Is your email going to spam? SPF, DKIM, DMARC and the way to the inbox

A significant share of the emails you send may be dropping into the spam folder without ever reaching the recipient's eye. This is a silent, invisible loss of revenue: your message shows as "sent," counts as delivered in reports, but no one reads it. Email deliverability is precisely the art of closing that gap. In this article we cover the difference between sending and delivering, the authentication trio of SPF, DKIM and DMARC, the new sender rules that took effect in 2024, and the practical ways to reach the inbox.

For cold-email strategy, our cold email piece, and to bring every channel into one place, our multichannel communication piece are complementary.

1Send2SPF3DKIM4DMARC5Inbox / Spam

Sending and delivering are not the same thing

Most people see a "delivered" report and assume the job is done. But "delivered" only means the message was accepted by the recipient's server; it doesn't tell you whether it landed in the inbox or the spam folder. What really matters is inbox placement. Two senders can send the same number of emails, and one reaches 95% of inboxes while the other loses 50% to spam. Three things determine the difference: authentication, sender reputation, and content.

The authentication trio: SPF, DKIM, DMARC

These three records are how you tell the recipient's server "this email really comes from where it claims to." Without any of them, even your most innocent message looks suspicious.

• SPF (Sender Policy Framework): A DNS TXT record that lists which servers may send email on behalf of your domain. The recipient checks here whether the incoming email came from an authorized server.
• DKIM (DomainKeys Identified Mail): Adds a digital signature to each message with a private key belonging to your domain. The recipient verifies this signature against the public key in DNS, confirming the message wasn't altered in transit and really came from you.
• DMARC (Domain-based Message Authentication): The policy that says what to do if SPF and DKIM fail. It has three levels: p=none (just monitor and report), p=quarantine (send suspicious ones to spam), p=reject (reject). The right path is to start with none and move gradually to reject by reading the reports.

Together these three both protect your deliverability and make it harder for your brand's name to be impersonated for fraud (spoofing).

The new sender rules after 2024

The rules of the game have tightened for bulk senders. Major email providers now explicitly require three things from high-volume senders: correctly configured SPF and DKIM for the domain, a valid DMARC policy, and a one-click unsubscribe link in marketing emails. They also expect your complaint rate to stay below a very low threshold (typically 0.3%). Senders who don't meet these rules can have their messages routed straight to spam. In other words, deliverability is no longer a good practice but a requirement.

Reputation and content

Even if you set up authentication, reaching the inbox is hard if your sender reputation is weak. Providers assign every sending domain and IP an invisible trust score, shaped by how recipients reacted to your past messages. The main factors that determine reputation are:

• List hygiene: Continuing to send to invalid, bouncing and never-opening addresses pulls your reputation down fast. Clean your list regularly, remove hard bounces immediately, and move long-inactive addresses to a separate bucket.
• Warm-up: Don't blast thousands of emails at once from a new domain or sender; build trust by ramping volume up gradually over days. A sudden spike in volume is one of the biggest spam signals in providers' eyes.
• Content balance: Messages that are all image, packed with links, or full of trigger words like "free," "hurry," "you've won" alert the filters. Write plainly, personally and with a focus on value; keep the text-to-image balance.
• Engagement: Messages with high open and reply rates are "wanted" email in providers' eyes and reach the inbox more easily. That's why continuing to send to an uninterested audience damages not only that message but all your future sends.
• Spam complaints: A user marking your message "as spam" is the heaviest penalty. Making it easy to unsubscribe protects your reputation by reducing complaints.

Don't forget transactional emails

When deliverability comes up, marketing emails always come to mind; yet transactional emails (password resets, order confirmations, invoices, appointment reminders) are at least as important, and the consequences are heavier when they hit spam. If a customer doesn't receive the invoice or confirmation they're expecting, that's not just a deliverability problem but a direct trust and operations problem. What's more, these emails usually have high open rates, so when sent correctly they actually feed your reputation.

So, where possible, send transactional and marketing emails through separate channels or separate subdomains. That way, even if a marketing campaign damages your reputation, your critical transactional emails are unaffected and keep reaching the customer. Separating the two streams both protects deliverability and keeps your most critical messages on the safest path.

