Why Emails Go to Spam Instead of Inbox (Fix It)

I've sent millions of cold emails across dozens of campaigns. I've also watched good outreach die in spam folders - not because the message was bad, but because of fixable technical and behavioral issues the sender never bothered to address.

If your emails are going to spam instead of the inbox, it's not random bad luck. It's a signal. Spam filters are telling you something is misconfigured, your sender reputation is damaged, your list is dirty, or your content is triggering filters. Usually it's a combination of all four.

This article breaks down every major reason emails land in spam - and what you actually do about each one. Start at the top. Fix what applies to you. Your deliverability will improve.

The Scale of the Problem (It's Worse Than You Think)

Before we get into fixes, understand what you're actually up against. Most senders have no idea how bad the inbox placement problem really is.

According to multiple deliverability benchmarks, only around 83% of legitimate marketing emails actually reach the inbox. That means roughly one in six emails you send - permission-based, properly worded, sent with good intent - never gets seen. Another 10.5% land in spam, and about 6.4% go missing entirely, never reaching a spam folder or inbox - just gone.

For cold outreach specifically, the numbers are worse. When you factor in cold email senders with newer domains, less established reputations, and leaner technical setups, inbox placement drops significantly below the marketing email average. I've seen cold outreach campaigns where less than half the emails were making it to the primary inbox - and the senders had no idea because their ESP was reporting a 98% "delivery" rate. Delivery and inbox placement are not the same thing. Your ESP counts spam folder delivery as a success. Spam filters don't.

The other thing worth knowing: deliverability is getting harder across the board. Gmail, Yahoo, and Microsoft have all raised enforcement thresholds. Microsoft's Outlook in particular has become dramatically more aggressive - in recent periods, high-volume senders saw Outlook inbox placement rates drop sharply, with some segments seeing roughly half their emails routed out of the primary inbox. If you're doing B2B outreach, a big chunk of your prospect list is sitting on Microsoft 365 or Outlook. That matters a lot.

None of this is a reason to panic. It's a reason to treat deliverability like the operational system it is, not something you set up once and forget. Let's go through every reason this breaks and what to do about it.

How Spam Filters Actually Work

Before you can fix the problem, you need to understand what you're up against. Spam filters are sophisticated algorithms that every major inbox provider - Gmail, Outlook, Yahoo - runs on every incoming message before it reaches the inbox. They check who you are, how you're sending, what's in the email, and how people have historically responded to messages from your domain. All of that happens in milliseconds.

Filters assign your message a spam score based on a combination of signals: your domain and IP reputation, whether your authentication records pass, what your email content looks like, and how engaged your previous recipients have been. If your score clears a threshold, you go to spam.

Gmail uses advanced machine learning to identify spam patterns. Its detection is personalized - it adapts to individual user behavior and updates continuously. Outlook uses a different approach: a heuristic-based system combined with more user-controlled filtering options. Microsoft also uses real subscriber feedback as part of its filtering model, meaning if too many people ignore or delete your emails, your reputation with Microsoft takes a hit fast.

The important thing to internalize here is that authentication alone is no longer enough. SPF and DKIM pass rates across the industry are high - over 90% of tested emails pass both - yet inbox placement rates remain stuck around 65-83% depending on whose data you look at. The gap between passing authentication and actually landing in the inbox is engagement signals. ISPs now layer behavioral data - opens, clicks, replies, deletions - on top of technical checks. Perfect authentication with poor engagement still gets you filtered. That's the modern deliverability problem.

Every major provider evaluates the same core categories, just with different weights and thresholds. Here's what each one is really looking for:

• Gmail - Heavily weights sender reputation and engagement signals. Has a strict spam complaint threshold (keep your rate below 0.10%, and if you cross 0.30%, Gmail starts rejecting mail outright). Rewards senders whose recipients actually open, click, and reply.
• Outlook / Microsoft 365 - Uses machine learning models updated continuously. Weights domain age, IP reputation, authentication completeness, engagement signals, and complaint rates. Has become significantly more aggressive. DKIM is now effectively required for reliable delivery to Microsoft-hosted inboxes - not just a best practice.
• Yahoo - Aligned closely with Gmail's requirements for bulk senders. Generally less aggressively enforced than Gmail at lower volumes, but the requirements are identical at the 5,000+ emails/day threshold.

