DEV Community

Cover image for SPF, DKIM and DMARC all passed. Gmail still sent my mail to spam.
Hisashi Space
Hisashi Space

Posted on Originally published at hisashi.space

SPF, DKIM and DMARC all passed. Gmail still sent my mail to spam.

Ask anyone why their email is going to spam and the first answer is always the same: check SPF, DKIM and DMARC. It's good advice. It's also where most guides stop.

In August 2026, mail from my own domain (I'll call it mydomain.example here) was going to Gmail's spam folder no matter how I sent it. All three checks passed. No blocklist had the domain. It stayed in spam anyway.

It's back in the inbox now. This is what I measured, what I found, and what I think got it out.

How bad it was

This is the address I've used with my readers for years. Up to the end of 2024, about half of what I sent from it got opened. I sent almost nothing through 2025, came back in December with a few thousand promotional emails in a row, and in April 2026 moved the domain's mail to Google Workspace.

By May, opens from Gmail users were at 5.9%. By August, 0.2%.

What told me it wasn't the content: I sent the same message to the same 1,783 people from a different address I own, in the same week. 30.7% of them opened it. Only the sender had changed.

What I ruled out

I sent a two word plain text test to a Gmail account four ways: directly from Workspace, through SocketLabs, through my old host's mail server, and through the Gmail API. All four went to spam, and all four passed authentication. So it wasn't the route. The domain itself had a bad name.

I took out every tracking link in case one looked like a trap. Still spam.

Google Postmaster Tools showed nothing, which I first took as good news. It isn't. For a domain that sends as little as mine, Google simply doesn't show the data.

What I actually found

When I moved the mail to Workspace, one thing didn't move with it. A warm-up service I'd connected months earlier was still attached to the old mail server, still sending about 40 emails a day from my address. The receiving half of that warm-up had nowhere to work anymore, because incoming mail now went to Google.

The two things I changed

On August 21st I switched the warm-up off and reconnected everything to Google.

On August 22nd I launched a small birthday giveaway for my readers, set up so that signing up sent you a confirmation email from that address, and your entry only counted once you replied to it. The announcement warned it might land in spam and asked people to look. The next day, a reminder went out from my other address to everyone who hadn't replied.

So real people went into their spam folders, found my mail, and wrote back.

What happened

I had a test going to a Gmail account every morning, reading back whether it landed in spam or the inbox. It said spam every day through August 31st. On September 1st it said inbox, and it has stayed there.

I can't tell you which change did it. They were a day apart. My guess is the replies, but I didn't set it up cleanly enough to prove it.

If you're here because your mail is in spam

Don't read an empty Postmaster Tools page as healthy. And if you've moved your domain's mail anywhere in the last year, go looking for anything still attached to the old server. That's what I missed for four months.

Top comments (24)

Collapse
 
robertpaschal profile image
Odinaka Robert Nnamani •

This is a well-run experiment — same message, same recipients, only the sender changed, and you still got a 150x difference in spam placement. That's the cleanest demonstration I've seen that auth is table stakes, not the ranking signal. One variable I'd want to isolate next: per-recipient engagement history on the new domain. Gmail's new-sender penalty decays on positive engagement signals, so the fastest path out isn't warming with the full list — it's warming with your most engaged recipients first and expanding from there. Also curious: did the two senders have identical List-Unsubscribe header setups? One-click unsubscribe presence affects Gmail's spam scoring independently of auth, and it's the kind of thing that differs silently between two sending stacks.

Collapse
 
hisashispace profile image
Hisashi Space •

Thanks! Yes, they were the same. Both sends went out through the same mailing system, and it adds List-Unsubscribe and List-Unsubscribe-Post (one-click) to every message no matter which address it's sent from. That went in back in May, so both of the August sends had it.

Collapse
 
robertpaschal profile image
Odinaka Robert Nnamani •

That rules out the header variable cleanly — same system, same headers, same auth, different outcomes. Which means the differentiator was never in the message at all; it was the domain's reputation the whole time, exactly like your warm-up service discovery. This is the part most "check SPF/DKIM/DMARC" guides miss: authentication answers "are you who you claim to be," but Gmail's real question is "should anyone hear from you." I treat auth as table stakes now and reputation as the actual deliverability layer — separate ledgers, separate monitoring. Did the reply-driven re-engagement move the needle permanently, or did you have to keep the volume warm afterwards to hold the inbox?

