Why do my emails go to spam when I only send to people who signed up?

Almost always authentication rather than the list. If SPF or DKIM does not align with the domain in your From address, DMARC fails, and a DMARC failure is now enough on its own at the major providers. Check the Authentication-Results header of a delivered message before you change anything about your content or your list.

Do spam words in the subject line still matter?

Barely. Sender reputation, authentication, and engagement dominate modern filtering, and a well-authenticated sender with a clean complaint rate is not going to be filtered over the word 'free'. What still matters is structural: image-only messages, shortened links, and a From name that does not match the sending domain.

How long does it take to recover sender reputation?

Two to six weeks of demonstrably good sending, and longer if the damage came from a purchased list or a spam trap hit. Recovery is driven by evidence that recipients want the mail, so the way through is low volume to your most engaged recipients — not pausing entirely, and certainly not continuing to send broadly.

Should I use a dedicated IP to fix deliverability?

Usually not, and below roughly 100,000 messages a month it tends to make things worse. A dedicated IP needs consistent volume to build a reputation; an IP that sends irregularly stays unknown, and unknown is treated with more suspicion than a well-managed shared pool. Fix authentication and list quality first — that is where the problem almost always is.

Can I test where my email lands before sending a campaign?

Partly. Seed addresses at the major providers show you placement for those accounts, and a raw-header check confirms authentication, which is the part that generalises. What no test reproduces is per-recipient engagement history, so treat a seed test as a check for configuration mistakes rather than a prediction of inbox placement.

Deliverability

Why your email goes to spam, in the order worth checking

Updated 3 September 2026 · 7 min read · SendKernel

Nine times out of ten, mail lands in spam for one of three reasons, and they are worth checking in a strict order: authentication that does not align with your From domain, a list containing addresses that never asked to hear from you, or a complaint rate that has already crossed 0.3%. Content — subject lines, the word 'free', how many images you used — is the last thing to check and almost never the cause. Fixing authentication takes an afternoon; fixing a reputation takes weeks.

The short version

Check in this order: authentication, then list quality, then sending pattern, then content. Most advice online starts at the end.
Spam-word checkers are close to useless in 2026. Filters weigh sender reputation far above phrasing.
A spam folder placement and an outright rejection are different failures with different causes — find out which one you have first.
Reputation recovers slowly. Every day of continued bad sending extends the recovery.

First: is it spam placement or rejection?

These get conflated constantly and they point at different problems. If your message is delivered but filed in the spam folder, the receiving server accepted it and then made a judgement — that is a reputation or content decision. If it was rejected, the server refused it during the SMTP conversation and the recipient never had a chance to see it, which almost always means authentication or a complaint rate over the ceiling.

Your sending platform's delivery log distinguishes these. A 250 followed by a spam-folder report is the first case. A 550 in the log is the second. Establish which one you are looking at before you change anything, because the fixes have almost nothing in common.

Second: authentication, and specifically alignment

This is the cause in the majority of cases that reach support, and it is the cheapest to rule out. SPF, DKIM, and DMARC must all be present, and — the part that catches people — they must pass on a domain that matches the From address your recipient sees. Passing SPF for your provider's domain while your From header says your own domain is a DMARC failure, even though every individual check looks green.

Exactly one SPF record. Two records is a permanent error, not a merge, and adding a second is the most common way a working setup breaks.
DKIM signing active, with the selector resolving in public DNS — check what resolves, not what is in your notes.
A DMARC record on _dmarc.yourdomain.com, even at p=none. Its absence is now a rejection at several major providers.
The From domain matching the authenticated domain. This is alignment, and it is the requirement people miss.
No sending from a free mailbox domain. A From address at gmail.com sent through a platform fails DMARC against Gmail's own policy and will not be delivered.

Third: where the addresses came from

If authentication is clean, the next question is not about your email at all — it is about your list. Filters are largely a machine for measuring whether recipients wanted the mail, and the strongest predictor of that is how the address was acquired.