Reason #1: Missing or Broken Authentication (The #1 Cause)

This is the biggest technical reason legitimate emails get filtered. Without proper authentication, inbox providers can't confirm you are who you say you are - so they treat you like a threat.

There are three DNS records that form the foundation of email authentication:

• SPF (Sender Policy Framework) - tells receiving servers which IP addresses are authorized to send email on behalf of your domain. Think of it like a publicly available employee directory. If the IP sending your email isn't on the list, you fail the check and can get quarantined or rejected.
• DKIM (DomainKeys Identified Mail) - adds a cryptographic signature to every outgoing message. The receiving server uses your public key stored in DNS to verify the message wasn't tampered with in transit and genuinely came from your domain.
• DMARC (Domain-based Message Authentication, Reporting & Conformance) - the policy layer on top of SPF and DKIM. It tells receiving mail servers what to do when an email fails those checks: deliver it, quarantine it, or reject it outright. It also sends aggregate reports back to you so you can see what's passing and what's failing.

Google and Yahoo require all three for any bulk sender. DMARC is mandatory for senders sending 5,000+ emails per day to Gmail or Yahoo - but even at lower volumes, not having DMARC means receiving servers have no policy to follow when authentication fails, which directly increases spam filtering risk. Microsoft implemented its own enforcement requirements for Outlook, Hotmail, and Live domains as well.

Here's where most people get tripped up: the majority of domains that have set up DMARC are sitting on p=none - which is monitoring mode only. That means you're collecting data but not actually enforcing anything. When authentication fails, mail still gets through. The goal is to move to p=quarantine or p=reject once you're confident your legitimate mail is passing. Right now, only a fraction of domains with DMARC records are actually enforcing a quarantine or reject policy. If you're in that majority sitting on p=none, you're not protected.

One common mistake I see: SPF records with too many "include" statements that silently break. SPF has a hard limit of 10 DNS lookups. Add too many third-party sending services and you silently exceed that limit - your SPF record becomes technically invalid and starts failing checks without any obvious error message. Check your setup using MXToolbox or Google's Admin Toolbox. For DKIM, send a test email to a Gmail address, open the original message headers, and look for "DKIM: PASS."

Another common failure mode: if your email passes through any relay or forwarding service that breaks the DKIM signature, Microsoft's spam filters see a failed authentication even if your original setup was correct. Make sure every sending service in your stack is properly authorized in SPF and has its own DKIM key configured.

Important: if you're doing cold outreach, do not send from your primary business domain. Use a separate sending domain with all three records configured. That way, if a campaign damages your sender reputation, your main domain is insulated.

For a full step-by-step setup, see our Email Verification Guide - it covers authentication alongside list cleaning.

Reason #2: Poor Sender Reputation

Even with authentication dialed in, your sender reputation determines inbox placement. Mailbox providers maintain reputation scores for both your domain and your sending IP. A fresh domain with no history gets scrutinized heavily. A domain with a history of spam complaints gets filtered automatically.

Your reputation is built - and destroyed - by a few key signals:

• Spam complaint rate - Recipients hitting "report spam" is the single most damaging signal. Google's sender guidelines require a spam complaint rate under 0.10%. At 0.30% you trigger heavy filtering and Gmail starts rejecting mail outright. For a sender sending 1,000 emails per day, that's just one spam complaint per day putting you at the soft threshold. Even one bad campaign can knock you off course.
• Hard bounces - A hard bounce is a permanent delivery failure, usually because the email address doesn't exist. High bounce rates signal to providers that you bought a list or haven't cleaned your contacts in years. A hard bounce rate above 2% is a red flag.
• Low engagement - If hardly anyone opens your emails, inbox providers start questioning whether recipients actually want them. Low open rates, high deletion-without-reading rates, and emails moved to trash all erode your domain reputation over time. Mailbox providers notice when users delete your emails without reading them and use that as a signal to filter your future sends.
• Shared IP neighbors - If you're on a shared sending IP (which most small senders are through their ESP), your reputation is partially tied to everyone else on that IP pool. Other senders sending junk from the same IP can drag down your deliverability. Ask your ESP how they vet senders and manage their IP pools.

