In short
Email deliverability is decided mainly by authentication and reputation, not by content. You need SPF, DKIM and DMARC configured correctly for your sending domain; without them, major providers may reject or quarantine your mail outright. After that, reputation follows engagement: mail people open and reply to is delivered, and mail that generates complaints or hits dead addresses is not.
Three records decide whether you are trusted
Before content is considered, the receiving server asks whether this mail genuinely comes from who it claims. Three DNS records answer that, and major providers now expect all three from anyone sending at volume.
SPF lists which servers may send on behalf of your domain. A published record lets the receiver check the sending server against it. The common failure is a record that does not include your actual sending service — or several records, which is invalid and fails outright.
DKIM signs each message cryptographically, so the receiver can verify it was not altered and genuinely came from your domain. Your sending service provides the keys to publish.
DMARC tells receivers what to do when SPF and DKIM fail, and where to send reports. Start with a monitoring policy so you receive data without affecting delivery, read the reports for a few weeks to find legitimate senders you forgot about, then tighten to quarantine and eventually reject.
If mail is going to spam and you have not verified all three, that is where to look before rewriting a subject line.
The From address matters
Send from your own domain, not a free mailbox provider. Mail claiming to be from a large consumer provider but sent by your server fails authentication by design.
Consider a subdomain for bulk mail — marketing from one, transactional from another. Reputation attaches to the sending domain, so a poorly received campaign then cannot damage delivery of password resets.
Keep the From address consistent. Recognition matters, and changing it resets accumulated reputation.
Use a real reply-to address that a person monitors. noreply@ suppresses the replies that would otherwise be a strong positive signal.
Reputation is built on engagement
Once authentication passes, delivery is decided by how people have treated your mail.
Opens and replies help. Deletions without opening hurt. Marking as spam hurts a great deal.
Sending to dead addresses hurts badly. Hard bounces signal a list that was not maintained, or was purchased. Remove them immediately and permanently.
Spam traps are severe. Addresses that exist only to catch senders who do not clean their lists. Hitting them causes lasting damage, and the usual cause is mailing addresses that have not engaged in years.
Volume changes attract attention. Going from 50 messages a day to 50,000 looks like a compromised account. New domains and new IPs need warming — start small, increase gradually.
Content matters less than people think
Modern filtering is behavioural, not keyword matching. Still, some things reliably hurt.
A single large image with no text is a classic spam pattern. Keep a real text-to-image ratio.
Link shorteners obscure destinations and are heavily associated with abuse.
Mismatched link domains — text saying one thing, href pointing elsewhere — is a phishing signature.
Missing plain-text alternative. Send multipart. HTML-only mail is more suspicious and reads badly in some clients.
Missing unsubscribe on bulk mail is both a deliverability problem and a legal one. Make it one click and honour it immediately — a hard-to-find unsubscribe converts into a spam complaint, which is far more damaging.
Transactional mail has its own failure mode
Password resets, receipts and booking confirmations are expected and should deliver well. When they do not, the causes are specific.
Sending from a shared server whose IP reputation you do not control. Use a dedicated sending service.
Sharing a domain with marketing that generates complaints — the argument for a separate subdomain.
Sending to typo addresses repeatedly, generating bounces.
And remember the operational consequence: if login depends on email — magic links, verification codes — a deliverability problem becomes an outage. That is worth knowing before choosing email as an authentication factor.
Diagnosing it
Send to accounts you control across the major providers and see where it lands. Free, and immediately informative.
Read the full headers of a delivered message. They show the authentication results for SPF, DKIM and DMARC explicitly — pass or fail, no guessing.
Use a deliverability testing tool that reports authentication and content signals across providers.
Read your DMARC reports. They tell you what receivers are actually seeing, which is the only authoritative answer.
Check the blocklists. If your sending IP or domain is listed, delivery collapses, and most lists have a straightforward delisting process once the cause is fixed.
The order to fix things
Verify SPF, DKIM and DMARC are configured and passing. Move to a proper sending service if you are still sending from an application server. Split transactional from bulk. Clean bounces and long-inactive addresses. Then look at content.
Most deliverability problems are resolved in the first two steps, and both are configuration rather than craft.
If your booking confirmations or password resets are not arriving, book a call — it is usually a DNS record.
Common questions
Why are my emails going to spam?
Most often because SPF, DKIM or DMARC are missing or misconfigured, so receiving servers cannot verify the mail genuinely comes from your domain. After authentication, the next most common causes are a poor sending reputation from bounces and complaints, or sending from a shared server whose IP reputation you do not control.
What are SPF, DKIM and DMARC?
SPF lists which servers may send for your domain. DKIM cryptographically signs each message so receivers can verify it was not altered. DMARC tells receivers what to do when the other two fail, and sends you reports. Major providers now expect all three from anyone sending at volume.
Should I use a separate subdomain for marketing email?
Yes, if you send both marketing and transactional mail. Reputation attaches to the sending domain, so separating them means a campaign that generates complaints cannot damage delivery of password resets and receipts — which are the messages where failure becomes an operational problem.
Does email content affect deliverability?
Less than people assume — modern filtering is behavioural rather than keyword-based. That said, a single large image with no text, link shorteners, link text that does not match its destination, HTML with no plain-text alternative, and a missing or buried unsubscribe all reliably hurt.
How do I check whether my email authentication is working?
Send a message to an account you control and read the full headers — they state the SPF, DKIM and DMARC results explicitly. Then read your DMARC reports, which show what receiving servers are actually seeing across all your mail, and check whether your sending IP or domain appears on any blocklist.
