# Why Your SaaS Emails Go to Spam (and How to Fix It) > Why SaaS signup, reset and onboarding emails land in spam, and how to fix it: authentication, DMARC alignment, spam rates under 0.1%, warm-up and free tests. - Canonical: https://zeroraised.com/blog/how-to-stop-saas-emails-going-to-spam - Published: 2026-11-10T09:30:00Z - Author: ZeroRaised Team (https://zeroraised.com/blog/authors/zeroraised) - Publisher: ZeroRaised (https://zeroraised.com/) - Section: Building - Tags: email, deliverability, saas, developer-tools **Short answer:** SaaS emails usually go to spam for one of four reasons. Your authentication passes but does not align with your From: domain. A new domain is sending too much too soon. Your spam complaint rate is above Gmail's 0.1% target. Or a newsletter shares a reputation with your password resets. Fix them in that order: authentication first, then volume, then complaints, then separation. Every rule and number below comes from Google, Yahoo, Microsoft and email providers' own pages, checked on 10 Nov 2026. The triage table, fix order and worked example are ours and marked as such. ## TL;DR - **Gmail's rules for everyone:** SPF or DKIM, valid forward and reverse DNS, TLS, RFC 5322 formatting and a spam rate below 0.3% ([Google sender guidelines](https://support.google.com/a/answer/81126?hl=en)). - **Above about 5,000 a day to Gmail:** SPF and DKIM, DMARC with alignment (p=none is fine), and one-click unsubscribe on marketing mail. Once you cross the line, you are a bulk sender for good ([Google FAQ](https://support.google.com/a/answer/14229414)). - **Spam rate target:** below 0.10%, and never 0.30% or higher. - **Yahoo and Outlook.com** ask for much the same. Outlook.com rejects non-compliant mail from domains sending over 5,000 emails per day ([Microsoft](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730)). - **Separate subdomains** for transactional and marketing mail, and **warm up** any new domain. **Disclosure:** ZeroRaised publishes this guide and is a launch site for bootstrapped products. We have no commercial relationship with any email provider or tool named here and earn nothing if you use them. Facts come from the linked sources as checked on 10 Nov 2026. ## What the inbox providers actually require Most "why is my email in spam" advice is folklore about trigger words. The real rules are now published, and they are short. ### Gmail Google's [email sender guidelines](https://support.google.com/a/answer/81126?hl=en) ask all senders to "Set up SPF or DKIM email authentication for your sending domains", have valid forward and reverse DNS (PTR) records, use TLS, follow RFC 5322 and "Keep spam rates reported in Postmaster Tools below 0.3%." Above 5,000 messages a day to Gmail accounts, you also need SPF **and** DKIM, plus DMARC, where "Your DMARC enforcement policy can be set to none." The From: domain "must be aligned with either the SPF domain or the DKIM domain", and "Marketing messages and subscribed messages must support one-click unsubscribe". Google's [sender guidelines FAQ](https://support.google.com/a/answer/14229414) adds two details that matter for a SaaS: "Senders who meet the above criteria at least once are permanently considered bulk senders", and messages from subdomains of the same primary domain count together. ### Yahoo Yahoo's [sender requirements](https://senders.yahooinc.com/best-practices/) mirror Gmail's: "Keep your spam rate below 0.3%", and for bulk senders "Implement both SPF & DKIM", "Publish a valid DMARC policy with at least p=none - DMARC must pass", support one-click unsubscribe and "Honor unsubscribes within 2 days". ### Outlook.com Microsoft's [high-volume sender post](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730) (2 April 2025) covers hotmail.com, live.com and outlook.com, and applies to "domains sending more than 5,000 emails per day". SPF and DKIM must pass, and DMARC must be "At least p=none and align with either SPF or DKIM (preferably both)." An update dated 29 April says failing mail is rejected with "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level." Our read: if you see 5.7.515 bounces, stop editing your copy and fix DMARC. ### One-click unsubscribe [RFC 8058](https://www.rfc-editor.org/rfc/rfc8058) defines it: one `List-Unsubscribe` header that "MUST contain one HTTPS URI", plus `List-Unsubscribe-Post: List-Unsubscribe=One-Click`, both covered by your DKIM signature. Google's FAQ says a mailto link alone does not count. Check your raw headers to confirm your provider adds them to marketing mail. Password resets and receipts do not need them. ## DMARC alignment in two minutes This is the usual answer to "but SPF and DKIM both pass". SPF checks the bounce