Inbox placement testing

3 April 2026 · 11 min read

Inbox placement testing answers a question that DMARC reports cannot: when your mail reaches a real mailbox, does it land in the inbox, the spam folder, a tab like Promotions, or nowhere at all? DMARC tells you whether a message authenticated and aligned. Placement testing tells you where the receiver decided to put it. Those are different layers, and senders constantly confuse them. A message can pass SPF, DKIM and DMARC perfectly and still be filed in spam, because authentication is a trust signal, not a delivery guarantee. This article explains how seed testing and placement tools actually work, what they can and cannot measure, where they quietly mislead you, and how to combine their output with your DMARC aggregate data so the two datasets correct each other instead of contradicting each other.

If you have not yet confirmed your authentication is clean, do that first with the DMARC checker, SPF checker and DKIM checker. Placement testing on an unauthenticated domain just measures the consequences of broken authentication, which is a waste of a test run.

What inbox placement testing is, and what it is not

Inbox placement testing estimates the percentage of your messages that reach the inbox versus the spam folder versus missing entirely, broken down by mailbox provider (Gmail, Outlook and Microsoft 365, Yahoo, Apple iCloud, corporate filters, regional providers like GMX, Mail.ru, La Poste and so on). It is a sampling technique. You send a copy of your real campaign or transactional message to a controlled set of monitored mailboxes, and a service reports where each copy landed.

Be precise about the boundary:

• It does not measure deliverability in the strict sense (accepted versus bounced at the SMTP layer). That is what your sending logs and bounce reports tell you.
• It does not measure what any individual real recipient saw. Placement is per-mailbox and personalised: engagement history, filter rules and prior interactions move the same message to different folders for different people.
• It does give you a representative, provider-segmented estimate of folder placement for a given message, IP, domain and content combination at a moment in time.

That last clause matters. A placement test is a snapshot of one message from one identity on one day. Reputation drifts, content changes, and providers re-evaluate constantly, so a single green result is not a clean bill of health, and a single red result is not a crisis. Trends across repeated tests are the signal; one run is an anecdote.

How seed list testing works under the bonnet

The classic method is the seed list: a set of email addresses the testing service controls across every major provider. You add these addresses as extra recipients on a send (or send a dedicated copy through the same IP, domain, template and ESP configuration as the real campaign), and the service logs the folder each seed copy lands in.

Mechanically, a seed test does the following:

1. You request a fresh seed list from the provider, typically a few hundred addresses spread across Gmail, Outlook/Microsoft 365, Yahoo, iCloud, regional ISPs and some corporate domains.
2. You include those addresses in the same send as your normal recipients, so the seeds travel through the identical IP, authentication and content path.
3. The service's automation logs into (or programmatically reads) each seed mailbox, finds your message by a unique identifier you embed or by subject matching, and records the folder: Inbox, Spam/Junk, a category tab, or Missing.
4. It aggregates the results into a per-provider placement percentage and usually surfaces the authentication results the seed mailbox saw (SPF, DKIM, DMARC) plus any blocklist hits on the sending IP.

The strength of seed testing is breadth: one send gives you a provider-by-provider map. The weaknesses are structural and worth understanding before you trust the numbers:

• Seed mailboxes have no engagement history. They never open, click, reply, or move your mail out of spam. Real subscribers do all of those things, and engagement is one of the heaviest inputs to Gmail and Microsoft filtering. A seed that sits untouched is the least engaged recipient you have, so seed placement often reads worse than reality for engaged audiences, and can read better for cold or unengaged lists where real complaints exist that seeds never generate.
• Seeds can be fingerprinted. Providers and filters can recognise patterns of dormant addresses that only ever receive bulk mail and never interact, and treat them differently. The major filters are aware seed lists exist.
• Gmail tabs are not failure. Landing in Promotions is inbox placement, not spam. Some tools count tabs as a miss, which inflates your apparent problem. Read the tool's tab handling before you panic about a low Gmail number.
• Content personalisation is stripped. Seed copies usually lack the personalisation, list segmentation and per-recipient sending-time logic that shape real delivery, so they test the worst-case generic version of your message.

