If your open rates fell off a cliff and nothing about your emails changed, the problem is almost never your subject lines. It is authentication, complaints, or list quality — and the first of those is now a hard requirement rather than a best practice.
The takeaway up front: inbox placement is decided mostly before anyone reads a word. Providers check that your domain cryptographically vouches for the message, then check how recipients have reacted to your mail in the past. Get authentication right and keep complaints low, and ordinary marketing email reaches the inbox. Skip either, and no amount of copywriting rescues it.
The rules changed, and they are enforced
In 2024, Google and Yahoo began enforcing a shared set of requirements on people sending bulk mail to their users. Microsoft followed with comparable rules for high-volume senders to its consumer domains. The specifics are worth knowing because they are checkable:
- Every sender needs authentication. At minimum SPF or DKIM, published in your domain's DNS.
- Bulk senders — roughly 5,000 or more messages a day to a given provider's personal accounts — need all three: SPF, DKIM, and a DMARC record, with the visible "From" domain aligned to the authenticated domain.
- One-click unsubscribe. Bulk marketing mail must include the standard list-unsubscribe headers, and requests must be honoured within two days.
- A spam complaint rate below 0.3%. Google publishes 0.1% as the level to stay under and 0.3% as the line you must not cross.
The 5,000/day threshold sounds like it exempts small businesses, and for the strict bulk rules it often does. It is a bad thing to rely on. Providers apply the same signals to everyone, just with less rigidity — an unauthenticated small sender is not exempt, merely judged case by case. Set it up as if you were a bulk sender, because the work takes an afternoon and never needs redoing.
Fix authentication first
This is DNS work, done once, at your domain registrar or DNS host. Your email platform generates the exact values; your job is publishing them and confirming they pass.
SPF lists which servers may send mail for your domain. It is a single TXT record on the root domain, and you get exactly one:
v=spf1 include:_spf.yourprovider.com ~all
The common failure is having two SPF records because two tools each added one. That is invalid and the check fails. Merge them into a single record with multiple include: statements.
DKIM signs each message with a private key so the receiver can verify it was not altered and really came from you. Your platform gives you a CNAME or TXT record to publish, usually on a selector subdomain. Publish it exactly as given.
DMARC tells receivers what to do when a message fails those checks, and asks them to send you reports. Start permissive:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
p=none means "do not change handling, just report." Live with it for a few weeks, read the reports to confirm every legitimate sender you use is passing, then tighten to p=quarantine and eventually p=reject. Tightening before you have checked the reports is the classic way to block your own invoices.
Alignment is the part people miss. Sending from [email protected] while the mail is authenticated as some other domain fails DMARC even though SPF and DKIM technically pass. The visible From domain has to match the authenticated one.
The reputation problems authentication does not solve
Once you authenticate, you are judged on behaviour. Four things drive that judgement.
Complaint rate. When someone marks your mail as spam, that is the strongest negative signal available. Above 0.3% you are in trouble; sustained above that, delivery collapses. Complaints come overwhelmingly from people who do not remember subscribing, so the fix is upstream — clear consent, an immediate welcome email that reminds them who you are, and an unsubscribe link that is easy to find. A visible unsubscribe is cheaper than a complaint every single time.
Bounces and unknown users. Sending repeatedly to addresses that do not exist marks you as someone working from a stale or purchased list. Remove hard bounces immediately; most platforms do this automatically, but confirm yours does.
Engagement. Providers weigh whether recipients open, reply, and move your mail out of the promotions tab. A list where most people never engage drags down placement for the people who do — which is why pruning a list often raises total clicks even though it lowers the send count.
Volume consistency. Going from 200 sends a month to 20,000 in one day looks like a compromised account. Ramp gradually when you scale, and especially when you move to a new domain or platform.
The list hygiene routine
Deliverability is mostly list discipline, and it is not complicated.
- Use confirmed opt-in for anything ambiguous. If a signup came from a form where the email was incidental — a contest, a bundled checkbox, an offline event — confirm it. The list shrinks and the complaint rate falls.
