How to avoid the spam folder (the 7 levers that decide placement)

Seven levers decide placement, and they act at five different moments in a message's life: infrastructure identity, authentication and alignment, volume shape, list validity, complaint rate, content and link reputation, and a working unsubscribe. The useful part is not the list — it is the ordering rule. Each lever acts at exactly one gate, gates are crossed in sequence, and a lever at gate four cannot rescue a failure at gate two. Rewriting a subject line while DMARC alignment fails is fixing the last thing that gets read.

A message crosses five gates, and each lever acts at exactly one

Every message goes through the same sequence, and each stage is evaluated by a different mechanism with different evidence available to it.

• Gate one — the connection. Can the receiver identify the machine that just connected, and is the transport encrypted? Lever 1, infrastructure identity.
• Gate two — the envelope. Does an authenticated identity belong to the domain in the visible From line? Lever 2, authentication with alignment.
• Gate three — acceptance. Will the receiver take this message, right now, at this rate? Lever 3, volume shape.
• Gate four — classification. Now that it is accepted, which folder? Levers 4, 5 and 6 — list validity, complaint rate, and content and link reputation.
• Gate five — the recipient. What does the human do next, and how easy did you make the harmless option? Lever 7, one-click unsubscribe.

The single most useful property of this model is that it tells you what a symptom rules out. A message that was accepted did not fail gate two under a rejecting policy. A message that was deferred never reached gate four at all. Diagnosis becomes a matter of finding the earliest failing gate rather than working through a checklist in the order somebody wrote it.

One thing to be clear about before the levers: the folder decision itself happens after acceptance, inside a classifier that reports nothing back. The SMTP conversation ends with a 250 and no protocol carries a verdict about the folder. That gap is why a dashboard can honestly show 99.4% delivered above a campaign that produced no replies at all.

Gate one: can the receiver identify the machine that connected

This is the cheapest gate and the one people skip because it sounds like somebody else's job.

Google's Email sender guidelines, in force since 1 February 2024, set three requirements on every sender regardless of volume: "Set up SPF or DKIM email authentication for your sending domains", "Ensure that sending domains or IPs have valid forward and reverse DNS records", and "Use a TLS connection for transmitting email". A fourth asks that messages be formatted "according to the Internet Message Format standard, RFC 5322".

The reverse DNS requirement is the one that quietly fails. A forward record maps a name to an address; a reverse, or PTR, record maps the address back to a name, and the pair must agree. If you send through Gmail, Microsoft 365 or a major ESP, this is already true and you own none of it. If you send from your own server or a rented IP, it is yours, and a missing PTR is a first-impression failure that no amount of later work compensates for.

Lever 1 costs an afternoon at most and never needs revisiting. That is a good reason to do it first, not a reason to assume it is done.

Gate two: does an authenticated identity match the name in the From line

Gate two is where most cold email that lands in spam actually fails, and where most of the effort does not go.

For all senders, Google asks for SPF or DKIM. Above roughly 5,000 messages a day to personal Gmail accounts, the bar changes: SPF and DKIM, a DMARC record on the sending domain, alignment between the From domain and either the SPF or the DKIM domain, and one-click unsubscribe on marketing and subscribed mail per RFC 2369 and RFC 8058. Yahoo published matching requirements. Microsoft added its own high-volume authentication rule for outlook.com, hotmail.com and live.com in 2025.

The word doing the work in that list is *alignment*, and it is the reason a header full of passes can sit above a failure. A relay can pass SPF for its own bounce domain and sign DKIM with its own d= value, producing two green results that belong to somebody else's domain and contribute nothing to yours. Which identifier each of the three protocols actually binds is the mechanism underneath that, and it is worth ten minutes because it converts a confusing symptom into an obvious one.

Lever 2 is the highest-return item on this page. It is also finite work: publish, verify on a real message, and it stays true until somebody changes a vendor.

Gate three: acceptance is a rate decision, and a deferral is not a rejection

Gate three is the one most often misread, because the receiver's answer looks like an error and is not.

RFC 5321 sorts replies by first digit. A 4yz is a Transient Negative Completion: "The command was not accepted, and the requested action did not occur. However, the error condition is temporary, and the action may be requested again." A 5yz is permanent. A receiving system that thinks you are sending too fast answers 4xx, which is closer to *slow down* than to *no*.

