If SPF, DKIM and DMARC all pass, why does my email still go to spam?

Because authentication answers a different question than placement does. It proves the message genuinely came from your domain and was not altered — that is all. It removes a reason to reject you; it never gives a provider a reason to trust you. Placement is decided afterwards by sender reputation, recipient engagement history, list quality and content. Clean DNS is the entry requirement, not the prize.

What is the difference between passing SPF and SPF alignment?

SPF can pass while the domain it validated is not the domain in your From header. SPF checks the Return-Path (envelope sender), which many sending platforms set to their own domain. The check passes, but DMARC compares the validated domain against your From domain, and if they do not match, DMARC treats it as a failure despite the green tick. This is the single most common reason people believe their authentication is fine when it is not.

Does a DMARC policy of p=none help deliverability?

Barely. p=none means 'do nothing when authentication fails' — it is a monitoring posture, useful for collecting reports before enforcing, but it asks mailbox providers to take no action. Moving to p=quarantine and then p=reject, once your reports show legitimate mail passing, is a positive trust signal. Sitting on p=none indefinitely is a missed one.

Can a perfectly authenticated domain still be blacklisted?

Yes, and the two are unrelated. Authentication proves identity; a blocklist is a judgment about behaviour. A domain with flawless SPF, DKIM and DMARC that hits spam traps or collects complaints gets listed anyway, and the listing overrides everything else. Check blocklist status separately from DNS.

SPF, DKIM and DMARC All Pass — So Why Is My Email Still in Spam?

Q: How long after fixing authentication should placement improve?

If authentication was genuinely the only problem, within days. If placement does not move in two weeks, authentication was not the cause — it was a prerequisite you happened to be missing. Look at reputation, list quality and engagement instead of re-checking DNS.

Disclosure: this site is operated by the MailPilot team. The checkers linked below are free and need no signup.

This is the most frustrating position in deliverability: every record validates, every checker shows green, and the mail still lands in junk. A post on r/u_warmy_ltd framed it well — “Your DNS checks out, so why the junk folder?”

The answer is a reframe most guides skip.

Why does email go to spam when SPF and DKIM pass?

Passing SPF, DKIM and DMARC proves exactly two things:

The message genuinely came from your domain
It was not altered in transit

That is the entire claim. Notice what is missing: nothing about whether the recipient wants it. A spammer with a correctly configured domain passes all three. Authentication removes a reason to reject you. It never supplies a reason to trust you.

So “my DNS is perfect and I’m still in spam” is not a contradiction. It is the normal state of affairs once you clear the entry requirement — and the entry requirement is not the prize.

What looks like passing authentication but isn’t?

Before moving on to reputation, rule these out — both show green in casual checks.

Passing without alignment

This is the most common false clean bill of health.

SPF validates the Return-Path (the envelope sender), not the From: address your recipient sees. Many sending platforms set the Return-Path to their domain. SPF passes — for their domain.

DMARC then compares the authenticated domain against your From: domain. If they don’t match, DMARC fails despite SPF showing a pass.

From:         you@yourdomain.com
Return-Path:  bounces@sendingplatform.com   ← SPF passes for THIS
DMARC:        fail (not aligned with From:)

The fix is a custom Return-Path or bounce domain on your own subdomain — most platforms support it, and it’s usually one DNS record.

A DMARC policy of `p=none`

p=none means “do nothing when authentication fails.” It’s a monitoring posture — correct while you collect reports, a missed signal if you sit on it forever. Moving to p=quarantine, then p=reject once reports show legitimate mail passing, is a genuine positive trust signal.

Check alignment and policy, not just presence.

What decides inbox placement if authentication is correct?

Factor	Why it outranks authentication
Sender reputation	Built from history, complaints and bounces. The dominant input.
Recipient engagement	Opens, replies, moves out of spam. Cold outreach starts at zero here by definition.
List quality	Hard bounces above ~2% signal a bought or scraped list.
Complaint rate	Google’s threshold is ~0.1% — one per thousand.
Blocklist status	Unrelated to DNS, and it overrides everything.
Content and links	Shorteners, shared tracking domains, poor link reputation.

Start with the free ones: blocklist status — a flawlessly authenticated domain gets listed too, and a listing overrides every other signal — then score the message itself.

Then connect Google Postmaster Tools. It reports Gmail’s own verdict on your domain reputation and your real complaint rate. If it says Low or Bad, that is your answer, and no DNS change will move it.

Are you in spam, or in the Promotions tab?

One more case worth ruling out, because it looks identical from the outside.

A message Gmail sorts into the Promotions tab carries the INBOX label. Tools that check for INBOX and stop report it as a clean inbox hit. So “my placement looks fine but nobody replies” and “I think I’m in spam” can both actually be “I’m in Promotions” — which is neither inbox nor spam, and which most tooling cannot see.

We had this exact bug in our own scoring and fixed it in October 2026; our reported inbox rates went down. If your authentication is genuinely clean and your reported placement looks healthy while replies stay flat, check the tab before assuming the spam folder.

In what order should you diagnose this?

Verify alignment, not just that records exist
Move DMARC off p=none once reports are clean
Check blocklists — unrelated to DNS, overrides everything
Check Postmaster Tools for Gmail’s own reputation verdict and complaint rate
Check bounce rate; above ~2% is damaging your reputation as you send
Only then look at content and links
If the domain is new or cold, it has no history — that is what warmup is for

And if you fixed authentication and placement doesn’t move within two weeks, authentication was not the cause. It was a prerequisite you happened to be missing.