Written by
Tim Collins
Published on
12 July 2026
The report says the campaign sent. Ninety-nine point something per cent delivered. No bounces worth worrying about.
And then nothing. No replies, no clicks, no bookings, and a customer three weeks later asking why you never told them about the thing you told them about twice.
This is the most frustrating problem in email, because everything looks fine from where you are standing. Delivered does not mean read. It does not even mean seen. It means a mail server accepted the message, and that server is perfectly entitled to accept your email and then quietly file it in a folder nobody opens.
Here is what is actually going on, and how to work out which part of it applies to you.
Nobody is reading your words
The first thing to let go of is the idea that a spam filter reads your email and judges the writing.
That was true in about 2005. Today, the content of your message is one of the smaller signals. Modern filtering at Gmail, Outlook and the Australian providers is built on machine learning that has watched billions of messages, and it is mostly asking three questions.
One: are you actually who you say you are?
Two: do the people receiving this want it?
Three: does this send look like sends that turned out badly?
Almost every reason your email goes to spam sits under one of those three. So rather than hand you a list of twelve unrelated problems, let us take them in order, because that is also the order you should check them.
Question one: are you who you say you are?
Email was designed in the 1970s with no way to verify a sender. Anyone could claim to be anyone. Everything built since has been an attempt to patch that hole, and inbox providers now treat the patches as mandatory.
There are three records involved. They live in your domain's DNS, which is usually managed wherever you bought the domain or wherever your website is hosted.
SPF is a list of the servers allowed to send email using your domain. If your email arrives from a server that is not on the list, that is a strike.
DKIM is a cryptographic signature attached to each message. It proves the email genuinely came from your domain and was not altered on the way. Think of it as a wax seal.
DMARC is the policy that ties the other two together. It tells inbox providers what to do when SPF or DKIM fails, and it is where you find out whether anyone is impersonating you.
If you send in any real volume to personal inboxes, you need all three. Not two. Missing one is enough to get rejected outright, and since late 2025 those rejections have been permanent rather than temporary retries.
Two traps worth knowing about.
The first is alignment. You can have a perfectly valid SPF record and still fail, because the domain in your "from" address does not match the domain that was actually authenticated. This happens constantly when businesses use a marketing platform without completing the domain setup step. The platform sends on its own domain, your customers see your name, and the authentication does not line up.
The second is a DMARC policy of p=none. This is the minimum accepted setting, and a lot of businesses put it in place, tick the box, and stop. But p=none only monitors. It tells you when someone spoofs your domain, it does nothing to stop them. You are visible, not protected. Moving to quarantine and then reject is a separate piece of work, and it is worth doing once your legitimate sending is clean.
Also in this category: reverse DNS. Your sending server should have a PTR record so its IP address resolves back to a hostname. If you send through a reputable platform this is handled for you. If someone set up a server in your office to send invoices, it is very possibly missing.
How to check the whole lot in two minutes: send an email from your marketing platform to a Gmail address you control. Open it, click the three dots in the top right, and choose "Show original". You want PASS beside SPF, DKIM and DMARC. Three passes and this whole section is not your problem.
Question two: do the recipients want it?
If your authentication is clean and mail is still going to spam, this is almost always where the answer is.
Inbox providers watch what people do with your email. Opens, yes, but far more importantly: replies, deletions without opening, moves out of spam, and complaints. They build a picture of whether your mail is wanted, and they apply that picture to everything you send afterwards.
Complaints are the sharpest signal. When someone hits the spam button, that is counted. The accepted ceiling is 0.1 per cent, or one complaint per thousand messages. At 0.3 per cent you are in genuine trouble. These are small numbers, and a single badly targeted campaign to a list that has not heard from you in two years can blow through them in an afternoon.
Engagement decay is the slow version. If half your list has not opened anything in eighteen months, every send drags your reputation down a little further. The list is not neutral. It is actively costing you.
This produces the most counterintuitive advice in email marketing: send to fewer people and you will reach more of them. Removing the dead weight feels like going backwards, especially if someone has been quoting list size as a success metric. But a list of 3,000 engaged contacts will outperform 12,000 stale ones on every measure that matters, including total revenue.
Where the list came from matters enormously. Purchased lists, scraped addresses and "we met at a trade show in 2019" contacts all behave the same way: high complaints, low engagement, spam traps. A spam trap is an address that exists purely to catch senders who did not get permission. Hitting one is a serious reputation event, and you will never know you did it.
In Australia this is not only a deliverability question. Under the Spam Act 2003 you need consent, which is either express or reasonably inferred from an existing business relationship. Buying a list gives you neither. The compliance risk and the deliverability risk point the same direction, which is convenient, because it means doing the right thing is also the thing that works.
