DNS & Auth 7 min read

DMARC Aligned but Emails Still Landing in Spam

SPF, DKIM, and DMARC all pass with alignment. But emails are still going to spam. Here's what authentication can't fix — and what to focus on instead.

You check email headers and see DMARC: PASS with proper alignment. SPF passes and aligns. DKIM passes and aligns. Your authentication is as clean as it gets. But emails still go to spam. This is deeply confusing because you've done everything the guides say.

Why This Happens

DMARC alignment is the authentication ceiling. Once SPF, DKIM, and DMARC all pass with alignment, you've maximized what authentication can do for you. Everything beyond this point is about reputation, content, and recipient behavior.

When DMARC alignment is clean and emails still go to spam, the problem is almost always one of these:

  • Domain reputation is Low or Bad in Postmaster Tools. Authentication protects reputation but doesn't create it. A domain that's been sending unwanted email has bad reputation regardless of authentication.
  • IP reputation is poor. Your sending IP may be on a shared pool with other senders whose behavior has damaged the pool's reputation.
  • Spam complaint rate is too high. Even slightly above 0.10% starts to hurt, and above 0.30% is critical per Google's guidelines.
  • Content triggers spam filtering independently. Certain content patterns, link domains, HTML structures, and formatting trigger content-based filters regardless of authentication.
  • Engagement signals are negative. Gmail tracks whether recipients open, reply, or engage with your messages. A history of low engagement teaches Gmail that your messages aren't wanted.

Step-by-Step Diagnosis

Check Postmaster Tools for domain reputation, IP reputation, and spam rate. This is the most informative single step when authentication is clean.

Run the blacklist checker on your domain and sending IP. Check PTR records with the rDNS checker — Google requires valid forward and reverse DNS.

Run a placement test and then run a plain text test with zero links or tracking. If the plain text version places in inbox but your campaign doesn't, the issue is content-based.

Check your sending volume and patterns over the last 30 days. Look for spikes, inconsistencies, or periods of very high volume.

Review list quality. What's your bounce rate? Use the blacklist check and check your link reputation with the link checker.

The Fix Path

If reputation is the issue, enter recovery mode. Reduce volume dramatically. Send only to your most engaged contacts. Generate positive engagement signals. Hold this pattern for 2–4 weeks while monitoring Postmaster Tools.

If complaints are the issue, add one-click unsubscribe headers, suppress unengaged recipients, and refine targeting to reduce complaints.

If content is the issue, simplify to plain text with minimal links. Test iteratively, adding back one element at a time to identify the trigger. Use the subject line spam tester to check for obvious triggers.

Authentication is not the problem here. Stop troubleshooting authentication and focus on what authentication cannot fix.

When to Replace Instead of Repair

When authentication is clean, the repair-or-replace decision comes down to domain reputation. If Postmaster Tools shows Medium or Low reputation, repair is possible with 2–4 weeks of effort. If it shows Bad and has been Bad for more than 2 weeks, replacement is often faster.

WarmInboxes provides inboxes on domains with established positive reputations — exactly what you need when your own domain's reputation is the bottleneck and authentication is already maxed out.

Mistakes That Make This Worse

  • Continuing to troubleshoot authentication when it already passes
  • Adding more authentication methods (like BIMI) and expecting them to fix reputation issues
  • Sending more volume to "test" whether the problem is fixed
  • Not checking Postmaster Tools because you assumed clean authentication meant clean reputation

Run the checks first

Before replacing anything, run a free inbox placement test. You might find the issue is DNS, not the domain — and save yourself a week of unnecessary work.

Free inbox placement test Check burn score

More guides

SPF, DKIM, and DMARC for Cold Email: The Simple Fix GuideHow to Check if a DNS Error Is Killing Your DeliverabilityCold Email Setup Checklist: Domain, DNS, Tracking, and Sending Health