Legitimate Email Being Classified as Spam

Step 1: Check Authentication Records

Verify all three email authentication mechanisms are published and valid:

# SPF record
dig TXT example.com | grep "v=spf1"

# DKIM selector (replace 'default' with your actual selector)
dig TXT default._domainkey.example.com

# DMARC policy
dig TXT _dmarc.example.com

Step 2: Send a Test and Inspect Headers

Send a test email to a free inbox (Gmail, Outlook) and view full message headers:

• In Gmail: click three dots → "Show original"
• In Outlook: File → Properties → Internet headers

Look for the Authentication-Results header. Example of a passing result:

Authentication-Results: mx.google.com;
   dkim=pass [email protected];
   spf=pass (google.com: domain of [email protected] designates 198.51.100.5 as permitted sender);
   dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.com

Step 3: Check Spam Score with mail-tester.com

Send a test email to the unique address provided by https://mail-tester.com and review the score breakdown. A score below 8/10 indicates specific problems.

Step 4: Check Sender Reputation and Blocklists

# Check your sending IP against major blocklists using MXToolbox
# Replace 198.51.100.5 with your actual sending IP
curl "https://api.mxtoolbox.com/api/v1/lookup/blacklist/198.51.100.5"

# Or manually check key RBLs with dig
dig 5.100.51.198.zen.spamhaus.org
dig 5.100.51.198.bl.spamcop.net

Step 5: Review Email Content

• Check for spam trigger words (free, guaranteed, winner, urgent)
• Verify the HTML-to-text ratio (avoid >90% image emails)
• Confirm unsubscribe link is present for marketing emails
• Validate links — URLs must match their visible anchor text

Fix Authentication Records

Ensure SPF, DKIM, and DMARC are all passing:

# Publish SPF — authorise your ESP's servers plus your own MTA
# example.com TXT "v=spf1 include:_spf.google.com include:sendgrid.net ip4:198.51.100.5 -all"

# Confirm DKIM is signing outbound mail through your ESP's dashboard
# Then verify the published public key:
dig TXT default._domainkey.example.com +short

# Set a DMARC policy (start with p=none to monitor, then tighten)
# _dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100"

Delist from Blocklists

1. Identify the specific DNSBL listing your IP via https://mxtoolbox.com/blacklists.aspx
2. Visit the self-service delist page for each blocklist:
3. Spamhaus: https://www.spamhaus.org/removal/
4. SpamCop: https://www.spamcop.net/bl.shtml
5. Investigate and correct the root cause before requesting removal — most RBLs require this

Improve Sender Reputation

• Gradually increase send volume (IP warming): start at 200/day, double every 2–3 days
• Enable list hygiene: remove hard bounces immediately and soft bounces after 3 attempts
• Implement a sunset policy: suppress contacts who have not engaged in 6 months
• Use a consistent From address and sending domain

Content Remediation

• Keep the HTML-to-text ratio below 60:40 in favour of text
• Include a plain-text alternative (text/plain part) in multipart emails
• Ensure every marketing email has a one-click unsubscribe header and visible link

• Monitor Google Postmaster Tools and Yahoo Postmaster weekly for domain and IP reputation trends
• Set up DMARC aggregate reports (rua=) and review them monthly with a tool like Valimail or Dmarcian
• Maintain a suppression list and honour unsubscribes within 10 seconds via list-unsubscribe headers
• Use dedicated sending IPs for transactional and marketing streams to isolate reputation
• Run pre-send content through SpamAssassin or Litmus before each campaign