Everything "passes" and the mail still lands in spam. Why?

Three green ticks. SPF passes, DKIM passes, DMARC passes. Google Postmaster Tools shows a spam rate of 0%. You have done everything the checkers told you to do, and Gmail still drops your mail in Junk. You open a support escalation. It gets rejected with a canned reply about "sender reputation."

This is the most common deliverability complaint there is, and it feels like the tool is lying to you. It isn't. The checkers are telling the truth about a different question than the one you're actually asking.

Short answer: SPF, DKIM and DMARC only prove identity. Whether the mail reaches the inbox is a separate decision, made on sender reputation, recipient engagement and complaint rate. None of it shows up as a red tick on a checker, which is exactly why a domain can pass every check and still sit in Junk.

What do the green ticks actually prove?

Authentication answers one question: is this mail really from who it claims to be from?

SPF checks that the sending IP is on your published list. DKIM checks a signature against your public key. DMARC checks that one of those two lines up with the domain in the From header. Pass all three and you have proven identity. Nothing more.

Here is the part nobody puts on the results page: a spammer's mail can pass all three too. Any competent bulk sender authenticates cleanly, because authentication is table stakes now, not a mark of trust. Gmail treats it that way. Passing SPF, DKIM and DMARC gets you to the door. It does not decide whether you're allowed in.

Our take: authentication is necessary and not sufficient. Green ticks mean "we know who you are." Placement is a separate decision about whether the receiver wants your mail. That decision runs on signals the checkers never look at.

So what decides placement?

Reputation and behaviour. Neither shows up in a DNS lookup.

Domain and IP reputation. Every mailbox provider keeps a running score for your sending domain and the IP it came from. A brand-new domain has no history, which reads as suspicious, not neutral. A VPS IP you just rented may have been someone else's before it was yours. Postmaster Tools grades your domain and IP reputation as High, Medium, Low or Bad, and Google's own definition of Low is a sender whose mail "is likely to be marked as spam"2, with every auth check green.

Engagement. Gmail watches what recipients do. Opens, replies, and someone dragging your mail out of Junk all push you toward the inbox. Deletes without opening, and being marked as spam, push the other way. A list full of addresses that never engage will sink a perfectly authenticated sender, because to Gmail "nobody wants this" looks the same whether you're a spammer or just boring.

Content and list hygiene. Spam-trigger phrasing, a wall of images with almost no text, link shorteners, and a mismatched or missing unsubscribe all count against you. So do the addresses you keep mailing that bounce, and the spam traps hiding in a list you bought or scraped. Spam traps exist to catch exactly that kind of list.

Complaint rate. Gmail's sender guidelines ask you to keep the spam rate in Postmaster Tools "below 0.10% and avoid ever reaching a spam rate of 0.30% or higher"1. Your dashboard can read 0% on average and still have one bad campaign that spiked complaints, and that spike is what the filter remembers.

Postmaster says 0% spam though. Isn't that the answer?

Postmaster Tools reports a spam complaint rate, which is how often people who received your mail hit the "Report spam" button. It does not report how much of your mail Gmail filed in Junk before anyone saw it. That gap is the trap.

If your mail lands in Junk, nobody clicks "Report spam" on it, because it's already there. So a domain buried in the spam folder can show a beautiful 0% complaint rate while barely reaching a human. Google says so itself. Its Postmaster Tools troubleshooting has an entry headed "Spam rate is low but reputation is poor", and the first cause it gives is that "Gmail is automatically sending a significant number of your messages to spam, and few recipients are reporting them as not spam"3. The number you want is domain reputation, not spam rate. A 0% spam rate next to a Low or Bad reputation is the whole story right there.

How do I actually see what's happening?

Stop guessing from the sender side and read what the receiver saw.

Read a real header. When a test message lands in spam, open it and look at the raw headers. The Authentication-Results line shows you exactly how the receiving server graded SPF, DKIM and DMARC on that specific message, and any spam-score header (X-Spam-Status, or a provider's own SCL) tells you how close to the line you were. TamingDNS's email header analyser puts the Received chain back in delivery order and surfaces those verdicts in plain English, so you're reading the receiver's decision instead of your own hopes.

Read your DMARC aggregate reports. A DMARC record at p=none is still worth having for one reason: it makes receivers mail you aggregate XML reports on every source sending as your domain, and how each one authenticated at scale. That's where you find the forgotten SaaS platform sending unaligned mail under your name, quietly dragging your reputation down. Paste one into the DMARC report reader and it becomes a readable table instead of a wall of XML. If you're still at p=none, our companion piece on moving from p=none to p=reject is the next step.

Check the blocklists. Auth passing does not mean you're not listed. A domain or IP listing on a blocklist that receivers actually consult (Spamhaus is the one that moves mail) will route you to spam or reject you outright, with every green tick intact. Run your domain and your sending IP through the blacklist checker, and check Spamhaus itself at check.spamhaus.org, because our checker can't query it. Which lists genuinely gate delivery, and which are vanity noise, is a topic on its own.

