Email Deliverability Triage: A 10-Step Checklist When Mail Goes to Spam

Pre-Triage: Categorizing the Failure Pattern

Before jumping into technical logs, you must first characterize exactly how your deliverability is failing. Not all "spam" is created equal. A "Hard Bounce," where the receiver rejects the message with a 550 error code, usually points to a binary failure like a blacklist entry or a critical authentication error. Conversely, "Spam Routing"—where the message is accepted but placed in the Junk folder—indicates a reputational or content-based issue where the receiver "knows" who you are but doesn't "trust" the specific message.

To begin your triage, collect three key data points: the full bounce message (if available), the original headers of a received test email (specifically the Authentication-Results header), and a breakdown of which providers are failing. If you are only failing at Gmail but delivering perfectly to Outlook, your problem is likely provider-specific reputation rather than a global DNS error. The table below represents the most common failure patterns and their likely technical origins.

As indicated in the table, the symptom dictates the diagnostic starting point. If you were working fine yesterday and broke suddenly today, you should look for "Sudden Change" events like a new blacklist listing or a recent DNS edit. If you have a slow decay in deliverability over several months, you are likely looking at a "Reputation Degradation" issue caused by poor list hygiene or falling engagement rates. By categorizing the failure correctly at the start, you avoid wasting hours debugging your SPF records when the actual problem is a stale recipient list.

The most important tool in this early phase is your own "Bounce Mailbox." Every time a server rejects your email, it sends a "Delivery Status Notification." Most administrators ignore these, but they are the most authoritative source of truth. A rejection that says 5.7.1 Service unavailable; Client host [1.2.3.4] blocked using zen.spamhaus.org is a gift—it tells you exactly where the blockage is. Without reading these codes, you are essentially flying blind through the global mail system's defensive layers.

Phase 1: Validating the Authentication Layer (SPF, DKIM, DMARC)

Step 1 in any deliverability crisis is a total audit of your DNS-based authentication. These records act as your "Passport" on the internet. In early 2024, Google and Yahoo made these records mandatory for all bulk senders. If your SPF, DKIM, or DMARC records are missing or misconfigured, your mail is treated as unauthenticated and is increasingly likely to be rejected outright by major providers.

SPF (Sender Policy Framework) is your authorized list of IPs. If your mail is sent from an IP not on this list, it soft-fails or hard-fails. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email, proving that the content wasn't altered in transit and that it truly originated from your domain. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the management layer; it tells receivers what to do if SPF or DKIM fails (e.g., p=reject).

1. Check SPF Alignment: Ensure your record includes the include: mechanisms for all currently active services (like SendGrid, Google, or Mailchimp).
2. Count SPF Lookups: Use our SPF Checker to ensure you aren't exceeding the 10-DNS-lookup limit, which causes a "Permerror."
3. Verify DKIM Selectors: Query your DKIM selector (selector._domainkey.yourdomain.com). If it returns an empty result, your signing is broken.
4. Audit DMARC Alignment: Check your received headers for dkim=pass and spf=pass. If both say "pass" but DMARC shows "fail," it means the domains don't match your From: header.

Alignment is the part most senders get wrong. You can have a "Pass" on SPF and DKIM but still fail DMARC if the ESP is using their own domain for signing instead of yours. This is called "Unaligned" authentication. For modern deliverability, you must achieve Identifier Alignment, where the domain you show the user (From: news@example.com) matches the domain used for authentication. Without alignment, DMARC cannot protect your domain from spoofing, and reputable receivers will penalize your traffic.

If your authentication fails, fixing it is your highest-impact action. An SPF fix propagates in minutes and can instantly restore mail flow for a domain that was being rejected. We recommend using our DMARC Policy Enforcement Guide to move safely from a p=none monitoring policy to a p=reject enforcement policy. This not only improves your deliverability but also secures your brand against phishing attacks that impersonate your company's email addresses.

Phase 2: Infrastructure Handshake Integrity and Blacklist Status

Once authentication is confirmed, the triage moves to the "Handshake" layer. Before a receiver even looks at your SPF record, they look at your IP Reputation and Blacklist Status. A blacklist listing (specifically on a critical list like Spamhaus) is a "Binary Block"—meaning no matter how good your content is or how perfect your SPF is, the mail is dead on arrival. This often affects shared IP pools most frequently, where a "bad neighbor" gets the IP blocked for everyone.

