Email deliverability: how spam filters work

Many cybersecurity providers, especially those focused on email protection, now deploy sophisticated artificial intelligence to analyze email routing behavior. These technologies simultaneously examine multiple aspects of your incoming message payload: sender identity, technical authenticity, content structure, tone, and the presence and nature of embedded attachments and links.

If an email displays any suspicious or dangerous markers, it is automatically filtered and blocked at the gateway, preventing it from ever reaching the recipient's primary inbox. Let's explore exactly how these filters operate and how you can architect your campaigns to pass through them seamlessly.

1. The Gateway Check: Technical Authentication Records

Before an AI filter even looks at the words in your email, it checks your technical passport. DMARC, SPF, and DKIM are the foundational pillars of modern email deliverability. They instantly dictate how strict the spam filter needs to be when scanning your payload.

a. SPF (Sender Policy Framework)

Role: An active DNS record that explicitly specifies which server IP addresses are legally authorized to transmit emails on behalf of your domain name.
Impact on Deliverability: If the SPF check fails, the message triggers an immediate high risk of total rejection or automatic spam routing. Major ISPs (Gmail, Outlook, Yahoo) use the SPF result as the primary variable to calculate their baseline spam score.

b. DKIM (DomainKeys Identified Mail)

Role: A digital cryptographic signature added to the email header that mathematically guarantees the content hasn't been intercepted or modified during transit.
Impact on Deliverability: Without a valid DKIM signature, modern email providers immediately classify the message as "less reliable." A passing DKIM signature builds trust in the domain and lowers the anti-spam aggression score.

c. DMARC (Domain-based Message Authentication, Reporting, and Conformance)

Role: A strict policy rule that gives receiving servers absolute instructions on exactly what to do if the SPF and/or DKIM checks fail.
Impact on Deliverability: Without DMARC, your domain is highly vulnerable to external spoofing, which puts the receiving filter in a highly suspicious posture. With a properly configured DMARC rule (even set to p=none), you achieve a significantly higher probability of passing alignment checks.

If your SPF/DKIM fail and DMARC is set to strict, immediate rejection is guaranteed. If SPF/DKIM pass but DMARC is missing entirely, you will trigger stricter content filtering and face a higher probability of landing in the "Promotions" or "Spam" folders.

2. Content Analysis & Structure

Once you pass the technical gateway, spam filters utilize AI to scan your email content—word by word, image by image, and link by link. To ensure high placement scores, you must avoid several common formatting traps.

2.1 Sender email address

Spam filters analyze both the host domain and the specific format of the sender address. Emails originating from domains deemed unreliable are automatically penalized.

• Use a custom, authenticated domain: We strongly advise against using free webmail addresses (like @hotmail.com, @gmail.com) for bulk broadcasting. These addresses are heavily penalized by filters, and DMARC policies at Yahoo and Google will actively block them. Always route traffic through a custom domain (e.g., @company.com).
• Avoid suspicious subdomains: Newly created, complex subdomains (like promo-2025-sale.mysite.com) are often identified as untrustworthy, burner domains and can be rapidly blacklisted.
• Never use "no-reply@" addresses: Addresses that block replies limit genuine recipient interactions. Inboxes track interaction loops (replies); a lack of replies actively harms your sender reputation score. Opt for friendly addresses like contact@company.com or firstname@company.com.
• Separate your traffic types: Protect your core reputation by segmenting traffic onto dedicated subdomains. For example, route receipts via invoices@company.com and marketing blasts via newsletter@company.com.

2.2 The Email Subject Line

Your subject line is closely scrutinized, and reckless choices here can spike your spam score instantly.

• Avoid Trigger Words: Words heavily associated with fraud trigger filters. Avoid: free, gift, urgent, 100% guaranteed, winner, cash, income, crypto.
• Avoid Camouflaged Variants: Bots easily spot deliberate misspellings designed to evade filters (e.g., FR€€, Fr33, $$$). Attempting to trick the filter usually results in an automatic block.
• Avoid Excessive Punctuation & Caps: ISPs reject subject lines loaded with special characters (!!!, ???, $, %, ♥, ✔). Similarly, writing an entire subject line in ALL CAPS is computationally flagged as aggressive or misleading.
• Never use Clickbait: Unrealistic promises (e.g., "Make $1,000 in a week") are categorized as deceptive. Furthermore, if recipients open a clickbait subject line and find unrelated content, they will manually click "Mark as spam"—which permanently damages your domain score.

2.3 The Sender Name

Inboxes evaluate the combined trust reputation of your "Sender Name + Email Address" string.

Ensure Consistency: Always deploy the same sender name to build stable reputation memory. Constantly changing your sender alias (e.g., randomly switching between "Customer Support", "Newsletter", and "Promo Team") confuses both recipients and the algorithmic filter.
Ensure Alignment: Your sender name must logically align with your domain. For example, a name like "Julie from StoreX" sending from julie@storex.com builds computational trust.

2.4 Email Body (Text, Media, and Links)

The internal structural weight and density of your email payload are carefully calculated by receiving servers.

• Payload Size: Message size dictates processing speed. Standard HTML emails should reside between 30 KB and 60 KB. If an email exceeds 100 KB, it is computationally heavy and risks partial clipping (like in Gmail) or gateway rejection.
• Text-to-Image Ratio: Never send emails consisting of one massive image with zero text. Spam filters view 100% image payloads as a classic tactic to hide fraudulent text from the scanner. Maintain a strict minimum ratio of 60% text to 40% images.
• Link Density: Filters evaluate link volume relative to total text volume. A two-line email containing four different links looks like an automated phishing attack. Limit marketing emails to 1–3 high-quality links (e.g., a primary CTA, a homepage link, and the required unsubscribe link).
• Link Quality: Never use external URL shorteners (like bit.ly or tinyurl). These are heavily utilized by bad actors and often trigger immediate quarantine routing. Always use clean, direct paths utilizing your authenticated custom domain.

2.5 Attachments

In high-volume email marketing, attachments are a high-risk liability. They rapidly inflate payload weight and invite intense security scrutiny.

• Size limits: Hard limit all emails (body + attachment combined) to under 5 MB. Server gateways frequently block anything approaching 10 MB.
• Format restrictions: "Safe" formats include .pdf, .jpg, .png, .txt. Executable and script formats (.exe, .bat, .js, .zip) will be instantly rejected as malware threats.

Applying these stringent recommendations is critical to secure premium deliverability. By architecting your emails to respect these computational boundaries, you guarantee that your messages bypass the filters and land squarely in the primary inbox.