Why legitimate email lands in spam

6 May 2026 · 14 min read

You sent the email. The recipient never saw it, or found it three days later in their junk folder next to the dubious watch adverts. The message was real, the content was useful, and nothing about it felt like spam to you. So what happened?

Mailbox providers like Gmail, Outlook, Yahoo and Apple Mail make a fresh filtering decision for every single message. They do not have a simple "allow" or "block" switch for your domain. Instead they score each message against hundreds of signals and then place it in the inbox, the spam folder, or (worse) silently drop it. Legitimate mail ends up in spam when enough of those signals look wrong, even if the message itself is honest.

The good news is that the signals are knowable, measurable and fixable. This guide breaks the problem into the four causes that account for the overwhelming majority of misfiled legitimate mail: authentication, reputation, content, and complaints. For each one you will get a plain explanation of how it goes wrong, how to diagnose it with concrete evidence, and how to fix it.

If you only remember one thing: deliverability is not luck. It is a chain of checks you can inspect.

How a mailbox provider actually decides

Before the four causes, it helps to picture the order of operations at the receiving server.

1. The receiving server accepts the connection and reads the envelope (the MAIL FROM and RCPT TO).
2. It checks SPF against the connecting IP, verifies any DKIM signatures, and then evaluates DMARC alignment.
3. It looks up the reputation of the sending IP and the sending domain in its internal databases.
4. It scans the message content and structure for spammy patterns and broken formatting.
5. It weighs engagement history: have people at this mailbox opened, replied to, or complained about your mail before?
6. It combines all of that into a placement decision.

Notice that authentication comes first and feeds everything after it. A message that fails authentication is treated as untrusted, and an untrusted message has no reputation to lean on. That is why authentication is cause number one, and why fixing it is usually the highest-leverage thing you can do.

Cause 1: Broken or missing authentication

Authentication answers a single question for the receiver: can this sender prove the message genuinely came from the domain in the From: address? Three protocols work together to answer it.

• SPF lists the IP addresses and servers allowed to send mail for your domain.
• DKIM attaches a cryptographic signature so the receiver can verify the message was not forged or tampered with in transit.
• DMARC ties the two together and tells receivers what to do when neither one aligns with the visible From: domain.

When authentication is weak, your mail looks indistinguishable from a spoof attempt. Here are the failure modes that quietly send good mail to spam.

SPF that does not cover all your senders

Most domains send from more than one place: a mail platform like Google Workspace or Microsoft 365, plus a marketing tool, a helpdesk, an invoicing system and a transactional API. If your SPF record only authorises the mail platform, every message from the other systems fails SPF.

A second, sneakier problem is the ten-lookup limit. SPF allows a maximum of ten DNS lookups when it is evaluated. Chain together a few include: statements for different vendors and you can blow past ten, which produces a permerror. A permerror means SPF is treated as failed for every message, even the ones you correctly authorised. We cover the fix in detail in the SPF ten-lookup limit and in fixing SPF permerror, and flattening is one way out, explained in SPF flattening explained.

Diagnose it by running your domain through the SPF checker. It shows the record, counts your lookups, and flags any system that is missing. If you are unsure which include belongs to which vendor, SPF for common providers lists the values to expect.

DKIM that is missing, broken, or on the wrong selector

DKIM signing has to be switched on at every sending system, not just your main one. A common pattern: the mail platform signs perfectly, but the marketing tool was never configured, so its mail arrives unsigned. Unsigned mail can still pass DMARC on SPF alone, but it is fragile, especially once forwarding enters the picture.

Other DKIM faults include a public key that was never published in DNS, a key that was rotated on the sending side but not in DNS so the signature no longer verifies, and a selector mismatch. If you are unclear on selectors, DKIM selectors explained walks through how the s= tag points at the right key, and DKIM key rotation covers swapping keys without breaking signatures.

Verify a specific selector with the DKIM checker. If you do not know your selector, send yourself a test message and read the DKIM-Signature header: the s= value is the selector and the d= value is the signing domain.

DMARC that does not align, or is not there at all

This is the one that catches people out. You can have SPF passing and DKIM passing, and DMARC can still fail, because DMARC requires alignment. Alignment means the domain that passed SPF or DKIM has to match the domain in the visible From: address.

A classic example: your invoicing tool sends from billing@yourcompany.com but its SPF passes for the vendor's own domain, vendor-mail.net, and it signs with DKIM as vendor-mail.net too. Both checks pass, yet neither is aligned with yourcompany.com, so DMARC fails. To the receiver this looks exactly like spoofing. DMARC alignment explained goes deep on relaxed versus strict alignment and why this happens.

If you have no DMARC record at all, you are not failing authentication outright, but you are giving receivers no policy to trust and no reporting to learn from. Big providers increasingly expect a DMARC record to exist before they will treat bulk mail as fully legitimate. Start with what is DMARC and the DMARC record explained.

