Skip to Main Content
Browse the Learning Center

Email deliverability

Email deliverability is whether your message reaches the recipient's inbox, not just whether the receiving server accepted it.

Updated September 3, 2026


Start here

Start with the failure you have.

Run the deliverability test →

The six most common ways mail fails, each with the exact fix.

  1. Why is Microsoft 365 rejecting my email with a 550 5.7.x error?Microsoft 365 returns 550 5.7.x when your mail fails a policy or authentication check. Fix SPF, DKIM, and DMARC alignment to clear the access-denied bounce.
  2. What does SMTP error 421 mean and how do I fix it?SMTP error 421 is a temporary deferral, not a bounce. Fix it by slowing your send rate and authenticating mail with SPF, DKIM, and DMARC before retrying.
  3. Why do my emails land in Gmail's Promotions tab?Why emails land in Gmail's Promotions tab: classify the delivered message, test one sender-controlled change, and validate the same sending path.
  4. Why is Gmail rejecting my emails with a 550 error?Gmail 550 5.7.26 rejections mean your mail fails authentication. See why Google now rejects instead of defers, and the exact fixes to get delivered.
  5. Why is Yahoo blocking my emails as unauthenticated?Yahoo blocks unauthenticated mail because SPF, DKIM, or DMARC failed. Fix the 550 5.7.9 'sender is unauthenticated' bounce by authenticating and aligning.
  6. Why is my email queued and how do I fix it?Why is my email queued? Find the queue location, capture the SMTP response, repair the documented condition, and validate the same delivery path.

What decides inbox placement

FactorWhat it isWhat it looks like when it breaks
AuthenticationSPF, DKIM and DMARC prove the mail is really from your domain, and that the passing domain aligns with the visible From address.Hard rejections: 550 5.7.26 from Gmail, 550 5.7.515 from Outlook.com.
ReputationHow mailbox providers rate your sending domain and IP based on history: complaint rates, spamtrap hits, bounce rates, blocklist presence.4xx deferrals and spam placement even when DNS is perfect.
EngagementWhether recipients open, reply and want the mail, and what the message itself looks like to a filter.The Promotions tab, then the spam folder, as engagement decays.

Authentication proves who sent the message. Publish SPF, sign with DKIM, and set a DMARC policy so the passing domain aligns with your visible From address. Gmail and Yahoo have required this of bulk senders since February 2024. Microsoft added the same requirement for Outlook.com: its postmaster page says non-compliant mail goes to Junk with rejection to follow, and its April 2025 announcement said rejection with 550 5.7.515 would apply from 5 May 2025.

Reputation is how mailbox providers rate your sending IP and domain based on history: complaint rates, spamtrap hits, bounce rates, and whether your IP has landed on a blocklist. A damaged reputation shows up as 4xx deferrals and spam placement even when your DNS is perfect, and it recovers slowly. Providers want to see weeks of a low complaint rate before restoring full placement.

Engagement decides the last mile: which tab you land in and whether you stay out of spam over time. Authentication is necessary but not sufficient: it establishes that you are who you claim to be, and reputation and engagement decide whether that trusted sender reaches the inbox.

When the problem is ongoing rather than a one-off test, the Palisade Email Deliverability Platform connects those signals to real DMARC report traffic, names the sending service behind an authentication failure, and opens the remediation work with the evidence attached.

Delivery vs deliverability

Email delivery and email deliverability get used interchangeably and mean different things. A server accepting a message only means it was not rejected outright; the message can still be filed as spam, quarantined, or dropped into a tab nobody reads. You can have perfect delivery and poor deliverability at the same time, every message accepted, every message in spam. Deliverability is the outcome that matters: the mail lands where it can be seen and acted on.

What it measuresWhat 100% looks like
DeliveryThe receiving server accepted the message instead of bouncing it.No bounces, but the mail may all be sitting in spam.
DeliverabilityThe message reached the inbox specifically, not the spam folder.The mail is where the recipient will actually see it.

The bulk sender requirements

Gmail, Yahoo and Outlook.com apply a shared baseline to anyone sending at volume. Non-compliant bulk mail is rejected rather than quietly filtered, so these are gating requirements, not best-effort suggestions.