address, and DKIM checks the signing domain. If your provider uses its own domain for either, both can pass while neither matches your visible From: line. Google's [DMARC setup page](https://knowledge.workspace.google.com/admin/security/set-up-dmarc) says DMARC judges "how closely the domain in the From: header matches the sending domain", and a message must pass SPF with alignment or DKIM with alignment. The fix: verify your own domain (or subdomain) with your provider, publish its DKIM records, and set a custom return-path if offered. Then publish DMARC. Google recommends starting at `p=none`, moving to quarantine or reject over time: ``` _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com" ``` If you have not set up SPF, DKIM and DMARC for your mailboxes yet, our [Google Workspace alternatives guide](https://zeroraised.com/blog/google-workspace-alternatives-for-solo-founders) walks through the basics. Your mailbox provider and your app's sending provider both need SPF and DKIM. ## Triage table: symptom, cause, fix This table is ours, built from the rules above. | Symptom | Likely cause | Fix | |---|---|---| | Everything goes to spam, at every provider | Missing SPF/DKIM, or From: domain not verified with your provider | Verify the domain, add DKIM, check with Learn DMARC | | Outlook bounces with 550 5.7.515 | Failing Microsoft's authentication requirement | Pass SPF and DKIM, publish DMARC aligned with one of them | | Gmail headers show DMARC fail but SPF and DKIM pass | No alignment: provider is signing or bouncing with its own domain | Custom DKIM and return-path on your domain | | Fine for weeks, then spam after a launch or import | Sudden volume spike or complaints from cold addresses | Slow down, warm up, send only to people who opted in | | Password resets in spam, newsletters fine | Shared domain and IPs with complaint-heavy marketing | Move transactional mail to its own subdomain and stream | | Spam only for messages with links | Link or tracking domain with poor reputation, or shortened URLs | Use a branded tracking domain or turn click tracking off for transactional mail | | High bounces after a CSV import | Old or bought list | Suppress hard bounces, stop sending to the list | | Postmaster Tools shows rising spam rate | People do not recognise or want the email | Clear sender name, one-click unsubscribe, cut frequency | ## The fix order Do these in sequence (our order). Each step removes a cause the next one cannot fix. 1. **Read one raw message.** Open the original source of a delivered email and check the SPF, DKIM and DMARC results. This shows quickly whether alignment is your problem. 2. **Authenticate your own domain.** Verify the sending domain with your provider, publish DKIM, set a custom return-path, publish DMARC at `p=none` with a reporting address. 3. **Split your streams.** Put sign-in, reset and receipt mail on one subdomain and newsletters on another. Resend [recommends](https://resend.com/docs/knowledge-base/is-it-better-to-send-emails-from-a-subdomain-or-the-root-domain) "sending your emails from one or more subdomains" to "isolate your sending reputation". Postmark [keeps](https://postmarkapp.com/message-streams) transactional and broadcast traffic apart "including IP ranges". If you are still choosing a provider, see our [free transactional email API comparison](https://zeroraised.com/blog/free-transactional-email-api). 4. **Turn on suppression.** Never re-send to a hard bounce or a complainer. Amazon SES's [account-level suppression list](https://docs.aws.amazon.com/ses/latest/dg/sending-email-suppression-list.html) is on "by default for both bounces and complaints" for accounts started after 25 November 2019, but warns that "Gmail doesn't provide complaint data to SES". 5. **Add one-click unsubscribe** to anything not strictly transactional, and honour it within 48 hours (Google's FAQ recommendation) or 2 days (Yahoo). 6. **Set up Google Postmaster Tools.** Its [dashboards](https://support.google.com/a/answer/14668346) show compliance status, spam rate, IP and domain reputation, feedback loop, authentication, encryption and delivery errors, for personal Gmail accounts only. 7. **Then look at content.