Why Legitimate Email Goes to Spam, and What Actually Changes It

Separate the four things that decide where your mail lands — authentication, reputation, engagement and content — and find out which ones you can change and which you cannot.

By Net Insight Published 2026-09-17 Updated 2026-09-17

The four things that decide where a message lands

Deliverability is often discussed as a single problem, and it is four problems that interact. Authentication decides whether a message is attributed to the domain it claims to come from. Reputation decides how a receiver weighs that attribution. Engagement decides how the receiver’s own users behave towards mail from that sender. Content decides whether the message looks like what that sender normally sends.

Only the first is purely a configuration matter, and it is the only one this site can observe. That is worth stating at the outset, because the most common frustration in this area comes from fixing authentication and expecting placement to follow. The email deliverability test tells you which parts of the first layer are in place; the other three layers are the subject of this page.

Authentication is a precondition, not a cause

SPF, DKIM and DMARC together establish that a message is authorised to use your domain and that its signed parts were not altered in transit. Passing all three does not earn a better placement any more than having a valid passport earns a visa. What it does is remove a reason to doubt the message, which matters because unauthenticated mail from a domain that could authenticate is treated as suspicious by default.

The failure mode to avoid is a partial rollout. Publishing DMARC at a strict policy before every legitimate sender is accounted for causes silent loss: the receiving side refuses the message, and the sending side sees no error at all. The sequence that avoids this — monitor, read the reports, repair, then tighten — is set out in the DMARC policy guide.

Reputation: what it is made of

A mailbox provider builds its picture of a sender from the behaviour of the infrastructure that sends, not from a published rating. Three inputs dominate. The volume pattern, because a sudden burst of mail from a domain that normally sends a trickle is a hallmark of a compromised account. The complaint rate, because recipients who press the spam button are making a direct accusation. And the history of a domain that has previously sent unwanted mail, which is the hardest input to change.

The last of those explains why two domains with identical DNS configuration can perform completely differently. Reputation attaches to identities — domains and sending addresses — and it persists. A domain used for a spam campaign years ago is still carrying that association, and there is no field you can edit to clear it.

This is also why the observation lists on the IP reputation check are laid out as separate facts rather than as a score. Different providers model risk differently and disagree with each other, and a single number would hide exactly the disagreement that is informative.

Engagement: the signal you can influence but not control

Once a message is delivered, what recipients do with it becomes the strongest signal available. Opening, replying, moving a message out of the spam folder and clicking a link all count in favour of the sender. Ignoring, deleting without reading and pressing the spam button all count against, and the spam button is weighted far more heavily than the others.

Two consequences follow, and both are practical. A list that has not been sent to in months produces a wave of non-engagement when you resume, which lands on the negative side of the ledger. And an unsubscribe mechanism that is difficult to find produces spam-button presses instead of removals, which is a strictly worse outcome for the sender. Making leaving easy is one of the few levers entirely within your control.

Sending less can be the correct answer. A smaller list of recipients who expect your mail reliably outperforms a larger list that mostly does not, and the difference shows up in the engagement ratio rather than in the volume.

Content: what it contributes, and what it does not

Content filtering has moved a long way from keyword lists, but some patterns still carry weight. A message whose HTML is mostly a single opaque image has no text for the receiver to evaluate. A mismatch between the display name and the address, or between the link text and the destination, is a spoofing pattern. Excessive link shortening removes the domain from the URL in a way receivers cannot inspect.

The common mistake is over-correcting. Rewriting legitimate copy to avoid certain words, or adding phrases intended to placate filters, is at best neutral and at worst makes the message look like an attempt to game the filter. The honest position is that content is the weakest of the four inputs for a sender with good authentication and a clean sending history, and it becomes prominent mainly when one of the other three is failing.

Working through it in a sensible order

Start by confirming that receiving is configured at all — the MX record check shows whether mail has a destination. Then confirm that the sending hosts are declared and that the domain’s policy is published, with reporting enabled. Fix the senders that the reports show as failing before tightening the policy, and check whether the sending addresses appear on any list using the IP blacklist check; the blacklist removal guide covers what to do if they do.

Only after those are clean does engagement work become worth doing, because its effect is gradual and it is easily mistaken for having fixed nothing. And only when a message is being refused rather than filed is the problem a configuration problem at all — a distinction worth checking early, since the two look identical from the sending side.

For where a failure sits in the wider picture, the network guide keeps address, resolution and mail questions separate so that a routing problem is not mistaken for a reputation problem.

Questions worth asking

I fixed SPF, DKIM and DMARC and mail still goes to spam. Why?

Because authentication is a precondition rather than a cause. It decides whether a message is attributed to your domain; it does not decide placement. Reputation and how recipients behave with your mail are what move a message between folders.

How long does it take to recover a damaged sending reputation?

It is measured in weeks to months of consistent, low-complaint sending, and it is not a switch. There is no configuration change that resets it, which is why protecting a domain's history matters more than repairing it.

Does using a shared sending service hurt my deliverability?

It cuts both ways. You inherit the provider's reputation along with its infrastructure, so a well-run service helps a new domain, and a badly behaving neighbour on the same addresses can hurt you. A dedicated address is the trade for isolation.

Should I remove the unsubscribe link to stop complaints?

No. Making it harder to leave increases the number of people who press the spam button instead, which is the single most damaging signal a mailbox provider records. An obvious, working unsubscribe is a deliverability measure.

Does asking recipients to whitelist me help?

It helps those recipients. It does not change the reputation signal that decides the folder for everybody else, so it is a useful add-on rather than an answer.