Your intent is real, but the receiver sees signals
A quote, invoice or opted-in newsletter can still land in spam. The receiver cannot inspect your internal approval or know the commercial relationship by intention alone. It sees a connection, authenticated identities, message structure, sending history and its own users’ responses.
The useful reframe is to separate legitimacy from observable trust. Authentication helps a receiver connect mail to accountable domains. Reputation reflects how traffic associated with domains and infrastructure has behaved. Recipient signals reflect wanted or unwanted outcomes. Content can matter, but it is one input rather than a magic list of forbidden words.
Google requires senders to personal Gmail accounts to meet published authentication and infrastructure requirements, with additional obligations for bulk senders. Google email sender guidelines Yahoo likewise tells senders to authenticate, control complaints, honour unsubscribes and separate different traffic types where appropriate. Yahoo sender best practices These pages describe prerequisites and practices, not an inbox guarantee.
Begin with evidence from the affected message. Avoid changing the subject, domain, IP and DNS together because any improvement would be impossible to attribute.
Name the outcome before calling it deliverability
Determine whether the sending system attempted the message, the receiving server accepted it, the mailbox placed it in spam, a user rule moved it, or the recipient never found it. These are distinct states with different evidence.
A successful SMTP hand-off is not proof of inbox placement or reading. A bounce is not a spam-folder event. A provider dashboard marked delivered often means the receiver accepted responsibility. Ask the recipient to search by message ID or sender and inspect spam, quarantine, rules and focused-inbox features where appropriate.
Record the UTC time, sender feature, envelope domain, visible From domain, DKIM signer, sending IP, receiver, SMTP result and observed folder. Keep a copy of the raw header from a delivered example. If a security gateway sits before the mailbox, identify whether it quarantined the message before the consumer provider made any folder decision.
Respect privacy. Use mailboxes you control for technical tests and plain content without customer data. Do not ask a recipient to forward a confidential message to a public analyser. A redacted header and provider event can usually establish the route.
The distinction between accepted and actually received is the most commonly missed check. A sending platform will often mark a message delivered the moment the receiver accepts responsibility for it, before the mailbox decides between inbox and spam. If you rely on that label alone, you can chase a recipient-rule or folder problem as if it were a sending fault, or the reverse. Ask the recipient what folder the message is in and search by sender or message ID before changing anything.
If the problem is inconsistent inbox placement rather than rejection, inbox placement testing with honest limits can help define a controlled comparison.
Find the smallest stream that shares the symptom
Group outcomes by sending application, recipient provider, From domain, DKIM domain, envelope domain, sending IP and time window. Compare staff mail, website notifications, invoices and marketing separately. A single visible address may mask several technical routes.
If only one recipient is affected, check personal rules, prior spam actions and address history. If one provider is affected, compare its responses and official requirements. If one application is affected everywhere, inspect that application’s authentication and message generation. If every route changed together, investigate shared DNS, account compromise, platform migration or reputation.
Use a known-good message from the same route as a control. Compare headers rather than display names. Note whether the problem began after a volume increase, list import, template change, authentication change, supplier migration or new shared infrastructure. Correlation is a lead, not proof, so preserve dates.
Segmentation has a trade-off. Yahoo notes that IP and DKIM-domain reputation can affect delivery and recommends separating bulk or marketing mail from user and transactional traffic. Yahoo best practices Separation can contain risk, but needless domain sprawl increases DNS ownership and monitoring work. Use it when streams truly have different owners and risk.
route-based sender inventory templateAuthenticate the route that produced the message
Inspect the receiver’s authentication results. Record SPF with the envelope identity it evaluated, DKIM with the d= signing domain, and DMARC with the visible From domain. ‘SPF exists’ and ‘DKIM enabled’ are configuration statements, not proof about this message.
Microsoft describes SPF as identifying authorised sources for the MAIL FROM domain, DKIM as cryptographically signing message elements, and DMARC as connecting authentication to the From address and policy. Microsoft email authentication overview The mechanisms work together but do different jobs.
Check for a passing aligned identity, correct forward and reverse DNS where your provider controls it, and encryption for transport according to the receiving provider’s rules. Google’s current guidelines cover SPF, DKIM, DMARC, PTR records, TLS and message formatting expectations. Google requirements
Repair the application owner’s route. Do not weaken DMARC or add a raw IP to SPF until you know who controls the observed envelope domain. A passing authentication result supports accountability; it does not override complaints, poor list quality or unsafe content.
