2026-07-07 ·

Why Your Authenticated Email Still Lands in Spam

SPF, DKIM, and DMARC all pass and your email still ends up in the spam folder. I ran into this exact problem with an announcement for our email forwarding service, so I dug into the headers and the broader reasons authentication alone is not enough.

I have to admit something. It has been a while since I last wrote a piece for this blog, and I am genuinely happy to be back at the keyboard. The Postmaster used to write here more regularly, and life (and a queue of infrastructure work) got in the way. But a recent incident pulled me back, because it is exactly the kind of problem this blog exists to unpack.

We sent an announcement to our service's subscribers. New feature, mailing lists, the usual. SPF passed. DKIM passed. DMARC passed. The headers were clean. And yet some subscribers told me the email landed in their spam folder.

That is frustrating but is also instructive. Authentication proves you are who you say you are. It does not prove what you are sending is wanted. Mailbox providers like Gmail look well past the technical handshakes before they decide where to file your message. So I dug into the original email headers, ran the analysis, and then went looking for every other common reason a perfectly authenticated email still gets flagged. Here is the full picture.

What the Headers Told Me

I pulled the raw message and fed it through an analysis. The technical parts was correct:

SPF: PASS, with IP 203.0.113.42
DKIM: PASS, domain example.com, selector default
DMARC: PASS, policy p=REJECT

If you stopped reading at the authentication layer, everything looked fine. But the moment you open the message body, the problems start.

The Reasons From the Email Itself

When Bayesian email filtering was first used it was a breakthrough: The one thing that spammers cannot try to workaround was the message itself. True, there were some bad tactics like stuffing the email with seemingly Innocent words to throw the Bayesian statistics off-track, but I don't see those anymore lately because now there are better ways to manage email sending reputation like SPF and DKIM. Having said that, an email's Achilles heel is always the content itself.

1. Too many tracked links

To gauge the effectiveness of our email, we do use email tracking. Every link in the email body had been rewritten through a click-tracking redirect. The clean URLs were replaced with track.example.com/l/... URLs, and there was a hidden 0x0 tracking pixel at the bottom of the HTML.

Spam filters are suspicious of emails that mix conversational text with heavy marketing tracking infrastructure. Multiple deeply nested tracking redirects and an invisible tracking pixel together push a message toward the Promotions tab or outright spam. As Inbox Monster's guide to tracking pixels puts it, overloading emails with multiple tracking pixels is something SpamAssassin will flag. The pixel is a 1x1 transparent image that pings a server when the email opens, but sloppy or excessive implementation is a red flag.

2. No unsubscribe link

Looking back, the email that we sent was clearly a promotional broadcast ("Introducing Mailing Lists", "Mailing Lists are part of paid plans"). We did write "If you have any questions, just reply to this email!" but we did not give recipients a direct opt-out link.

This is not just a best practice. It is a pseudo-hard requirement. Since February 2024, Google's sender guidelines require bulk senders (anyone sending more than 5,000 messages per day to Gmail accounts) to support one-click unsubscribe via the List-Unsubscribe header, as defined in RFC 8058. Yahoo enforced the same rule. Postmark's writeup on list-unsubscribe headers explains the logic well: if recipients cannot find how to unsubscribe, they hit "Mark as spam" instead, which hurts your sender reputation far more than a clean opt-out ever would.

3. Trigger phrases clustered together

The email also contained phrases like "paid plans", "Free Upgrade Program", "Sign up for", and bullet points listing feature tiers, all packed into a few short paragraphs. None of these words are spam on their own, but a new sending domain combining marketing vocabulary, tracking links, and no unsubscribe path checks the same behavioural boxes as an actual spam campaign. Filters read semantics, not just syntax.

4. Young domain, thin reputation

Another thing: If your domain is not a domain with a long sending history at volume and does not have an established robust sender reputation with a provider like Google, automated filters default to a guilty-until-proven-innocent stance for broadcast email. Passing SPF, DKIM, and DMARC is the baseline can get your foot in the door, but it does not hand you a perfect reputation score.

The Reasons That Were Not in the Original Analysis

I stopped at four reasons, then kept digging, because the original analysis missed several common causes that affect every sender regardless of their specific email.

