Email Deliverability: Why Your Emails Land in Spam

Why this matters

You can write the cleanest email in the world and still land in spam. The receiving mailbox provider doesn't read your prose; it scores about a dozen signals before it even considers the body. Get those signals wrong and the inbox door stays closed.

This post walks through every one, in roughly the order Gmail / Microsoft / Yahoo evaluate them.

TLDR

In priority order:

1. SPF + DKIM aligned with your from domain. Skip this and you're done before you start.
2. DMARC with at least p=none and a rua= reporting address. Reads the alignment data; tells you what to fix.
3. Sending IP / domain reputation. New domains have to be warmed up. Don't blast 10,000 from a fresh setup.
4. List hygiene. Hard bounces stay in your suppression list, scraped lists destroy reputation, role addresses (info@, support@) hurt engagement metrics.
5. Complaint rate under 0.1%. A handful of "Mark as spam" clicks per thousand sends will get you flagged at any major provider.
6. Engagement. Inboxes that open or reply tell Gmail you're wanted. Inboxes that delete unread tell it the opposite.
7. Content tells. Some patterns score badly: all-caps subjects, link-shorteners, mismatched display name vs. from address, missing plain-text part.

1. SPF (Sender Policy Framework)

SPF lists which servers are allowed to send email for your domain. It's a TXT record on the apex:

v=spf1 include:amazonses.com ~all

That single line says "Amazon SES is authorized; soft-fail anything else." If you're on SMTPfast we delegate to SES, so this is the record you publish.

Two gotchas that bite real users:

• The 10-lookup limit. SPF resolution is recursive. include:amazonses.com itself contains include: chains, and so does Google Workspace, and Microsoft 365. Stack five vendors in one SPF record and you'll exceed 10 DNS lookups. Receivers fail-open in that case (they treat the record as missing, which is worse than a hard fail). Use dig +short txt yourdomain.com and count carefully if you have multiple senders.
• One TXT record only. Two TXT records starting with v=spf1 is a permanent fail. Merge them.

Without SPF, anyone with an open SMTP relay can send mail claiming to be from your domain. Modern receivers reject such mail outright.

2. DKIM (DomainKeys Identified Mail)

DKIM cryptographically signs every email with a private key whose public half lives in your DNS. The receiving server fetches the public key, verifies the signature, and confirms the message wasn't tampered with in transit and that the sender holds the key.

SMTPfast generates a 2048-bit DKIM key per domain and gives you three CNAME records to publish:

tok1._domainkey.yourdomain.com   CNAME   tok1.dkim.amazonses.com
tok2._domainkey.yourdomain.com   CNAME   tok2.dkim.amazonses.com
tok3._domainkey.yourdomain.com   CNAME   tok3.dkim.amazonses.com

Three keys (not one) so we can rotate without downtime. The dashboard turns the DKIM column green once all three resolve.

DKIM by itself doesn't say "this email is wanted." It says "this email is authenticated." That's the precondition; without it, every other signal carries less weight.

3. DMARC (Domain-based Message Authentication)

DMARC ties SPF and DKIM together. It tells receivers two things:

1. Alignment. The domain in the from header has to match the domain that signed the DKIM signature, or the domain that passed SPF. Mismatch and DMARC fails even if SPF and DKIM each technically pass on their own.
2. Policy. What the receiver should do when DMARC fails: none (let it through), quarantine (spam folder), reject (bounce).

Ramping up:

# Day 0: monitoring only
_dmarc.yourdomain.com    TXT    "v=DMARC1; p=none; rua=mailto:[email protected]"

# Day 30, after reviewing aggregate reports and fixing any unauthenticated sources
_dmarc.yourdomain.com    TXT    "v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]"

# Day 60+, once quarantine is clean
_dmarc.yourdomain.com    TXT    "v=DMARC1; p=reject; rua=mailto:[email protected]"

The rua= address gets a daily XML report from each receiving provider listing every IP that sent mail under your domain and whether it passed alignment. That feed is gold for catching shadow-IT senders (a marketing team using a different vendor through Mailchimp, a partner who forgot to be added to your SPF, etc.) before you tighten the policy and start blocking them by accident.

For new senders the order is: launch with p=none, watch reports for two to four weeks, fix every unauthenticated source, then move to p=quarantine and finally p=reject. Reject without monitoring first is how legitimate mail starts bouncing without warning.

4. Domain and IP warmup

Brand-new sending domains have zero reputation. Mailbox providers don't trust you yet. Send 10,000 emails on day one and the throttle drops hard.