** Recognisable sender name, a text version, no URL shorteners, links on your own domain. Content comes last, not first. ## Warming up a new sending domain A new domain has no reputation. Resend's [warm-up guide](https://resend.com/docs/knowledge-base/warming-up) says "Whenever you change your sending patterns, warm up your domain and/or IP" and gives this schedule, which it calls "a baseline". | Day | New domain: up to (per day) | Existing domain: up to (per day) | |---|---|---| | 1 | 150 | 1,000 | | 2 | 250 | 2,500 | | 3 | 400 | 5,000 | | 4 | 700 | 5,000 | | 5 | 1,000 | 7,500 | | 6 | 1,500 | 7,500 | | 7 | 2,000 | 10,000 | During warm-up Resend says to keep your bounce rate below 4% and your spam rate below 0.08%. Our read: transactional volume mostly warms itself because it follows real signups. The danger is your first newsletter to every user, or an old waitlist import. Send those in slices over a week, most recently active users first. ## Worked example: spam-rate arithmetic Illustrative numbers, ours. Postmaster Tools calculates the real figure for personal Gmail accounts. Say your SaaS sends a monthly product update to 6,000 users, 2,500 of them on personal Gmail. Gmail delivers 2,400 to the inbox and 6 people click "Report spam". - Spam rate: 6 / 2,400 = 0.25%. - That is under the 0.30% line you must never reach, but 2.5 times Google's 0.10% target. - To get under 0.10% on the same send you would need no more than 2 complaints (2 / 2,400 = 0.083%). The trap: if that update shares a domain with your password resets, the reputation hit lands on both. Our read: a findable unsubscribe link and sending only to recently active users will usually move this number more than rewriting copy. ## Bounces, link domains and other quiet killers **Bounces.** Hard bounces tell providers you do not maintain your list. Suppress them permanently. SES notes that sends to suppressed addresses still count toward your sending quota, so clean the list in your app too. **Tracking domains.** Click tracking rewrites links through a tracking domain; if it is shared with bad senders, you inherit their reputation. Our read: use a branded tracking subdomain, and turn click tracking off for resets and magic links. **Cold outreach.** Never send cold email from your product domain. Use a separate domain so complaints cannot touch product mail. ## Tools to test deliverability - **[Mail-Tester](https://www.mail-tester.com/):** send a message to the address it gives you and get a spam report. Its [pricing page](https://www.mail-tester.com/manager/) says manual tests need no account; paid packs start at 10 tests for $5. - **[Learn DMARC](https://www.learndmarc.com/):** "By sending an email to our DMARC tester, we will analyze your DMARC setup and visualize how an email server will validate SPF, DKIM, and DMARC." The page lists no price. - **[MxToolbox deliverability test](https://mxtoolbox.com/deliverability):** send to `ping@tools.mxtoolbox.com` for a report on headers, your outbound IP's blacklist reputation and SPF. - **[Google Admin Toolbox Check MX](https://toolbox.googleapps.com/apps/checkmx/):** checks MX and SPF records for a domain, with an optional DKIM selector. - **[Google Postmaster Tools](https://support.google.com/a/answer/9981691):** Google's own view of your Gmail spam rate and compliance. Set it up before you need it. ## Launch-day checklist A launch on Product Hunt or ZeroRaised can bring a sudden spike of signups to a domain that has never seen one. Our checklist for the week before (pair it with our full [product launch checklist](https://zeroraised.com/blog/product-launch-checklist-for-bootstrapped-makers)): - Test signups to Gmail, Outlook.com and Yahoo: SPF, DKIM and DMARC pass and align. - Transactional mail on its own subdomain, apart from any launch announcement. - Postmaster Tools verified for both subdomains. - Bot protection on the signup form, so fake addresses do not bounce at scale. - One welcome email on day one, not a five-email burst. - Launch announcement sent in slices, most engaged first. - Bounce and complaint webhooks wired to suppression. - Bounce logs watched for 550 5.7.515 from Outlook. ## Mistakes to avoid - Newsletters, resets and cold outreach all from `hello@` on the root domain. - Adding a second provider without adding it to SPF and DKIM. - Publishing `p=reject` before reading a single DMARC report. - Rewriting subject lines to dodge "spam words" while DMARC fails. - Assuming you are too small for bulk rules. One big day can make you a Gmail bulk sender permanently. ## Frequently asked questions ### Why are my SaaS emails going to spam even though SPF and DKIM pass? Passing is not the same as aligning. Gmail and Yahoo require the domain in your From: header to align with the SPF or DKIM domain for bulk mail, so a provider signing with its own domain can pass DKIM and still fail DMARC. After alignment, the usual causes are a high spam complaint rate, a new domain sending too much too soon, marketing and transactional mail sharing one reputation, or a link or tracking domain with a poor reputation. ### What spam rate does Gmail allow? Google's sender guidelines say to keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching 0.30% or