How to Prevent Emails From Going to Spam: The Sender Rules, Record by Record

Mailbox providers decide where your email lands from a few signals: whether your domain proves it sent the message, whether recipients complain, and whether they asked for it. Since 2024, Gmail and Yahoo have written those signals down as rules, and Outlook.com followed in 2025. This guide covers each rule, the DNS records behind them, and how to keep the emails a store can't afford to lose out of the spam folder.

Why emails go to spam

Filters don't read intent. They read evidence, and most of it falls into three groups.

Content matters less than most checklists suggest. A clean subject line won't save a domain with no DKIM and a complaint problem. Fix identity and consent first, then look at the copy.

For a store, the cost of the spam folder isn't only a weaker campaign. An order confirmation that never arrives sends the customer to support or to their bank. A failed-payment notice that lands in spam means a renewal that never gets fixed. A missed reminder before a free trial converts can turn into a dispute. These emails deserve the most protection, and they're the ones a bad marketing blast can drag down with it.

The Gmail, Yahoo and Outlook sender rules

Google's rules took effect on February 1, 2024, and Google says it has been ramping up enforcement on non-compliant traffic since November 2025.1Google, Email sender guidelines (Google Workspace Admin Help)2Google, Email sender guidelines FAQ Yahoo published matching rules for bulk senders.3Yahoo Sender Hub, Sender best practices Microsoft followed for Outlook.com, Hotmail.com and Live.com addresses: since May 5, 2025, domains sending more than 5,000 emails a day that fail the checks are rejected with the code 550; 5.7.515 Access denied.4Microsoft Tech Community, Outlook's new requirements for high-volume senders (April 2, 2025, updated April 29, 2025)

Two details catch stores out. First, Google counts subdomains with their main domain: 2,500 messages from yourstore.com and 2,500 from news.yourstore.com make you a bulk sender, and once you've crossed 5,000 in a day, you stay one permanently.2Google, Email sender guidelines FAQ Second, Microsoft's checklist recommends a From or Reply-To address that can actually receive replies.4Microsoft Tech Community, Outlook's new requirements for high-volume senders (April 2, 2025, updated April 29, 2025) A no-reply@ address on a receipt works against that, and it's also the address an unhappy customer will try to answer before calling their bank.

Set up SPF, DKIM and DMARC

The three records do different jobs. SPF lists the servers allowed to send for a domain. DKIM signs each message so the receiver can check it wasn't altered. DMARC ties both to the address the customer sees in the From line and tells receivers what to do when the check fails.

SPF: who may send for your domain

SPF is a TXT record on the domain used in the envelope sender (the Return-Path), not necessarily the visible From.6RFC 7208, Sender Policy Framework (SPF)

yourstore.com.  TXT  "v=spf1 include:_spf.your-mailbox-host.example include:_spf.your-email-platform.example ~all"

• One record per domain. Two v=spf1 records make the check fail with a permanent error.6RFC 7208, Sender Policy Framework (SPF)
• 10 DNS lookups at most. Each include, a, mx and redirect counts. Store stacks hit this fast: mailbox host, email platform, helpdesk, review app, invoicing tool. Past 10, SPF returns a permanent error, which is not a pass for Gmail, Yahoo or Microsoft.6RFC 7208, Sender Policy Framework (SPF)
• End with ~all or -all. Soft fail or fail for anything not listed. Never +all.

DKIM: a signature on every message

Your email platform generates a key pair and gives you a public key to publish under a selector.7RFC 6376, DomainKeys Identified Mail (DKIM) Signatures

s1._domainkey.yourstore.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...IDAQAB"

Make sure each tool signs with your domain (d=yourstore.com in the signature), not its own. A platform signing as d=platform-mail.example passes DKIM but doesn't align with your From address, so it doesn't help DMARC.

DMARC: policy and reports

DMARC lives at _dmarc on the From domain.8RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC)

_dmarc.yourstore.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourstore.com"

A message passes DMARC when SPF or DKIM passes and the domain that passed matches the From domain. Relaxed alignment, the default, accepts a subdomain: DKIM signed by mail.yourstore.com aligns with a From of orders@yourstore.com.8RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC) The rua address receives daily aggregate reports listing every server that sent mail as your domain. Yahoo recommends including it.3Yahoo Sender Hub, Sender best practices

p=none meets all three providers' rules. Going further is about protection: payment and order emails are what phishers copy, and only quarantine or reject tells receivers to stop delivering fakes that use your domain.

Add one-click unsubscribe to marketing email

Gmail and Yahoo require one-click unsubscribe on marketing and subscribed messages from bulk senders, on top of a visible link in the body.1Google, Email sender guidelines (Google Workspace Admin Help)3Yahoo Sender Hub, Sender best practices The mechanism is RFC 8058: two headers that let the mailbox show its own "Unsubscribe" button and send the request for the user.

List-Unsubscribe: <https://news.yourstore.com/u/8f3a2c9e>, <mailto:unsubscribe@news.yourstore.com?subject=8f3a2c9e>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

What RFC 8058 requires from the sender:5RFC 8058, Signaling One-Click Functionality for List Email Headers

Then honor the request: within 48 hours, Google suggests; within 2 days, Yahoo requires.2Google, Email sender guidelines FAQ3Yahoo Sender Hub, Sender best practices US law gives you 10 business days, but the mailbox rules are stricter.10FTC, CAN-SPAM Act: A Compliance Guide for Business

Transactional messages are outside this rule. Google names password resets and reservation confirmations as examples.2Google, Email sender guidelines FAQ Order confirmations, receipts and shipping updates don't need the header. A one-click unsubscribe on a failed-payment email would even be counterproductive: a customer could stop the very notice that saves their subscription.

