Skip to content

The publication for web craftspeople Wednesday, 19 August 2026

Email & deliverability

Deliverability: the six causes of spam placement that actually occur

Authentication in place and messages still in junk: the six real causes, in the order they appear, and the diagnostic method.

A message can be perfectly authenticated, correctly coded, and still end up in junk. Authentication decides whether the message is admissible; reputation decides whether it is welcome. Here are the six causes of spam placement that actually occur at small volumes, in the order they appear.

This article assumes SPF, DKIM and DMARC already in place. Without them, none of the causes below is yet the main problem.

This is the dominant cause, and the only one no setting can fix. A list imported from an address book, purchased, or built with pre-ticked boxes mechanically produces complaints and dead addresses. Providers measure exactly that.

IndicatorAccepted thresholdEffect of exceeding it
Complaint rate (“report as spam”)< 0.1% — alert from 0.3%Junk placement, then blocking
Invalid addresses (hard bounces)< 2%Rapid degradation of sending reputation
Spam trapsNone toleratedDomain or IP blocklisting

Double opt-in costs subscriptions in the short term and gains them in the medium term, because it eliminates typos and addresses entered by third parties.

A list of one thousand consented addresses delivers better than a list of ten thousand collected ones. That is not a moral position, it is reputation arithmetic.

2. No compliant unsubscribe mechanism

Since 2024, bulk senders must offer one-click unsubscription compliant with RFC 8058, processed within two days. In practice, two headers must accompany the send:

List-Unsubscribe: <https://example.com/unsubscribe?t=TOKEN>, <mailto:[email protected]>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The reasoning is counter-intuitive but sound: easy unsubscription prevents a spam report. The first act is reputation-neutral, the second degrades it lastingly.

3. A sending domain with no history

A new domain, or a dedicated IP address never used, has no reputation. Sending several thousand messages straight away from such an origin triggers anti-spam protections.

Progressive warm-up is the standard answer: a few dozen sends in the first days, prioritising the most engaged contacts, then progressive doubling over two to four weeks. At small volumes, a well-managed shared IP from the sending platform generally performs better than an under-used dedicated IP.

Dedicated subdomain: separating marketing sends (news.example.com) from transactional ones (mail.example.com) protects the latter. A campaign that generates complaints then does not drag order confirmations down with it.

4. Weak engagement, sustained

Modern filters weigh recipient behaviour heavily: opens, replies, filing, deletion without reading. Continuing to write to contacts who have not opened for a year does not merely waste sends — it degrades delivery for everyone else.

Periodic cleaning is a deliverability action, not an accounting one:

  • Segment inactives at six or twelve months depending on send frequency.
  • Attempt a single, short re-engagement campaign with an explicit exit.
  • Remove the non-reactivated from the main list.

5. Content that resembles what filters discard

Lists of “forbidden words” are largely folklore: current filters assess a bundle of signals. Some remain penalising and easy to avoid:

  • A message made of one large image with no usable text.
  • No plain-text version.
  • Generic URL shorteners, heavily used by malicious campaigns.
  • A link-tracking domain different from the sending domain and unauthenticated.
  • A mismatch between subject line and content, which produces immediate deletions.

6. Infrastructure that contradicts the message

A final point, often neglected on small sites: the subscription form and the site itself are part of the signal. A site served without HTTPS, an unsubscribe page returning an error, an expired tracking domain or a bouncing reply address all degrade the whole. Technical consistency between the message and the infrastructure carrying it is checked.

Diagnosing in the right order

  1. Read the DMARC reports: they reveal unauthenticated sends made in your name.
  2. Consult the postmaster tools of the major providers, which expose complaint rate and domain reputation.
  3. Check public blocklists for the domain and the sending IP address.
  4. Segment by provider: a problem limited to one operator points to reputation, a general problem to authentication or content.

What to take away

Deliverability is not a setting but a regime. The three levers that weigh most are, in order: how the list was built, how easy it is to leave, and how consistent engagement is. Content and infrastructure come afterwards — they rarely explain junk placement on their own.

On my own sends, the one measure that produced an immediate and lasting effect was removing contacts inactive for more than a year. I lost a third of a list and gained delivery on the remaining two thirds. It is the most counter-intuitive decision in the discipline, and the most profitable. — Simon Janvier

Also on Mail Studio

Read next