Run the DMARC checker to confirm a record exists and is syntactically valid, and use the DMARC checker alongside the per-protocol tools at /tools to see the whole authentication picture in one place. If you need to publish or repair a record, the DMARC generator builds a correct one.

The reporting blind spot

Here is the trap. Without DMARC aggregate reports you are diagnosing deliverability with no data. You can see that your own test message passed, but you cannot see that your payroll system, which mails twenty staff once a month, fails SPF and DKIM every time and lands in their spam. DMARC reports (RUA) tell you exactly which sources pass and fail, broken down by sending IP. Read DMARC RUA and RUF reports for what is in them, then feed a report into the DMARC report analyzer to turn the raw XML into a readable summary. Our monitoring service ingests these continuously so you do not have to.

Cause 2: Poor sending reputation

If authentication is the lock, reputation is whether the receiver trusts the person holding the key. Mailbox providers track reputation at two levels: the sending IP and the sending domain. Domain reputation has become the dominant signal, which is good news, because a clean domain reputation travels with you even if you change sending infrastructure.

What damages reputation

• Sudden volume spikes. Going from 50 messages a day to 50,000 overnight looks like a compromised account or a list blast. Receivers throttle or junk mail from senders whose patterns change abruptly.
• Sending to bad addresses. A high rate of hard bounces (addresses that do not exist) signals that you bought or scraped a list, or that your list is stale. Spam traps, which are addresses that exist only to catch senders mailing people who never opted in, are even worse.
• Low engagement. When recipients consistently ignore, delete unread, or never open your mail, providers infer it is unwanted and adjust placement accordingly.
• Authentication failures over time. Reputation and authentication are linked. Months of DMARC failures from a given source erode the trust in your domain, which is another reason to fix cause 1 first.
• Shared IP neighbours. On a shared sending IP, a bad actor sending from the same address drags your reputation down with theirs.

How to diagnose reputation

Reputation is harder to measure directly than authentication, but you have real tools.

• DMARC aggregate reports show volume per source and pass/fail rates, which is your first window into whether a source is sending the way you expect.
• Google Postmaster Tools reports domain and IP reputation for Gmail, plus spam complaint rates, if you verify your domain.
• Microsoft SNDS gives similar data for Outlook and Hotmail.
• Blocklist checks tell you if your IP or domain has been listed by a service like Spamhaus. A fresh listing often explains a sudden delivery cliff.
• Seed and inbox-placement tests send to a panel of test addresses across providers and report where each landed.

How to repair reputation

• Warm up gradually. When you start sending from a new IP or domain, or after a long gap, ramp volume up over days and weeks rather than all at once.
• Clean your list. Remove hard bounces immediately, suppress addresses that have not engaged in months, and never re-import old lists wholesale.
• Separate your mail streams. Send transactional mail (receipts, password resets) and marketing mail from different subdomains so a marketing reputation problem cannot poison your password-reset deliverability. This is also where a tidy SPF setup and per-stream DKIM pay off.
• Get off blocklists. Most reputable lists have a delisting process once you have fixed the underlying cause. Delisting without fixing the cause just gets you relisted.

Reputation recovers slowly because it is built on history. The fastest lever is almost always to stop the bleeding: identify the source that is mailing bad addresses or failing authentication and fix that source.

Cause 3: Content and message structure

Once a message is authenticated and from a trusted sender, the content scan still gets a vote. Modern filters are far less naive than the old "the word free triggers spam" myth, but message structure and content patterns absolutely affect placement.

Structural and technical content problems

• Broken or missing plain-text part. A well-formed email has both an HTML part and a plain-text alternative. HTML-only mail, or mail where the two parts say completely different things, looks evasive.
• Image-heavy, text-light messages. A single large image with almost no text is a classic spammer tactic to evade content scanning. Filters know this.
• Sloppy HTML. Unclosed tags, inline styles copied from a word processor, and bloated markup all lower your score.
• Link and domain mismatch. Link text that says one domain while the href points at another reads as phishing. So does shortened-URL chaining and linking to domains with poor reputations of their own.
• Mismatched or missing headers. A missing Date, a malformed Message-ID, or a From: display name that impersonates a different brand are all red flags.

Recipient-facing content problems

• Misleading subject lines that do not match the body.
• No clear unsubscribe mechanism. For bulk mail, a working one-click unsubscribe is now effectively mandatory at the large providers, and its absence is both a content failure and a complaint magnet.
• Spammy phrasing in volume. No single word dooms you, but a message stuffed with urgency, all-caps and money language scores worse than a plainly written one.

How to diagnose content

• Send a test message to yourself and view the raw source. Confirm both an HTML and a plain-text part exist and broadly agree.
• Run the message through a content-scoring tool (many mail-testing services expose a rule-by-rule breakdown) so you can see which specific rules fire.
• Check that every link resolves to the domain its text claims, over HTTPS, with no surprise redirects.
• Compare a message that lands in spam against one that lands in the inbox and look for the structural differences.

