If your order confirmations, shipping updates, or cart-reminder emails keep landing in spam instead of your customers' inboxes, the cause usually isn't your subject line. It's almost always one of three things: missing email authentication, a messy contact list, or a sending pattern that looks suspicious to mailbox providers. This guide walks through what's actually going on and how to fix it.
Delivered vs. Delivered to the Inbox: Two Different Things
A lot of store owners assume that if their email platform reports a message as "delivered," the job is done. It isn't. Delivery just means a mailbox provider's server accepted the message — it says nothing about whether that message landed in Primary, got shoved into Promotions or Spam, or was filtered out entirely. This gap between "delivered" and "actually seen" is where a lot of ecommerce revenue quietly disappears.
Mailbox providers like Gmail, Yahoo, and Outlook watch how you send, not just what you send. An online store that stays quiet for weeks and then blasts its entire list the moment a sale launches looks a lot like a compromised account or a spam operation to an automated filter — even if every word in the email is legitimate.
Why Ecommerce Sending Patterns Trigger More Spam Filters
Two things make ecommerce lists riskier than a typical B2B mailing list:
- Uneven sending volume. Quiet for a month, then a flood of emails during a flash sale — that spike pattern is exactly what spam filters are tuned to catch.
- Stale contact lists. Ecommerce lists pick up dead weight fast: one-time buyers from years ago who never opened another email, checkout opt-ins typed in a hurry (typos and disposable addresses included), and contacts who were never valid to begin with.
Put an erratic sending curve together with a stale list, and you've built the exact profile spam filters are designed to flag.
The Authentication Basics: SPF, DKIM, and DMARC
Google, Yahoo, and Microsoft now require proper email authentication from any sender pushing meaningful volume. If you haven't set these up, this is where to start:
- SPF tells a receiving mail server which servers are allowed to send email on behalf of your domain.
- DKIM adds a digital signature to your outgoing mail that proves it wasn't tampered with in transit.
- DMARC ties SPF and DKIM together and tells receiving servers what to do with a message that fails either check — anything from letting it through to rejecting it outright.
- BIMI is optional, but once DMARC is properly enforced, it lets your logo appear next to your emails in supported inboxes, which can help a promotional email stand out.
A misconfigured SPF record is one of the most common reasons a legitimate store's emails get rejected outright rather than just filtered to spam — it's worth double-checking before any big sale.
Beyond authentication, Google and Yahoo also require a working one-click unsubscribe link and a spam-complaint rate that stays under a strict threshold. During a heavy promotional push, sending more often to a broader list raises the odds that someone hits "report spam" instead of unsubscribing — and complaint rate is one of the fastest ways to damage your sending reputation.
Diagnosing a Deliverability Problem
When emails aren't landing where they should, start by separating a rejection from a filtering problem:
- Check your bounce codes. A hard bounce or outright rejection usually points to a broken authentication record or a blacklist listing.
- Look at where messages are landing. Soft filtering to spam or promotions usually points to engagement and reputation issues rather than a technical block.
- Fix the technical layer first — authentication and blacklist status — before you touch content or sending frequency.
Watch Out for Shared Sending Infrastructure
If you send email through a shared IP pool (common with many marketing platforms), your inbox placement is partly determined by everyone else sharing that pool. If another sender on the same infrastructure gets flagged for spam complaints, your own emails can suffer collateral damage even with a clean sending history.
List Hygiene Trouble Spots
- Checkout opt-ins: typed quickly under purchase pressure, so typos and disposable addresses slip through more than on a dedicated signup form.
- No sunset process: without a routine to reduce sending frequency to (or remove) unengaged subscribers, your list stays weighted down with dead addresses.
- Spam traps: addresses seeded specifically to catch senders with poor list hygiene. They tend to show up in old, purchased, or scraped lists, and hitting even one can hurt your reputation disproportionately.
Free Tools to Check Your Standing
Google Postmaster Tools and Microsoft SNDS are both free and give you a direct look at how those providers see your domain — spam rate, reputation, and authentication status. Check them before a big sale, not just after something goes wrong.
| Signal | Healthy domain | At-risk domain |
|---|---|---|
| Spam complaint rate | Well below the provider threshold | Approaching or exceeding it |
| Authentication | SPF, DKIM, DMARC all passing and aligned | One or more missing or misaligned |
| Sending pattern | Steady baseline, gradual increases | Long quiet stretches followed by spikes |
| List engagement | Most contacts open or click within 30 days | Large share never engage |
| Blacklist status | No active listings | One or more active listings |
Ramping Up Safely Before a Sale
Stores that get through big sale events cleanly start increasing send volume weeks in advance, not the day before. That means gradually raising frequency against your most engaged segment first, watching complaint rates and spam placement the whole way, and holding volume steady instead of doubling it overnight when the sale goes live. A domain with a strong, gradually built sending history has far more headroom once volume spikes than one that's been sitting at a flat, low baseline all year.
Keep Transactional and Marketing Email Separate
Order confirmations, shipping updates, and password resets are evaluated differently by mailbox providers than promotional campaigns. If both streams share the same sending domain, a spike in promotional spam complaints can drag down the delivery of transactional email your customers are actively waiting for. Sending marketing and transactional mail from separate subdomains — each with its own SPF and DKIM under one root DMARC policy — contains that risk, since a reputation hit on one side doesn't touch the other.
Common Issues
My emails have a good delivery rate but low open rates. Why?
A good delivery rate only means the message was accepted by the mail server — it doesn't mean it reached the inbox. Check your Promotions/Spam placement specifically, not just delivery reports.
Do I need DMARC if I already have SPF and DKIM?
Yes. DMARC is what tells receiving servers what to actually do when a message fails an SPF or DKIM check, and major providers now expect it from bulk senders.
Should transactional and marketing email use the same domain?
It's safer to split them onto separate subdomains so a reputation problem on your marketing side never affects order confirmations and receipts.
Getting deliverability right isn't a one-time fix — it's authentication done correctly, a list you actually maintain, and a sending pattern that ramps up gradually ahead of every sale, not just the big ones.