If your domain is tanked, you can't just switch senders and expect improvement. Your domain reputation follows you. You need to actively rebuild it by warming up your sending volume, sending only to engaged contacts, and stopping campaigns that generate complaints.

Use Google Postmaster Tools to monitor your domain and IP reputation directly inside Gmail's system. It shows spam rate, authentication results, and delivery errors. For Outlook and Microsoft 365, use Microsoft SNDS (Smart Network Data Services) - it shows spam trap hits, complaint rates, and whether you're being throttled. Check both regularly - not just when something breaks.

Reason #3: You Haven't Warmed Up Your Domain

New domain? New IP? You have zero reputation. Inbox providers don't know if you're a legitimate sender or a spammer, so they watch everything closely.

Sending 500 emails per day from a brand-new domain is a fast track to spam. The right approach is a gradual warm-up: start with small volumes to highly engaged recipients, increase sending over several weeks, and build a positive track record before scaling.

Tools like Smartlead and Instantly both have built-in warm-up features that automate this process by sending and receiving emails between a network of real inboxes, gradually increasing volume and building your domain's reputation before you go live with actual campaigns.

The general warm-up arc looks like this: start with 10-20 emails per day in week one, double it each week for 4-6 weeks, and only begin real campaigns once you're consistently hitting your target daily volume without seeing spam filtering. Watch your domain reputation in Google Postmaster Tools during this window. If you see reputation drop to "Low" or "Bad," slow down.

One thing people miss: warm-up tools send real emails between real accounts and generate real engagement signals - opens, replies, moves to inbox. That positive engagement history is what builds your domain's credibility with the filter algorithms. It's not a hack. It's just simulating normal sender behavior until you have enough real sending history to stand on.

Don't skip this. I've seen people spend weeks writing the perfect email sequence only to get zero replies because every message went straight to spam on a cold domain.

Reason #4: Spammy or Trigger-Heavy Content

Technical setup gets your foot in the door. Content determines whether you stay in the inbox.

Spam filters maintain databases of words and patterns commonly found in spam messages. Using too many of them in your subject line or body raises your spam score. A single "free" in an otherwise clean email won't tank deliverability. But stacking five trigger words in a subject line will.

Common content mistakes that hurt deliverability:

• Spam trigger words in subject lines - "Guaranteed," "Act now," "Free offer," "Risk-free," "Make money," "Free money," "Exclusive deal" - all of these raise flags. Keep subject lines honest, direct, and under 50 characters. Don't try to be clever with urgency that sounds manufactured.
• Deceptive subject lines - Using "Re:" or "Fwd:" on messages that aren't replies or forwards. Gimmicky fake-reply subject lines may boost opens briefly, but they erode trust fast and generate spam complaints that will haunt your domain for months.
• Heavy HTML and image-to-text imbalance - Emails that are mostly images with minimal text are a pattern spam filters associate with mass marketing blasts. For cold outreach especially, plain text or near-plain text consistently outperforms heavily formatted HTML. Keep your text-to-image ratio heavily weighted toward text.
• Attachments on cold emails - Spam filters treat attachments as potential malware vectors. On a first cold contact, never include attachments. Get the conversation started first.
• Too many links - One or two links is fine. An email loaded with five hyperlinks to three different domains looks like a phishing attempt to both filters and humans.
• Broken links or blacklisted domains in your links - If you're linking to a URL that's on a blacklist, or if your link tracking domain has a bad reputation, that drags your email's spam score up. Check your link domains before sending.
• Misleading headers - Your "From" name, reply-to address, and message headers need to be consistent and honest. Mismatches between the "From" domain and the sending domain are red flags for both authentication checks and human recipients.

Before any campaign, run your email through a spam checker. Mail-Tester and GlockApps both give you a score and flag specific issues. SpamAssassin scores are a useful benchmark - emails scoring above 3.0 start getting caught by filters, and anything above 5.0 is likely to land in spam. Fix the issues before you send, not after you see the results tanking.

