Why mail goes to spam — and how to find out

Authentication passing is not the same as landing in the inbox. A message can have perfect DKIM, aligned SPF and a passing DMARC check and still be filed as junk — because the things that decide the last few percent are about content, links and reputation, not cryptography. This page is about finding out which one is biting you.

Start with what the receiver says

Every other number in email software — bounce rate, complaint rate, open rate — is the sender's view of what happened, and all of it shares one blind spot: a message filed into spam is still delivered. No bounce, no complaint, nothing to see.

Your sending domain's page in Settings → Email shows Google's own rating of the domain and the share of your mail that Gmail users marked as spam. That is the only signal here that comes from the receiver — and the only place Gmail's spam reports appear at all, because Google does not send them to senders the way other providers do.

If it says there is not enough volume yet, that is normal and not a fault: Google publishes nothing for a domain below roughly a hundred messages a day to Gmail.

Then measure where mail actually lands

On a campaign's Review step, Test placement sends the real campaign to a panel of genuine Gmail, Outlook, Yahoo and Apple mailboxes and reports which folder each one filed it in. Everything else on that screen predicts; this measures — and it is the only thing that can tell “nobody opened it” apart from “nobody saw it”.

One reading note: a seed that never received the message is worse news than one that filed it as spam. It means the message was blocked at the gateway, before filtering. Do not read a low spam count as good if seeds are missing.

Put your links on your own domain

Spam filters compare the domain a message is signed by against the domains its links point at. A mismatch is one of the cheapest checks they have and one of the most reliable, because it is the structural shape of a phishing message.

Legitimate senders trip it constantly and by accident, almost always through a click-tracking domain belonging to their email provider rather than to them. Publish the Link tracking CNAME on your domain's page and your tracked links become link.yourdomain.com. It is one record, the certificate is issued for you, and nothing about your campaigns changes.

Find out who else is sending as you

DMARC's reports are the only way to see every system sending mail that claims to be from your domain. The catch has always been that they arrive as daily compressed XML, which nobody reads — so most DMARC records sit at p=none forever and never do anything.

Add the rua= address shown on your domain's page and we collect and read them for you. You get a plain list: every sender, how much they send, and whether it authenticates. That list is the checklist for tightening your policy — it is safe to enforce once you recognise every row and none of them are failing. We say when that point is reached, and we are deliberately cautious about it, because enforcing breaks mail that fails alignment and some of that will be your own invoicing or payroll system.

Reports contain no recipient addresses and no message content. There is nothing private in them.

Stop the damage before it happens

Two checks now run earlier than they used to:

• At import. Typo'd domains (gmial.com), domains with no mail server, disposable inboxes and obvious test data are flagged in the preview. A hard bounce tells a mailbox provider you do not know who your recipients are, which is the fastest way to lose a domain's standing — and nearly all of them are visible before you import. It is a warning, never a block: a shared sales@ address can be a real subscriber, and the decision stays yours.
• Before a campaign sends. The Review step now fails on links that go nowhere and warns when your links point somewhere other than the domain you send from.

Find out when encryption fails

Mail between servers is normally encrypted, but the fallback when it cannot be is to send it in the clear anyway — and neither end tells anyone. An expired certificate on your mail host, a misconfigured MX, a provider quietly downgrading: all of it is invisible from both sides.

TLS reporting on your sending domain’s page fixes the visibility half. Publish one TXT record and the servers sending you mail send a daily report of every connection where encryption failed or a policy did not validate. One record, nothing to maintain, and no downside — it changes nothing about how your mail is handled, it only makes the failures visible.

Once those reports show a clean run you can go further and require encryption, with MTA-STS on the same page. That is a much bigger step — getting it wrong makes mail to your domain undeliverable rather than merely unencrypted — so it starts in a testing mode that reports without acting, and enforcement stays locked until the reports justify it. How to turn it on safely.

Consider mailing fewer people

Mailbox providers judge you on how your mail is received. A large dormant segment does not merely fail to help — it drags delivery down for the people who do read you, and long-abandoned addresses are where recycled spam traps come from.

Settings → Marketing has an optional setting that stops sending to contacts who have not engaged in a long time. It is off by default, nothing is ever deleted, nobody is dropped without being mailed once more first, and anyone who opens, clicks or replies comes straight back. If you turn it on, the windows are yours to set.