How to prevent your emails from ending up in spam

Have you sent an important email to a client or supplier but have not heard back? Your email may have ended up in the recipient’s Spam folder. Your essential email is lost among hundreds of spam messages.

Email deliverability is not a precise science, which can irritate senders of all kinds. For various reasons, such as your authentication status or your email server’s reputation, you may unintentionally end up in the spam folder.

We’ve all been in this situation and know how frustrating it can be. But with a few simple steps, you can prevent your emails from ending in spam and ensure your messages reach the recipient’s inbox.

To solve a problem, we must first define the problem correctly, and in this case, that means understanding why certain emails are marked as spam.

Why do emails end up in spam?

Most email services use automatic filters to separate legitimate emails from spam. These filters analyse various aspects of an email, such as content, subject, sender and others.

Due to the increase in spam, mail server filters have become very strict, and every domain owner should manage their domain reputation to ensure that emails sent from that domain reach the recipient’s inbox.

Mail servers can classify emails as spam due to several elements:

• lack of authorisations and validations (SPF, DKIM, DMARC)
•  mass mailing
•  Based on the content or preferences of the recipients, if the emails are not read repeatedly, are deleted without being read or are marked as spam, email servers learn these preferences and start filtering them as spam.

Both Gmail and Yahoo announced as early as October 2023 that starting in February 2024, they would further increase the strictness of their filters, affecting all emails sent to addresses belonging to Gmail and Yahoo.

• Gmail announcement
• Yahoo announcement

Things that until now were only considered good practices will now become mandatory to ensure that the emails we send do not end up in spam. These are:

1. Email authentication using DKIM, SPF and DMARC.
2.  Reducing spam and maintaining a spam complaint rate below 0.3%.
3.  Allow people to unsubscribe by clicking a single link and honour unsubscribes within two days.
4.  RFC 5322 compliance, PTR records, rDNS
5.  Make sure your sending server IP addresses have valid reverse DNS records.
6.  Use a TLS connection for email transmission.

How do you stop your emails from being marked as spam?

The most important thing to do is to make sure that all emails sent on behalf of your domain are sent with authentication by valid sources authorised to send email on behalf of the domain.

You can start by determining who is sending mail on behalf of the domain. Examples of sources that send emails are:

• you and your colleagues through mail clients on computers or phones (Outlook, Apple Mail, etc.)
•  your website
•  customer management (CRM) application
•  the service that sends newsletters
•  etc.

1. Identification of sources

By definition, e-mails sent through mail clients are sent with authentication; when configuring the mail client, you enter the correct data, such as email address, password, incoming/outgoing server, ports, etc. These emails are sent through the mail server that offers you hosting.

Emails sent from WordPress sites

Some sites send emails when someone leaves a comment on the blog.

Others, such as online stores, also send transactional emails: order notifications, delivery notifications, invoices, etc. These emails are crucial and should reach the recipient’s inbox.

By default, WordPress sends emails through a PHP function. It can work without problems, especially when the email hosting is on the same server as the website hosting. However, the method could be better because the sending is done without authentication. Hence, the chances of it ending up in spam are high.

The best practice recommendation is to use a WordPress plugin to send emails via SMTP authentication.

We use the FluentSMTP WordPress plugin to force WordPress not to send emails via the standard method (wp_mail) but via SMTP authentication. This is a more professional method that ensures a better delivery rate.

The plugin can be configured to send through the domain’s mail server or specialised services such as Sendgrid, Brevo, Amazon SES, SMTP.com, Mailgun, Postmark, etc.

Customer Relationship Management (CRM) application

Using such a platform, you can send emails to your customers.

For example, our platform sends emails with invoices, payment notifications, and responses to support tickets. So, emails sent through this application are vital and should not be sent through the standard PHP method without authentication.

Most platforms have integrated options to set an SMTP server through which to send emails, just as it is set in WordPress through the module presented above.

We, for example, send these emails through a specialised service – Postmark.

Among the services we tested were Mandrill from Mailchimp, Amazon SES, Google, our email server, Sendgrid, Mailgun, Sendinblue, and Postmark. Postmark is the most expensive ($1.25 per 1000 emails), but it’s the best quality, with the highest inbox delivery rate.

Newsletter sending service

If you use a newsletter service like Mailchimp, its servers will send emails on your (your domain’s) behalf and will need authorisation.

The sources that send emails are authorised by implementing the necessary DNS entries for validation.

2. Authorisation of sources

After establishing the valid sources through which we send emails, the second step is to authorise these sources so that the spam filters of the recipients’ mail servers know that we indeed send the emails on our behalf.

What we can do here is to implement the necessary DNS entries for the source of the emails to be authorised (SPF, DKIM, DMARC).

SPF (Sender Policy Framework)

SPF allows the receiving email server to verify during email delivery that an email purporting to be from a particular domain is sent by a server authorised by that domain’s administrators.

 Wikipedia

The Sender Policy Framework (SPF) DNS entry is a list of servers (or IPs) authorised to send mail on behalf of our domain.

Your TXT entry may look like this:

v=spf1 include:relay.whmpanels.com -all

By default, only one source is authorised to send mail on behalf of your domain: the Simplenet servers (relay.whmpanels.com).