Reason #5: Your Email Looks Like a Mass Blast (Even If It Isn't)

This one is underappreciated. Even if you're sending individually personalized emails, the structure of the message can signal "bulk" to filters.

Spam filters have gotten very good at identifying mass email patterns. Here's what triggers that classification even in lower-volume sends:

• Template-heavy HTML with tracked links - If your email looks like a newsletter template with a big header image, colored buttons, and multiple tracking URLs, spam filters and recipients alike classify it as bulk marketing mail. This is fine for newsletters to opted-in subscribers. It's a problem for cold outreach.
• Identical or near-identical sends at high volume - Sending the exact same email text to 500 people in one hour looks like bulk behavior. Use personalization variables, send at a throttled rate, and vary your templates across sequences.
• Sending from a single domain at high volume - Spread volume across multiple sending domains if you're running large campaigns. Keep each domain's daily send count conservative and consistent.
• Using a tracked link domain that's flagged - Many outreach tools use shared link tracking subdomains. If that shared subdomain has been flagged by spam databases, every email you send using it gets dinged. Use a custom tracking domain tied to your own domain.

For cold outreach specifically: write emails that look like you wrote them manually. No big headers. No branded footers. No colored CTA buttons. Just plain text that reads like a real person sent it - because at the end of the day, that's what you want the filter to believe.

Reason #6: Dirty or Unverified Email Lists

This one costs people more deliverability than almost anything else. Sending to invalid, stale, or purchased lists destroys your bounce rate and tanks your reputation fast.

Every email you send to an address that doesn't exist adds to your hard bounce count. Every email you send to someone who never heard of you increases your spam complaint risk. If you bought a list from a sketchy vendor, you're almost certainly sending to spam traps - addresses maintained by ISPs specifically to catch senders with poor list hygiene. Hit enough spam traps and your domain gets blacklisted.

The fix is straightforward: verify your list before you send. Use an email validator to check addresses for deliverability before they ever enter your sequence. ScraperCity's email validator lets you clean lists in bulk - catching invalid addresses, role-based emails, and known spam traps before they blow up your sender score. You can also run verification directly through Findymail, which verifies emails at the point of finding them.

Beyond initial verification, ongoing list hygiene matters just as much. Here's the maintenance routine that keeps lists clean:

• Remove hard bounces immediately - Every hard bounce that occurs should be automatically suppressed. Never retry a hard bounce address.
• Suppress chronic non-openers - Contacts who haven't engaged in 90+ days are dragging your engagement signals down. Either run a re-engagement sequence and remove non-responders, or remove them proactively. A smaller list that engages beats a large list that doesn't.
• Never use purchased or scraped-without-context lists - If you didn't source the email from a verified data provider or build it through legitimate means, don't use it. Purchased lists are notorious for containing spam traps, role-based addresses, and invalid contacts.
• Check for role-based addresses - Emails like info@, admin@, support@, or noreply@ are role-based addresses that are almost never appropriate for cold outreach. They often go to multiple people or are unmanned entirely, and they generate spam complaints disproportionately.

Also check our dedicated resource on this: the Email Verification Guide walks through exactly how to audit and clean a list properly.

Reason #7: Sending From a Free Email Domain

If you're sending from a @gmail.com, @yahoo.com, or @outlook.com address for business outreach, most mailbox providers will route those emails straight to spam. Their DMARC policies forbid anyone except them from sending on behalf of those domains. You'll fail authentication by default.

You need a custom domain. Full stop. Set up a professional domain, configure SPF, DKIM, and DMARC on it, warm it up, and use that for all business email. This is non-negotiable in today's environment.

Also: make sure the website attached to your sending domain is live and functional. Sending email from a domain with an empty or inactive website makes ISPs suspicious. They want to see a real business behind the domain. A simple one-page site is enough. But a parked domain or a domain that 404s is a red flag.

Reason #8: No (Or Hidden) Unsubscribe Option

Gmail and Yahoo now require bulk senders to include a one-click List-Unsubscribe header. Without it, or without a visible unsubscribe link in the footer, your messages get throttled or dropped into spam. This isn't optional.

The requirement specifically is that List-Unsubscribe must be honored and processed within two days. That means if someone clicks to unsubscribe, they need to actually stop receiving your emails within 48 hours - not get added to a suppression list that someone checks monthly.

