Email Deliverability: How to Stay Out of the Spam Folder

You wrote a good email, hit send to 8,000 subscribers, and your open rate fell off a cliff. The likely reason is that a big share of the messages never reached the inbox. They went to spam, or they were rejected before anyone could see them.

Email deliverability is the share of your mail that actually reaches the inbox. It is different from “delivery rate”, which only tells you a receiving server accepted the message. A message can be delivered straight into the spam folder, and your email platform will still count it as delivered.

Since 2024 the rules have tightened. Gmail, Yahoo and Microsoft’s Outlook.com now set hard requirements for bulk senders, and Gmail began ramping up enforcement in November 2025 with temporary and permanent rejections. This guide covers what those providers check, the list hygiene and sending habits that keep you safe, and a step-by-step plan to fix a sender reputation that has slipped.

How inbox providers decide where your email goes

Mailbox providers don’t publish their full filtering formulas, but their sender guidelines make the main inputs clear. They look at 3 groups of signals.

• Identity. Can the provider prove the message really came from your domain? That is the job of SPF, DKIM and DMARC.
• Reputation. How have recipients reacted to your past mail? Spam complaints, deletions without opening, replies and “not spam” clicks all feed in. Reputation attaches to your sending domain and your sending IP addresses.
• Content and format. Is the message well formed, sent over an encrypted connection, and free of the patterns typical of spam and phishing?

Reputation carries the most weight over time. A perfectly authenticated email still goes to spam if the people receiving it keep marking your mail as junk.

The bulk-sender rules from Gmail, Yahoo and Outlook.com

The 3 largest consumer inbox providers in the US now have written requirements. If you send 5,000 or more messages a day to any one of them, you count as a bulk sender. Google says that status is permanent: once you hit the threshold, you stay a bulk sender even if your volume drops.

Every sender, bulk or not, also needs valid forward and reverse DNS (PTR) records for sending IPs, TLS encryption in transit and correctly formatted messages under RFC 5322. Gmail and Yahoo both ask for at least SPF or DKIM from small senders too.

Outlook.com mail that fails the high-volume checks gets a “550 5.7.515” rejection that says the sending domain “does not meet the required authentication level”. If you see that bounce code, authentication is the fix.

Key takeaway: The 0.3% complaint limit is a ceiling, not a target. Google tells senders to stay below 0.1%, which means no more than 1 spam report for every 1,000 messages that reach the inbox.

Set up authentication first

If you only fix one thing this week, make it authentication. Without it, everything else is built on sand.

1. SPF lists the servers allowed to send mail for your domain. Add your email platform, your CRM and any other tool that sends as you.
2. DKIM adds a cryptographic signature. Your email platform gives you DNS records to publish. Google and Yahoo both ask for keys of at least 1024 bits, and 2048 bits is common.
3. DMARC ties the two together and tells receivers what to do when mail fails. Start at p=none with a reporting address, review the reports, then move toward quarantine or reject.

Our full walkthrough of SPF, DKIM and DMARC shows example records and a safe path to enforcement. The same records also stop criminals from spoofing your domain in business email compromise attacks.

One common mistake: sending marketing mail from your email platform’s shared domain instead of your own. Set up a custom sending domain (often a subdomain such as news.yourbusiness.com) so the From address, the DKIM signature and your reputation all belong to you. Yahoo also suggests separating marketing and transactional mail onto different IPs or DKIM domains so a bad campaign doesn’t slow down receipts and password resets.

List hygiene: the habit that protects your reputation

Most deliverability problems start with the list, not the email. Old addresses, purchased lists and people who forgot they signed up all drive complaints.

Only mail people who asked. Yahoo calls out purchased lists and pre-checked opt-in boxes as practices to avoid. Use a clear signup form and consider double opt-in, where new subscribers confirm by clicking a link. It slows list growth a little but filters out typos, fake addresses and bots.

Remove hard bounces immediately. An address that doesn’t exist will never become valid. Most email platforms suppress hard bounces automatically. Check that yours does.