Not sure what SPF, DKIM and DMARC each check and why one pass can still mean spam? Start with an SPF, DKIM and DMARC explainer that names the job of each record.
Inspect reputation through evidence you can own
Ask the sending provider for event-level results, deferrals, complaint signals and the infrastructure used. Where you qualify for a receiver’s postmaster service, use its aggregated data and understand thresholds, sampling and privacy limits. Do not infer domain-wide reputation from one free checker or one blocklist.
Look for sudden changes in volume, recipient acquisition, invalid addresses, complaints, inactive contacts, compromised credentials and mixed traffic on shared infrastructure. Yahoo advises senders to keep complaint rates low, remove invalid recipients promptly, monitor bounces and avoid sending to people who do not want the mail. Yahoo list and complaint guidance
Shared sending services introduce a trade-off. They can provide managed scale and authentication, while some infrastructure reputation remains outside your direct control. Dedicated infrastructure gives more isolation but requires volume, expertise and maintenance. Moving to a new IP does not erase poor permission or sending practices.
If there is evidence of account compromise, stop normal deliverability testing. Contain the account, revoke sessions or credentials through your incident process, preserve logs and involve the security owner. Reputation repair cannot begin while unauthorised sending continues.
Review audience, cadence and message construction together
For marketing mail, verify how each audience was collected, whether the promised content matches what is sent, and whether objections and unsubscribes are honoured across imports. Authentication does not create permission. Remove confirmed invalid recipients and prevent suppressed addresses from being silently reintroduced.
Check that the visible sender is recognisable, the reply address works, links point to domains the organisation controls or intentionally uses, and the message has a clear purpose. For subscribed mail, provide the unsubscribe mechanisms required by the receiving provider and make the visible option easy to use. Google and Yahoo both publish unsubscribe expectations for qualifying bulk senders. Google sender guidelinesYahoo sender guidance
Inspect HTML validity, text alternatives, URL redirects and unexpected tracking introduced by templates. Do not remove all branding or rewrite language to evade filters. That can make wanted mail less recognisable and conceal the actual fault.
The trade-off between frequency and visibility is business-specific. More mail creates more opportunities for engagement and more opportunities for complaints or fatigue. Use your own consent, engagement and operational evidence rather than invented universal cadence rules.
clean your email list before it works against youChange one owned variable and keep a rollback
Write the diagnosis in a testable form: ‘the booking route signs with an unaligned supplier domain’, ‘a recent import contains invalid addresses’, or ‘one shared IP is deferred at one receiver’. Choose the correction that addresses that mechanism and name its owner.
Record the old state, new state, approver, implementation time, expected signal and rollback condition. A DNS correction may require cache time and service activation. A list correction should preserve suppression evidence. A content repair should not change the sending route. A provider escalation should include event IDs, UTC times and representative redacted responses.
Do not make simultaneous authentication, domain, template, audience and volume changes. A broad reset can interrupt working mail and prevents you learning what mattered. For an urgent business message, use an established alternative channel rather than repeatedly resending through the impaired stream.
Stop if the affected route cannot be identified, the proposed DNS record would overwrite an unknown value, the provider cannot explain its infrastructure, or customer-sensitive content would be required for testing. Escalate to the mail administrator, service provider or security owner with the evidence already collected.
Verify the same stream, then watch for recurrence
After the correction is active, send a plain non-sensitive control through the same application, account, From identity and receiving provider. Record SMTP acceptance. Open the received original and compare route, SPF identity and result, DKIM signing domain and result, and DMARC outcome with the failed example.
Then check the actual symptom. If the complaint was spam placement, observe the folder in a mailbox you control without moving the test first. One inbox result is evidence for that test, not a universal placement rate. Repeat only enough to distinguish a route-specific fault, and do not recruit customers as test recipients.
Restore normal volume gradually according to business risk and provider guidance. Watch bounces, deferrals, complaints, authentication and replies. Verify that an adjacent working stream, such as staff replies or password resets, remains healthy. Keep a dated sender inventory so future changes preserve ownership.
Escalate if same-route authentication passes but placement remains consistently poor, if results differ sharply by provider, or if complaint and compromise signals continue. Give the specialist a redacted timeline and exact routes. Legitimate mail earns a better chance when its observable identity, audience and behaviour are coherent; no single record can promise an inbox.
Sources and further reading
- Google: Email sender guidelines
- Yahoo Sender Hub: Sender best practices
- Microsoft Learn: How email authentication works in Microsoft 365