How to fix content

• Always send multipart mail with a genuine plain-text alternative.
• Keep a sensible text-to-image ratio: enough real text that the message makes sense with images switched off.
• Use clean, simple HTML and host images on a reputable domain over HTTPS.
• Make the unsubscribe link obvious and make it work on the first click.
• Write subject lines that honestly describe the body.

Content rarely sends well-authenticated, well-reputed mail to spam on its own. But when authentication is borderline, a content problem is often the deciding vote.

Cause 4: Complaints and engagement

The final cause is the one you control least directly and the one mailbox providers weigh most heavily: what recipients actually do with your mail.

Why complaints are so damaging

When a recipient clicks "report spam" or "junk", that is the strongest possible negative signal. The provider learns, straight from its own user, that your mail is unwanted in this inbox. A complaint rate above roughly 0.3 percent (three complaints per thousand delivered) is widely treated as the danger threshold, and the large providers have made staying under it an explicit expectation for bulk senders. Cross it and placement degrades fast.

Engagement is the positive counterpart. Opens, replies, clicks, and moving a message out of spam into the inbox all tell the provider your mail is wanted. Persistent non-engagement does the opposite.

What drives complaints up

• Mailing people who did not clearly opt in. Purchased lists, scraped addresses, and "we found your email online" outreach generate complaints because the recipient never asked to hear from you.
• Hard-to-find or broken unsubscribe. When the unsubscribe does not work, recipients use the spam button instead, which is far more harmful to you.
• Sending too often or off-topic. Someone who signed up for a monthly newsletter and gets daily promotions feels misled.
• Confusing sender identity. If the From: name does not match the brand they expected, recipients assume it is spam and report it.

How to diagnose complaints and engagement

• Google Postmaster Tools and Microsoft SNDS both surface complaint rates. Watch the trend, not just the snapshot.
• Set up feedback loops (FBLs) with providers that offer them so you receive a notification each time someone marks your mail as spam, and can suppress that address.
• Track open, click and unsubscribe rates in your sending platform and watch for engagement falling off a cliff, which often precedes a placement drop.

How to fix complaints and engagement

• Only mail people who asked. Confirmed opt-in is the single biggest protection against complaints.
• Make unsubscribing trivial. A working one-click unsubscribe lowers complaints, because annoyed recipients leave quietly instead of hitting the spam button.
• Honour preferences and cadence. Send what people signed up for, at the frequency they expected.
• Prune the disengaged. Stop mailing addresses that have not opened anything in months. A smaller engaged list outperforms a large indifferent one on placement.
• Use a consistent, recognisable From identity so recipients know at a glance who you are. This is also where BIMI helps: a verified logo in the inbox, explained in what is BIMI, reinforces that the mail is genuinely yours, though BIMI requires DMARC at enforcement first.

Putting it together: a diagnosis order that works

When good mail is landing in spam and you do not yet know why, work the causes in this order, because each one builds on the last.

1. Authentication first. Run /tools: the DMARC checker, SPF checker and DKIM checker. Fix any record that is missing, invalid, over the lookup limit, or not aligned. Then read your DMARC reports to find sources you did not know were failing.
2. Reputation second. Check Google Postmaster Tools and Microsoft SNDS, run a blocklist check, and look at your DMARC report volumes for any source behaving unexpectedly. Warm up, clean your list, and separate transactional from marketing streams.
3. Content third. View raw source, confirm a real plain-text part, check the text-to-image ratio, and verify every link points where its text claims.
4. Complaints last but never least. Confirm you only mail people who opted in, that unsubscribe works on the first click, and that your complaint rate sits well under the danger threshold.

Most real cases trace back to causes one and two. A vendor you forgot about is failing DMARC, or a marketing blast spiked volume and torched reputation for a week. The per-protocol tools at /tools will show the authentication faults in minutes, and the harder reputation and engagement work follows from there.

The practical takeaway

Legitimate email lands in spam because it carries signals that look untrustworthy, not because the message is bad. Those signals fall into four buckets: authentication that does not prove who you are, reputation that history has dented, content and structure that read as evasive, and recipient complaints that tell the provider your mail is unwanted. Each is diagnosable with concrete tools and fixable with concrete steps.

Authentication is where most fixes start and where the leverage is highest, because everything downstream depends on receivers trusting that your mail is genuinely yours. If you want to see exactly where your domain stands right now, run it through the free tools and read the requirements the big providers now enforce. And if you would rather have the whole chain (SPF, DKIM, DMARC, MTA-STS and BIMI) set up correctly, moved safely to enforcement, and monitored for changes without you babysitting DNS, that is exactly what our done-for-you DMARC service and continuous monitoring exist to do.