# Why Your Emails Go to Spam: A Deliverability Diagnostic URL: https://notificationharbor.com/journal/why-are-my-emails-going-to-spam Type: blog Locale: en Published: 2026-09-01 Updated: 2026-09-02 --- > Emails land in spam because of broken authentication, damaged IP reputation, content triggers, or list hygiene failures. This diagnostic covers each cause in order. Why are my emails going to spam? In November 2025, Gmail switched from soft-filtering non-compliant bulk mail to hard SMTP rejection with 5xx permanent errors. If inbox placement dropped sharply around that period without any content change on your side, that is the most likely explanation. Microsoft began similar enforcement in May 2025. Yahoo escalated in April 2025. The authentication compliance model is now binary: SPF, DKIM, and DMARC aligned, or your message does not reach a mailbox at all. This article walks through the four layers that determine whether your email reaches the inbox. Each layer has specific signals you can measure. Start at layer one and work down. ## Authentication Failures: The Binary Gate SPF, DKIM, and DMARC are not optional configurations for large senders. Gmail and Yahoo have required all three for bulk senders (5,000+ messages per day to personal accounts) since February 2024, and enforcement became hard rejection by late 2025. **SPF** is a DNS TXT record listing which mail servers are authorized to send from your domain. If your ESP or transactional email provider is not listed, messages fail SPF and the receiving server treats them as potential forgeries. **DKIM** adds a cryptographic signature to each outgoing message. The receiving server verifies the signature against a public key published in your DNS. Altered messages or messages from unauthorized servers fail the check. **DMARC** ties the two together. It checks that the domain passing SPF or DKIM aligns with the visible From domain, and it tells receiving servers what to do with failures: `none` (monitor only), `quarantine` (route to spam), or `reject` (hard block). The critical point is alignment. You can pass SPF on a third-party sending domain and still fail DMARC if that domain does not match your From address. The implementation order that produces the fewest surprises: - Pick a dedicated sending subdomain (`mail.yourcompany.com`) to isolate sending reputation from your root domain. - Publish an SPF record that includes every service sending on your behalf. Audit third-party tools quarterly. - Enable DKIM at 2048-bit for every sending service. - Publish DMARC at `p=none` first with a reporting address, confirm your legitimate mail passes alignment in the aggregate reports, then move to `quarantine` and then `reject`. Google Postmaster Tools v2, launched October 2025, now surfaces a binary "Compliance Status" field. Pass or fail. There is no partial-credit state. ![Terminal screen showing DNS TXT records for SPF and DKIM email authentication](https://fdzlnqpwsaniezitwiuw.supabase.co/storage/v1/object/public/cms-media/accorata/2026-09/3c2f5c-img-inline1.webp) ## IP and Domain Reputation: What the Score Actually Measures Authentication establishes identity. Reputation is what mailbox providers think of that identity based on observed behavior. The signals that damage reputation are measurable and predictable: - **Spam complaints**: Gmail requires bulk senders to stay below 0.3% complaint rate. Above 0.1% you start seeing filtering pressure. Above 0.3%, you hit enforcement thresholds. - **Hard bounces**: Sending to invalid addresses signals list hygiene failure. Hard bounce rates above 2% are a common threshold where ESPs start throttling or suspending accounts. - **Spam trap hits**: Addresses seeded by mailbox providers and anti-spam organizations into purchased or scraped lists. A single trap hit in a small send volume can damage a domain's reputation score significantly. - **Sudden volume spikes**: A domain that sends 500 messages one day and 50,000 the next looks like a compromised account or a bulk acquisition. Providers apply extra scrutiny. Domain warmup matters because reputation is built through consistent, wanted mail. New sending domains need to start at low volumes (50 to 100 messages per day) with the most engaged recipients, increase gradually over 4 to 6 weeks, and pause if bounce or complaint rates spike during the ramp. Skipping warmup on a new domain is the most common cause of immediate spam placement. Shared IP pools distribute reputation across senders. If another sender on the pool has a high complaint rate, your mail can be affected. Dedicated IPs give full control over reputation but require sufficient consistent volume to build a meaningful history. Below 50,000 sends per month, a shared pool with a reputable ESP is usually the better tradeoff. ## Content Signals That Trigger Spam Filters Content is the third layer, and it matters less than most teams assume. Spam filters in 2026 are primarily reputation and authentication engines. Content signals are secondary indicators that accelerate filtering decisions when