Email Deliverability: Why Your Emails Go to Spam (And How to Fix It)

The Problem: Why Emails Go to Spam

Your email is perfectly written. Your campaign is targeted. But it lands in spam. Why?

The Hard Truth About Email Deliverability

85% of all emails sent globally are spam or malware. This war against spam is won through authentication. Email providers don’t trust unverified senders. If you can’t prove your identity, your email goes to spam.

Common Reasons Emails Get Filtered

• No SPF record: Email provider can’t verify you’re authorized to send
• No DKIM signature: Email provider can’t verify email hasn’t been tampered with
• No DMARC policy: Email provider doesn’t know what to do if authentication fails
• Poor sender reputation: Your domain/IP has history of spam complaints or bounces
• High bounce rate (>2%): Signals poor list quality to email providers
• High spam complaint rate (>0.1%): Recipients marking you as spam
• Content triggers: Certain words, links, formatting trigger spam filters
• Compliance violations: Missing unsubscribe link, no physical address, misleading subject

2025 Email Authentication Requirements (Mandatory)

This isn’t optional anymore. Gmail, Yahoo, Microsoft, and Apple have all mandated authentication standards. Non-compliance means rejection.

Who Must Comply & When

The Enforcement Reality

• Gmail: Started rejecting non-compliant emails in April 2024. Gradually increases rejection percentage. Non-compliance = emails bouncing
• Microsoft: Began enforcement May 5, 2025. Non-compliant emails are permanently rejected
• Yahoo: Actively enforcing since February 2024. Non-compliant traffic gets filtered or rejected
• Current compliance status: Only 18% of top domains have valid DMARC. Only 7-8% enforce quarantine/reject policies

SPF: Sender Policy Framework Explained

SPF is the first layer of authentication. It tells email providers: “Here are the servers authorized to send emails from my domain.”

How SPF Works

When an email arrives, the recipient’s server checks the SPF record in your domain’s DNS. If the sending server’s IP is listed, SPF passes. If not, SPF fails.

What SPF Looks Like

Basic SPF record example:

v=spf1 include:sendgrid.net -all

Breaking it down:

• v=spf1 – Version (always spf1)
• include:sendgrid.net – Authorizes SendGrid to send on your behalf
• -all – (Hard fail) Any other server is NOT authorized

SPF Record for Multiple Senders

If you use multiple email providers (Mailchimp, SendGrid, Brevo, etc.), you need to include all of them:

v=spf1 include:sendgrid.net include:mailchimp.com include:brevo.com -all

Important SPF Limitations

• Hard limit of 10 DNS lookups. If you have too many includes, SPF will fail (DNS limit exceeded)
• SPF only checks the envelope sender (MailFrom). It doesn’t verify the visible “From” address, which is why DKIM is also needed
• SPF alone isn’t enough. Gmail and Yahoo require SPF + DKIM + DMARC

How to Add Your SPF Record

DKIM: Adding Cryptographic Signatures

DKIM adds a digital signature to your emails. It proves the email hasn’t been tampered with and comes from your domain.

How DKIM Works

Your email provider creates a public key (added to your DNS) and a private key (kept secret). Every email gets signed with the private key. Recipients verify the signature using the public key.

What DKIM Looks Like in DNS

Example DKIM record:

v=DKIM1; k=rsa; p=MIGfMA0GCS... (much longer, truncated here)

What this means:

• v=DKIM1 – Version
• k=rsa – Key type (RSA encryption)
• p=... – The public key itself

DKIM Setup (By Provider)

Key DKIM Facts

• Usually requires changing DNS multiple times. Most providers give you 3-4 DKIM records to add
• DKIM must align with your From domain. Email comes from [email protected], DKIM must be set up for example.com
• Can be set up multiple times. Unlike SPF (limit 1), you can have multiple DKIM records for different selectors

DMARC: The Policy Framework

DMARC tells email providers what to do if an email fails SPF or DKIM. It’s the policy layer on top of the authentication layers.

DMARC Policy Options

Rollout Sequence (The Right Way)

Week 1-2: Start with p=none

• Set up SPF + DKIM first
• Add DMARC record with p=none
• Get reports showing what’s passing/failing

Week 3-4: Move to p=quarantine

• After confirming all legitimate emails are passing SPF + DKIM
• Move to p=quarantine (non-compliant emails go to spam, not rejected)

Month 2+: Enforce with p=reject

• After weeks of monitoring and confirming no legitimate email is being rejected
• Move to p=reject (maximum protection)

What a DMARC Record Looks Like

v=DMARC1; p=none; rua=mailto:[email protected]

Breaking it down:

• v=DMARC1 – Version
• p=none – Policy (none, quarantine, or reject)
• rua=mailto:[email protected] – Email address for aggregate reports

How to Set Up DMARC

Building Sender Reputation

Authentication is the foundation. But reputation is what gets you in the inbox.

