Most businesses find out they have a deliverability problem the same way: open rates slide, replies dry up, and someone forwards a customer complaint that says, "I never got your email." By then, mailbox providers have usually been filtering the program for weeks.
Between November 2025 and August 2026, our team at Formula Inbox audited 10 email programs for companies in healthcare, law, real estate, publishing, recruiting, and B2B services. Nine of them came to us because something was already broken. The surprising part wasn't how different their problems were. It was how similar.
Key takeaways
8 of 10 programs had a spam complaint rate that spiked above Google's 0.3% limit. That was every program where we had complaint data.
7 of 10 had at least one major mailbox provider (Gmail, Microsoft, or Yahoo) sending 100% of test emails to spam while other providers delivered normally.
7 of 10 were still emailing contacts who hadn't engaged in four months or more.
4 of 10 had SPF, DKIM, and DMARC passing perfectly and still landed in spam. Authentication gets you in the door. It doesn't get you into the inbox.
How we Ran These Audits
Each audit covered the same ground: inbox placement tests across major providers, Google Postmaster Tools and Yahoo Sender Hub data where available, DNS authentication for every tool sending on the domain, blacklist checks, spam filter tests, list composition, engagement trends, consent flows, and email content.
The programs ranged from a 700-contact professional services business to a consumer healthcare brand sending millions of emails a month. They ran on familiar platforms: HubSpot, Klaviyo, Apollo, Google Workspace, Microsoft 365, and others. One audit (a B2B firm setting up a new outbound program) came back healthy. The other nine had real damage.
A caveat worth stating up front: this is a sample of businesses that already suspected a problem, not a random cross-section. But that's exactly why it's useful. These are the mistakes that actually put companies in the spam folder.
Mistake 1: Emailing People Who Stopped Engaging Long Ago
Found in 7 of 10 audits, which was every program with an established marketing list.
None of the seven had a working sunset policy, meaning a rule that stops emailing contacts after a set period of no opens or clicks. The inactive share of these lists was startling:
A real estate investment firm had a database of roughly 93,000 contacts. Only 3% had engaged in the past 90 days, and 59% had no engagement recorded at all.
A consumer services company with about 320,000 contacts had 54% who hadn't engaged in 90+ days, and those contacts were included in large acquisition sends.
A media brand had 44.5% of its list inactive for over a year.
Why it hurts: Gmail, Yahoo, and Microsoft judge your mail partly by how recipients react to it. Every email sent to someone who ignores it is a small vote that your mail isn't wanted. When most of your list is inactive, those votes outweigh your real fans, and the filters start treating everyone's copy as unwanted, including your best customers.
The fix:
Suppress contacts with no opens or clicks in 120 days (90 for high-frequency senders).
Tag contacts by recency (engaged in the last 14, 30, 60, and 120 days) and send your most important campaigns to the most recent groups first.
Run a short re-engagement campaign before suppressing anyone, and remove those who don't respond.
Mistake 2: Blasting the Whole List After a Quiet Period
Found in 5 of 10 audits.
Mailbox providers build your reputation on patterns. A sudden jump in volume, especially to people who haven't heard from you in months, looks exactly like a spammer who just bought a list.
A consumer healthcare brand went from about 160,000 emails a month to 4.9 million in roughly two months. Gmail rate-limited them, the spam complaint rate peaked at 4.0%, open rates fell from 40–60% to about 20%, and inbox placement tests showed 0% delivery to the inbox at Gmail and Outlook.
The real estate firm sent two full-list announcements that made up 83% of its annual volume. One of them produced a 2.2% complaint rate, about seven times Google's limit.
The media brand sent two December blasts (40% of its yearly volume), then went almost silent for three months. Microsoft ended up routing 100% of test emails to spam.
A small professional services business sent about 19 emails per contact per month. Its Yahoo complaint rate hit 3.8% and Google rated the domain's reputation "bad."
Why it hurts: A quiet period erases the positive history that would normally cushion a spike. The blast then lands on the least-engaged part of the list and generates complaints, and with no recent good sends to balance them, reputation drops fast.
The fix:
Keep a steady weekly cadence, even if it's small.
Ramp volume gradually. If you need to send a big announcement, send it to your most engaged segment first and expand over several days while watching complaints.
Cap frequency. For most marketing programs, around four emails per contact per month is a safe ceiling.
Mistake 3: Letting Bad Addresses Onto the List
6 of 10 audits had bounce rates that peaked above 3%.