Two behaviours follow, and both are commonly got backwards.

• Retry a 4xx patiently and at a lower rate. Retrying immediately and repeatedly is the response most likely to convert a throttle into a reputation event.
• Never retry a 5xx. A permanent rejection repeated is a bounce generated on purpose, and bounce rate is one of the few signals every provider agrees on.

Lever 3 is the shape of your volume rather than its size. Filters watch the derivative: a mailbox that sends 40 a day for a month and then 400 on a Tuesday is a sharper anomaly than one that sent 400 from the beginning. Autocloz's shipped per-mailbox defaults are deliberately small — daily_limit 40, hourly_limit 10, and min_gap_sec 90, so the day's volume is spread rather than released at 09:00 — and the hourly limit is not rescaled when somebody raises the daily one, which is why a mailbox configured for 200 a day frequently clears far fewer. Before raising a number, find out which constraint is actually binding.

Gate four: classification, and the only number a provider publishes about you

Once a message is accepted, three levers act on where it goes.

Lever 4 — list validity. Every invalid address is a hard bounce, and a hard bounce is a permanent rejection at the recipient address rather than a temporary condition like a full mailbox. Treating the two identically will make you delete valid contacts, so the classes have to be separated before anything is suppressed. Autocloz auto-pauses a campaign whose bounce rate crosses a threshold, resolved as the per-campaign setting, then the workspace default, then a 15% safety floor for manual campaigns where nothing was configured — measured over a rolling 24 hours, and never firing below a 100-send sample, so three bounces out of twelve cannot trip it while the number is still noise. The rate is computed for the campaign being evaluated first, and only falls back to the workspace-wide figure when that campaign has not yet produced 100 sends, so one bad list does not halt every other campaign for a day while a genuine workspace-level incident still registers.

Lever 5 — complaint rate. This is the only threshold a major provider publishes as a number. Google's guidelines say to keep the spam rate reported in Postmaster Tools below 0.30%, and as a guideline below 0.10%. Two things about that figure are worth stating plainly. It is a Gmail number, not an industry one — Microsoft and Yahoo publish no equivalent. And it is invisible to you below whatever volume Postmaster Tools requires before it shows data, which is the position most cold programmes are permanently in.

Lever 6 — content and link reputation. This acts last and matters least, which does not mean it never matters. The parts that carry real weight are the destinations rather than the words: the reputation of every hostname you link to, whether your open and click tracking runs through a shared domain used by thousands of unrelated senders, and whether a first touch carries an unexpected attachment. Autocloz scores a draft before it is sent with a deterministic rules-based heuristic — 0 to 100, warning at 30, severe at 60, and treating 80 as a block — and the module's own docstring is honest that "it's *not* SpamAssassin", which is the right expectation to have of any pre-send checker. What the famous trigger-word lists are actually worth is a longer answer than the folklore suggests, and it is shorter than the afternoon most people spend rewriting.

Gate five: the recipient's hand, and the header that changes what it reaches for

The last gate is a human choosing between two buttons, and lever 7 changes which button is nearer.

RFC 8058 specifies one-click unsubscribe as a pair of headers. Section 3.1: "A mail sender that wishes to enable one-click unsubscriptions places one List-Unsubscribe header field and one List-Unsubscribe-Post header field in the message", the List-Unsubscribe header "MUST contain one HTTPS URI", and the List-Unsubscribe-Post header "MUST contain the single key/value pair 'List-Unsubscribe=One-Click'".

Then section 4 adds the requirement almost nobody checks: both headers "MUST be covered by the signature and included in the 'h=' tag of a valid DKIM-Signature header field".

That is the real reason a native unsubscribe control fails to render on a message that visibly contains both headers. Unsigned headers are unverified headers, and a client will not offer a one-click action it cannot attribute. It is also the one part of lever 7 a sending tool may not control for you — see the limits section below.

The counter-intuitive part is worth stating directly: an easy opt-out improves placement. It converts people who would otherwise press the spam button, and one complaint costs far more reputation than one unsubscribe.

Which lever to pull, given the symptom you actually have

Symptom first, then the earliest gate it implicates.