None of this makes seed testing useless. It makes it a comparative instrument. The absolute percentage is soft; the difference between two tests run the same way is hard. Use it to compare a content variant against a control, a warmed IP against a cold one, or this week against last week, not to declare an absolute inbox rate.

Panel data and the alternative to seeds

The other main methodology is panel-based measurement, sometimes called crowd-sourced or live placement. Instead of dormant seed mailboxes, a panel uses real, consenting users' mailboxes (typically through an opt-in extension or partnership) and reports where genuine messages from a given sender landed across those real accounts. Gmail's own Postmaster Tools is a related but distinct source: it reports aggregate inbox-versus-spam rates that Google itself observed for your authenticated domain, with no seeding required, provided you send enough volume to clear its reporting threshold.

Panel and Postmaster data fix the biggest seed weakness, real engagement, but bring their own limits:

• Coverage is uneven. Panels are strong where they have users and blind where they do not, so a regional ISP or a corporate filter may have no panel coverage at all.
• Volume thresholds apply. Gmail Postmaster Tools needs a meaningful daily volume to your domain before it shows spam-rate and reputation data, so low-volume and transactional senders often see sparse or empty dashboards.
• You cannot test on demand. Panel and Postmaster data reflect what you actually sent to real people; you cannot fire off a one-off probe and get a clean reading the way you can with seeds.

In practice the two methods are complementary. Seed lists give you on-demand, broad provider coverage with weak realism. Panel and Postmaster data give you realistic, engagement-aware signal with patchy coverage and no on-demand control. Mature deliverability programmes use both and never rely on either alone.

Why authentication shows up inside placement tools

Every competent placement tool reports the SPF, DKIM and DMARC result the seed mailbox observed, and it does so for a reason: authentication is an input to the placement decision, not a separate concern. This is exactly where placement testing and your DMARC programme meet.

A few specifics that catch senders out:

• Alignment, not just pass. A placement tool that only shows "SPF: pass / DKIM: pass" without showing the signing domain (d=) and the envelope domain can hide a DMARC alignment failure. Mail can pass raw SPF and DKIM yet fail DMARC because neither authenticated identity aligns with the visible From domain. If your seed results show authentication passing but your DMARC reports show high failure rates from the same send, alignment is your culprit. See SPF and DKIM passing but DMARC failing for the mechanism, and confirm alignment with the DMARC report analyzer.
• DKIM is the durable signal for placement. Because SPF breaks on forwarding while a correctly signed DKIM survives it, receivers lean on DKIM-based reputation for the domain in d=. A placement test that shows DKIM failing at a provider is a stronger warning than an SPF failure, because it points at a reputation identity you are trying to build. Check signatures with the DKIM checker.
• Tools can show ARC for forwarded paths. If your seeds route through a forwarder or a mailing list, the placement view may show ARC results. That tells you the forwarder is vouching for the original authentication, which is relevant to whether forwarded copies place well.

The headline point: a placement tool that reports authentication is giving you the same verdict your DMARC reports give, but from the receiving side and at the moment of folder placement. Treat the two as cross-checks.

The combined workflow: DMARC data plus placement data

DMARC aggregate reports and placement tests answer adjacent questions, and each covers the other's blind spot:

• DMARC reports are census-wide and continuous. Every participating receiver tells you, for every IP that used your From domain, whether SPF and DKIM aligned and what disposition was applied. This is complete coverage of authentication and policy, but it tells you nothing about folder placement. A message can be dmarc=pass and still sit in spam, and a quarantine disposition in a report does not always mean the user saw it in Junk. The relationship between the report view and the inbox is covered in DMARC reports versus the inbox.
• Placement tests are narrow and periodic. They sample a handful of mailboxes for one message, but they tell you the thing DMARC cannot: inbox versus spam versus tab versus missing, per provider.

Combine them like this:

1. Establish authentication baseline from DMARC. Before reading a single placement result, confirm from your aggregate reports that your legitimate sources are aligned and passing at near-100 percent. Use the DMARC report analyzer to group by sending source. If a source is failing alignment, fix that first; placement testing it is premature.

1. Run a placement test through that same source. Send the seed copy through the exact IP, domain and ESP configuration whose DMARC data you just read, so the two datasets describe the same identity.

