Why Emails Go to Spam: The SMTP, DNS, and Deliverability Engineering Guide

Your Emails Aren't Going to Spam Because of Bad Luck

Every email that lands in a spam folder was put there by an algorithm making a determination based on technical signals, content signals, and reputation signals. Understanding these signals is the difference between 95% inbox placement and 40% inbox placement.

This guide covers the full technical stack behind email deliverability — from DNS configuration through SMTP relay selection to content optimization — with specific attention to WordPress sites sending email via WP Mail SMTP or similar configurations.

The Three Categories of Spam Signals

Technical authentication signals (the most common failure): Most email deliverability problems for small businesses are technical, not content-related. Gmail, Outlook, and Yahoo check three DNS records before deciding whether to trust an email:

• SPF (Sender Policy Framework): A DNS TXT record that lists which IP addresses and mail servers are authorized to send email from your domain. If your email comes from an IP not listed in your SPF record, receiving mail servers can reject it or mark it as spam.
• DKIM (DomainKeys Identified Mail): A cryptographic signature attached to every email. The receiving server checks the signature against a public key in your DNS. DKIM proves the email wasn't modified in transit and came from an authorized sender.
• DMARC (Domain-based Message Authentication, Reporting & Conformance): A policy that tells receiving servers what to do with emails that fail SPF or DKIM checks (reject, quarantine, or deliver). It also provides reporting — you get aggregate reports on who's sending email from your domain.

Without all three properly configured, your emails are statistically likely to land in spam — regardless of content quality.

Verifying Your DNS Configuration

SPF check: Query your domain's DNS TXT records: dig TXT yourdomain.com or use MXToolbox's SPF checker. Your SPF record should include all legitimate sending sources: your web host, your email marketing platform (Klaviyo, Mailchimp), and any other services that send email on your behalf.

Example SPF record:

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 -all

The -all at the end means "reject everything not listed" — the strictest and most deliverability-safe setting.

DKIM check: Your email provider (Google Workspace, SendGrid, Mailgun) will provide a DKIM DNS record to add to your domain. Verify it's active with MXToolbox's DKIM checker.

DMARC check: A basic DMARC record: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

Start with p=none (monitor mode) to receive reports without affecting delivery. After verifying legitimate sends are passing, move to p=quarantine then p=reject.

WordPress SMTP Configuration:Why WordPress's Default Email Fails

WordPress sends email via the PHP mail() function by default. This uses your web server's local mail transfer agent — which has no SPF, DKIM, or DMARC authentication configured for your domain. The result: WordPress emails (password resets, contact form notifications, WooCommerce order emails) frequently end up in spam.

The fix: WP mail SMTP + a transactional email provider

1. Install WP Mail SMTP (free or Pro)
2. Connect it to a transactional email provider: SendGrid, Postmark, Mailgun, or Amazon SES
3. Configure SPF and DKIM records for the sending domain in your transactional provider's dashboard
4. Test via WP Mail SMTP's built-in email test tool

Transactional email provider selection:

• SendGrid: Generous free tier (100 emails/day), excellent deliverability, easy DKIM setup
• Postmark: Best-in-class deliverability for transactional email, more expensive but worth it for high-value sends
• Amazon SES: Cheapest at scale ($0.10/1,000 emails), but requires more technical configuration and starts in a sandbox that requires manual production access request

Sender Reputation:The Long-Term Deliverability Factor

Technical authentication gets you through the door. Sender reputation keeps you there.

Reputation is built from:

• Engagement rate: What percentage of your emails are opened, clicked, replied to? High engagement = positive reputation signal.
• Spam complaint rate: Gmail requires below 0.08% complaint rate (enforced since February 2024). Above 0.1% triggers delivery restrictions. Monitor via Google Postmaster Tools.
• List hygiene: Sending to invalid or inactive email addresses generates bounces and spam complaints. Clean your list quarterly: remove hard bounces immediately, suppress unengaged subscribers after 180 days of no opens.
• Unsubscribe compliance: Every marketing email must have a working one-click unsubscribe. Gmail and Yahoo now enforce this technically (List-Unsubscribe header required for bulk senders).

Content Signals That Trigger Spam Filters

• Excessive capitalization in subject lines ("FREE GIFT INSIDE")
• Spam trigger words in subject lines ("guaranteed," "no risk," "act now")
• HTML with very low text-to-image ratio (image-only emails are high-risk)
• Missing plain-text version (every HTML email should have a plain text alternative)
• Shortened URLs that obscure the destination domain
• Multiple exclamation marks in subject lines

At Verdant Mindset, we configure transactional email infrastructure and deliverability systems for WordPress and ecommerce sites. See our web development and technical setup services.