• Messages are being refused at SMTP with a 5xx mentioning authentication or DMARC. Gate two. Nothing downstream is relevant until the record and its alignment are fixed.
• Messages are deferred with 4xx and eventually deliver. Gate three. This is a rate conversation, not a reputation one, unless it persists.
• Everything is accepted, replies are near zero. Gate four. Run an inbox placement test before touching the copy — if the probes are landing in spam, the copy is not the variable.
• Bounce rate climbs in the first week of a new list. Gate four, lever 4. A list problem wearing a reputation costume.
• Placement is fine at Gmail and poor at Outlook. Separate reputation systems with separate thresholds. Do not average them into one score; what each provider rewards and measures differently is a distinct diagnosis.
• Volume is far below the configured daily limit. Not a placement problem at all. Find the binding throttle.
• The unsubscribe control does not appear in Gmail. Gate five, and check h= before checking anything else.

Autocloz's free plan covers 5 users and 10 mailboxes with the warmup ramp, SPF, DKIM and DMARC monitoring, bounce auto-pause and RFC 8058 headers on every send — start free if you would rather have gates one through three answered before your first campaign than after it. If you want a second opinion on a domain you already send from, the deliverability self-audit checker scores the parts that are visible from outside.

If you are already in the spam folder, the order of the recovery matters

Sending more mail while you diagnose makes the problem worse, so the sequence is not optional.

1. Pause the affected mailboxes. Switching domains and continuing burns the new domain the same way, because the cause travelled with the list and the copy rather than with the name.
2. Verify authentication end to end on a real message, including alignment. Read the Authentication-Results header on something you actually received.
3. Re-verify the list and remove every address that has never engaged. This is the input that generated the complaints and bounces in the first place.
4. Check whether the sending domain or IP is listed on a public blocklist, and file removal requests only where the listing is legitimate. A listing is often a symptom rather than the cause — how blocklist lookups actually answer, and what a return code means is worth reading before you file anything.
5. Restart on the warmup ramp from day one, not at the previous plateau.
6. Return at roughly half the previous volume and hold there while you watch placement rather than acceptance.

Recovery is measured in weeks. Prevention is measured in an afternoon, which is the entire argument for treating gates one and two as setup work rather than as a response to a problem.

What none of the seven levers can do, and what Autocloz does not do

The boundaries are more useful than another paragraph of reassurance.

None of this makes a message wanted. Complaint rate measures how recipients feel about being contacted. No configuration changes that, and a well-authenticated campaign to a badly chosen list fails as silence — which is harder to diagnose than a spam-folder problem and easier to misattribute to one.

No sender can observe the folder decision directly. Seed tests are the closest instrument, and their vocabulary is narrow by construction. Autocloz classifies each probe as inbox, spam or missing and nothing else. There is no Promotions verdict and there could not be one, because the probes are read over IMAP and Gmail's category tabs are not IMAP folders, so a message sitting in Promotions reads as inbox. The tests are also operator-triggered — you run one, the dispatch and scoring phases are separated by a 15-minute delay so the mail has time to arrive, and nothing fires them on a schedule for you. What a placement test can and cannot see covers the rest of that instrument's limits.

Autocloz cannot make your provider sign the unsubscribe headers. It injects both List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click on every send. But when you send through your own Gmail, Microsoft 365, Amazon SES or SMTP account, the DKIM signature is applied by that provider, and whether those two headers end up inside the signature's h= list is that provider's behaviour, not the product's. If the control does not render, verify h= on a received message before assuming the headers are missing.

Autocloz does not sell contact data, and does not verify a list as deliverable. The built-in free-tier verifier is deliberately incapable of returning a deliverable verdict — it can identify addresses that are clearly invalid and leave everything else as unknown — so a rule like "drop every address that is not deliverable" would delete most of a clean list. Treat it as a filter for the obviously broken, not as a proof of validity.

It cannot see inside anybody's classifier. Neither can anyone else outside Google, Microsoft and Yahoo. What the seven levers do is remove the failure modes that are documented, measurable and yours to control; they do not make placement certain, and any tool that says otherwise is describing a system it cannot observe. If you want the comparison against the tools sold specifically as placement fixers, the Folderly comparison is where that category argument sits.