Beyond compliance, making it difficult for people to opt out means they hit "report spam" instead. That's far more damaging than a clean unsubscribe. Make the opt-out dead simple. Fewer complaints beats more fake engagement every time.

For cold email, the one-click unsubscribe requirement technically targets bulk marketing senders rather than individualized outreach. But Gmail's spam filters treat unsubscribe friction as a negative signal regardless of campaign type. Include an unsubscribe option in every sequence. Don't argue with the filter.

Reason #9: Inconsistent or Sudden Volume Spikes

Sending too many emails in a short time or going from low volume to high volume overnight triggers flags. Inbox providers watch for sudden behavioral shifts as a signal that an account may have been compromised or sold.

Microsoft is particularly sensitive to this. Outlook's filters respond sharply to volume spikes from domains that haven't established a consistent sending history at that level. If you've been sending 50 emails a day and suddenly jump to 500, expect filtering problems.

Stick to a consistent sending cadence and scale gradually. Build your volume increases into a deliberate ramp - double your sends every week rather than jumping all at once. If you're running outbound campaigns at scale, the Cold Email Tech Stack guide covers how to structure your sending infrastructure so volume spikes don't kill deliverability.

Reason #10: Your Domain or IP Is Blacklisted

A blacklist is a database of domains and IP addresses known for sending spam. There are dozens of these databases, and major inbox providers reference multiple of them when evaluating incoming mail. If your domain or sending IP is on a blacklist, a significant portion of your emails will be blocked or filtered outright - often with no warning.

How do you end up blacklisted? Usually by triggering spam traps, generating too many spam complaints, or sending at high volume from a new or poorly configured domain. Once you're listed, getting removed requires finding out why you were listed, fixing the root cause, and submitting a removal request to each relevant blacklist authority.

The good news: if you catch it early, you can usually get delisted. Repeat offenders have a much harder time. That's why monitoring matters - you want to catch a blacklist hit within hours, not weeks.

How to check: run your domain and sending IP through MXToolbox's blacklist checker. It checks against dozens of databases simultaneously. Also check Spamhaus specifically - they're one of the most widely referenced databases and a hit there has major consequences.

If you find you're listed, don't just request delisting and move on. Figure out why it happened. Usually it's a spam trap hit (meaning your list was dirty), a spike in complaints (meaning your targeting or content was wrong), or someone else on your shared IP dragged you down (meaning you should ask your ESP to move you to a cleaner IP pool).

Reason #11: BIMI - The Optional Signal That's Becoming Standard

BIMI (Brand Indicators for Message Identification) is an email specification that lets you display your brand logo next to your emails in supported inboxes. It's built on top of DMARC - you need a fully enforced DMARC policy (p=quarantine or p=reject) before you can implement BIMI.

BIMI is currently supported by Gmail, Yahoo, Apple Mail, and Fastmail - collectively a large percentage of the inboxes you're sending to. When your logo appears next to your email, it signals to both the recipient and the inbox provider that you're a verified, authenticated sender. Recipients are more likely to open emails they recognize. Higher engagement lifts deliverability.

BIMI isn't a fix for broken authentication or a dirty list. But for senders who have the fundamentals right and want an additional trust signal, it's worth implementing - especially if you're doing higher-volume outreach to consumer or SMB audiences. Getting it set up requires a Verified Mark Certificate (VMC) for the Google-verified logo display, which has a cost attached. For pure cold outreach, it's probably not your first priority. For marketing email programs, it's increasingly a best practice worth the investment.

Reason #12: Poor List Sourcing (The Upstream Problem)

A lot of deliverability issues start upstream - with the quality of the contacts you're reaching out to in the first place. If you're scraping random emails from the web or buying bulk lists, you're going to have high bounce rates, spam complaints, and deliverability problems no matter how clean your authentication is.

The cleanest list you can build is one that starts with verified B2B data filtered by the criteria that actually matter for your offer - job title, seniority, industry, location, company size. Starting with garbage data and then verifying it costs more and wastes more time than starting with quality data from the beginning.