The second critical infrastructure check is Reverse DNS (PTR). This is a DNS record that points your IP address back to your hostname. If you send mail from 203.0.113.42 but that IP doesn't have a PTR record pointing to mail.yourdomain.com, Gmail and Outlook will view your server as "unmanaged" or "malicious." A professional mail server must have a functional PTR record that forward-resolves back to the same IP. This is a non-negotiable requirement for enterprise-grade deliverability.

; The Full-Circle Reverse DNS (FCrDNS) Check:
1. IP 1.2.3.4 -> PTR -> mail.example.com (PASS)
2. mail.example.com -> A -> 1.2.3.4 (PASS)
Result: FCrDNS Match. Trust Level: High.

• Blacklist Audit: Check your sending IP against the "Big 3" blacklists (Spamhaus, Barracuda, SpamCop). If you are on any of these, stop all sending immediately.
• PTR Consistency: Ensure your mail server software (like Postfix or Exchange) uses a HELO/EHLO name that matches your public PTR record.
• Port 25 Testing: Use an SMTP Test Tool to ensure your server isn't accidentally acting as an "Open Relay," which is a fast-track to permanent blacklisting.
• TLS Coverage: Verify that your server supports at least TLS 1.2 for the SMTP connection. Many receivers now penalize unencrypted mail flow.

If you find your IP is blacklisted, never just request "removal." You must first audit your mail logs to find the "Leak." Was it a compromised web form? A stolen password? An unconfirmed sign-up list? Blacklist operators like Spamhaus track how many times an IP is re-listed. If you remove yourself and get re-listed within an hour, your reputation with the operator is destroyed, making it much harder to get a permanent removal later. Fix the leak first, then request the delisting.

For more details on navigating these infrastructure hurdles, see our Reverse DNS Explained guide and Email Blacklist Removal guide. These provide the step-by-step workflows for restoring your IP's integrity once a fault has been identified. Remember, infrastructure health is about stability over time; a single day of "shaky" configuration can have reputational consequences that last for weeks in the eyes of automated security filters.

Phase 3: Measuring Global and Provider-Specific Reputation

Reputation is a "Lagging Indicator." It's a scoreboard that tracks your behavior over the last 30 to 90 days. You can have perfect technical settings and no blacklists, but still land in spam if your "Reputation Score" is low. This happens when your recipients consistently ignore your mail, delete it without reading, or (worst of all) mark it as junk. To diagnose this, you must look at the providers' own internal scoreboards.

Google Postmaster Tools is the single most important diagnostic for B2C senders. It tells you exactly what Google thinks of your "Domain Reputation." If Google shows a "Bad" reputation, it doesn't matter what your logs say—every email you send to a @gmail.com address will go to spam. Microsoft SNDS provides similar data for Outlook and Hotmail. If you are struggling with a specific provider, these tools are your only way to see the "Ground Truth" as the receiver sees it.

As shown in the table above, recovering from a "Bad" Gmail reputation is an arduous process. There is no support form to fill out; you must simply "be a good sender" for 4 to 8 weeks before the automated systems trust you again. This usually involves pausing all low-engagement segments of your list and only sending to your highly-active users (those who opened in the last 30 days). This "re-training" of the filter is the only way to pull a domain out of a reputational tailspin.

Reputation is also tied to Volume Consistency. If you usually send 1,000 emails a day and suddenly send 100,000 in a "blast," the filters will flag you as a possible botnet. This "Burstiness" is a classic spam signal. To maintain a high reputation, you should use "Traffic Shaping" or "Rate Limiting" to spread your sends out more evenly over time. This predictable volume is far more trusted by receivers than erratic, high-pressure spikes.

Phase 4: Content Analysis and Subscriber Engagement Signals

The final phase of triage focuses on the message itself. Even with a perfect IP and perfect authentication, your content can still trip "Heuristic Filters." These are AI models that look for patterns common in phishing and spam. This includes things like "Hidden Text" (white text on a white background), excessive use of "URL Shorteners" (which hide the real destination), and "Image-to-Text" ratios that are too high (spammers often put all their text in an image to bypass scanners).

However, modern filters care more about Engagement Signals than keyword filters. A "Subject Line" full of emojis might not be a spam signal itself, but if that subject line leads to a 0.05% open rate and a 2% unsubscribe rate, those user actions tell the filter the content is garbage. High-engagement mail (replies, "Not Spam" clicks, moves to folders) is the strongest path to a "Gold" reputation.