Bounces tell mailbox providers you don't know who you're emailing. The worst cases came from addresses that should never have been on the list:
An independent publisher's abandoned-cart automation was flooded by bots through an e-commerce security gap. That single flow bounced 37–77% of the time while the regular newsletter stayed under 1%. It was enough to tank the domain's reputation at Microsoft, where inbox placement fell to 0%.
The media brand imported three B2B contact lists that bounced at 25–33%.
The real estate firm had about 4,700 contacts whose domains had no mail server at all, which means a guaranteed bounce on every send.
A medical aesthetics practice saw bounces peak at 27.7%, and over 1,100 contacts used a fake "noreply" domain.
The healthcare brand had hundreds of typo domains like gmail.con and gmai.com on its list.
The fix:
Validate addresses at the point of entry (signup forms, checkout, imports), not just once a year.
Protect forms and automations with bot protection like CAPTCHA or double opt-in, and alert on sudden spikes in signups.
Never send to an imported list without running it through a verification tool first.
Run your full list through verification quarterly, and suppress hard bounces after one occurrence.
Mistake 4: Running Cold Outreach From the Domain Customers Rely On
Found in 3 of the 5 audits that included sales outreach.
Cold email naturally gets low engagement and more complaints. When it shares a domain with invoices, onboarding emails, and client conversations, that risk spreads to everything.
A consumer services company ran a six-week cold sequence from its main domain: about 281,000 sends at a 0.43% reply rate. It was the main driver of their complaint spikes. Reply rates dropped from 1.1% on the first email to 0.2% from the second onward, so emails three through six added spam risk while producing almost nothing. Meanwhile, the same team's transactional and post-sale emails were getting 7–19% reply rates.
A recruiting firm's candidate outreach was flagged by Microsoft's machine-learning filters as resembling recruiter phishing, a common scam. Because it shared a domain with client mail, client emails started landing in junk too, even though Microsoft's message trace said "delivered." After we escalated with Microsoft and the false positive was cleared, seed-test inbox placement went from 75% to 95%.
Two programs also shared a timing mistake: Friday carried the most volume and got the worst results. One team's Friday reply rate was 3.5%, versus 9.7–10.2% Tuesday through Thursday.
The fix:
Send cold outreach from separate, dedicated domains (for example, getcompany.com or trycompany.com), and keep the main domain for customers and staff.
Warm new domains for at least two to three weeks before using them, and keep spare domains warming so you can rotate if one degrades.
Keep sequences to two or three emails. Our data showed nearly all replies come from the first two touches.
Shift volume to midweek and check your own day-of-week reply data.
Mistake 5: Authentication with Holes
Found in 5 of 10 audits.
Most teams set up SPF, DKIM, and DMARC once, for their main email platform, and then forget about it. Then someone adds a CRM, a form tool, an investor portal, or a transactional email service that sends on the same domain, and nobody updates DNS.
The real estate firm's investor portal wasn't included in SPF. Investor emails were exactly the messages the client told us were going to spam.
An estate planning law firm's business email was being signed with an old brand domain instead of their current one, so SPF and DKIM both failed. DMARC was set to p=none with no reporting. Inbox placement at Google was 0%.
The consumer services company had three sending tools missing from SPF and DMARC enforced on only 25% of failing mail.
The publisher had two conflicting DMARC records, which made DMARC fail entirely.
One business had DMARC reports going to five individual staff inboxes, where nobody read them.
The fix:
List every tool that sends email as your domain, then confirm each one passes SPF and DKIM with alignment. Watch SPF's 10-DNS-lookup limit as you add senders.
Publish exactly one DMARC record and send reports to a DMARC monitoring tool, not a person's inbox.
Start at p=none to collect data, then move to p=quarantine and eventually p=reject once all legitimate mail passes.
For reference, the current mailbox provider rules: Google's sender guidelines require SPF, DKIM, and DMARC for bulk senders (roughly 5,000+ emails a day to Gmail), and Microsoft began routing non-compliant high-volume mail to Junk on May 5, 2025. Both require DMARC of at least p=none. Stricter policies are best practice, not a requirement.
Mistake 6: Weak Consent and Opt-out
Found in 6 of 10 audits. When people don't remember signing up, or can't easily unsubscribe, they hit "Report spam." That single click does far more damage than an unsubscribe.
The healthcare brand's marketing consent was buried in its Terms of Service, and its unsubscribe wasn't one-click compliant.
At the consumer services company, there was no clear opt-in, and our auditor received marketing emails without ever signing up.
The real estate firm had no explicit opt-in checkbox. Its 2.2% complaint spike suggests many recipients didn't expect the email.