When building prospect lists for outbound, start with verified B2B data. This B2B lead database lets you filter by job title, seniority, industry, location, and company size - so you're targeting real decision-makers, not pulling garbage data that tanks your bounce rate. If you need to find email addresses for specific contacts you've already identified, an email finding tool like ScraperCity's Email Finder can surface verified emails for those prospects individually.

Combine quality sourcing with list verification before any send and you've addressed the list quality problem at the source - before it ever damages your sender reputation.

Reason #13: Inbox Provider-Specific Issues You're Ignoring

Most deliverability advice treats "email" as monolithic. It isn't. Getting into Gmail's primary inbox requires different signals and optimizations than getting into Outlook's inbox, which is different again from Yahoo or Apple Mail.

Here's a practical breakdown of the major providers and what actually moves the needle for each:

Gmail

Gmail's spam filtering is heavily machine learning-based. It adapts to individual user behavior and rewards senders whose mail gets opened, replied to, and clicked. Gmail introduced AI-powered annotations that pull snippets from your email - if your content highlights something confusing or off-brand, that can backfire.

What matters most for Gmail: strong sender reputation, consistent engagement across your list, spam complaint rate below 0.10%, proper DMARC enforcement, and one-click unsubscribe compliance. Use Google Postmaster Tools to monitor your Gmail-specific metrics weekly.

Outlook / Microsoft 365

Microsoft's filtering system has become significantly more aggressive. It uses machine learning models updated continuously, and it factors in engagement signals, domain age, IP reputation, and authentication completeness. DKIM is now effectively required - not optional - for reliable Outlook delivery.

Microsoft also runs a Spam Fighters program that periodically asks users to rate whether emails they've received are junk. That feedback feeds directly into filtering decisions. If your emails look even slightly spammy to real Outlook users, it affects your reputation across the entire Microsoft network.

For Outlook-specific monitoring, use Microsoft SNDS to check spam trap hits, complaint rates, and throttling, and pair it with the Junk Mail Reporting Program (JMRP) to receive feedback loop reports when users mark your email as junk. Also keep your daily volume consistent - Outlook is particularly sensitive to sudden send volume spikes.

Yahoo

Yahoo's requirements for bulk senders mirror Gmail's almost exactly. They require SPF, DKIM, and DMARC, one-click unsubscribe, and a spam rate below 0.3%. Yahoo has historically been somewhat less aggressive in enforcement than Gmail at lower volumes, but the requirements are identical and getting stricter.

Apple Mail

Apple's Mail Privacy Protection (MPP) made open rates an unreliable metric for anyone sending to Apple Mail users. Apple pre-fetches emails and pre-loads images, which means opens get registered even if the user never actually opens the message. Don't use open rate as your primary deliverability indicator - especially if a large portion of your list is on Apple devices. Track replies and clicks instead. Those are signals that can't be faked by pre-fetching.

How to Diagnose the Problem Fast

If you're actively having deliverability issues right now, here's the diagnostic sequence I'd run:

1. Check authentication - Run your domain through MXToolbox. Verify SPF, DKIM, and DMARC are all passing. Fix any failures first. Also check that your SPF record doesn't exceed 10 DNS lookups.
2. Check Google Postmaster Tools - Set up your domain there if you haven't. Look at domain reputation, IP reputation, spam rate, and authentication results. Anything in "Bad" or "Low" needs immediate attention.
3. Check Microsoft SNDS - If a meaningful part of your prospect list is on Outlook or Microsoft 365, you need the Microsoft-side visibility that SNDS provides. Check for spam trap hits and throttling.
4. Check blacklists - Run your sending domain and IP through MXToolbox's blacklist checker. If you're listed, find out why and request removal after fixing the root cause.
5. Verify your list - Before sending another campaign, run your list through an email validator. Remove hard bounces, unengaged contacts, and any flagged addresses.
6. Send a seed test - Send your email to test accounts across Gmail, Outlook, and Yahoo. See where it actually lands. Tools like GlockApps or Mail-Tester will do this for you and give you a spam score with specific issues flagged.
7. Review content - Run your subject line and body through a spam checker. Count your links, look for trigger words, check your image-to-text ratio. Aim for a SpamAssassin score below 3.0.
8. Audit your sending infrastructure - What ESP are you on? Are you on a shared IP? When did you last check your sending domain's age and reputation? Are you using a custom tracking domain for links?

