Your SPF, DKIM, and DMARC records are all green. You checked them twice. And your emails are still landing in the Gmail Promotions tab at best, or the spam folder at worst. If that's where you're stuck, the DNS records were only step one — deliverability is a moving target that depends on your sending reputation, your content, and a handful of things almost nobody checks until mail starts disappearing. Here's the checklist we walk customers through after the DNS piece is already sorted.
Symptom: Authenticated Mail Still Gets Flagged
This is different from the classic "mail bounces with an SPF error" problem. You're past that. What you're seeing instead:
- Mail passes SPF, DKIM, and DMARC (check the headers — it really does), but still lands in Junk.
- Delivery was fine for months, then suddenly your open rates cratered with no code changes.
- Gmail delivers fine but Outlook/Hotmail spam-folders everything, or vice versa.
- A mail-tester.com or similar score comes back below 7/10 even though "everything looks configured."
When authentication passes but delivery still fails, the problem has moved from "can this mail be verified" to "does this mail look trustworthy" — and that's a reputation and content problem, not a DNS problem.
Cause: Reputation, Not Records
Mailbox providers score every message using signals that have nothing to do with SPF/DKIM/DMARC. The most common culprits we see on shared and VPS hosting:
- IP or domain reputation is damaged. A previous tenant on a shared IP sent spam, or your own server got compromised and mailed out through a leaked SMTP password.
- No reverse DNS (PTR) record, or the PTR doesn't match the hostname your server introduces itself with in the SMTP handshake (HELO/EHLO).
- Sudden volume spikes — a new domain or IP that goes from 5 emails a day to 5,000 overnight looks exactly like a spam run to receiving servers, regardless of authentication.
- Content triggers — all-caps subject lines, a huge image-to-text ratio, URL shorteners, or a mismatch between the "From" display name and the actual sending domain.
- Poor list hygiene — high bounce rates or spam complaints from an old, unverified mailing list drag the whole domain's reputation down.
- Missing or broken List-Unsubscribe header on bulk mail, which Gmail and Yahoo have required since their 2024 bulk-sender rules.
Fix: Work Through the Checklist in Order
1. Confirm Authentication Actually Passes (Don't Assume)
Send a test email to check-auth@verifier.port25.com or use mail-tester.com, then read the report line by line — not just the final score. A common trap: DKIM passes for your main domain but fails for a subdomain or a transactional-mail service (like a WordPress plugin sending through a different "From" address) that isn't covered by your SPF include or DKIM selector.
2. Check Reverse DNS (PTR)
Run this from any Linux box:
dig -x YOUR.SERVER.IP.ADDRESS +shortIt should return your mail server's hostname, e.g. mail.yourdomain.com. — and that hostname should match what your mail server sends in its HELO/EHLO greeting. On shared cPanel hosting, PTR records are managed by SkyServer at the network level — open a ticket with your server's IP and desired hostname if it's missing or wrong. On a VPS, you'll usually set it in your provider's network panel, not in your domain's zone file, since PTR lives on the IP's reverse-lookup zone.
3. Check Blacklists
Run your sending IP through MXToolbox's blacklist checker. A listing on a major list (Spamhaus, SORBS, Barracuda) will tank delivery regardless of how clean your DNS is. Most listings come with a stated reason and a delisting request form — follow that process rather than just waiting it out, since some lists don't auto-expire.
4. Warm Up New IPs and Domains Gradually
If you just moved to a new server or started a new sending domain, don't blast your full list on day one. Start with your most engaged recipients — customers who open and reply regularly — and ramp volume up over 1-2 weeks. Receiving servers build trust in a sender's pattern over time; a brand-new IP sending thousands of messages immediately reads as a spam campaign even with perfect SPF/DKIM/DMARC.
5. Clean the List Before You Send
Remove hard bounces after the first attempt — don't retry them. Strip addresses that haven't opened anything in 6+ months, or move them to a separate low-frequency list. A 2% bounce rate or a spam-complaint rate above roughly 0.1% is enough to get flagged by Gmail's Postmaster Tools thresholds.
6. Fix the Content, Not Just the Headers
A few concrete things to check in the message itself:
| Trigger | Why it hurts | Fix |
|---|---|---|
| From name ≠ sending domain | Looks like spoofing even when authenticated | Keep display name and domain visually consistent |
| Image-only email, little text | Filters can't verify content, common spam pattern | Keep a healthy text-to-image ratio |
| Shortened links (bit.ly etc.) | Shorteners are heavily abused by spammers | Use your own domain for links where possible |
| No unsubscribe link on bulk mail | Violates Gmail/Yahoo bulk-sender rules | Add a visible unsubscribe link and List-Unsubscribe header |
7. Register with Postmaster Tools
If you send meaningful volume to Gmail addresses, add your domain to Google Postmaster Tools. It shows your actual spam-complaint rate, IP/domain reputation, and authentication success rate straight from Gmail's side — far more useful than guessing from your own logs.
Prevention
- Keep transactional mail (password resets, order confirmations) on a separate subdomain from marketing/bulk mail, so a bad newsletter send doesn't hurt your login emails.
- Monitor your domain's DMARC aggregate reports — they'll show you unauthorized senders using your domain before it becomes a reputation problem.
- Re-run a mail-tester or Postmaster Tools check after any change to your mail setup, migration, or a big jump in sending volume.
- If you're on shared hosting and share an IP with other accounts, ask SkyServer support whether a dedicated sending IP makes sense for your volume — shared reputation cuts both ways.
Frequently Asked Questions
My SPF, DKIM, and DMARC all pass. Why is Outlook still spam-foldering me?
Microsoft's filters weigh sender reputation and engagement history more heavily than Gmail's. If your domain or IP is new, or if Outlook recipients haven't been opening your mail, expect a slower reputation build even with perfect authentication. Ask a few recipients to mark your address as "Not Junk" and move you to Safe Senders — that's a real signal Microsoft's filters use.
How long does it take to recover from a blacklist listing?
It varies by list. Some (like Spamhaus) delist within hours of a valid removal request once the underlying issue is fixed; others review manually and can take days. Fix the root cause first — a compromised script, an open relay, an old exposed SMTP password — before requesting removal, or you'll just get relisted.
Does using a dedicated IP guarantee better deliverability than shared hosting?
Not automatically. A dedicated IP has no reputation at all on day one, which means you're starting from zero and need to warm it up carefully. A shared IP with a good, established reputation can outperform a fresh dedicated IP in the short term — dedicated only wins long-term for high-volume senders who can maintain consistent sending patterns.
Can a single spam complaint really hurt deliverability?
One complaint won't blacklist you, but complaint rate is tracked as a percentage of total sends, and mailbox providers use fairly low thresholds — Gmail flags anything trending above roughly 0.1%. On low sending volumes, a handful of complaints can push that percentage up fast, so list hygiene matters more the smaller your list is.
Do I need to redo my SPF/DKIM/DMARC setup for this checklist to work?
No — this checklist assumes those records are already correct. If you haven't set them up yet, do that first; it's the foundation everything else here builds on.