Thread Thread
 
hisashispace profile image
Hisashi Space •

The warm-up never went back on after August 21st. The daily inbox test said inbox from September 1st through the 17th, then its Gmail token expired and it stopped reporting, so I don't have daily data after that.

What I do have: in early October I sent about 1,700 emails from that address to Gmail users through the Gmail API, and 20.2% opened. In August it was 0.2%.

Thread Thread
 
robertpaschal profile image
Odinaka Robert Nnamani •

0.2% to 20.2% is a hundred-fold recovery — and the most interesting part is what you didn't do: the warm-up never went back on. That more or less isolates the variable. Whatever fixed it, it wasn't ongoing warming — it was the reply-driven re-engagement, real humans pulling your mail out of spam and writing back. That's a stronger claim than most deliverability advice gets to make, because you have the before/after with the confounder removed. The open question is durability: it's been holding since September without the warm-up crutch, but have you seen any decay in the months since, or is the reputation now self-sustaining?

Thread Thread
 
robertpaschal profile image
Odinaka Robert Nnamani •

Hisashi, your experiment is the cleanest proof I've seen that authentication is table stakes, not the ranking signal. I'm opening the rootmail beta now — it's built for exactly this kind of deliverability plumbing: rootmail.io/beta. Would be good to have someone who's measured the problem this carefully testing the fix.

Thread Thread
 
hisashispace profile image
Hisashi Space •

No decay so far, it's actually gone up. I've been sending almost every day since, to the same list of about 1,700 Gmail addresses, still with no warm-up. Open rates per send:

Oct 7: 23.1% (the one in the post, it was 20.2% when I wrote it)
Oct 9: 32.7%
Oct 10: 37.8%
Oct 13 and 14: 26.5%
Oct 15: 34.4%
Oct 16: 29.0%
Oct 18: 14.2% (only a day of data so far)

So it's been holding between about 25% and 38% while sending this often.

And thanks for the beta invite. I send all of this from a mail system I built myself, so I'll stay with it for now. Good luck with the launch ☺️

Thread Thread
 
robertpaschal profile image
Odinaka Robert Nnamani •

Holding 25 to 38% at near-daily volume with no warm-up pretty much answers the durability question. Makes sense to stay on a system you built and can see all the way into. Thanks for sharing the numbers all the way through.

Thread Thread
 
hisashispace profile image
Hisashi Space •

Thanks, Robert. Your questions are what got me to go back and actually look at the numbers, so I'm glad you asked ☺️

Thread Thread
 
robertpaschal profile image
Odinaka Robert Nnamani •

Glad it was useful — the numbers are usually where the real answer hides. Curious what you found when you looked: was it engagement-based filtering on Gmail's side, or something in the sending pattern itself? That distinction decides whether the fix is list hygiene or infrastructure.

Thread Thread
 
hisashispace profile image
Hisashi Space •

From what I could measure, it looked like the domain itself, not the sending. I sent a plain "test" message four different ways (Workspace, SocketLabs, an old hosting mail server and the Gmail API), with no links at all, and all four went to spam with SPF, DKIM and DMARC passing.

People actually replying is what changed it. I ran a birthday gift sign-up where you had to reply to the confirmation email to finish, and people found it in their spam folder and replied. From September 1st the daily test landed in the inbox and stayed there. So my guess is engagement, but I can't prove that's what did it.

Thread Thread
 
robertpaschal profile image
Odinaka Robert Nnamani •

The four-way test is the right way to isolate it — same message, same domain, different pipes, identical result. That rules out the sending path and points at the domain's reputation, which is exactly where SPF, DKIM and DMARC stop helping. And the reply-to-finish sign-up is the sharpest part: real replies are engagement signals Gmail actually watches, so you rebuilt trust one inbox at a time. From your September numbers, did the improvement hold on later sends, or did the domain slide back once the reply wave ended?

Thread Thread
 
hisashispace profile image
Hisashi Space •

It held. I kept sending the daily test every morning, and it's gone to the inbox every day since September 1st.