Separate transactional and marketing email

Every provider points the same way. Google advises against mixing content types in one message and suggests a different IP address and From address for each type.1Google, Email sender guidelines (Google Workspace Admin Help) Yahoo recommends not sending bulk or marketing mail from the IPs used for transactional or alert mail, because each IP and DKIM domain builds its own reputation.3Yahoo Sender Hub, Sender best practices Postmark splits traffic into transactional and broadcast streams, on separate subdomains with their own DKIM and Return-Path, so broadcast traffic doesn't slow transactional delivery.9Postmark, How to create and send through message streams

Each subdomain gets its own DKIM key and Return-Path, and ideally its own IP or provider stream. A campaign that draws complaints then hurts news., not the receipts. Two limits: Google still counts every subdomain toward the 5,000-a-day threshold of the main domain, and your DMARC policy on yourstore.com applies to subdomains unless you set sp=.2Google, Email sender guidelines FAQ8RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC)

The emails to put on the protected stream are the ones with money attached:

• Order confirmation and receipt. The customer's proof of what they paid and to whom. Our guide to the payment confirmation email covers what to put in it, including the billing descriptor they'll see on their statement.
• Failed payment and card update. The core of dunning: if it lands in spam, the renewal fails for good. The causes on the payment side are in subscription payment failures.
• Trial-end and renewal reminders. Visa requires a notice at least 7 days before the payment when a trial, introductory offer or promotion ends, with the amount, the payment date and a simple way to cancel.13Visa Core Rules and Visa Product and Service Rules, April 18, 2026 A notice nobody sees doesn't protect you in a dispute. More in negative option billing.
• Refund and cancellation confirmations. A customer who doesn't see one tends to file a chargeback.

Keep promotions out of these emails. Beyond deliverability, CAN-SPAM judges a mixed message by its primary purpose: if the subject line reads like an ad, or the transactional part isn't mainly at the beginning, the whole email is treated as commercial and needs an opt-out.10FTC, CAN-SPAM Act: A Compliance Guide for Business

Inside Tagada

Build the funnel once, route every customer to the right offer

Checkout, upsells and subscriptions on one flow, with conditions per country, order or customer.

Start free

Get consent and keep your list clean

Complaints come from people who didn't expect your email. The fix is upstream, at the moment you collect the address.

Sources: FTC CAN-SPAM guide10FTC, CAN-SPAM Act: A Compliance Guide for Business; Directive 2002/58/EC, Article 13.11Directive 2002/58/EC (ePrivacy Directive), Article 13 A checkout checkbox that is pre-ticked or bundled with the terms is weak consent in the EU and a complaint generator everywhere.

Then keep the list honest:

Double opt-in, where a new subscriber confirms by clicking a link, isn't required by Gmail, Yahoo or US law, but it removes typos and fake signups before they cost you anything. Keep customers who unsubscribed from marketing on the transactional list: they still need their receipts.

Warm up a new domain or IP

A domain or IP with no history has no reputation. Sending a full list from it on day one looks like a spammer who just registered a domain. Ramp up instead: start with your most engaged recipients (recent buyers, recent openers), keep a steady daily rhythm, and raise volume while bounces and complaints stay low. Most email platforms publish their own warm-up schedule for dedicated IPs; follow your provider's, since it knows its infrastructure.

The same logic applies when you migrate platforms. Reputation is attached to the domain and IP, so a new IP starts from zero even if the domain is old. Don't schedule a migration the week before a big sale.

Choosing a sending tool for volume is a separate question, covered in our guide to sending bulk emails.

What filters still read in the content

Content is a weaker signal than identity and complaints, but it isn't zero. The reasoning matters more than any list of "spam words," which no provider publishes.

• Mismatch. A subject line that promises something the email doesn't deliver is deceptive under CAN-SPAM and draws complaints.10FTC, CAN-SPAM Act: A Compliance Guide for Business
• Links. Filters check the reputation of linked domains. URL shorteners and links to a domain unrelated to yours look like phishing, especially in a "payment failed" email.
• One big image. An email that is a single image gives filters nothing to read and shows nothing when images are blocked. Send real text and a plain-text version.
• Attachments. Invoices as PDF attachments can trigger scanning; a link to the invoice in the customer's account avoids it.
• Brand consistency. The From name, the From domain and the links should all say the same store. A receipt from Shop <noreply@mailer-123.example> linking to a third domain looks forged.

Monitor before you troubleshoot

Google Postmaster Tools shows, for verified domains, your spam rate, reputation, authentication and delivery errors for mail sent to personal Gmail accounts. Its compliance status dashboard marks each sender requirement as Compliant or Needs work.12Google, Postmaster Tools dashboards (Gmail Help) Two caveats from Google itself: data can take up to 7 days to appear, and when Gmail already filters a lot of your mail, the spam rate can look artificially low because fewer people see the messages in their inbox.12Google, Postmaster Tools dashboards (Gmail Help)

Add your DMARC aggregate reports (every server sending as your domain) and your platform's bounce logs. Together they answer most questions before a customer emails "I never got my receipt."

Diagnose it: symptom, cause, fix