RequirementThresholdEnforced by
SPF and DKIM published, with one aligned so DMARC passesRequired; p=none is an acceptable startGmail and Yahoo since February 2024; Outlook.com since May 2025
Spam complaint rateBelow 0.3%, with 0.10% the recommended targetGoogle Postmaster Tools
One-click unsubscribe on marketing mail (RFC 8058)Honoured within two days; transactional mail exemptGmail and Yahoo
Valid forward and reverse DNS, plus TLS on the connectionRequiredAll three providers
Volume that triggers the strict thresholdsAbout 5,000 messages a day to one provider's usersGmail and Outlook.com; Yahoo declines to publish a number

What a good deliverability rate looks like

A good email deliverability rate is not a published number. Mailbox providers publish exactly one rate threshold, the spam-complaint rate, and keep placement decisions private, so the honest benchmarks are the instruments you can read directly.

MetricHealthy looks likeWhere to read it
Spam complaint rateBelow 0.10%; Google starts mitigation at 0.3%, so the recommended number is the operating ceilingGoogle Postmaster Tools
Hard bounce rateNo mailbox provider publishes a threshold. Rising is the signal; hard bounces get removed immediatelyYour sending platform's delivery report
DMARC pass rate100% of legitimate mail once every sender is aligned; anything less names a sender to fixDMARC aggregate reports
Inbox placementNo mailbox provider publishes a target, and placement is per-receiver. Measured only against real delivered messagesA deliverability test of an actual message

How to improve email deliverability

Improving deliverability means fixing three things in order: authentication first, then reputation, then engagement. Skipping to content changes while authentication is broken is the most common wasted effort. The full 12-step version, with the mechanism behind each step, is in the how to improve email deliverability guide.

  1. Authenticate every sending servicePublish SPF, sign with DKIM, and set a DMARC policy. Every tool that sends as your domain, CRM, invoicing, help desk, needs to be covered, not just your mail server.
  2. Align the passing domain with your From addressDMARC only passes when SPF or DKIM authenticates the same domain the recipient sees. A passing SPF check on a vendor's domain does not help you.
  3. Move off p=noneStart at p=none with an aggregate-report address so you can see every source sending as your domain, then tighten to quarantine and reject once the reports confirm your legitimate mail passes.
  4. Keep the complaint rate under 0.10%Send only to people who opted in, and make unsubscribing easy. 0.3% is where mitigation starts, not a safe operating level.
  5. Clean the listRemove hard bounces immediately and drop addresses that have not engaged in months. Spamtraps and invalid addresses do more damage than a smaller list does.
  6. Warm any new domain or IP graduallyA cold sender with no history has no reputation to draw on. Increase volume steadily and keep the pattern consistent rather than spiking.
  7. Check the sending IP against the major blocklistsA listing explains sudden 5xx rejections that authentication changes will not fix. Delist through the operator's own process.
  8. Monitor DMARC reports continuouslyA broken sender should show up in a report, not in lost mail. Aggregate reports are how you find the shadow sender before a customer does.

Fix delivery to a specific provider

Why are my emails being blocked?

Emails get blocked for four main reasons: your domain fails SPF, DKIM, or DMARC checks, your spam complaint rate crossed the provider's threshold, your IP or domain sits on a blocklist, or you broke a bulk-sender rule. Read the bounce to identify the provider, fix authentication first, then check blocklists and complaint data.

Why is Outlook blocking my emails?

Outlook blocks outbound mail for three reasons: your domain fails SPF, DKIM, or DMARC checks; your sending IP or domain has a poor reputation with Microsoft's SmartScreen filter; or your IP sits on a Microsoft block list. Fix authentication first, then check SNDS and request delisting; most blocks trace back to those three.

How to stop emails going to spam in Outlook

To stop emails going to spam in Outlook, fix the four things Microsoft's filter actually scores: authentication that passes but doesn't align with your From domain, a rising junk-complaint rate, weak list hygiene and content signals, and a cold IP or domain with no sending history. Align SPF and DKIM first; that is the post-May-2025 junk trigger.

Why do emails go to junk in Hotmail and Outlook?

Emails go to junk in Hotmail and Outlook.com when Microsoft's SmartScreen filter distrusts the sender: missing or misaligned SPF, DKIM, or DMARC, a high junk-complaint rate, a new IP with no history, or a stale mailing list. Since May 2025, Microsoft's high-volume sender requirements make failing authentication a documented enforcement trigger: Junk placement first, then rejection. Fix authentication first; reputation follows.