Question three: does this look like a bad send?
The last category is pattern matching. Nothing here is wrong exactly, but each one resembles what bad senders do.
Sudden volume changes. A domain that sends 500 emails a week and then sends 40,000 on a Tuesday looks like a compromised account. Ramp up gradually, especially on a new domain or a new platform. This is what domain warming is for, and it is legitimate infrastructure work rather than a trick.
Link problems. URL shorteners are heavily abused and heavily penalised. Links pointing to a domain with no reputation, or to a domain different from your sending domain, raise flags. So does a message that is one big image with a single link and almost no text.
Shared tracking domains. If your platform uses a default tracking domain shared across all its customers, your click links inherit whatever reputation the worst sender on that platform has earned. A custom tracking domain on your own subdomain fixes this and takes about ten minutes.
Attachments. A PDF attached to a bulk send looks like a phishing attempt, because that is a common phishing pattern. Link to a file instead.
No easy unsubscribe. Beyond being legally required here, a missing or buried unsubscribe link converts people who would have quietly left into people who hit the spam button. One-click unsubscribe support, which is now a requirement for bulk senders anyway, is the cheapest reputation protection you can buy.
Formatting that shouts. ALL CAPS SUBJECT LINES, rows of exclamation marks, and red text on yellow do still register. Not because the filter is offended, but because those patterns correlate with senders who turned out to be a problem. This is real, but it is a much smaller factor than most people assume, and no amount of careful word choice will save a campaign that fails on questions one or two.
The myth worth dispelling
Somewhere in the mid 2010s a genre of blog post took hold listing "spam trigger words" to avoid. Never write "free". Never write "act now". Never mention money.
You can largely ignore this. Filters are not running a banned word list. Legitimate businesses send emails containing the word "free" every day and they arrive perfectly well, because everything else about the sender checks out. Meanwhile a beautifully worded, entirely inoffensive newsletter will land in spam if it is going to a purchased list from an unauthenticated domain.
Word choice is downstream of everything else. Spending an afternoon rewording your subject line while your SPF record is broken is not a good use of the afternoon.
Working out which one is yours
Do these in order. The order matters, because there is no point tuning content while authentication is failing.
Step one: check authentication. The Gmail "Show original" trick above. Two minutes. If you do not see three PASS results, stop here and fix that first. This is the single most common cause and the most fixable.
Step two: check your complaint and bounce rates. Your platform should show these. Complaints above 0.1 per cent, or hard bounces above 2 per cent, tell you the problem is your list rather than your setup.
Step three: look at engagement by segment. Split your list by last engagement date. If the bulk of it has not opened anything in a year, you have found it. Suppress them, or run a single re-engagement campaign and suppress whoever ignores it.
Step four: check placement, not just delivery. Delivery reports cannot tell you which folder a message landed in. Inbox placement testing sends a campaign to seed addresses across the major providers and reports back where it actually went. This is the only way to know for certain, and it will often show that you are fine at Gmail and struggling at Outlook, or the reverse, which changes what you do next.
Step five: check reputation directly. Google Postmaster Tools and Microsoft SNDS are both free and both show you what those providers think of your domain. If you send any real volume and have not set these up, do it this week.
If it has already gone wrong
Reputation recovers, but slowly, and only if the underlying behaviour changes.
Clean the list first. Suppress everyone who has not engaged in twelve months, and validate the rest to remove addresses that no longer exist. Then reduce volume and rebuild gradually, sending only to your most engaged contacts for a few weeks so the signals coming back are positive ones. Fix the authentication properly while you wait.
What does not work is carrying on as before and hoping. Nor does moving to a new domain, which resets you to zero reputation and looks exactly like what a spammer does when they get burned.
Expect four to six weeks for meaningful improvement. It is genuinely slow, which is the best argument for not letting it slide in the first place.
Where FlipSend fits
We built FlipSend because too much of this falls on the sender when it should be handled by the platform.
Authentication setup is guided rather than left to you to work out. One-click unsubscribe, suppression and bounce handling are automatic. Custom tracking domains are standard, not an upgrade. Inbox placement testing and domain warming are built in, so you can see where your mail actually lands rather than guessing from a delivery report. Email validation runs at the point of send at no charge, because protecting your domain reputation should not be a line item.
And all of it runs in Australia. Your contact data does not leave the country, which matters if you work in healthcare, government, education or anywhere else the Privacy Act 1988 shapes what you can and cannot do with customer information.
If you are not sure where your current setup stands, we will check it and tell you plainly. It takes about ten minutes and there is nothing to sign.
FlipSend by Flipside Digital. Email, SMS and fax from one platform, built and hosted in Australia.