Setting up the records correctly

All three records are configured in your domain's DNS settings, and a wrong setup is sometimes worse than none. For SPF, gather all the services that send email (your own server, your marketing tool, your billing system) into a single record; adding a separate SPF record for each service is treated as invalid. For DKIM, don't forget to add the key your email service provides to DNS and to enable signing in the service panel; a key in DNS with signing turned off does nothing. For DMARC, always start with p=none and define a reporting address; after collecting reports for weeks and seeing who sends in your name, move gradually to quarantine and reject once all legitimate senders are verified. Rushing to reject can get even your own legitimate emails rejected.

Protect your brand

Authentication has another often-overlooked benefit: brand protection. When you don't set up SPF, DKIM and especially a strict DMARC policy, fraudsters can impersonate your domain and send fake emails to your customers. The customer receives an "invoice" or "payment request" that didn't really come from you; they get harmed and blame your brand. Moving DMARC gradually to the reject level ensures these impersonations never reach the recipient at all.

So your deliverability infrastructure doesn't just get your own emails into the inbox; it also protects your customers' trust by preventing the misuse of your name. A well-configured authentication setup is both a deliverability tool and a security shield.

How to test and monitor

Manage deliverability with measurement, not guesswork. Before sending in bulk, send a copy to a deliverability-scoring test tool; these tools show your SPF, DKIM and DMARC status, spam trigger words, and your content score on one screen. For ongoing tracking, use the sender postmaster tools the big providers offer to watch your domain reputation, spam rate, and authentication success. Reading DMARC reports is also valuable: they show who sends in your domain's name, where failures occur, and which sends impersonate your brand. These reports may look technical at first glance, but read regularly they clearly reveal the root of deliverability problems.

Cold email or marketing email?

Deliverability rules become more nuanced depending on the type of email you send. For permission-based marketing emails (newsletters, campaigns), the most critical issues are list hygiene, easy unsubscribe and a low complaint rate, because this audience already knows you and expectations are high. Cold email is a completely different game: the recipient doesn't know you, so even the smallest spam signal renders your message invisible. In cold sending, keeping volume low, personalizing every message, and where possible using a domain separate from your main one are vital.

Sending both types from the same infrastructure, with the same list and the same carelessness, is the most common mistake. If you run into a reputation problem in cold sending and you're doing it from your main domain, even the newsletters going to your most loyal customers start dropping into spam. So separate the two streams: a different domain, a different warm-up rhythm, a different content discipline.

The numbers that show deliverability health

There are a few numbers you should track to manage deliverability. Bounce rate: the share of emails that don't arrive; if it's rising, your list has gone stale. Complaint rate: the share who hit "spam"; it must be kept below a very low threshold (a few per thousand), and exceeding it carries a heavy penalty. Open and reply rate: low engagement tells providers your message isn't wanted. Unsubscribe rate: if it's high, your content or send frequency is out of step with expectations; but a high unsubscribe is always better than a high complaint.

Track these numbers as trends, not after every single send. A single campaign going poorly is normal; but a complaint rate climbing for weeks or opens steadily falling is an early warning that your reputation is eroding. Catch it early and you fix it easily; ignore it and one day all your emails quietly drop into spam and you won't know why.

What to do if you're already in spam

If your messages are already landing in spam, panicking and sending more often makes it worse. First diagnose the cause: is authentication missing, is the list dirty, did volume spike suddenly, is the content triggering filters? Then follow a recovery plan. Temporarily reduce send volume and send only to your most loyal audience who engage with you regularly, because high opens and replies rebuild your reputation. Leave out long-inactive addresses. Re-check your authentication records from scratch. Reputation doesn't drop in a day, nor does it return in a day; but with a clean list and plain content, it recovers within weeks.

Common mistakes

• Using a purchased list: Sending to addresses without permission is the fastest way to destroy both deliverability and reputation.
• Sending everything from one domain: Doing cold outreach from your main domain puts all your email at risk when a problem arises; consider a separate domain for cold sending.
• Making unsubscribe hard: When unsubscribing is hard, people hit "spam"; that's a far heavier penalty than an unsubscribe.
• Set and forget: Deliverability isn't a one-time setup but an ongoing discipline; it doesn't stay good without regular measurement.

In the end, deliverability depends as much on this invisible infrastructure as on the words you send. Set up authentication correctly, keep your list clean, write your content plainly, grow volume gradually, and watch the numbers. Your message reaching where it deserves to be — the inbox — is possible only with this discipline.