Why does mail go to spam when SPF, DKIM and DMARC pass?

Passing SPF, DKIM and DMARC shows that your domain's setup authorises the sender. It does not show that recipients want the mail. Mailbox providers such as Gmail and Yahoo check authentication first. Then they choose between the inbox and the spam folder on other signals. This page covers four of them: how often recipients mark your mail as spam, the reputation of your domain and of the servers that send for it, what the message contains, and whether it was forwarded. Before you work through those, make sure the pass you saw is a pass for your domain.

Make sure the pass is for your domain

DMARC counts a pass only when it is aligned: SPF or DKIM passed for the domain in the From address, the one recipients see. A sending service can pass SPF for its own bounce domain and DKIM for its own signing domain, while your domain fails DMARC. When a service says your domain is authenticated, verified or connected, check the result in a real message anyway.

To see the result, send a message to a Gmail address of your own and open it there. Choose More, then Show original, and the full header opens in a new window. Find the line that starts with Authentication-Results. It holds one result for each check, with the domain it checked:

spf=pass smtp.mailfrom=… is SPF, checked for the domain of the envelope sender.
dkim=pass header.d=… or header.i=… is a DKIM signature, checked for the signing domain.
dmarc=pass header.from=… is DMARC, checked for the domain in the From address.

If the DMARC result is pass with your domain, the mail passes, and the rest of this page applies. If it is fail, or there is no DMARC result, the problem is authentication after all. Who has to fix it? finds the service and the change.

One message shows one sending service. Your own mailbox can pass while your newsletter tool, your webshop or your invoicing service fails. Each service that sends as your domain needs its own setup, and your DMARC reports list them all.

Authentication is the first check, not the last

Google lists what it requires of everyone who sends to personal Gmail accounts: SPF or DKIM, valid forward and reverse DNS for the sending servers, a TLS connection, a spam rate below 0.3 percent, messages formatted to RFC 5322, and no From addresses that impersonate Gmail. Yahoo's list for every sender is close: SPF or DKIM, a spam rate below 0.3 percent, valid DNS records for the sending servers, and mail that follows RFC 5321 and RFC 5322.

Meeting these gets your mail considered. It does not promise the inbox. Of mail sent through email service providers, Google's guidelines say: "We can't guarantee messages sent by email providers will pass Gmail's spam filters." What Google, Yahoo and Microsoft ask of senders lists the rest of their rules.

Recipients mark your mail as spam

Your spam rate is the share of your mail that recipients report as spam. Gmail and Yahoo both set a ceiling for it, and both apply it to every sender, small ones included.

Gmail. Google's FAQ says senders "should keep their spam rate below 0.1% and should prevent spam rates from ever reaching 0.3% or higher". Gmail calculates the rate daily. Above 0.3 percent, Google gives bulk senders no delivery support or mitigation. A bulk sender is eligible again once its rate stays below 0.3 percent for 7 consecutive days. Google Postmaster Tools shows the rate Gmail measures for your domain.
Yahoo. "Keep your spam rate below 0.3%." Yahoo calculates the rate on mail delivered to the inbox. Once you sign your mail with DKIM, its complaint feedback loop can help you track the complaints.

Mail that people did not expect raises the rate. Yahoo writes that "sending unsolicited commercial email can negatively affect your reputation". It also warns against sending to people who do not read your mail or who report it as spam. Google requires one-click unsubscribe in the marketing and subscribed messages of bulk senders.

This part is yours to fix. Send to people who asked for your mail, make leaving the list easy, and stop mailing addresses that never read it.

Reputation

Mailbox providers keep a reputation for your domain and for the servers that send your mail. Yahoo: "Each IP and DKIM domain has a reputation, which can impact the delivery of your email." Google: "Over time, user spam reports can lower your domain's reputation."

A new domain or a new mailbox has no history. Google's advice is to "start with a low sending volume to engaged users, and slowly increase the volume over time". Send at a consistent rate, not in bursts.
Shared servers carry other senders' reputation. A sending service may send the mail of many customers from the same addresses. Google: "The activity of any senders using a shared IP address affects the reputation of all senders for that shared IP address." That reputation is the service's to look after. If mail you send through the service lands in spam and your other mail does not, ask the service's support.
An abused form counts against you. If someone used your website's contact form, or a hacked site, to send mail as your domain, the spam reports on that mail lower your domain's reputation. Yahoo's advice: "Filter user-generated content before sending it, to prevent spammers from using your resources." Close the hole first.

Content

Google's guidelines set these rules for what a message contains:

"Message headers and message content should be accurate, and not misleading or deceptive."
"Don't use HTML and CSS to hide content in your messages." Google adds that hiding content "might cause messages to be marked as spam".
"Web links in the message body should be visible and easy to understand."
"Don't mix different types of content in the same message. For example, don't include promotions in sales receipt messages."

Forwarded mail

When a recipient forwards your mail, for example from a work address to Gmail, Gmail receives it from the forwarding server, not from yours. Google's guide for forwarders says that "forwarded messages often fail SPF authentication", and that "Messages that don't pass DKIM are more likely to be sent to spam." A DKIM signature with your domain usually survives the forward, unless the forwarder changes the message. So DKIM is the setting on your side that helps.

The forwarding server has a reputation of its own. Google tells forwarders that when recipients mark forwarded messages as spam, later messages from the forwarding domain are more likely to be marked as spam too. That part is for whoever runs the forwarding. Forwarded and mailing-list mail fails DMARC shows how Mailmoni reports forwarded mail. If the message came back with an error instead of landing in spam, What does my bounce message mean? explains the code.

What your DMARC reports show

A DMARC aggregate report counts the messages each server sent as your domain, with their SPF, DKIM and DMARC results. It also records what the mailbox provider did under your policy. RFC 9990, the standard for these reports, calls that "the result of applying the DMARC policy".

The report has no field for the inbox or the spam folder, and the standard discourages adding one. In Mailmoni, a message that passed shows as "not applied" in the Disposition column, whether it then reached the inbox or the spam folder. So the reports answer the first question on this page: whether every service passes for your domain. When every service passes and mail still lands in spam, the cause is one of the four above, outside DMARC. For the spam rate Gmail measures, use Google Postmaster Tools.

Check every source in Mailmoni

Fix a source that fails DMARC shows how Mailmoni lists every source that sends as your domain and names the change for each one that fails.