1. Cross-read the two results. Four combinations, four conclusions:
2. - DMARC passes, placement is inbox: healthy. Keep monitoring for drift.
3. - DMARC passes, placement is spam: an authentication-clean reputation or content problem. Look at engagement, complaint rates, blocklists and message content, not at your DNS.
4. - DMARC fails, placement is spam: fix alignment first. The placement problem may resolve once authentication is clean, because failing DMARC is itself a placement penalty at Gmail, Yahoo and Microsoft.
5. - DMARC fails, placement is inbox: a fragile state. You are getting away with it for now, often on engagement and IP reputation, but you are exposed and you cannot safely move to enforcement. Treat this as a warning, not a pass.

1. Use DMARC to find the source, placement to grade it. When a placement test shows a provider filtering you, your DMARC reports tell you whether the problem is that provider seeing unaligned mail (an authentication fix) or seeing aligned mail it simply distrusts (a reputation fix). Without the DMARC data you cannot tell those two apart, and they have opposite remedies.

This division of labour is the entire point. Placement data without authentication data leads you to fiddle with subject lines when the real fault is a broken DKIM key. Authentication data without placement data leads you to declare victory at p=reject while half your transactional mail quietly sits in Junk.

Reading a placement result without fooling yourself

A few disciplines keep placement testing honest:

• Hold the variables still. Change one thing per test: content, or IP, or from-address, never several at once. Otherwise a movement in placement cannot be attributed to anything.
• Segment by provider and act per provider. "85 percent inbox overall" is meaningless if it is 99 percent at Gmail and 20 percent at Microsoft. Microsoft (Outlook.com and Microsoft 365) is the provider most senders struggle with, and it weights different signals than Gmail, so always read per provider.
• Watch the blocklist column. Most tools check your sending IP and domain against major blocklists. A listing on a widely-consumed list is often the single explanation for a sudden placement drop, and it is checkable in seconds.
• Treat "Missing" seriously. A copy that is neither inbox nor spam may have been silently dropped or greylisted. Missing at a specific provider is a stronger signal than spam-foldering and usually points at IP reputation, an outright block, or a 4xx deferral.
• Correlate timing with DMARC. If placement degrades, check whether your DMARC reports show a new or changed source appearing around the same time. A misconfigured new sender (shadow IT signing up for a tool) can drag down the whole domain's reputation, and the DMARC report is where it shows up first. Unrecognised senders are covered in DMARC reports show unknown sources.

How this fits the enforcement journey

Placement testing is most valuable at two moments in a DMARC programme.

Before you move from p=none toward quarantine and reject, run placement tests on your major sending streams so you have a baseline. If placement is already poor while you are at p=none, enforcement will not fix it and may make a content or reputation problem more visible, so resolve placement before tightening policy. The path to enforcement without breaking mail is covered in reaching p=reject without breaking email and the enforcement journey.

After you reach enforcement, keep testing periodically, because p=reject protects you from spoofing but does nothing for the reputation and content factors that govern folder placement. Plenty of domains sit at p=reject with excellent authentication and mediocre inbox rates, precisely because the two problems are independent. If you are seeing quarantine in reports but users still find mail in the inbox, that specific mismatch is explained in DMARC quarantine but mail in inbox.

The practical takeaway

Inbox placement testing and DMARC reporting are two instruments pointed at the same mail from opposite ends. DMARC tells you, completely and continuously, whether your mail authenticates and aligns. Placement testing tells you, narrowly and periodically, where the inbox decision actually fell. Used together, they let you separate the two failures that look identical from a distance, an authentication failure and a reputation failure, which is the single most common confusion in deliverability work. Read your DMARC data first to confirm the identity is clean, then use seed and panel placement to grade where that clean identity lands, then act on the difference: alignment and DNS for authentication faults, content, engagement and reputation for placement faults.

Start by confirming the foundation is solid: run your domain through the DMARC checker and feed your reports into the DMARC report analyzer so that every placement test you run sits on top of authentication you can trust. If you would rather not manage alignment, enforcement and ongoing monitoring by hand, our managed DMARC service takes a domain from p=none to p=reject without an email outage and watches for the source and reputation changes that quietly move your mail to spam, with emailed change alerts when something shifts.