Why does Outlook move emails to junk after they arrive?

Outlook moves delivered mail to Junk after arrival for four main reasons: Microsoft's zero-hour auto purge (ZAP) re-scans the last 48 hours of delivered mail against updated spam and phishing signatures; the recipient marked you as junk, so every future message is classified as spam; the Outlook desktop client's own junk filter re-files it; or a recipient rule moves it. Authentication and complaint rate decide the first two.

Why is Microsoft 365 blocking outbound emails?

Microsoft 365 blocks outbound mail for three reasons: a user or connector exceeded outbound sending limits and landed on the Restricted entities page; Exchange Online classified the mail as spam and routed it through the high-risk delivery pool; or the tenant hit Exchange Online's service limits. Recipient-side rejections trace to missing SPF, DKIM, or DMARC.

Why is Microsoft blocking my automated emails?

Microsoft blocks automated mail (scanners, CRMs, monitoring alerts) for three reasons: the app or device fails SPF and DKIM alignment for your domain; it uses a submission method the tenant no longer accepts, like Direct Send or Basic-auth SMTP; or it trips Exchange Online throttling. The Office 365 mail filter treats unauthenticated app mail as anonymous internet traffic.

Why are my emails going to spam in Gmail?

Gmail spam-folders outbound mail for four main reasons: SPF, DKIM, or DMARC is missing or unaligned under Google's Email sender guidelines; your user-reported spam rate crossed 0.3%; your domain reputation in Google Postmaster Tools is Low or Bad; or you send bulk mail without one-click unsubscribe. Fix authentication first; everything else builds on it.

Why does Gmail mark new domain emails as spam?

Gmail spam-folders mail from a new domain because the domain has no sending history, so authentication and behavior are the only signals Google can score. Missing SPF, DKIM, or DMARC, a cold start at full volume, and a bare domain with no web presence all read as spam. Authenticate everything first, then warm up gradually.

Your email has been blocked because the sender is unauthenticated: the Gmail fix

Gmail returns "blocked because the sender is unauthenticated" when a message passes neither SPF nor DKIM for your domain. Under Google's February 2024 sender requirements, unauthenticated mail is spam-foldered or, as here, refused outright. The fix is DNS: publish SPF and DKIM for every service that sends as your domain, confirm both pass and align, then re-send.

Why is Yahoo blocking my emails?

Yahoo blocks outbound mail for three main reasons: your domain fails SPF, DKIM, or DMARC under the sender requirements Yahoo has enforced since February 2024; your spam complaint rate is above Yahoo's published 0.3% ceiling; or your IP has a poor reputation or sits on a blocklist Yahoo consults. AOL runs on the same filters, so one fix clears both.

Why is iCloud blocking my emails?

iCloud Mail blocks outbound mail for three main reasons: your sending IP is flagged by Proofpoint's reputation system (a linkage neither vendor documents, but one deliverability teams widely report in iCloud bounces), your domain fails SPF, DKIM, or DMARC, or your stream breaks one of Apple's published bulk-sender rules. Fix authentication first, check the IP at Proofpoint's lookup, then escalate to Apple's postmaster address.

Why does Gmail show 'this message seems dangerous'?

Gmail shows "this message seems dangerous" when its filters score your message as a phishing risk. Google does not publish the exact trigger, but the documented causes are mail failing SPF and DKIM, a lookalike From name or domain, and links or attachments its scanners distrust. The recipient's admin decides whether it stays in the inbox or goes to Spam.

Why are Google Workspace emails going to spam?

Google Workspace does not authenticate your domain for you. Mail lands in spam when DKIM was never switched on in the Admin console, when your SPF record misses a service that sends as your domain, or when no DMARC record exists. Google also requires a spam rate below 0.3% in Postmaster Tools.

What does the X-Microsoft-Antispam message-info header mean?

X-Microsoft-Antispam-Message-Info is an encoded diagnostic value Microsoft 365 stamps on mail, and Microsoft publishes no decoder for it. It cannot tell you why your message was junked. The published verdict lives in X-Forefront-Antispam-Report (CAT, SFV, SCL, DIR) and in the compauth result inside Authentication-Results.