If you want to add other sources, such as Postmark and Mailchimp, you can edit the DNS entries from cPanel’s Zone Editor section.

For example, you can add two more sources authorised to send emails on behalf of your domain:

v=spf1 include:relay.whmpanels.com include:spf.mtasv.net include:servers.mcsv.net -all

Now, there are three authorised sources:

• Simplenet servers (relay.whmpanels.com)
• Postmark servers (spf.mtasv.net)
• Mailchimp servers (servers.mcsv.net)

These entries are made available to you by each provider, and you need to add them.

DomainKeys Identified Mail (DKIM)

DKIM allows the recipient to verify that an email purporting to be from a particular domain has been authorised by the owner of that domain. It applies a digital signature associated with a domain name to each email message.

 Wikipedia

DKIM is a digital signature used to send mail to the server. This is usually a TXT DNS entry with the name default._domainkey and a value like:

v=DKIM1; k=rsa;p=MIGfMA0GCSqasdkjagdiuagfA4GNADCBiQKBgQCjpd9u4vATaUFwhHVCVuNKNDDKAunbKWSnSTwVNiYjakjahkkUkeMpVqvR7Z2jzNBW1aOf1vxuW+FL4N2+PZNA6Vzk5I3sfsdfsdfmnANSashfayWoOurWm0nvYJg755sQibyYrRB6v3 wuvxUNmsdfsdkfsdjASFnafAmSvmtSZwIDAQAB

Such an entry has already been generated by cPanel to authorise the Simplenet server. This should remain the same.

Separate TXT entries must be added to authorise other sources. Specialised email services, such as Postmark or Mailchimp, in our example, provide you with these TXT entries to add.

Other services use other methods; for example, Amazon SES will require you to add 3 CNAME entries for DKIM validation. Each service has documentation and instructions for implementation; if you follow them carefully, you can quickly validate these sources.

Domain-based Message Authentication, Reporting & Conformance (DMARC)

DMARC is an email authentication, policy, and reporting protocol. It relies on SPF and DKIM protocols, adding links to the author’s domain name (“From:”), published policies for handling recipient authentication failures and reporting from receivers to senders to improve and monitor domain protection against e-fraudulent email.

 dmarc.org

DMARC is not implemented by default on any email servers; it must be implemented by each site owner for their domain.

It is the domain owner’s responsibility to manage his sources, authorizations, and source validation or rejection policies.

Using Cloudflare’s DNS hosting, you can implement DMARC through them with a single click. You can find it in the Email > DMARC Management section. This will add the DNS entry you need for DMARC.

Another tool, which we also use, you can find here – https://dmarc.postmarkapp.com

This service provided by Postmark generates a TXT DNS entry that you need to add to your DNS zones. It looks something like this:

v=DMARC1; p=none; pct=100; rua=mailto:name@domain.com; sp=none; aspf=r;

Values in DMARC can be changed:

• p=none can be set as p=quarantine or p=reject
•  pct=100 means that 100% of emails will be filtered; it can be set to a lower value
•  rua=mailto:name@domain.com will change with your email address, the one you want to receive the reports to

You will receive reports every month with the emails sent during the past week on behalf of your domain and the sources sending emails on behalf of your domain.

The reports from the above service help you identify the sources (who is sending emails on behalf of your domain) and block invalid sources.

DMARC extends the two mechanisms (SPF and DKIM) to allow you to manage your domain reputation.

For example, after implementing DMARC for simplenet.io, we saw in the reports that several hundred emails were being sent in the name of simplenet.io from IPs in Russia, China or Vietnam, with no connection to the emails we sent.

I changed the DNS entry for DMARC from p=none to p=reject so that only SPF and DKIM-aligned emails are allowed.

3. Other good practices

The authentication protocols described above (SPF, DKIM and DMARC) help confirm the authenticity of emails sent by your domain and significantly reduce the risk of being marked as spam.

But even with all these implementations done right, emails can still end up in spam.

If your email contains specific characteristics associated with spam or is sent from a domain known to send spam, there’s a good chance it will be automatically marked as spam.

Make sure you follow these best practices:

1. Do not send unsolicited emails
2.  Avoid forwarders
3.  Use a relevant and non-spammy subject: Avoid exaggerated or alarmist subjects often associated with spam emails. Make sure the subject line reflects the actual content of the email and is not just designed to attract attention.
4.  Optimise email content: Avoid overusing keywords or links in your emails. Limit the use of images and make sure the text is well-structured and relevant.
5.  Require opt-in and confirmation: If you send marketing emails, ensure recipients have voluntarily opted in to receive your messages. Send them a confirmation email to confirm their subscription.
6.  Regularly update your subscriber list: Remove inactive or invalid email addresses from your subscriber list. This way, you will maintain a clean list of recipients.

Conclusion

Sending emails that don’t end up in spam can be challenging, and unfortunately, it is still the responsibility of site/domain owners.

However, these operations become crucial if the business involves intensive email use. Therefore, by following these steps and adhering to good emailing practices, you can significantly improve the chances of your messages being successfully delivered to your recipients’ inboxes.