Sunset inactive subscribers. People who haven’t opened or clicked in 6 to 12 months drag down engagement and some old addresses get turned into spam traps by providers. Send a short re-engagement series, then suppress anyone who still doesn’t respond. Keep in mind that Apple Mail Privacy Protection can register opens automatically, so clicks are a more reliable activity signal.

Make leaving easy. A hidden unsubscribe link doesn’t keep people on your list. It just pushes them to the spam button, which hurts far more. Put the link where people can find it and support one-click unsubscribe in the headers.

Watch signup forms for bots. Bots can fill forms with real people’s addresses, which then generate complaints. A CAPTCHA or a hidden honeypot field on the form helps.

Sending habits that keep you in the inbox

Once the list is clean, how you send matters.

• Keep a steady volume. Sudden spikes look like a compromised account or a spammer. If you are moving to a new domain or IP, warm it up by sending to your most engaged subscribers first and increasing volume over several weeks.
• Send consistently. A list that hears from you every 2 weeks remembers who you are. A list you email twice a year forgets and complains.
• Segment by engagement. Send your biggest campaigns to people who opened or clicked recently, and mail less active segments less often.
• Set expectations at signup. Tell people what they will get and how often, then stick to it.
• Keep your From name recognizable. Use your business name, or a person’s name plus the business name, every time.
• Write like a person. Misleading subject lines, all-caps urgency and image-only emails with little text look like spam to filters and to people. Lean on clear text, a few images with alt text and a link to a domain you own.

Automated emails tend to perform well here because they go to people who just did something, like signing up or leaving items in a cart. Our guide to email automation workflows covers the flows worth setting up.

The US law you also have to follow

The CAN-SPAM Act sets the legal floor for commercial email in the US. According to the FTC, every commercial message needs accurate header information, a subject line that matches the content, a valid physical postal address and a clear way to opt out. You must honor opt-out requests within 10 business days, and each violating email can bring penalties of more than $50,000. Inbox provider rules are stricter than the law, so meeting Gmail’s 48-hour unsubscribe rule keeps you covered on both. If you collect subscriber data across states, check the state privacy laws that may apply too. This is not legal advice.

How to monitor deliverability

You can’t fix what you don’t measure. Use these free tools alongside your email platform’s reports.

Where to start: a 7-step deliverability fix

If your open and click rates have dropped, work through these steps in order.

1. Check authentication. Confirm SPF, DKIM and DMARC are published and passing for your sending domain. Send a test to a Gmail account and use “Show original” to see the results.
2. Register for monitoring. Verify your domain in Google Postmaster Tools, sign up for Yahoo’s feedback loop and set a DMARC reporting address.
3. Turn on one-click unsubscribe. Most email platforms support it. Make sure it is enabled for marketing mail and that the body link is easy to find.
4. Clean the list. Remove hard bounces, suppress subscribers with no clicks in 6 to 12 months and stop using any purchased or rented lists.
5. Run a re-engagement series. Give inactive subscribers 2 or 3 chances to stay, then let them go.
6. Rebuild slowly. Send to your most engaged segment for a few weeks before returning to full-list sends.
7. Review your platform. If your provider can’t support custom domains, one-click unsubscribe or engagement segments, it may be time to look at how to choose an email marketing platform.

The bottom line

Deliverability isn’t a trick. It’s the result of proving who you are, sending to people who want your mail and making it easy for everyone else to leave. Authenticate your domain, keep complaints well under 0.1%, honor unsubscribes within 48 hours and keep your list fresh. Do those 4 things and the spam folder becomes the exception, not the rule. For more terms used in this guide, see our glossary.

Sources

• Google Workspace Admin Help: Email sender guidelines — Gmail requirements for all senders and bulk senders, spam rate thresholds, one-click unsubscribe
• Google Workspace Admin Help: Email sender guidelines FAQ — November 2025 enforcement ramp-up, 48-hour unsubscribe window, permanent bulk sender status
• Yahoo Sender Hub: Sender best practices — Yahoo requirements, 0.3% complaint rate, 2-day unsubscribe rule, Complaint Feedback Loop
• Microsoft Support: Fix NDR error 550 5.7.515 in Outlook.com — Outlook.com high-volume sender threshold and authentication requirements
• FTC: CAN-SPAM Act compliance guide for business — US legal requirements for commercial email