- It's rarely the words in your subject line
- The technical setup that decides your fate
- Your sending reputation is a credit score, and most people never check it
- Engagement is the uncomfortable part nobody wants to hear
- What spam filters scan for in your content
- What to do this week
- Why this matters more than your open rate metric alone shows
- Frequently asked questions
The short version: your email lands in spam because of technical authentication gaps, your sending reputation, and how many people ignore or delete you without opening, not because you used the word "free" or added an exclamation mark. Fix the boring infrastructure first, then worry about the words.
I once had a client, a lovely woman running a small skincare brand, who spent three weeks rewriting her welcome email because she'd read somewhere that the word "guarantee" triggers spam filters. She rewrote it four times. Open rate never moved past 11%. Turned out her domain had no DMARC record set up at all, and half her list hadn't opened an email from her in eight months. The word "guarantee" was never the problem. Gmail simply didn't trust her domain, and her own subscribers had trained the algorithm to ignore her.
That's the story I tell every time someone asks me about spam filters, because it's the pattern I see over and over. People obsess over copy when the real issues sit underneath, in places they never think to look.
It's rarely the words in your subject line
Old advice still floating around says never use "free," "buy now," "cash," or too many capital letters. That advice was accurate around 2010. Modern spam filters, especially Gmail's, use machine learning models that look at hundreds of signals together, not a blacklist of scary words. A well-authenticated, well-engaged sender can write "FREE MONEY NOW!!!" in the subject line and still land in the inbox. A poorly authenticated sender can write something perfectly polite and still get filtered.
I'm not saying write reckless subject lines. I'm saying stop treating word choice as your main lever. It isn't. It's maybe 5% of the equation.
The technical setup that decides your fate
Three records sit behind every email you send, and if they're missing or wrong, you're fighting uphill before a single subscriber even sees your name:
- SPF (Sender Policy Framework) tells receiving servers which mail servers are allowed to send on your domain's behalf.
- DKIM (DomainKeys Identified Mail) adds a digital signature that proves the email wasn't tampered with in transit.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do if SPF or DKIM checks fail, and gives you reporting so you can see abuse.
Google and Yahoo made this non-negotiable in February 2024: any sender pushing more than 5,000 emails a day to Gmail or Yahoo addresses must have valid SPF, DKIM, and DMARC, plus a one-click unsubscribe link, or their mail gets bounced or bulk-folder'd outright. I've watched agencies who ignored this warning lose 40% of their inbox placement within a fortnight of the deadline passing, purely because nobody checked their DNS records.
You can check yours in about two minutes using a free tool like MXToolbox or by asking your email service provider (Mailchimp, Klaviyo, ActiveCampaign all have a setup checklist). If you've never touched your DNS records, there's a decent chance at least one of these three is missing or misconfigured right now.
Your sending reputation is a credit score, and most people never check it
Every domain and IP address you send from builds up a reputation with Gmail, Outlook, and Yahoo based on how recipients behave. Do they open? Do they reply? Do they mark you as spam? Do they delete without reading? Do they just never engage at all? That reputation follows you the same way a credit score follows you between banks. A cold email tool with a dodgy history of complaints can tank your deliverability even if you've never sent a bad email through it, because you're sharing infrastructure with people who did.
Google Postmaster Tools is free and shows you your domain reputation directly from Gmail's own data. Most business owners have never opened it. If your reputation shows as "low" or "bad," no amount of clever copywriting will fix that. You need weeks of clean sending, verified authentication, and better list hygiene before Gmail trusts you again.
Engagement is the uncomfortable part nobody wants to hear
Here's the bit that makes people uncomfortable: your inactive subscribers are actively hurting you. Gmail and Outlook watch what happens after you hit send, and if a big chunk of your list opens nothing, clicks nothing, and just lets your email sit there unread for months, the algorithm reads that as a signal you're not wanted. It doesn't matter that they never unsubscribed. Silence is treated almost as harshly as an actual spam complaint.