Authentication proves who you are. Reputation decides whether anyone wants to hear from you. The checkers measure the first and stay silent on the second.

How long does warming up a new domain take?

One of our clients bought a brand-new domain, and we had SPF, DKIM and DMARC in place before the first message went out. Everything passed. For the first week, mail to some big companies still landed in spam, at receivers running Mimecast and Microsoft 365. Then it settled down7.

That first week is normal, and Spamhaus explains why: "for the first 30 days after initial registration, most spam protection companies will flag a newly registered domain (in any TLD)"4. The flag means closer scrutiny, not a block. A brand-new domain sending in bulk on day one looks exactly like what that scrutiny is watching for.

We had warned the client to expect a ramp-up, so nobody expected it to pass at once. They kept their volumes low, and when the first messages landed in spam, they asked the people they were writing to to mark them as not spam. It seems the reports to Microsoft 365 and Mimecast that it was a safe domain helped them out. We cannot see inside either filter, so treat that as our reading of it.

Spamhaus's advice has the same shape: warm the domain up "by regularly sending small amounts of emails to people who expect to be emailed"5. Google's advice for a sender that trips its rate limit points the same way: "Send email at a constant rate"6. Start with people who know you and will open the mail, keep the volume steady, and grow it only while nothing lands in Junk.

The same goes for a VPS IP. It may have been someone else's before it was yours, so check it against Spamhaus before you send a single message from it. If it is already listed, you are warming up from a hole.

So what do I actually do about it?

A practical order of operations when everything passes and mail still lands in spam:

• Pull your Postmaster Tools domain reputation, not the spam rate. If it's Low or Bad, that's your problem, and the rest of this list is how you climb out.
• Read the headers of a message that actually landed in Junk. Confirm the receiver graded auth the way you think it did, and see how close to the spam threshold you sat.
• Read your DMARC reports and hunt for sources sending as your domain that you didn't authorise or align. Fix or remove them.
• Check your domain and IP against Spamhaus. Delist if you're listed, and find out why you got listed before you do.
• Clean the list. Drop hard bounces and long-dormant addresses, and never mail a list you bought, because dead addresses and spam traps are exactly what tell a provider you are a careless sender.
• Warm up new domains and IPs slowly. Volume from a cold sender reads as a spam run.
• Watch the content. A real unsubscribe link, a sane text-to-image ratio and no link shorteners keep you out of the content-based filters.

None of that shows up as a red tick on a checker, because none of it is an authentication failure. It's the half of deliverability the green ticks were never measuring.

When it's Microsoft rather than Gmail junking you, the NDR codes come with it, and why Microsoft 365 blocks your mail covers that case. Sometimes you get a bounce instead of silent filing. Paste it into the bounce decoder to find out whether it's you or them, and read what a bounce code actually tells you if you want to stop guessing at them altogether. Tracing one message end to end is the email header analyser, which walks the whole Received chain; our forensics walkthrough goes through what the interesting lines look like.

Run a free check on your domain.

Sources checked

Each sourced claim above was checked against the page named here on 4 October 2026. Vendor pages change, so follow the link rather than trusting the date.

1. Gmail's spam-rate thresholds, verbatim: "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher." Read 4 October 2026. Source: Email sender guidelines (Gmail Help) ↩
2. Postmaster Tools reputation ratings Bad, Low, Medium and High; Low is "History of sending a significant volume of spam regularly. Email from this domain or address is likely to be marked as spam." Read 4 October 2026. Source: Postmaster Tools dashboards (Gmail Help) ↩
3. Troubleshooting entry "Spam rate is low but reputation is poor": "This dashboard shows the user-reported spam rate. Gmail is automatically sending a significant number of your messages to spam, and few recipients are reporting them as not spam". Read 4 October 2026. Source: Postmaster Tools dashboards (Gmail Help) ↩
4. "One thing many people do not know is that for the first 30 days after initial registration, most spam protection companies will flag a newly registered domain (in any TLD). The flag simply means the domain is under heightened scrutiny". Read 4 October 2026. Source: XYZ's best practice on new domains and email deliverability (Spamhaus) ↩
5. "The domain owner should be “warming up” the email domain by regularly sending small amounts of emails to people who expect to be emailed." Read 4 October 2026. Source: XYZ's best practice on new domains and email deliverability (Spamhaus) ↩
6. Under “Rate limit exceeded”: “Send email at a constant rate. This is less likely to cause this error than sending email at a varying rate.” Read 4 October 2026. Source: Postmaster Tools dashboards (Gmail Help) ↩
7. From the author's own client work, October 2026. The effect of the not-spam reports is our reading; we cannot observe the receivers' filters. No outside source. ↩