Why does your email land in spam? A deliverability checklist

Mail that quietly lands in spam is almost never bad luck: it is a configuration problem, a reputation problem, or both. This checklist is written for anyone running a mail server or sending application mail from their own server, and it is ordered on purpose: the early items block everything that comes after them. Fix them top to bottom and measure after each step.

1. PTR record and HELO must match

Before a receiving server looks at a single header, it checks who is connecting. Three things must agree: the reverse DNS (PTR) of your IP, the hostname your server announces in HELO/EHLO, and the forward DNS of that hostname. If any of the three disagree, large providers will defer or drop your mail regardless of how good the rest of your setup is.

dig -x 203.0.113.25 +short        # PTR of your sending IP
dig mail.example.com +short       # must return 203.0.113.25

The PTR must be a real hostname such as mail.example.com, not a generic one like static-203-0-113-25.provider.net. Set your MTA to announce the same name: in Postfix that is myhostname in main.cf. On infrastructure where you control reverse DNS you can fix this in minutes; on shared IPs you usually cannot, which is one honest argument for a dedicated IP.

2. SPF, DKIM and DMARC: present and aligned

SPF lists the IPs allowed to send for your domain, DKIM signs the message, and DMARC ties both to the visible From address. The key word is aligned: an SPF pass for a return-path domain that differs from the From domain does nothing for DMARC. Check all three records:

dig TXT example.com +short
dig TXT default._domainkey.example.com +short
dig TXT _dmarc.example.com +short

• Keep SPF under 10 DNS lookups and end it with ~all or -all, never +all.
• Use a 2048-bit DKIM key and rotate it yearly.
• Start DMARC with p=none; rua=mailto:dmarc@example.com, read the reports for two weeks, then move to p=quarantine.

Verification is simple: send a message to a Gmail account, open Show original, and confirm you see spf=pass, dkim=pass and dmarc=pass on the same domain.

3. Check IP and domain reputation

Filters score the sending IP and the domains inside the message separately, so check both. For the IP, query the major DNS blacklists. Spamhaus ZEN is the list that actually blocks mail at large providers:

dig +short 25.113.0.203.zen.spamhaus.org   # octets reversed
# any 127.0.0.x answer means listed; no answer means clean

Note that Spamhaus refuses queries coming through big public resolvers such as 8.8.8.8, so run the query through your own resolver or use the lookup form on spamhaus.org. For a wider sweep, multirbl.valli.org and the MXToolbox blacklist check cover well over 100 lists, though only a handful of them matter. For domain reputation, register the domain in Google Postmaster Tools: it shows how Gmail actually scores you, and Gmail is usually half of your recipients.

4. Warm up new IPs

A fresh IP has no sending history, and to a large mailbox provider no history is mildly suspicious by itself. Do not migrate a 50000-recipient list to a new server and press send. Ramp up instead: a few dozen messages a day in the first week to your most engaged recipients, then roughly double the volume each week while watching the mail log for deferrals with 421 and 450 codes.

This is the honest part of the checklist: configuration takes about an hour, reputation takes weeks. Expect 2 to 6 weeks before a new IP delivers reliably at volume, and nothing you can buy or configure shortcuts that.

5. Content triggers: what matters and what is a myth

Filter folklore is full of advice from 2005. Modern filters are statistical models fed by user behaviour, so single trigger words hardly matter. What actually hurts:

• Links to domains with a bad reputation, including public URL shorteners.
• Link text that shows one domain while the href points to another.
• HTML-only messages with no plain-text part, or one large image with no text.
• Attachment types associated with malware, such as .zip archives with executables inside.

What is mostly myth: the word free, coloured text, one loud subject line. A single spammy phrase will not sink a sender with good reputation, and a perfectly clean text will not save one with bad reputation. Engagement dominates: opens and replies help you, deletions without reading and spam complaints hurt you.

6. List hygiene and bounces

• Remove hard bounces (5xx) immediately and automatically. Repeatedly hitting dead mailboxes is a classic spammer signature.
• Never buy or scrape lists. Old lists contain spam traps, addresses that exist only to catch senders who never got consent.
• Use confirmed opt-in for anything bulk and honour unsubscribes instantly.
• Keep the complaint rate below 0.1 percent. Gmail and Yahoo enforce 0.3 percent as a hard limit for bulk senders and also require a working one-click unsubscribe header (RFC 8058).

7. When a relay is the better answer

Running your own outbound mail makes sense when you control reverse DNS, send steadily, and can invest the warm-up weeks. It stops making sense when you send a handful of transactional messages a month, when your provider blocks port 25, or when the IP range you were given has a bad history you cannot fix. In those cases route outbound mail through an established relay (smarthost) and let its reputation carry your messages, while you keep SPF, DKIM and DMARC on your own domain.

If you want full control, a VPS with your own IP and custom PTR records gives you everything this checklist needs, on IP ranges we keep clean in our own network. If you would rather not think about MTAs at all, mail on our managed web hosting already ships with the DNS records and outbound reputation handled. Either way, the order above is the fastest route out of the spam folder: an hour of configuration, then weeks of consistent sending.