What is the spam confidence level (SCL) in Microsoft 365?

The spam confidence level (SCL) is a value Microsoft stamps in the X-Forefront-Antispam-Report header, either -1 or a number from 0 to 9, where Microsoft says "an SCL value of 5 or higher generally indicates the message is considered bad". In cloud organizations it no longer decides the verdict or the action. Read CAT instead.

Why is Comcast blocking my emails?

Comcast rejects mail during the SMTP transaction and returns a coded error such as BL000000 or ES000010. The usual causes are a listing on a blocklist Comcast consults, a missing or failing PTR record, mail sent from dynamic or residential IP space, or rate limiting that Comcast applies harder to unauthenticated senders.

Why is AOL blocking my emails?

AOL is not a separate mail filter. AOL mailboxes are handled by Yahoo, postmaster.aol.com redirects to Yahoo's Sender Hub, and Yahoo's sender requirements decide whether your mail is accepted. So an AOL block means the same three things a Yahoo block means: failed SPF, DKIM, or DMARC, a spam complaint rate over 0.3%, or a poor sending reputation.

Why is GMX blocking my emails?

GMX rejects mail that misses one of its published requirements, and it names the reason in the last line of a multi-line SMTP error. The two most common are a missing or unaligned DKIM signature, which GMX makes mandatory, and a sending IP that is block listed. GMX uses no enhanced status codes.

Why is GoDaddy email blocked?

GoDaddy email is usually blocked on the sending side, not the receiving one. GoDaddy resells Microsoft 365, so a mailbox that exceeds Microsoft's outbound limits is restricted and bounces with 550 5.1.8 Access denied, bad outbound sender. A compromised account, a missing or duplicated SPF record, and unsigned DKIM are the next causes.

Why is Proofpoint blocking my emails?

Proofpoint refuses mail at two separate layers, and the bounce tells you which one. Proofpoint Dynamic Reputation rejects your sending IP at the connection with 550 5.7.1 Email rejected because 1.2.3.4 is listed by Proofpoint.com. Everything else is the recipient organization's own gateway policy, decided after the message was accepted.

Why is Mimecast blocking my emails?

Mimecast blocks mail at the recipient's gateway, not at yours, so the rejection is the receiving organization's policy rather than a verdict on your mailbox. The usual causes are their Anti-Spoofing policy, a Blocked Senders policy, an SPF hard fail their DNS Authentication policy rejects, and poor sending IP reputation. Mimecast's bounce text names the policy.

Why is Barracuda blocking my emails?

Barracuda is a filtering gateway in front of your recipient's mail server, not a mailbox provider, so a block comes from one of two places: your sending IP is listed on Barracuda's reputation systems, or the recipient's own gateway policy rejected you on sender authentication, a local block list, or rate control. Only the first has a public removal form.

Why is Trend Micro blocking my emails?

Trend Micro blocks in two places, and they need different fixes. Email Reputation Services can terminate the connection because your sending IP is listed, before the message is ever sent, and Trend Micro runs a public lookup and removal form for that. Everything after the connection is the recipient's own console: blocked sender lists and DMARC actions.

Why are SendGrid emails going to spam?

SendGrid files mail as spam most often because domain authentication was never completed, so the message is DKIM-signed by sendgrid.net and Gmail shows a via sendgrid.net line instead of your domain. Nothing bounces: SendGrid records spam placement as delivered. Shared-IP reputation, an unwarmed dedicated IP, and a missing DMARC record follow.

Why are HubSpot emails going to spam?

HubSpot marketing email is filed as spam when your email sending domain is not connected. HubSpot then rewrites the sending address onto a HubSpot-managed domain, so receiving filters judge that domain instead of yours. Partial authentication, a broken SPF record, shared IP reputation, and list quality are the next causes.

Why are Klaviyo emails going to spam?

Klaviyo mail is filed as spam for two different reasons, and they need different repairs. Either the account is still on Klaviyo's shared sending domain, so recipients see via klaviyomail.com and none of your domain's reputation applies, or engagement has fallen far enough that the receiving provider files you on reputation.

Why are Constant Contact emails going to spam?