reputation is already marginal. That said, a few patterns consistently cause problems: **Link domain reputation**: If your email contains links to domains with poor reputation, that signal transfers to your message. Shortened URLs (bit.ly, tinyurl) are a common source. Use your brand domain for all links, including tracking parameters. **Heavy image-to-text ratios**: Early spam filters caught text-heavy spam, so spammers switched to image-only content. Filters adapted. A message with one large image and almost no text now resembles phishing templates. **Misleading subject lines**: Subject lines that do not match the message body, use deceptive phrasing, or include character manipulation (replacing letters with similar Unicode characters) are reliable spam signals. **Missing or broken unsubscribe mechanisms**: Gmail and Yahoo now require one-click unsubscribe (RFC 8058) for bulk senders. The unsubscribe link must work and must process requests within two business days. A broken unsubscribe flow is both a compliance failure and a reason recipients file spam complaints instead of opting out cleanly. Test your actual MIME output, not the rendered preview in your ESP's editor. Spam filters evaluate the raw message structure. A rendering that looks clean in the editor can have malformed headers or hidden content that flags filters. ## List Hygiene and Engagement Rates Mailbox providers track how recipients interact with your mail. Opens, clicks, replies, moves to inbox from spam, and folder organization are positive engagement signals. Deletes without reading, spam complaints, and folder moves to spam are negative signals. These aggregate into what Gmail's infrastructure treats as a sender's "wanted" score for a given recipient. ![Analytics dashboard displaying email reputation metrics and delivery performance](https://fdzlnqpwsaniezitwiuw.supabase.co/storage/v1/object/public/cms-media/accorata/2026-09/5e1b77-img-inline2.webp) The practical implications for list management: **Remove hard bounces immediately.** A hard bounce is a permanent delivery failure. Continuing to send to that address after a hard bounce signals that you are not processing delivery feedback. **Suppress chronic non-openers.** Recipients who have not opened, clicked, or interacted with any email in the past 90 to 180 days are dragging down your engagement rate. A sunset flow that sends one re-engagement message before suppressing is better than continued sends to a dead segment. **Never buy or scrape lists.** Purchased lists contain spam traps, invalid addresses, and recipients who never consented to hear from you. The complaint rates from cold lists are almost always above Gmail's 0.3% threshold. **Use double opt-in for marketing sends.** Single opt-in with a pre-checked box produces lists with lower engagement and higher complaint rates. Double opt-in confirms the address is valid and that the person understands they are subscribing. ## Separating Transactional From Marketing Streams This is an infrastructure decision, not a content decision, and it has a disproportionate impact on deliverability. Transactional email includes account verification, password resets, purchase receipts, billing notices, and security alerts. These messages are expected, have high engagement rates, and rarely generate complaints. Marketing sends, including newsletters and promotional campaigns, have lower engagement and occasionally generate complaints. If both streams share an IP address and sending domain, a bad batch of marketing mail can degrade inbox placement for your transactional mail. For a SaaS product, that means a failed user verification email or a missed security alert because a campaign hit a complaint spike. Separate the streams at the infrastructure level: different subdomains (transactional.yourcompany.com vs. mail.yourcompany.com), separate IP pools, and separate monitoring. When the marketing stream has an incident, the transactional stream is unaffected. This separation also gives you clean per-stream metrics. You can measure complaint rates and bounce rates independently, which makes root cause analysis faster when something breaks. ## Reading Google Postmaster Tools: The Actual Signal Postmaster Tools is the only direct feedback channel Gmail exposes to senders. Most teams set it up once and ignore it. That is a mistake. The four panels that matter most: **Domain Reputation**: Rated High, Medium, Low, or Bad. High means messages reliably reach the inbox. Low means Gmail is filtering a significant portion. Bad means active enforcement. **Spam Rate**: Gmail's estimate of what percentage of your mail recipients are marking as spam. This is sampled, not exact, but it is the number Gmail's systems act on. Keep it below 0.10% as a target; 0.30% is the hard enforcement threshold. **Delivery Errors**: Shows SMTP error rates. A spike in 4xx (temporary) errors means deferral. A spike in 5xx (permanent) errors means hard rejection. **IP Reputation**: Shows the reputation of the IPs your mail is sent from. If you are on a shared