5. Missing or mismatched reverse DNS (PTR record)

Every sending IP address needs a PTR record that resolves back to a hostname, and that hostname must resolve back to the same IP. Google's sender guidelines require valid forward and reverse DNS for all senders. Valimail's explanation of PTR records is blunt: most major mail servers treat a missing PTR record as a trust signal failure. You can pass every content check and still get blocked at the connection level if your IP has no reverse DNS.

KaiMail has it's PTR correctly pointed and we've resolved this early on, but you might want to check your own email senders.

6. Engagement signals are weak

Mailbox providers now also filter based heavily on user engagement. If recipients are not opening, clicking, or replying, that is a signal the email is unwanted, regardless of how perfect the authentication is. Twilio SendGrid's deliverability tips stress monitoring engagement metrics closely, because declining engagement is one of the major triggers for spam folder placement. Google uses engagement as a primary mailbox placement metric.

7. No plain-text alternative, or a broken one

The email that we sent was multipart/alternative, which is correct, but many other marketing tools send HTML-only messages with no plain-text part. Spam filters compare the HTML and text versions. A missing or mismatched plain-text part is a signal of a hastily assembled marketing blast, not a legitimate message. SendGrid's testing guidance specifically recommends checking for missing plain-text versions before sending.

8. Shared IP with a poisoned reputation

If your email sender uses a shared IP pool, your reputation is tied to everyone else on that IP. One bad neighbour who sends spam can drag your perfectly authenticated email into the spam folder alongside theirs. Google's sender guidelines advise checking whether your shared IP is on any internet blocklist and using Postmaster Tools to monitor its reputation.

So What Can We Actually Do About It

Identifying the problem is only half the work. These are some standard email hygiene practices that genuinely reduce the chance of being marked as spam, drawn from the sources above and from my own experience running mail infrastructure.

Authenticate everything, and align it. SPF, DKIM, and DMARC are the baseline. Make sure the domain in your From: header aligns with the SPF or DKIM domain (DMARC alignment). This is non-negotiable as of 2024.
Add a one-click unsubscribe header. Include List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click headers, plus a visible unsubscribe link in the email footer. This is required for bulk senders by both Google and Yahoo.
Dial back the tracking. If the email is meant to read as a personal note, disable click-tracking redirects and tracking pixels. Use a dedicated tracking subdomain if you must track, so the redirects live on your own domain rather than a third-party tracking service. Keep pixels minimal.
Warm up your domain. Mailgun's domain warm-up guide recommends starting with a small volume and gradually increasing over days or weeks, sending to your most engaged recipients first. A new domain sending at full volume on day one is asking for a reputation penalty.
Build your list organically, with double opt-in. Never purchase, rent, or scrape email lists. Send a confirmation email requiring an action before subscribing someone. This confirms genuine interest and keeps you off spam traps.
Clean your list regularly. Remove bounced addresses, suppress spam traps, and implement a sunset policy for subscribers who have not engaged in months. A lean, engaged list outperforms a large, dead one every time.
Set up reverse DNS on your sending IP. Make sure the PTR record resolves to a hostname, and that hostname resolves back to the same IP. This is a connection-level requirement, not a content one.
Monitor engagement and complaint rates. Keep spam complaint rates below 0.3% (ideally below 0.10%, per Google). Use Google Postmaster Tools to watch your domain and IP reputation as the providers see it.
Tell subscribers to allowlist you. Include clear instructions in your welcome email for adding your sending address to contacts or the safe sender list in Gmail, Outlook, and Yahoo.
Keep your content honest. Avoid clustering trigger phrases, do not use deceptive subject lines, and make sure the display name in the From: header identifies the sender, not the pitch. Google explicitly prohibits using the display name to imply urgency or a thread that does not exist.

The Bottom Line

Authentication is the floor, not the ceiling. SPF, DKIM, and DMARC get you through the door. What keeps you in the inbox is sender reputation, engagement, and the unglamorous discipline of email hygiene: clean lists, real consent, proper unsubscribe mechanisms, and a sending infrastructure that does not look like a marketing machine pretending to be a person.

We learned this the hard way with a single announcement email. The fix was not another DNS record. The fix was sending email that behaves like email people actually want to receive.

The Postmaster is back. I intend to keep writing about these topics, because the gap between "I set up SPF" and "my email reaches the inbox" is wider than most people think, and it is not getting narrower. If you have questions about your own deliverability, write to us at the address in the site footer. I read everything.