Digital marketing 5 min

Email deliverability: why your emails end up in spam

Your emails end up in spam when mailbox providers cannot prove they really come from you, or when too many recipients report them. SPF, DKIM and DMARC provide that proof; since February 2024, Gmail and Yahoo have required them from bulk senders, with one-click unsubscribe and a complaint rate below 0.3%.

Contents6
  1. 01Why does a legitimate email end up in spam?
  2. 02SPF, DKIM, DMARC: three proofs, one goal
  3. 03What Gmail and Yahoo have required since 2024
  4. 04The second half: recipients who want your emails
  5. 05What you gain from it
  6. 06Frequently asked questions

You polished the subject line, reread the text three times, picked the right day to send. And the open rate stalls, with no explanation. Often the problem is not in the message: it lies in what the recipient’s mailbox provider decided before even displaying it. This article from our digital marketing section explains why an email ends up in spam, and what a company of 20 to 500 people gains by settling the question once and for all.

In short

  • A mailbox provider sorts first on two questions: does this message really come from this sender, and do its recipients want it?

  • SPF, DKIM and DMARC answer the first question. They are settings of the domain name, not of the content.

  • Since February 2024, Gmail and Yahoo have required them from high-volume senders, with one-click unsubscribe.

  • Recipient complaints answer the second: above 0.3%, you are out of bounds.

Why does a legitimate email end up in spam?

Because on the internet, anyone can write an email pretending to be anyone. Mailbox providers have therefore learned to be suspicious by default. A message that does not prove its origin looks to them like an impersonation attempt; a message that many recipients report looks like spam, whoever the sender is.

This sorting does not only affect newsletters. Quotes, invoices, reminders, invitations: everything sent from your domain benefits or suffers from the same reputation.

Before reading your message, the mailbox provider reads your identity card. Without it, the best text in the world stays at the door.

SPF, DKIM, DMARC: three proofs, one goal

These three acronyms describe records placed in the configuration of your domain name. They change nothing in your emails, and everything in the trust given to them.

What the recipient’s mailbox provider checks

  1. SPF

    Is this server allowed to send for this domain?

  2. DKIM

    Does the message carry a valid signature from the domain, and has it not been altered?

  3. DMARC

    Does the displayed address match the verified domain, and what should happen if not?

The benefit lies in the third point. DMARC links the address the recipient sees to the technical proofs, and tells mailbox providers what to do with a message that fails: let it through while warning you, quarantine it, or reject it. It also sends you reports, which often reveal forgotten services sending in your name: an invoicing tool, a form on the website, a support application.

Definition

Alignment

The domain verified by SPF or DKIM being the same as the domain of the address shown in “From”. This is where configurations fail most often: each tool is authenticated, but for its own domain, not for yours.

What Gmail and Yahoo have required since 2024

In February 2024, Gmail and Yahoo turned these good practices into rules. They apply to all senders in their basic version, and in full to those who send a lot: at Gmail, the threshold is around 5,000 messages a day to Gmail addresses.

SPF and DKIM

both, plus a DMARC record, for bulk senders

0.3%

the spam complaint rate not to exceed

2 days

to honour an unsubscribe, at Yahoo

Source: Google, Email sender guidelines, and Yahoo, Sender Best Practices

For marketing messages, both providers also require one-click unsubscribe, declared in the message header, and a visible unsubscribe link in the body. The minimum DMARC level required is the one that only monitors: the rule does not force you to reject failing messages, but it does force you to publish the policy.

Watch out

The 5,000 threshold is no protection

A team that sends less is still subject to the basic requirements, and its messages are judged with the same tools. Setting up SPF, DKIM and DMARC takes a few hours; doing without them costs an invisible share of every send.

The second half: recipients who want your emails

Authentication proves that the message comes from you. It does not prove anyone is expecting it. Complaints, dead addresses and recipients who never open anything damage your sender reputation, campaign after campaign.

  1. A clean list.

    Addresses obtained with clear consent, and invalid addresses removed: our guide to cleaning CRM data applies to them first.

  2. Expected sends.

    Segment by what each person asked for, rather than sending everything to everyone.

  3. An easy exit.

    A one-click unsubscribe costs a contact; a spam complaint costs reputation for the whole list.

  4. Continuous monitoring.

    DMARC reports and Google’s Postmaster Tools dashboard tell you what mailbox providers think of you.

What you gain from it

Sorted deliverability means campaigns that really reach their audience, quotes and invoices that arrive, and, with a DMARC policy that rejects failing messages, a domain that is much harder to spoof to trap your customers. It also means reliable measurement: when emails arrive, a low open rate finally speaks about the message, and no longer about the plumbing.

That is the starting point of our email marketing and CRM offer: set up the domain, connect sending to the CRM, then build the campaigns, within the broader framework of our digital marketing offer. For what comes next, our guide on how to run an email campaign lays the foundations of the message itself, and our article on marketing automation shows what can be handed to automated scenarios.

Frequently asked questions

How do I know if my emails are landing in spam?

Send a test to Gmail, Outlook and Yahoo addresses and look at where it actually lands. For lasting monitoring, publish a DMARC record with a reporting address, and register your domain in Google Postmaster Tools, which shows your complaint rate.

Are SPF, DKIM and DMARC enough to get out of spam?

They are necessary, not sufficient. They prove where the message comes from. If your recipients often report it as spam or if your list contains many invalid addresses, the domain’s reputation keeps deteriorating despite perfect authentication. The two efforts move forward together.

Do Gmail’s requirements apply to a small company?

The basic requirements do: SPF or DKIM authentication, an encrypted connection and a complaint rate below 0.3% apply to all senders. The full rules, including DMARC and one-click unsubscribe, target those who send around 5,000 messages a day to Gmail.

Do you need a separate domain for newsletters?

It is often a good idea: a subdomain dedicated to marketing sends protects the reputation of the main domain, which carries your quotes and everyday exchanges. It must be authenticated with the same rules as the main domain, and warmed up gradually before large sends.

Sources

  1. Yahoo, Sender Best Practices (new tab)senders.yahooinc.com
Source 1

Yahoo, Sender Best Practices

Read on senders.yahooinc.com(new tab)

Jim · founder of Brain Plus AI

Also in digital marketing

  • Practical guide10 min

    How to run an email campaign, step by step

    Before you press Send: check who you are allowed to write to, get your domain recognised by mailbox providers, write a message that carries a single action, then judge the result by clicks rather than opens. The method, with the rules of the CNIL (France's data protection authority) and Gmail.

  • Practical guide11 min The topic guide

    Marketing automation for SMEs: with or without AI

    Emails, social media, SEO in several languages, support, reporting, catalogue: most of an SME's marketing tasks can be automated with simple rules. AI is justified at a few precise steps, and a person reviews whatever commits the brand.

  • Practical guide9 min

    Cleaning your CRM data: duplicates, fields and rules

    A CRM full of duplicates and empty fields stops being consulted, and every automation or AI plugged into it repeats its errors. The method for a thorough clean-up, then the rules and automatic checks that make it last.

WhatsApp