- Never buy or scrape a list. Beyond the legal exposure under GDPR, CAN-SPAM, and similar regimes, purchased lists are full of spam traps: addresses that exist only to catch senders who did not get permission. Hitting one damages reputation badly.
- Suppress hard bounces on the spot, and soft bounces after a few tries.
- Run a sunset policy. Anyone who has not opened or clicked in six to twelve months gets one re-permission email, then moves to a suppression list. Keeping them costs money and placement.
- Watch the complaint rate per campaign, not just overall. One badly targeted send can do the damage.
Diagnose a live problem in twenty minutes
If mail is already landing in spam, work in this order rather than guessing.
- Send yourself a test to accounts on different providers. Where it lands tells you whether the problem is universal or specific to one mailbox provider — those have different causes.
- Open the raw message and read the headers. Look for
spf=pass,dkim=pass,dmarc=pass. Afailornoneon any of these is your answer; stop and fix it. - Check Google Postmaster Tools. Verify your domain and read the spam-rate and domain-reputation charts. It is free, it is the provider's own view of you, and it removes all speculation about Gmail.
- Open your platform's complaint and bounce report. Compare the last few campaigns against the earlier ones to find the send where things turned.
- Check whether your sending domain or IP is on a public blocklist. If it is, each blocklist publishes its own delisting process, and delisting without fixing the cause just repeats the cycle.
- Only then look at content. Aggressive claims, a single giant image with no text, link shorteners, and mismatched link domains all contribute — but they are rarely the whole story on their own.
Small choices that make a real difference
Use a subdomain for marketing mail — something like news.yourdomain.com — so campaign reputation is separated from the transactional and personal mail sent from your root domain. If a campaign goes badly, your invoices and password resets are insulated.
Keep transactional and promotional streams apart in general. Receipts have high engagement and low complaints; newsletters have the reverse. Mixing them means the newsletter's problems follow your receipts. In practice that can mean two tools rather than one, which is a real cost worth weighing against the rest of your marketing stack.
And make your welcome email do real work. The first message sets the pattern: it confirms who you are while the signup is fresh, which is when complaints are least likely, and strong early engagement establishes a good baseline. Our welcome email sequence guide covers the sequencing; from a deliverability angle, the important thing is simply that it arrives fast.
FAQ
How long does it take to recover a damaged sender reputation?
Plan on several weeks of consistent good behaviour, not days. Fix the cause first — authentication, complaints, or list quality — then reduce volume and send only to your most engaged recipients for two to four weeks before ramping back up. Reputation recovers on evidence, and evidence accumulates one clean send at a time.
Do I need DMARC if I only send a few hundred emails a month?
It is not strictly required at that volume, but publish it anyway. A p=none record costs one DNS entry, tells you who is sending mail as your domain, and puts you ahead of the next tightening of provider rules. It also protects your brand from being spoofed by others.
Will switching email platforms fix my deliverability?
Usually not by itself. Reputation is attached mainly to your sending domain, so it travels with you. A move helps when your current provider has genuinely poor shared-IP reputation or lacks the authentication and reporting features you need — but if the underlying issue is complaints or a stale list, you will reproduce it on the new platform within a month.
Does the Gmail Promotions tab count as landing in spam?
No. Promotions is still the inbox, and most commercial mail belongs there. Worry about the spam folder and about engagement; trying to trick your way out of Promotions by stripping images and links tends to cost more in clarity than it gains in placement.
How many spam complaints are too many?
Google's published guidance is to stay under 0.1% and never exceed 0.3% — that is roughly one complaint per thousand messages as a target. If a single campaign spikes above that, treat it as a signal about targeting or consent for that segment and fix it before the next send.
Get the boring parts right, then send
Deliverability rewards maintenance over cleverness: three DNS records published correctly, a list that only contains people who asked to be there, complaints watched per campaign, and inactive subscribers retired on a schedule. Do those and the rest of your email work — the strategy, the sequences, the offers — actually gets a chance to be read. If your current platform makes authentication setup or complaint reporting hard to reach, compare the best email marketing platforms on deliverability features, automation depth, and true cost as your list grows.