A simple ramp:

If you're on a shared sending pool, the IP reputation is shared too, which means the warm-up is concentrated on your domain. If you later move to a dedicated IP arrangement outside the standard plans, both domain and IP reputation start from scratch and need similar pacing.

The biggest mistake here is buying a list and blasting it. Even if every recipient address is technically deliverable, the ones who don't recognize your sender will mark it as spam, your complaint rate explodes past 0.1%, and SES (or any provider) will pause your account before you finish the campaign.

5. List hygiene

The two metrics receivers care about most:

• Bounce rate. Hard bounces (invalid addresses, full mailboxes, blocked) above 5% over a rolling 24h window puts you on AWS SES's watchlist; above 10% pauses the account. SMTPfast adds every hard bounce to your suppression list automatically and refuses subsequent sends to that address, which keeps the rolling rate honest as long as you don't manually re-import bounced contacts.
• Complaint rate. "Mark as spam" clicks above 0.1% (one per thousand) is the trigger. Above 0.3% is account-suspension territory.

Two practices that move both metrics:

1. Confirmed (double) opt-in for any list-style mail. Single opt-in is fine for transactional, but a marketing list with single opt-in will be 5-10% bounces from typos alone and accumulate complaints from people who don't remember signing up.
2. A real List-Unsubscribe header on every send. RFC 8058 one-click unsubscribe is required by Gmail and Yahoo on bulk senders since 2024. Without it, the only way out for an annoyed user is the spam button. SMTPfast adds this header automatically when you provide an unsubscribe_url.

6. Engagement signals

Past the technical layer, mailbox providers measure how recipients actually react. The signals they reward:

• Opens (especially if accompanied by clicks or replies).
• Reply (the strongest "this is wanted" signal there is).
• Marking as "Not spam" if a message landed in the spam folder.
• Moving the message to a folder, starring, marking as important.

The signals they punish:

• Delete without open.
• "Mark as spam" or unsubscribe.
• Mailbox full / bounce after several sends to the same address.

You can't directly influence engagement except by sending the right thing to the right person. The two changes that move engagement most for transactional senders: send less of what people don't read, and use a recognizable from address that makes the recipient remember why they're getting your mail.

7. Content tells

The content scoring is the smallest layer but it's the easiest to fix. Things that score badly:

• Subject lines in ALL CAPS or with three or more exclamation marks.
• A from display name that doesn't match the domain (From: "PayPal Security" <[email protected]>).
• Missing plain-text alternative. HTML-only email is automatically suspicious.
• Excessive image-to-text ratio. An email that's a single hero image with no real text body looks like spam by construction.
• URL shorteners. Spammers use them to mask destinations. Use canonical links to your actual domain instead.
• Mismatched link domains. If the visible link text says one URL but the href goes somewhere else, every spam filter in the world flags it.

The fix for almost all of these is "send mail like a normal person sends mail." Plain language, your real domain, a real subject line, a plain-text part.

8. The order to fix things in

If your mail is landing in spam right now and you can only do one thing today, do this in order:

1. Confirm SPF, DKIM, and DMARC all pass alignment. Use dig, then send a test through mail-tester.com.
2. Look at the last 24h on your dashboard for bounce rate and complaint rate. If either is above the suspend thresholds, fix list hygiene before doing anything else.
3. Check your DMARC rua reports for unauthenticated sources. If a third-party tool is sending under your domain without alignment, that's killing you alone.
4. Audit content. Re-read your last three sends as a recipient. If they look spammy to you, they look spammy to a filter.
5. Warm up. If the domain is new, send less and to your most-engaged audience until the daily volume hits where you want it.

Skipping straight to the content layer when the auth or hygiene layer is broken is the most common reason "but my email looks fine" senders stay in spam.

How SMTPfast helps

When you add a domain we generate the DKIM key, give you the exact CNAME / TXT records to publish, and re-poll DNS every minute until the verification turns green. Bounces go straight into your suppression list so the next attempt to that address is refused at the API layer instead of becoming another bounce. Complaints do the same. We add the List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click headers on every send when you pass an unsubscribe_url, so Gmail's one-click button works out of the box.

The infrastructure piece is what we own. The list, the content, and the cadence are still yours.

Where to go next

• Why emails go to spam, the same topic from the recipient's mailbox perspective.
• Domain authentication guide, DKIM/SPF/DMARC at the level of "I've never set up email DNS before."
• Email reputation guide, how mailbox providers actually score you over time.
• Webhook best practices, wire up bounce + complaint events so your suppression list stays current.