Source	Typical outcome
Explicit signup, recent, engaged	Delivers reliably
Explicit signup, two years untouched	Rising complaints and bounces — re-engage a small segment or drop it
Conference badge scans and business cards	Treated as unsolicited by recipients regardless of your legal position
Purchased or rented lists	Spam traps, hard bounces, and a reputation that takes months to repair
Scraped or guessed addresses	Immediate spam trap hits; the fastest way to lose a domain

Spam traps are addresses that never opt in to anything, so a hit is strong evidence the list was not consent-based. Recycled traps — abandoned real addresses reactivated as traps — are why mailing an old list is riskier than mailing no list.

Bounce rate is the fastest read on list quality. Under 2% is normal. Above 5% you are telling every receiving server that you do not know who your recipients are, and they will act accordingly. If a fresh import spikes your bounce rate, stop the campaign rather than letting it finish — the remaining messages are actively costing you reputation.

Fourth: your sending pattern

Volume that appears from nowhere looks like a compromised account, because that is usually what it is. A domain that has sent 200 messages a month for a year and suddenly sends 40,000 in an afternoon will be throttled or filtered on that basis alone, entirely independently of content or list quality.

Increase volume gradually on a new or long-idle domain rather than in one step.
Send at a consistent cadence. Irregular bursts read worse than steady volume.
Split transactional and marketing mail onto separate streams or subdomains, so a campaign cannot pull password resets down with it.
Send to your most engaged recipients first when starting a large campaign. Early positive signals shape how the rest is treated.

Last: content, which is rarely the problem

The folklore about trigger words is a decade out of date. Modern filters weigh sender reputation far above phrasing, and the word 'free' in a subject line from a well-authenticated sender with a clean complaint rate is not going to hurt you. Spam-word checkers mostly generate anxiety and busywork.

There are still content patterns worth avoiding, but they are structural rather than lexical: a message that is one large image with no text, link shorteners that hide the real destination, a mismatch between the From name and the domain, or links to a domain with its own poor reputation. These are signals that a message is trying to conceal something, which is a different thing from a keyword.

The diagnostic in order

1Establish the failure mode
Delivered-then-filtered, or refused? The delivery log tells you. Do not proceed until you know which.
2Read one message's Authentication-Results header
SPF, DKIM, and DMARC pass or fail, and against which domain. Fix alignment before looking at anything else.
3Check bounce and complaint rates for the last three sends
Bounces over 2% or complaints over 0.1% mean the list is the problem, whatever else is also true.
4Compare this send's volume to your normal
A large multiple of your usual volume is itself the explanation.
5Only now, look at the message
Image-only layouts, shortened links, and mismatched sender identity. Not the word 'free'.

Questions people actually ask

Why do my emails go to spam when I only send to people who signed up?: Almost always authentication rather than the list. If SPF or DKIM does not align with the domain in your From address, DMARC fails, and a DMARC failure is now enough on its own at the major providers. Check the Authentication-Results header of a delivered message before you change anything about your content or your list.
Do spam words in the subject line still matter?: Barely. Sender reputation, authentication, and engagement dominate modern filtering, and a well-authenticated sender with a clean complaint rate is not going to be filtered over the word 'free'. What still matters is structural: image-only messages, shortened links, and a From name that does not match the sending domain.
How long does it take to recover sender reputation?: Two to six weeks of demonstrably good sending, and longer if the damage came from a purchased list or a spam trap hit. Recovery is driven by evidence that recipients want the mail, so the way through is low volume to your most engaged recipients — not pausing entirely, and certainly not continuing to send broadly.
Should I use a dedicated IP to fix deliverability?: Usually not, and below roughly 100,000 messages a month it tends to make things worse. A dedicated IP needs consistent volume to build a reputation; an IP that sends irregularly stays unknown, and unknown is treated with more suspicion than a well-managed shared pool. Fix authentication and list quality first — that is where the problem almost always is.
Can I test where my email lands before sending a campaign?: Partly. Seed addresses at the major providers show you placement for those accounts, and a raw-header check confirms authentication, which is the part that generalises. What no test reproduces is per-recipient engagement history, so treat a seed test as a check for configuration mistakes rather than a prediction of inbox placement.

Rule out authentication in thirty seconds

Enter your domain and get its live SPF, DKIM, and DMARC status with the actual problem named — a second SPF record, an unaligned DKIM selector, a missing DMARC policy — rather than a pass or fail.

Check my domain