What Determines Your Sender Reputation?

Sender Reputation by Provider (2025)

How to Build & Maintain Sender Reputation

1. Keep Bounce Rates Low (Target: <2%)

• Use double opt-in (verify email addresses at signup)
• Remove hard bounces immediately after first bounce
• Clean your list monthly using a list validation service
• Never buy email lists (guaranteed high bounce rate)

2. Keep Complaint Rates Low (Target: <0.1%)

• Only send to opted-in subscribers (with their permission)
• Make unsubscribe easy (visible, one-click)
• Honor unsubscribe requests immediately
• Don’t send too frequently (more than 2x weekly = fatigue)

3. Monitor Your Sender Score

Free tools: SendersScore.org, MXToolbox.com

• Enter your domain/IP address
• Get score 0-100 (80+ is good, 90+ is excellent)
• Check monthly – trends matter

4. Warm Up New Domains/IPs

If you switch domains or IPs, start small:

• Day 1-3: Send 5-10 emails per day
• Day 4-7: 20-50 emails per day
• Day 8-14: 100-500 emails per day
• Week 3+: Scale to full volume gradually

Why? Email providers see new domains as risky. Gradual warm-up proves you’re legitimate.

Email Compliance Essentials

Authentication + reputation aren’t enough. You also need compliance. Non-compliance results in fines up to $43,792 per email (CAN-SPAM) or €20 million (GDPR).

Three Major Laws You Must Know

CAN-SPAM Requirements (USA)

• Accurate sender information: “From” address must be truthful and identify you/your business
• Non-deceptive subject line: Must reflect email content
• Clear identification: Clearly identify email as advertisement if it is
• Physical address: Include valid postal address of your business
• Functional unsubscribe: Must work for 30 days after send, honored within 10 business days

GDPR Requirements (EU)

• Explicit opt-in consent: Must ask permission BEFORE adding to list (pre-checked boxes don’t count)
• Data subject requests: Users can request their data, deletion, or portability
• Data protection: Encrypt data, limit access, document processing
• Privacy policy: Must be clear about how you use their data

Compliance Checklist

• Never buy email lists
• Use double opt-in (confirm email before adding to list)
• Maintain suppression lists (honor unsubscribes)
• Include physical address in every email
• Include clear unsubscribe link (one-click preferred)
• Honor unsubscribe requests within 10 business days
• Keep accurate records of consent (date, method)
• Make subject lines truthful, non-deceptive
• For EU contacts: get GDPR-compliant opt-in consent

Complete Implementation Checklist

Week 1: Authentication Setup

Week 2-3: Monitoring & Verification

• Check SPF/DKIM/DMARC with MXToolbox.com – all should show PASS
• Send test emails to yourself, check headers for authentication results
• Check DMARC report email (after 48 hours) – should show most emails passing
• Monitor bounce rate – should be <2%
• Monitor complaint rate – should be <0.1%

Week 4: Upgrade to p=quarantine

• Confirm all legitimate emails passed SPF + DKIM for full week
• Update DMARC record: change p=none to p=quarantine
• Monitor next week – should see similar performance

Week 5-8: Monitor & Optimize

• Check inbox placement rate – target 95%+
• Monitor DMARC reports for failures
• If issues arise, investigate immediately
• After 3-4 weeks at p=quarantine with no issues, consider upgrading to p=reject

Ongoing: Maintenance

• Monitor sender score monthly (SendersScore.org)
• Track bounce rate and complaint rate
• Clean list monthly (remove bounces, inactive subscribers)
• Honor unsubscribe requests immediately
• Check DNS records quarterly for issues

Troubleshooting Common Issues

Problem: SPF is failing

• Check that you added TXT record (not CNAME)
• Verify exact SPF string – even one character off breaks it
• If using multiple providers, check you included all of them
• Wait 24 hours – DNS caches take time

Problem: DKIM is not authenticating

• Verify DKIM is enabled in your email provider
• Check that all DKIM records are added (usually 2-3)
• Confirm DKIM domain aligns with From address
• Wait 24 hours – DKIM takes time to activate

Problem: Emails still going to spam

• Confirm all three (SPF, DKIM, DMARC) show PASS on MXToolbox
• Check bounce rate – if >2%, clean your list
• Check complaint rate – if >0.1%, reduce sending frequency
• Warm up your domain – start with 10 emails/day, scale gradually
• Check content – certain words trigger spam filters