DKIM confirm that a message genuinely came from your domain — they don't tell Gmail whether recipients want it. Placement is decided mostly by sender reputation and engagement history. If you're authenticated and still filtered, check DMARC alignment first, then look at who you've been mailing.

What is a good email deliverability rate? Aim for inbox placement above 95% and a delivery rate above 99%. More usefully, watch the thresholds that trigger filtering: complaint rate under 0.1%, bounce rate under 2%, unsubscribe rate under 0.5%. Those lines matter more than any single deliverability percentage.

Is deliverability the same as delivery rate? No, and the difference is why so many problems go undetected. Delivery rate measures whether the receiving server accepted your message. Deliverability measures whether it reached the inbox. A message sitting in the spam folder counts as delivered.

How long does it take to fix email deliverability? Technical fixes like authentication take effect within 24–48 hours of DNS propagation. Reputation recovery takes three to six weeks, because it requires accumulating new positive engagement evidence to outweigh the old negative evidence. There's no way to shortcut the second part.

Will changing my ESP fix a spam problem? Usually not. Reputation attaches primarily to your sending domain, and your domain moves with you. Switching platforms without fixing the underlying list and engagement problems typically reproduces the same result on a new bill. Switch for features, deliverability tooling, or support — not as a reputation reset.

Does sending less often improve deliverability? Frequency itself is neutral; mismatch with expectations is what hurts. Sending daily to people who signed up for a daily email is fine. Sending weekly to people who expected monthly generates complaints. If you're currently flagged, sending less to fewer, more engaged people is one of the fastest available fixes.

Do spam trigger words still matter? Far less than the folklore suggests. Modern filters are classifiers trained on behaviour, not keyword blocklists. "Free" in a subject line from a sender with strong engagement lands fine. The same word from a domain with a 0.4% complaint rate doesn't — and the word wasn't the reason.

Can one bad campaign ruin my sender reputation? A single aggressive send to a large unengaged segment can absolutely cause a measurable reputation drop — this is the classic Black Friday pattern. It's recoverable, but recovery takes weeks of deliberate rebuilding, which is why the send is rarely worth it.

---

What to do next

Run the seed test. It takes a minute, and it tells you which of the three factors you're actually dealing with — which determines everything you do afterward.

If it comes back clean and you're still worried, check your open rate split by provider. If Gmail is materially below your other providers, you have a Gmail-specific reputation issue, and Postmaster Tools will tell you why.

If it comes back in spam, don't start changing settings. Start by pausing broadcasts, then work steps 3 through 7 above in order.

Free: The 60-Minute Email Authentication Fix — a checklist that walks you through verifying SPF, DKIM, DMARC, and alignment on your own domain in under an hour.

Go deeper: The Email Deliverability Playbook — 36 chapters, 10 templates, a 14-day implementation plan, a 100-point audit scorecard, and role-specific playbooks for ecommerce, creators, coaches, agencies, and cold outreach.

---

Related guides

• Email authentication: SPF, DKIM, DMARC, and BIMI — the full technical setup
• Why your emails suddenly went to spam — when this happened overnight
• Email blocklists: how to check and get removed — if you suspect a listing
• How to stay out of the Gmail Promotions tab — if you're delivered but invisible
• Email list building and hygiene — fixing factor two at the source
• Email copywriting — what happens after you reach the inbox