This is the part most guides skip because it means telling clients to delete people. I've had to tell business owners with 40,000-strong lists that 60% of it is dead weight actively damaging the other 40%. Nobody enjoys hearing that their "big list" is a liability, but I've watched open rates jump from 14% to 31% within one send cycle purely from removing anyone who hadn't opened in 180 days. Fewer people saw the email. More of them got it.
If you've ever bought or rented an email list, this problem is worse, because those addresses were never yours to begin with and they're the fastest way to torch a domain's reputation in a single afternoon.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
What spam filters scan for in your content
Beyond authentication and engagement, filters do still scan the message itself, just for different things than people assume:
- A huge mismatch between image and text, like an email that's 95% image with almost no readable text, which spammers use to dodge keyword filters.
- Broken or mismatched links, where the visible text says one domain but the actual link goes somewhere else entirely.
- Too many links crammed into a short email, especially shortened URLs from services like bit.ly, which spammers historically used to hide destinations.
- Missing or fake physical address and unsubscribe link, which breaks CAN-SPAM Act rules in the US and PECR/UK GDPR rules in Britain, both legally required regardless of filters.
- Sloppy HTML with broken tags, leftover template code, or huge file sizes, which some filters read as a sign of low-quality automated spam tools.
None of these alone will bury you. Stack three or four together on a domain with a shaky reputation and you're finished before the email even renders.
What to do this week
- Check your SPF, DKIM, and DMARC records using a free checker or your ESP's built-in tool.
- Open Google Postmaster Tools and see what your actual domain reputation looks like from Gmail's side.
- Segment out anyone who hasn't opened an email in the last 90 to 180 days and either send a re-engagement sequence or remove them.
- Check every link in your last three campaigns goes where the anchor text says it does.
- Send a plain-text-heavy test to a Gmail, Outlook, and Yahoo address before your next big campaign, not just to your own inbox.
If this all feels like more than you want to untangle alone, this is exactly the kind of technical mess an AI consultant for small business gets pulled into constantly, because deliverability sits right at the intersection of marketing and IT, and most business owners have nobody covering that gap.
Why this matters more than your open rate metric alone shows
There's a newer wrinkle worth knowing about. AI-powered inbox tools and summary features are now reading and categorising emails before a human ever sees them, which changes what "opened" even means. I've written before about how AI is reading your marketing emails before your customers do, and it's part of why deliverability strategy from five years ago is already out of date. The filters aren't just checking spam anymore, they're deciding what's even worth a human's attention.
If you want the fuller data picture on how email performance has shifted, the numbers in Email Marketing in 2023: The 30 Stats You Need to Know still hold up as a useful baseline, and if you're wondering whether email is even worth this effort in 2026, I answered that directly in is email marketing still effective.
Related: machine learning (this site).
If that's your next question, see why your emails might be headed straight to spam. I've also covered what the .com at the end of an email address means in a separate guide.
Frequently asked questions
Why did my email suddenly start going to spam when it never did before?
Something changed, and it's almost always one of three things: your domain reputation dropped because engagement fell, a DNS record broke or expired, or you sent a sudden spike in volume that looked suspicious compared to your normal sending pattern. Check Google Postmaster Tools first, it usually shows exactly when the drop happened.
Does using words like "free" or "buy now" get my email marked as spam?
Not on its own, not anymore. Modern filters weigh authentication, sender reputation, and engagement far more heavily than specific words. A trusted sender can use those words freely; an untrusted sender will get flagged regardless of how careful the copy is.
How do I know if my SPF, DKIM, and DMARC records are set up correctly?
Use a free tool like MXToolbox or the built-in authentication checker inside your email service provider. It takes about two minutes and will tell you clearly which of the three, if any, are missing or misconfigured.
Should I remove subscribers who never open my emails?
Yes, generally after 90 to 180 days of no opens or clicks. Inactive subscribers drag down your sender reputation in the eyes of Gmail and Outlook, and removing them typically improves inbox placement and open rates for everyone who's still reading you.
