Why your newsletter goes to spam

For years you could send a newsletter with sloppy authentication and mostly get away with it. That ended in February 2024, when Google and Yahoo rolled out enforced requirements for bulk senders — roughly anyone sending more than about 5,000 messages a day to their users. Microsoft has since announced comparable requirements for high-volume mail to Outlook.com and Hotmail. Miss them and your mail is throttled, filtered to spam, or rejected outright with a 5.7.x error. The good news: the requirements are specific and checkable.

The three things bulk senders must do

1. Authenticate with SPF and DKIM. Both, not either — and they must be valid. Check them with the SPF Checker and DKIM Checker.
2. Publish DMARC. At minimum p=none, but with alignment: the domain that passes SPF or DKIM must match your visible From: domain. This is the step that trips up senders using an email platform — see below. Verify with the DMARC Checker.
3. Offer one-click unsubscribe. A working List-Unsubscribe header plus List-Unsubscribe-Post: List-Unsubscribe=One-Click (RFC 8058), and you must honour unsubscribes within a couple of days. Check a real message with the List-Unsubscribe Checker.

On top of those, keep your spam-complaint rate low — Google asks senders to stay under 0.3%, and ideally below 0.1%. A high complaint rate will sink you even with perfect authentication.

The alignment trap (the #1 reason “I have SPF and DKIM” still fails)

Here’s the scenario that generates the most confused support tickets. You send through a marketing platform. SPF passes — for the platform’s bounce domain. DKIM passes — signed by the platform’s domain. Both green, and yet DMARC fails, because neither passing domain matches the From: address your subscribers see. DMARC requires alignment, and unaligned passes don’t count.

The fix is to authenticate on your domain: set up a custom Return-Path (a CNAME your platform gives you) so SPF aligns, and/or configure the platform to DKIM-sign with your domain (again, usually a DNS record they provide). Once one of them aligns, DMARC passes. To see it end-to-end — what your actual newsletter does when it goes out — send one to the Outbound Deliverability Test; it reports the real SPF/DKIM/DMARC result and whether they align.

The headers a compliant bulk email carries

A properly configured bulk message includes, among the usual headers:

List-Unsubscribe: <https://example.com/unsub/abc>, <mailto:unsub@example.com> List-Unsubscribe-Post: List-Unsubscribe=One-Click Authentication-Results: ... spf=pass ... dkim=pass ... dmarc=pass Message-ID: <unique@example.com>

The one-click endpoint must process the unsubscribe on a single POST, with no login and no confirmation page. Keep a visible unsubscribe link in the body too — it’s still expected and, in many places, legally required.

A quick diagnosis checklist

• Bouncing with 5.7.26 / “message not authenticated”? SPF or DKIM isn’t aligned. Fix alignment.
• Landing in spam despite passing auth? Check complaint rate, list hygiene (verify your list with the Email Verifier so you’re not mailing dead addresses and spam traps), sending-IP reputation, and content.
• Rejected with 421 / rate-limited? You’re sending too fast or your reputation is poor — slow down and warm up.
• Not sure where you stand? Run the Bulk Sender Compliance check on your domain.

Get ahead of it, don’t react to it

The senders who sail through these rules treat authentication and list hygiene as ongoing hygiene, not a one-off fix. Publish DMARC and monitor the reports so you catch a broken sender before Gmail does; clean your list before every big send; and keep an eye on complaints. Google’s own sender guidelines and Yahoo’s sender best practices are the canonical references, and the deliverability cheat sheet distils the rest.