Run through this list systematically. Deliverability problems are almost never just one thing - they stack. Fix the foundation (authentication), clean the list, adjust the content, monitor the results.

A Complete Deliverability Checklist Before Every Campaign

I use this before every new campaign or any time I'm spinning up a new sending domain. Print it out or bookmark it.

Domain & Authentication Setup

• Custom sending domain (not your primary business domain)
• SPF record configured and passing - verified in MXToolbox
• DKIM record configured and passing - verified in Gmail header check
• DMARC record in place - at minimum p=none with a reporting address; ideally p=quarantine or p=reject once you've confirmed clean pass rates
• Domain attached to a live, functional website
• Custom link tracking domain configured (not using ESP's shared tracking domain)

Warm-Up & Infrastructure

• New domains warmed up for at least 4-6 weeks before live campaigns
• Daily sending volume consistent - no sudden spikes
• Warm-up tool active and running in the background if the domain is recent
• Google Postmaster Tools set up and monitored weekly
• Microsoft SNDS set up if targeting enterprise prospects

List Quality

• List sourced from verified B2B data, not scraped or purchased lists
• List verified through an email validator before campaign launch
• Hard bounces from previous campaigns suppressed
• Role-based addresses removed (info@, support@, admin@, noreply@)
• Chronic non-openers from previous campaigns suppressed or moved to re-engagement

Content & Sending

• No spam trigger words in subject line or opening paragraph
• Plain text or near-plain text format for cold outreach
• No attachments on first contact
• Maximum 1-2 links in the email body
• Unsubscribe link present and functional
• Seed test completed across Gmail, Outlook, and Yahoo before full send
• SpamAssassin score below 3.0
• No deceptive "Re:" or "Fwd:" subject lines

How to Rebuild Deliverability After It's Already Broken

If you've already damaged your sending domain's reputation, here's the recovery path. It's not fast, but it works.

Step 1: Stop the bleeding. Pause any active campaigns immediately. Don't send more emails while your domain is in trouble - every additional send makes the reputation hole deeper.

Step 2: Audit and fix the root cause. Is it authentication? Fix it. Is it a blacklist hit? Find out why, fix it, request delisting. Is it complaint rate? Figure out who you've been sending to that's generating complaints and cut those segments.

Step 3: Clean the list. Run every contact through a validator. Suppress all hard bounces. Remove anyone who hasn't engaged in 90+ days.

Step 4: Start sending to your most engaged contacts only. High engagement signals to inbox providers that your mail is wanted. Start rebuilding your reputation by sending only to people who are likely to open and reply. Small volume, high engagement.

Step 5: Gradually increase volume. Over 4-6 weeks, bring your volume back up slowly. Monitor your Postmaster Tools reputation scores the entire time. If they drop, slow down again.

Step 6: Consider a new sending domain. If the original domain is severely damaged - multiple blacklist hits, extended history of high complaint rates - starting fresh with a new domain is often faster than trying to rehabilitate a destroyed reputation. Set the new domain up correctly from day one, warm it up properly, and don't repeat the mistakes that killed the first one.

Tools Worth Having in Your Deliverability Stack

You can't improve what you're not measuring. Here are the tools I actually use:

• Google Postmaster Tools (free) - Non-negotiable if you're sending to Gmail addresses. Set it up the day you set up your domain.
• Microsoft SNDS (free) - Same logic for Outlook and Microsoft 365. Essential if your prospect list skews enterprise.
• MXToolbox (free tier available) - Quick checks for SPF, DKIM, DMARC configuration and blacklist status.
• GlockApps or Mail-Tester - Inbox placement testing across multiple providers. Tells you where your email actually lands, not just whether it was "delivered."
• Smartlead or Instantly - Built-in warm-up functionality plus sending infrastructure for cold outreach campaigns at scale.
• Findymail - Email verification at the point of finding contacts, so you're not importing invalid addresses in the first place.
• A bulk email validator - For cleaning existing lists in one pass before any send.