The recruiting firm's sales and candidate outreach had no opt-out at all, which fails CAN-SPAM.
The fix:
Add a clear, unchecked marketing consent checkbox to every signup form, and keep it separate from your Terms of Service.
Enable one-click unsubscribe (the List-Unsubscribe header). Google requires it for marketing email from bulk senders.
Include a simple opt-out line in cold outreach, and honor it immediately.
Mistake 7: Watching the Wrong Numbers
At least 7 of 10 audits had a serious problem hidden inside an average. The most dangerous deliverability problems don't show up in a dashboard's top-line numbers.
Averages hide provider-level failures. The consumer services company's Gmail placement was 100%, but Yahoo, AOL, and Apple sent 100% to spam, and Yahoo-family addresses were about a quarter of the list (roughly 75,000 people). The healthcare brand had the reverse: Yahoo and Apple were fine while Gmail and Outlook were at 0%.
"Delivered" doesn't mean "inboxed." The recruiting firm's message traces said "delivered" while client emails sat in junk. Delivered only means the receiving server accepted the message.
Falling unsubscribes can be bad news. In three programs, unsubscribe rates dropped because emails weren't reaching people at all.
Rising open rates can be misleading. The publisher's open rates "improved" only because the list had shrunk to a small, loyal core.
Security scanners fake engagement. At the real estate firm and its sister media brand, 6–10% of contacts sat behind corporate security filters (Proofpoint, Mimecast, and others) that automatically open and click links, inflating engagement.
The fix:
Check deliverability by mailbox provider, not overall. Use Google Postmaster Tools, Yahoo Sender Hub, and Microsoft SNDS.
Run an inbox placement (seed) test monthly and before big sends.
Treat clicks and replies as your main engagement signals. Read open and unsubscribe rates in context.
Honorable Mention: Links and Images
Content was rarely the root cause, but it made bad situations worse. The medical aesthetics practice sent emails with up to 58 links and 14 images, and the publisher's emails carried 1.1 MB of images. The healthcare brand was using a link-tracking domain that spam filters had flagged, which sent messages straight to spam. Five of the 10 programs had link-tracking problems: either a flagged tracking domain or no custom tracking domain on some or all of their sending.
Keep links under about 10 and images under about seven per email, compress images, and set up a custom tracking domain in your email platform.
One more lesson from the aesthetics practice: we tested versions of their email with no spam trigger words and no links, and they still went to spam. When clean content fails, the problem is reputation, not copy.
A 15-Minute Self-check
Before your next campaign, run through these:
Pull your spam complaint rate from Google Postmaster Tools. Google says to keep it below 0.1% and never reach 0.3%.
List every tool that sends as your domain and confirm each passes SPF and DKIM.
Check that you have exactly one DMARC record, with reports going to a monitoring tool.
Count contacts with no engagement in 120 days. If it's more than a third of your list, start a sunset policy.
Look at bounce rates per automation, not just per campaign.
Make sure cold outreach isn't sending from your main domain.
Confirm one-click unsubscribe is enabled on marketing emails.
Run a seed test and read the results by provider.
If you're comparing platforms, our guide to the top email marketing tools is a useful starting point. Just remember that none of them can fix a list or a domain reputation on their own.
When to Bring in a Specialist
Most of these fixes are well within reach for an in-house team. It's time for outside help when inbox placement is at 0% with a major provider, your domain shows up on a blacklist, complaint rates stay above 0.3% after you've cleaned the list, or you can't work out which of several sending tools is causing the damage. That's the work we do every day at Formula Inbox, starting with an email deliverability audit that breaks results down by provider, sending tool, and list segment.
The good news from all 10 audits: none of these problems were permanent. Reputation recovers when you stop sending what recipients don't want and start sending what they do.
FAQ
What is a good spam complaint rate?
Google recommends staying below 0.1% and never reaching 0.3%. In our audits, the biggest spikes traced back to large blasts, long cold sequences, or bad addresses getting onto the list.
Why are my emails going to spam if SPF, DKIM, and DMARC pass?
Authentication only proves who you are. Inbox placement depends on reputation, which comes from engagement, complaints, bounces, and volume patterns. Four of the 10 programs we audited had perfect authentication and still landed in spam.
How long does it take to recover deliverability?
Straightforward issues like a missing SPF entry can improve within a few weeks. Rebuilding a damaged domain reputation can take three months or more of consistent, well-targeted sending.
Should I use a separate domain for cold email?
Yes. Cold outreach carries more complaint risk, and keeping it on separate domains protects the deliverability of your customer and business email.