Thread Thread
 
robertpaschal profile image
Odinaka Robert Nnamani •

The daily test is the underrated part of this whole experiment — most people stop measuring after the first good month. A standing canary like that turns 'it held' from a feeling into a datapoint you can graph. I'm curious about the next layer though: the test message is identical every day with near-zero engagement on it. Do your real sends, the ones with actual opens and replies, ever behave differently from the canary — or does the daily test track real traffic tightly enough that you'd trust it as the domain's health signal?

Thread Thread
 
hisashispace profile image
Hisashi Space •

So far they've lined up. The real sends go to the same list of about 1,700 Gmail addresses, and since the test started landing in the inbox they've been opening at somewhere between 15% and 38% a send. The last few: Oct 19 15.4%, Oct 20 36.8%, Oct 21 29.0%, Oct 22 16.6%, and this morning's 26.9% (only half a day in). Back in August, while the test was still going to spam, a send to that kind of list got 0.3%.

Thread Thread
 
robertpaschal profile image
Odinaka Robert Nnamani •

The paired numbers are the real finding — a lone canary only tells you placement, but the 0.3% vs 15-38% gap on the same list tells you engagement followed the canary out of the hole, and that gap IS the reputation signal. I once tracked opens against inbox rate on a shared spreadsheet during a warm-up and the two moved together within days. What would the two numbers show after a real complaint spike or a stale-list send?

Thread Thread
 
hisashispace profile image
Hisashi Space •

The list I'm sending to is actually the stale part already. It's the Gmail addresses that hadn't opened anything since May, so those 15% to 38% numbers are a stale list coming back. A complaint spike I can't tell you about, I don't have numbers on that one.

Thread Thread
 
robertpaschal profile image
Odinaka Robert Nnamani •

That reframes the numbers in the best way — the 15-38% is a cold-list reactivation, and honestly that's a stronger signal than a broad recovery, because cold addresses are exactly the ones Gmail's reputation model weighs heaviest. I ran SES sends where we segmented canaries by engagement recency, and the gap between the fresh and dormant cohorts told us more than any blended number ever did. Are you keeping the addresses that never re-engaged on the list, or pruning them now?

Thread Thread
 
hisashispace profile image
Hisashi Space •

Keeping them for now. The only ones that come off are people who unsubscribe or bounce, and that's 32 so far out of about 1,700. Honestly this list is the result of a habit I've had for years: when someone hasn't opened anything for three months, I don't delete them, I move them off the main system and send from a separate one instead.

Thread Thread
 
robertpaschal profile image
Odinaka Robert Nnamani •

Moving three-month non-openers off the main system is exactly the right call, because it protects the main sender reputation from the addresses Gmail's model weighs heaviest. The 32 out of about 1,700 who unsubscribed or bounced also tells me this list is not hostile, just dormant. The question I would keep in mind is whether the separate system ever gets a sunset of its own. I have seen dormant addresses turn into spam traps over a long enough horizon, so keeping them indefinitely still carries a cost even when the main system is protected. Do you prune after a longer silence, say twelve months, or keep the separate list going indefinitely?

Thread Thread
 
hisashispace profile image
Hisashi Space •

My policy is to keep sending at a steady pace unless they unsubscribe themselves. If I tried to win those addresses back through ads, each one would be worth around $10, so throwing them away myself would be like throwing money down the drain. For the people who still never open, I send them a gift, or use spintax to personalize the email in more detail.

Thread Thread
 
robertpaschal profile image
Odinaka Robert Nnamani •

ten bucks an address changes the math on throwing them away.

Collapse
 
to21as profile image
Tobias •

Sending the same message to the same 1,783 people from a different address in the same week is what makes this readable: 0.2% against 30.7%, only the sender changed, so the content and the list are both out before you start guessing. I would have gone straight to blaming the copy.

The warm-up service still sending 40 a day from the old server after the MX moved is nasty, because none of the three checks can show you that.

Did the morning test flip back the day after you switched it off, or did it take until people started replying?

Collapse
 
hisashispace profile image
Hisashi Space •

Not the next day. I switched the warm-up off on the 21st, and the morning test still came back spam every day through the 31st. It flipped on September 1st and has stayed there since.

The replies started on the 22nd, so by the time it flipped, people had been digging me out of spam for over a week. Which of the two did it, I can't separate. They were a day apart and I didn't set it up cleanly enough to prove it.