There’s no single switch that fixes spam placement, but there is a clear priority order. Fix authentication first — without it, bulk mail is rejected or filtered before anything else is even evaluated. Then reputation, because it’s the biggest factor once you’re authenticated. Then list quality and engagement, which feed reputation. Then the compliance and content details that tip borderline cases. Below, each item says what to do and how to verify it. If you only do the top three, you’ll fix the large majority of spam-folder problems.
1. Authenticate with SPF, DKIM and DMARC
This is non-negotiable and comes first. Gmail, Yahoo and Microsoft now reject or spam-folder unauthenticated bulk mail. You need all three records published and aligned with your visible From domain — a common trap is SPF passing while DMARC fails because the checked domain doesn’t match. A minimal starting point looks like this:
; SPF — authorise your sender, keep it under 10 DNS lookups
example.com. TXT "v=spf1 include:_spf.yourprovider.com -all"
; DMARC — publish a policy so providers know what to do on failure
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"DKIM is generated by your sending provider and published as its own record. Start DMARC at p=none to monitor without blocking, read your reports, then move to enforcement — the staged rollout is in how to move DMARC to p=reject safely. Confirm all three at once with the Email Health Check and the DMARC Checker, and follow the SPF, DKIM and DMARC guide for the details. Set up ongoing reporting with DMARC monitoring.
2. Protect and repair your sender reputation
Once authenticated, reputation is what decides inbox versus spam. It’s scored per domain and IP from your sending history: volume, consistency, complaints, bounces and trap hits. Check where you stand in Google Postmaster Tools, and if the picture is poor, work through how to check and repair your sender reputation. Reputation is rebuilt over weeks of steady, permission-based sending — there’s no instant fix, which is exactly why the habits below matter.
3. Keep your list clean and verified
A dirty list poisons every other signal: bounces, spam-trap hits and dead weight that kills engagement. Verify before every significant send with the Email Verifier, which runs a live SMTP check without delivering a message, so invalid mailboxes are removed before a server ever counts a bounce. Drop undeliverables, segment out risky and catch-all results, and never mail a purchased or scraped list — those carry spam traps by design (what is a spam trap). The full process is in how to clean an email list, and keeping bounces under roughly 2% is covered in how to reduce your email bounce rate.
4. Check you’re not on a blocklist
A single spam-trap hit can land your domain or IP on a blocklist, and that overrides every other signal — mail to whole providers gets rejected. Run the Email Blacklist Check regularly, and if you’re listed, follow the delisting workflow in how to avoid email blacklists and get delisted fast.
5. Add one-click unsubscribe and honour it fast
Bulk senders are now required to include RFC 8058 one-click unsubscribe headers and to process opt-outs within a couple of days. A visible, working unsubscribe actually protects you: recipients who can leave easily won’t hit “report spam,” which is the far more damaging signal. Implement it on your marketing stream following how to implement one-click unsubscribe. The complete provider mandates are in Gmail, Yahoo and Microsoft bulk sender requirements.
6. Keep your complaint rate low
Providers expect spam complaints to stay below 0.3% — published guidance, not a rule of thumb. Complaints come from mailing people who didn’t clearly opt in, over-mailing, or making unsubscribe hard. Use genuine opt-in (ideally double opt-in), set honest expectations at sign-up, and don’t over-send. Watch the spam rate in Postmaster Tools and act the moment it trends up.
7. Improve engagement and sunset the dormant
Opens, clicks and replies are strong positive signals; a list of people who never engage teaches providers your mail is unwanted. Segment by activity, send your best content to engaged contacts, and run a sunset policy that gives dormant addresses one or two re-engagement campaigns before you suppress them. This lifts engagement and removes the recycled-trap candidates hiding in your least-active segment.
8. Clean up your content and links
Filters read the message. Avoid spammy phrasing, keep a healthy text-to-image ratio (an image-only email is a red flag), don’t use link shorteners that hide the destination, and link only to domains you control or trust — link reputation is part of your score. Make sure your HTML is well-formed and your From name and address are consistent and recognisable.
9. Warm up new sending identities and send steadily
A new domain or IP has no reputation, and a sudden volume spike looks like a compromised account. Ramp any new sending identity gradually (how to warm up a new sending domain) and, once established, keep daily volume roughly consistent — erratic bursts trigger throttling even on a warm domain. If you send both receipts and campaigns, separate them so a bad campaign can’t sink your transactional mail: see how to separate transactional and marketing email.
10. Monitor continuously
Spam placement is a moving target, and most of the signals above are lagging indicators — by the time delivery drops, the damage is recorded. Set up Google Postmaster Tools, watch reputation and spam rate per provider, re-run the Email Blacklist Check on a schedule, and re-verify your list periodically since it decays 20–30% a year. Catching a problem early is the difference between a quick correction and a rebuild.
Common failure modes
- Skipping straight to content tweaks. Rewriting subject lines won’t fix broken authentication, a blocklisting or a bad reputation. Work the list top-down.
- SPF passes, DMARC fails. Passing a mechanism isn’t the same as aligning it to your From domain. Check alignment specifically.
- Mailing everyone to stay visible. Sending to unengaged contacts is the fastest route to the spam folder. Segment and sunset.
- One-and-done. Reputation and list quality decay. Without monitoring and re-verification, you’ll slide back.
Verify your setup right now
Two checks cover most of this list. Run your sending domain through the Email Health Check to confirm SPF, DKIM, DMARC, PTR and blacklist status are clean, then send a real message through the Email Deliverability Test to see authentication, content flags and placement together. Push your list through the Email Verifier before the next send, and you’ve closed the loop on the top of the priority order.
Sources
Authentication is defined across RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC); one-click unsubscribe is RFC 8058. The sender requirements and the 0.3% complaint-rate guidance are published in the Google email sender guidelines and the Yahoo sender best practices.