pool, this reflects the behavior of all senders on that pool, not just you. If your domain is not yet verified in Postmaster Tools, that should happen before your next diagnostic. The data is not retroactive, but the compliance status is available immediately after verification. ## Tools That Complement Your Email Stack For teams managing email alongside broader notification infrastructure, three tools from adjacent communication categories worth evaluating: ElevenLabs provides text-to-speech generation at scale with per-character emotional tone control. If your notification stack spans email and voice channels (IVR, in-app audio alerts), this integrates at the audio generation layer without requiring a separate audio production workflow. Krisp's noise suppression SDK is relevant for teams building communication infrastructure where audio quality matters alongside email. The model runs locally and integrates at the media pipeline layer, which keeps latency predictable. Shopify's transactional email infrastructure handles order confirmations, shipping notifications, and receipts at scale. For teams building notification layers on top of commerce platforms, understanding how Shopify structures its own deliverability setup (dedicated domains, stream separation, feedback loop enrollment) is useful context. ## A Diagnostic Sequence for Teams The order in which to investigate when inbox placement drops: - **Check authentication alignment first.** Confirm SPF, DKIM, and DMARC are all passing with proper alignment. If any fail, stop here and fix them. - **Check Postmaster Tools for domain reputation and spam rate.** If domain reputation is Low or Bad, the authentication layer may be fine but reputation has been damaged by past sends or complaint spikes. - **Audit your list for bounce rate and complaint rate.** Pull the last 30 days of delivery events from your ESP. Hard bounce rate above 2% and complaint rate above 0.10% both need immediate attention. - **Check for recent volume changes.** A sudden increase in send volume, a new IP, or a new subdomain all require warmup. If any of these happened before the placement drop, that is likely the cause. - **Run an inbox placement test.** Tools like GlockApps or Litmus run your actual message through seed addresses at major providers and report where it lands. This confirms whether the issue is global or provider-specific. - **Check content signals last.** Only after the above are clean. Run the MIME output through a spam score checker and inspect for link domain reputation, image-to-text ratio, and header anomalies. Most teams reverse this sequence and start with content when the problem is almost always authentication or reputation. Fix the infrastructure layer first. Content rarely determines inbox placement on its own when the other signals are clean. If authentication is correctly configured, reputation is stable, and filtering persists on specific providers, look at what changed in your sends in the 2 to 4 weeks before the drop. The timing is almost always a signal. ## FAQ ### What is the most common reason emails go to spam in 2026? Missing or misconfigured email authentication is the most common cause. Since November 2025, Gmail rejects non-compliant bulk mail at the SMTP layer with permanent 5xx errors. SPF, DKIM, and DMARC must all be configured and aligned with the visible From domain. ### How do I check if my SPF, DKIM, and DMARC are configured correctly? Send a test message to a dedicated inbox placement checker or use MXToolbox's DMARC analyzer. Verify that SPF lists all your sending services, that DKIM signatures pass validation, and that DMARC alignment is confirmed. Also check Google Postmaster Tools for your domain's compliance status. ### What spam complaint rate triggers Gmail filtering? Gmail begins applying filtering pressure above 0.10% and enforces hard thresholds at 0.30%. For every 1,000 emails sent, receiving 3 or more spam complaints can trigger Gmail's filters. Monitor this rate in Google Postmaster Tools. ### Should I use a dedicated IP or shared IP for email sending? For volumes below 50,000 sends per month, a shared IP pool with a reputable ESP is usually the better choice. Dedicated IPs require consistent volume to build meaningful reputation. Above 100,000 sends per month, dedicated IPs give full control over reputation. ### Why should I separate transactional and marketing email streams? Sharing infrastructure between streams means a complaint spike from a marketing campaign can degrade inbox placement for account verification emails, security alerts, and receipts. Separate subdomains and IP pools keep the streams independent so a marketing incident does not affect transactional delivery. ### How long does domain warmup take? Domain warmup for a new sending domain or IP typically takes 4 to 6 weeks. Start at 50 to 100 sends per day with your most recently engaged recipients, increase gradually, and pause if bounce or complaint rates spike. Skipping warmup is the most common cause of immediate spam placement on a new domain.