Why your emails land in spam (and what actually fixes it)
Authentication is table stakes. Once it passes, placement comes down to engagement, list quality and consistency — here is how each one is judged.
You set up SPF, DKIM and DMARC. Your test email still lands in spam. This is the part most guides stop short of.
Authentication only proves you are who you claim to be. It says nothing about whether recipients want your mail. Placement is decided by reputation, and reputation is mostly behavioural.
What mailbox providers actually measure
Complaint rate is the strongest negative signal there is. One person in a thousand marking you as spam — 0.1% — is roughly the ceiling. Above that, Gmail starts routing everything to the spam folder, not just the complained-about message.
Engagement matters more than most senders expect. Opens, replies, moving a message out of spam, adding you to contacts: all positive. Deleting without opening is mildly negative. Never opening anything from you for months is strongly negative.
Bounce rate signals list quality. A list with many dead addresses looks bought rather than earned. Keep hard bounces under 2%; above 5% and Amazon SES will place your account under review regardless of what Gmail thinks.
Spam traps are addresses that exist only to catch senders who do not clean their lists. Some are recycled abandoned accounts; some were never real. Hitting one is disproportionately damaging because there is no legitimate way to have acquired it.
The fixes, in order of impact
Stop emailing people who never open. Suppress anyone with no engagement in 90 days. It feels like shrinking your audience. It is actually removing the portion actively damaging you.
Make unsubscribing trivially easy. Every unsubscribe you make difficult becomes a complaint instead, and a complaint costs far more. Both a visible link and a working List-Unsubscribe header.
Never buy a list. There is no recovery path that is faster than starting over on a clean domain.
Warm up gradually. Going from zero to 50,000 sends in a day reads as a compromised account. Double daily over two weeks instead.
Send consistently. A dormant domain that suddenly sends heavily looks like a takeover. Steady volume builds a steadier reputation than occasional bursts.
Separate your streams
Password resets and marketing campaigns should not share a domain. A marketing campaign that collects complaints will drag your password resets into spam with it, and password resets are the mail you genuinely cannot afford to lose.
Use a subdomain — mail.yourdomain.com for marketing, notify.yourdomain.com for transactional. Reputation is tracked per subdomain, so a bad campaign cannot poison the mail your product depends on.