Email Deliverability: Why Your Messages End Up in Spam
By The Atlas Hoster team4 min read
What Makes an Email Delivered
Deliverability is the ability of your messages to land in the inbox rather than the spam folder. It does not depend on a single factor, but on a chain: the sender's identity, message authentication, the reputation of the sending IP address, and the content itself.
When your emails end up in spam, the cause is almost always one of these four links. The best approach is to review them in order, starting with authentication, as this is the most frequent and easiest-to-fix cause. Many companies notice spam folder issues because their domain simply lacks configured SPF, DKIM, and DMARC. Fixing these weak links is often enough to restore normal delivery.
SPF: Who Can Send on Your Behalf
SPF (Sender Policy Framework) is a DNS record that lists the servers authorized to send messages on behalf of your domain. When a server receives a message claiming to come from you, it checks this record: if the sending server is not listed, the check fails.
This is the first line of defense against spoofing. A domain without SPF, or with a misconfigured SPF, leaves the door open to spoofers and degrades its reputation. The specification is defined by RFC 7208. To configure yours, follow our SPF and DomainKeys guide.
DKIM: The Signature of Your Messages
DKIM adds a cryptographic signature to each message. The receiving server retrieves the public key published in your domain's DNS and verifies that the message has not been altered in transit. While SPF indicates "this server is authorized to send," DKIM ensures "this message indeed comes from this domain and has not been modified."
The two mechanisms complement each other: SPF controls the sender, while DKIM controls integrity. A properly managed domain deploys both mechanisms. A message may pass SPF but fail DKIM if its content has been modified in transit, and vice versa: this is why both checks are essential.
DMARC: Your Domain's Policy
DMARC provides the final instruction: it tells recipients what to do when a message fails SPF or DKIM checks. The policy can be lenient (do nothing), intermediate (quarantine), or strict (reject). DMARC also provides reports that inform you who is attempting to send emails using your domain name.
It is DMARC that turns SPF and DKIM into real protection: without it, a receiving server can ignore an authentication failure. The specification is described in RFC 7489. When properly configured, DMARC reduces domain spoofing and reassures receiving servers. You can start with a neutral policy (p=none) to analyze reports without risking blocking legitimate sends, then gradually tighten the rule towards quarantine or rejection once your flows are validated.
Blacklists and IP Reputation
Beyond authentication, the reputation of the sending IP address plays a decisive role. An IP address shared with a malicious sender, or already compromised by spam, ends up on blacklists (RBL/DNSBL). Your messages may then be rejected even if they are perfectly authenticated.
This is why choosing a host that actively monitors its IP addresses is essential. Atlas Hoster monitors its IP addresses on blacklists and continuously monitors deliverability, in addition to preconfiguring SPF, DKIM, and DMARC. In shared hosting, this monitoring is crucial since the sending IP address is shared among multiple users.
Content and Sending Practices
Content also matters. A message overloaded with links, written in uppercase, or consisting solely of images without text frequently triggers spam filters. Unsolicited bulk sends degrade reputation very quickly: a campaign sent to purchased contact lists can permanently degrade your domain's evaluation. Prioritize sending to recipients who have consented to receive your communications, and adjust your sending volume.
Another often overlooked point: flow separation. If your domain sends both newsletters and transactional notifications, ensure that each flow is clearly identified and authenticated. A bulk rejection on a promotional campaign should not penalize your critical transactional messages.
Monitoring Deliverability Over Time
Deliverability is not permanently guaranteed: it requires regular monitoring. Periodically check the validity of your DNS records, ensure your domain does not appear on any blacklists, and observe your delivery rates. As soon as an anomaly is detected, correct the cause immediately to avoid degrading your sender score.
Regular checks are advised: inspect your SPF, DKIM, and DMARC records, verify public blacklists, and send test emails to various mail providers (Gmail, Microsoft 365, etc.). To intervene in your DNS configurations, consult our guide on modifying the MX configuration as well as our tips on reducing received spam.
To deepen your knowledge of email best practices, consult our guide on professional email and our comparison of email solutions. The overall credibility of your domain also depends on your site's security: deploying the HTTPS protocol helps establish this trust.
For messages that consistently reach their destination, discover our professional emails with SPF, DKIM, and DMARC configured and monitored.
FAQ
Where should I start when my emails go to spam? Check your SPF, DKIM, and then DMARC records in order. The absence or misconfiguration of these protocols is the most common cause of landing in the spam box.
Can a domain without SPF be spoofed? Yes. Without an SPF record, any server can send messages on behalf of your domain without being immediately rejected by receiving servers.
Does IP reputation depend on me? Partially. On a shared server, the sending IP is shared with other senders. The host's role is then to monitor blocklists and immediately stop abuse to preserve the reputation of all users.