The Right List Is Half the Battle

A lot of deliverability issues start upstream - with the quality of the contacts you're reaching out to in the first place. If you're scraping random emails from the web or buying bulk lists, you're going to have high bounce rates, spam complaints, and deliverability problems no matter how clean your authentication is.

When building prospect lists for outbound, start with verified B2B data. The B2B lead database at ScraperCity lets you filter by job title, seniority, industry, location, and company size - so you're targeting real decision-makers, not pulling garbage data that tanks your bounce rate. Combine that with list verification before any send and you've addressed the list quality problem at the source.

Track all of this in a structured way. Our free Cold Email Tracking Sheet has columns for bounce rate, open rate, and reply rate by campaign - which makes it easy to spot deliverability drops before they become full-blown problems.

Frequently Asked Questions About Email Deliverability

Why are my emails going to spam even though I set up SPF, DKIM, and DMARC?

Authentication is the floor, not the ceiling. Having all three records configured correctly means inbox providers can verify your identity - but they still need to trust you based on behavioral signals. If your list is dirty, your complaint rate is high, your sending volume is inconsistent, or your engagement signals are poor, you'll still land in spam despite perfect authentication. Run through the full diagnostic checklist: check your Postmaster Tools reputation, verify your list, audit your content, and look for blacklist hits.

How long does it take to rebuild a damaged domain reputation?

Depends on how badly it's damaged. Minor reputation issues - a temporary spam rate spike from one bad campaign - can recover in a few weeks if you stop the problematic sends and start sending only to engaged contacts. Severe damage - blacklist hits, sustained high complaint rates, months of bad sending behavior - can take 2-3 months to fully recover. In some cases, starting fresh with a new sending domain is faster. Either way, the recovery path is the same: fix the root cause, clean the list, send small volumes to engaged contacts, and let the positive engagement history rebuild your reputation gradually.

Can I use Gmail or Outlook for cold outreach?

Google Workspace (Gmail with a custom domain) is actually a common choice for cold outreach because it has good deliverability when properly configured and has higher daily sending limits than free Gmail. What you can't do is send cold outreach from a @gmail.com or @outlook.com personal address - those fail authentication by default. Use a custom domain with Google Workspace or Microsoft 365 configured behind it.

What's the difference between email delivery and inbox placement?

Email delivery measures whether the receiving server accepted your email. An email "delivered" to the spam folder counts as delivered. Inbox placement measures whether your email actually landed in the primary inbox. Your ESP reports delivery rate - which is almost always high. What matters for your outreach is inbox placement, which your ESP doesn't track. That's why Google Postmaster Tools and third-party seed testing tools exist.

Does a cold email need an unsubscribe link?

Technically, the one-click unsubscribe requirement targets bulk marketing senders rather than one-to-one cold emails. But in practice, Gmail's spam filters treat unsubscribe friction as a negative signal regardless of campaign type. Including a simple text unsubscribe option ("reply with 'unsubscribe' to be removed") in cold email sequences is good practice - not just for compliance optics, but because it reduces the chance that someone who doesn't want your email hits "report spam" instead.

Why is Outlook so much harder to land in than Gmail?

Microsoft's filtering approach is more aggressive and less predictable than Gmail's. Outlook uses a heuristic-based system that can misclassify legitimate emails. Its inbox placement rates for high-volume senders have dropped sharply in recent periods. Microsoft also uses real subscriber feedback more aggressively in its filtering model. If your prospect list skews enterprise (Microsoft 365), factor in that Outlook will be harder to crack and monitor your SNDS data closely.

The Bottom Line

Emails go to spam for fixable reasons. Missing authentication, poor sender reputation, dirty lists, spammy content, sudden volume spikes, blacklist hits, provider-specific issues - every one of these has a solution. None of it is complicated once you understand what's actually going on.

The senders who consistently land in the inbox aren't lucky. They treat deliverability as a system: authenticate properly, warm up domains before scaling, verify lists before sending, write emails that don't read like spam, monitor their reputation continuously, and adjust when something breaks. That's it.

Do those things and you'll outperform 90% of the outbound senders in your space - not because your email copy is magic, but because your emails actually arrive.

If you want to go deeper on cold email infrastructure and outreach systems, I cover the full technical stack inside Galadon Gold.