Constant Contact mail is filed as spam mostly because the account is not self-authenticated. Until you publish its DKIM and DMARC records, Constant Contact rewrites your From address onto its shared ccsend.com domain, so you inherit a pooled reputation instead of building your own. A free From address, unverified records, and weak engagement follow.

Why are ActiveCampaign emails going to spam?

ActiveCampaign mail is filed as spam because the sending domain was never set up. Until you do that, ActiveCampaign says DKIM signs with a domain it owns, the Return Path is its own, and neither aligns with your From address, so recipients see a via line and filters cannot tie the message to you. Shared-domain reputation and complaint rate follow.

Why are Mailgun emails going to spam?

Mailgun files mail as spam most often because the sending domain was never verified in Mailgun itself. An unverified domain is capped at 300 messages a day and recipients see a sent via Mailgun.org line, because Mailgun signs with its own domain rather than yours. Missing DMARC, shared-IP reputation, and list quality follow.

Why are Amazon SES emails going to spam?

Amazon SES mail is filed as spam when nothing in the message aligns with your own domain. Until you enable Easy DKIM, SES does not sign with your domain, and its default MAIL FROM domain is a subdomain of amazonses.com, so DMARC cannot pass on SPF either. Reputation limits follow.

Why are Brevo emails going to spam?

Brevo mail is filed as spam most often because the sending domain was never authenticated in Brevo, so no DKIM record and no DMARC record exist for it. Brevo's own warning is blunt: without DMARC, mail to Microsoft consumer addresses "will be marked as spam or rejected". Shared-pool reputation and complaint rate come next.

Why are Salesforce Marketing Cloud emails going to spam?

Salesforce Marketing Cloud mail is usually filed as spam because the sending address is not actually authenticated. Salesforce states that adding an address or registering a domain in From Address Management "will not authenticate those addresses"; only a Sender Authentication Package or a Private Domain does. Unaligned SPF, an under-volume dedicated IP, and complaint rate follow.

Why are transactional emails going to spam?

Transactional email is filed as spam for two specific reasons: the app, billing system, or help desk that sends it was never added to your SPF and DKIM records, and it shares a From domain with marketing, so it inherits a complaint rate it did not cause. Providers measure both per domain, and only the unsubscribe rule exempts transactional mail.

Questions, answered straight

What is a good email bounce rate?

Under 1% is healthy, 2% needs investigating, 5%+ is an emergency. The bounce-rate benchmarks ESPs actually publish, plus the triage table to fix yours.

Why are my Mailchimp emails going to spam?

Mailchimp campaigns landing in spam? The four real causes: unauthenticated sending domain, shared IP reputation, list decay, engagement. And the DNS fix.

How to authenticate email for marketing

The platform-agnostic setup order: sending subdomain, SPF include, custom DKIM, DMARC with rua, alignment check, policy ramp. With live ESP doc links.

What is SPF flattening?

SPF flattening swaps include: mechanisms for raw IPs to beat the 10-lookup limit. When it helps, when it silently breaks, and the alternatives that age better.

Why are my newsletters going to spam?

Four causes: failed SPF/DKIM/DMARC, no one-click unsubscribe, complaints over 0.3%, dead engagement. What Gmail and Yahoo actually require, plus the fix.

What is Google Postmaster Tools?

Google Postmaster Tools explained: the v2 dashboards, DNS TXT setup, the 0.3% spam-rate line, and how to read it before moving DMARC to p=reject.

What is Microsoft SNDS?

SNDS is Microsoft's free per-IP reputation portal for Outlook.com senders. What it shows, how to sign up, its limits, and how it pairs with DMARC reports.

What are DMARC aggregate reports?

Daily XML files sent to your rua address: every source IP, message counts, disposition, SPF/DKIM results. What's inside one and how to read it.

Why is DMARC failing but SPF passes?

SPF checks the Return-Path domain; DMARC needs it to match your From domain. Why ESP bounce domains, forwarding, and strict aspf break alignment.

How do I move from DMARC p=none to p=reject?

The RFC 9989 playbook from p=none to p=reject: monitor with rua, fix alignment, test full quarantine on lower-volume subdomains, then enforce.

Does DMARC affect email marketing?

Yes. Google and Microsoft require DMARC for bulk senders, misalignment sends campaigns to spam, and enforcement unlocks your BIMI logo in the inbox.