• Link Reputation: Check the reputation of every domain you link to in your email. If you link to a blacklisted partner, you get penalized.
• Unsubscribe Clarity: Ensure your "Unsubscribe" link is visible and a "One-Click" process. Hiding it only forces users to click the "Report Spam" button instead.
• HTML vs. Plain Text: Always include a plain-text version of your email. Missing the text/plain part is a legacy spam signal.
• URL Check: Do your links go to the same domain as your From: address? Discrepancies here are a heavy phishing signal.

If you suspect content is the issue, use a "Seed List" or a tool like Mail-Tester. You send a draft to an assigned address, and it gives you a score out of 10, breaking down exactly which technical and content-based filters were triggered. This is the fastest way to see if your "Sale" subject line is actually the reason your newsletter is going to the spam folder.

Finally, audit your List Collection Practices. If your deliverability is failing, it's often because your "Top of Funnel" is broken. Are you using a purchased list? Are you scraping addresses from LinkedIn? These tactics are the fastest way to kill a domain's reputation permanently. Focus on "Double Opt-In" sign-ups where the user must confirm their email. This ensures that every address on your list is valid, active, and—most importantly—wanted.

Structured Diagnostic: The Triage Decision Tree

When you’re in a deliverability crisis, it’s easy to get overwhelmed. Use this "Decision Tree" to navigate your diagnostic priority. Start at the top and only move to the next level when the current one is confirmed "Green." This structured approach ensures you solve the "Foundational" problems before nitpicking over content or subject lines.

IS MAIL GOING TO SPAM?
│
├── [1] Check "Authentication-Results" Header
│   ├── Fails SPF/DKIM/DMARC? -> FIX AUTH (Step 1-3)
│   └── Passes? -> Continue
│
├── [2] Check Blacklist Status (Major RBLs)
│   ├── Listed on Spamhaus/Barracuda? -> FIX ROOT CAUSE + DELIST (Step 4)
│   └── Clean? -> Continue
│
├── [3] Check Infrastructure (PTR / FCrDNS)
│   ├── Missing/Generic PTR? -> SETUP REVERSE DNS (Step 5)
│   └── Verified? -> Continue
│
├── [4] Check Google Postmaster Tools (Domain Rep)
│   ├── Rep is "Low" or "Bad"? -> CLEAN LIST + SEGMENT (Step 7-8)
│   └── Rep is "High"? -> Continue
│
└── [5] Check Content (Mail-Tester Score)
    ├── Score below 9/10? -> FIX HTML/LINKS/HEADERS (Step 9)
    └── Perfect Score? -> AUDIT ENGAGEMENT/UNSUBS (Step 10)

As the tree shows, Authentication and Infrastructure are the bedrock. You cannot fix a bad reputation (Phase 3) until your technical house is in order (Phases 1-2). Most deliverability issues are solved by Stage 3. If you reach Stage 5 and everything is still going to spam, you are likely dealing with a very high "User Complaint" rate from a specific campaign, requiring a manual review of your marketing strategy and list acquisition methods.

If you follow this tree, you'll find that deliverability isn't a "Mystery"—it's a predictable outcome of technical alignment and recipient trust. By treating each step with the seriousness it deserves, you build a "Resilient Signature" that global mail providers recognize as legitimate, ensuring your business-critical communications reach the inbox every time.

Frequently Asked Questions

Next Steps

Perform a complete audit of your sending domain now using our Email Deliverability Report. This tool runs through the first five steps of this checklist automatically, giving you an instant diagnostic dashboard for your authentication and infrastructure health.

For deeper technical deep-dives into each authentication layer, see our guides on SPF Setup, DKIM Management, and DMARC Policy Enforcement. If you find a blacklist listing, follow our Blacklist Removal workflow immediately.

Browse all Email Guides on DNSnexus for advanced strategies on list health, infrastructure warming, and provider-specific compliance.

Related Guides

• SPF Record Explained: Setup, Syntax, and the 10-Lookup Limit
• DKIM Explained: How It Works and How to Verify It
• DMARC Policy Enforcement: Moving Safely from monitoring to reject
• Email Blacklist Removal: Why IPs Get Listed and How to Get Removed
• Reverse DNS Lookup Explained: Why PTR Records Matter for Email