Why did my email get clipped in Gmail?

Gmail clips HTML over ~102KB behind a View entire message link. What counts toward the limit, why it hurts opens and unsubscribes, and how to slim the template.

The other 88 deliverability guides

Look up an exact answer

Diagnose your domain

Send a message to the Email Spam Checker to see what the receiving server recorded and why it may be filtered. For the DNS side, run a free Email Security Score or check a sending IP against the major blocklists.

Sources

  • Google's sender guidelines require keeping the spam rate reported in Postmaster Tools below 0.3%, and recommend staying below 0.10%. Google: Email sender guidelines, checked 2026-07-20.
  • Yahoo publishes the same baseline for bulk senders: authentication, a low complaint rate, and one-click unsubscribe. Yahoo Sender Best Practices, checked 2026-07-20.
  • One-click unsubscribe on marketing mail is specified by RFC 8058. The two-day window for honouring it is Google's and Yahoo's requirement, not the RFC's. RFC 8058, checked 2026-07-20.
  • Microsoft's announcement said Outlook.com would reject high-volume mail failing SPF, DKIM or DMARC with 550 5.7.515 from 5 May 2025; the live postmaster page describes Junk placement with rejection to follow. Microsoft Support: NDR 550 5.7.515, checked 2026-07-17.

Email deliverability FAQ

What is email deliverability?

Email deliverability is whether your messages actually reach the inbox, not just whether they are accepted by the receiving server. It depends on three things working together: authentication (SPF, DKIM, DMARC that proves who sent the mail), reputation (how mailbox providers rate your sending IP and domain), and engagement (whether recipients open, reply, and want your mail). A failure in any one shows up as a bounce, a deferral, or a trip to the spam folder.

What's the difference between delivery and deliverability?

Delivery means the receiving server accepted your message without rejecting it. Deliverability means it reached the inbox specifically, rather than the spam folder. You can have 100% delivery and poor deliverability if most of your mail is being filed as junk.

Does authentication guarantee inbox placement?

No. SPF, DKIM, and DMARC are necessary but not sufficient. They establish that you are who you claim to be; reputation and engagement decide whether that trusted sender lands in the inbox. Authentication removes a common reason for filtering. It does not override a poor complaint history.

Why are my emails bouncing or being rejected?

A bounce with a 5xx code is a permanent rejection: usually failed authentication, a bad recipient address, or a blocklisted sending IP. A 4xx code is a temporary deferral, often rate-limiting or a reputation throttle that clears on retry. Read the exact code in the bounce message: it tells you whether to fix DNS, clean your list, or slow your sending.

Why do my emails go to spam even though authentication passes?

Usually reputation or engagement. A recent spike in spam complaints, a cold IP with no sending history, or recipients who never open your mail can all push authenticated mail to the spam folder. Check that your complaint rate is below 0.10% and that people are actually engaging.

How long does it take to fix deliverability?

Technical fixes (adding SPF, DKIM, DMARC, or a PTR record) take effect within DNS propagation, so minutes to a couple of days. Reputation recovery is slower: mailbox providers want to see a sustained low complaint rate, often over one to several weeks, before they restore full inbox placement.

Do the bulk sender rules apply to small senders?

Google and Microsoft put the strict thresholds at roughly 5,000 messages a day to their users; Yahoo applies the same requirements but declines to publish a number. The underlying requirements (SPF, DKIM, DMARC, valid reverse DNS, and TLS) are best practice at any volume, and small senders that follow them see steadier inbox placement too.

What is a good email deliverability rate?

There is no published inbox-rate target to hit, because mailbox providers keep placement decisions private. The one number the major providers do publish is the spam-complaint threshold: keep it below 0.10% in Google Postmaster Tools, with 0.3% the level where mitigation starts. Beyond that, judge health by instruments you can read directly, and compare providers separately rather than in one aggregate number: hard bounces trending at or near zero, DMARC aggregate reports showing every legitimate sender passing, and a deliverability test of a real message confirming where it landed.

How do I check my email deliverability?

Send a real message through the Email Spam Checker to see what the receiving server recorded and why it may be filtered. For the DNS side, run your domain through an Email Security Score to see every authentication gap at once, and check your sending IP against the major blocklists. Then monitor your DMARC reports so new problems surface before they cost you mail.