higher. Its list of requirements for all senders says to keep spam rates below 0.3%. Yahoo's sender page also says to keep your spam rate below 0.3%. ### Do the bulk sender rules apply to a small SaaS? Gmail's extra bulk rules apply once you send close to 5,000 messages or more to personal Gmail accounts in 24 hours, and Google says senders who meet that once are permanently considered bulk senders. Outlook.com's rules apply to domains sending over 5,000 emails per day. A launch day can push a small SaaS over these lines, and the all-sender rules apply at any volume, so it is simpler to meet the bulk rules from day one. ### Should transactional and marketing emails use different domains? Use different subdomains of your main domain, for example one for sign-in and reset mail and one for newsletters. Resend recommends sending from one or more subdomains to isolate sending reputation, and Postmark keeps transactional and broadcast traffic on separate IPs. Google counts messages from subdomains of the same primary domain together for the bulk sender threshold, so separation protects reputation but does not dodge the bulk rules. ### How do I test if my emails go to spam for free? Send a real message to Mail-Tester, which lets you run manual tests without an account, and to Learn DMARC, which visualises how a server checks SPF, DKIM and DMARC. Check your DNS with Google Admin Toolbox Check MX. Then set up Google Postmaster Tools for your sending domain to see your Gmail spam rate, authentication and compliance status over time. ## Launch with your inbox in order ZeroRaised is a launch directory for products built without institutional VC. Once your signup emails land where they should, [submit your product](https://zeroraised.com/submit) for free and let the launch traffic test your setup. For more practical guides on building without investors, [join the ZeroRaised newsletter](https://zeroraised.com/newsletter). ## Sources - [Google: Email sender guidelines](https://support.google.com/a/answer/81126?hl=en), last checked 10 Nov 2026 - [Google: Email sender guidelines FAQ](https://support.google.com/a/answer/14229414), last checked 10 Nov 2026 - [Google: Set up DMARC](https://knowledge.workspace.google.com/admin/security/set-up-dmarc), last checked 10 Nov 2026 - [Google: Set up Postmaster Tools](https://support.google.com/a/answer/9981691), last checked 10 Nov 2026 - [Google: Postmaster Tools dashboards](https://support.google.com/a/answer/14668346), last checked 10 Nov 2026 - [Yahoo: Sender best practices and requirements](https://senders.yahooinc.com/best-practices/), last checked 10 Nov 2026 - [Microsoft: Outlook's new requirements for high-volume senders](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730), last checked 10 Nov 2026 - [RFC 8058: Signaling One-Click Functionality for List Email Headers](https://www.rfc-editor.org/rfc/rfc8058), last checked 10 Nov 2026 - [Postmark: Message streams](https://postmarkapp.com/message-streams), last checked 10 Nov 2026 - [Resend: Warming up](https://resend.com/docs/knowledge-base/warming-up), last checked 10 Nov 2026 - [Resend: Subdomain or root domain](https://resend.com/docs/knowledge-base/is-it-better-to-send-emails-from-a-subdomain-or-the-root-domain), last checked 10 Nov 2026 - [Amazon SES: Account-level suppression list](https://docs.aws.amazon.com/ses/latest/dg/sending-email-suppression-list.html), last checked 10 Nov 2026 - [Mail-Tester](https://www.mail-tester.com/) and [Mail-Tester plans](https://www.mail-tester.com/manager/), last checked 10 Nov 2026 - [Learn DMARC](https://www.learndmarc.com/), last checked 10 Nov 2026 - [MxToolbox deliverability test](https://mxtoolbox.com/deliverability), last checked 10 Nov 2026 - [Google Admin Toolbox Check MX](https://toolbox.googleapps.com/apps/checkmx/), last checked 10 Nov 2026 ## Frequently asked questions ### Why are my SaaS emails going to spam even though SPF and DKIM pass? Passing is not the same as aligning. Gmail and Yahoo require the domain in your From: header to align with the SPF or DKIM domain for bulk mail, so a provider signing with its own domain can pass DKIM and still fail DMARC. After alignment, the usual causes are a high spam complaint rate, a new domain sending too much too soon, marketing and transactional mail sharing one reputation, or a link or tracking domain with a poor reputation. ### What spam rate does Gmail allow? Google's sender guidelines say to keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching 0.30% or higher. Its list of requirements for all senders says to keep spam rates below 0.3%. Yahoo's sender page also says to keep your spam rate below 0.3%. ### Do the bulk sender rules apply to a small SaaS? Gmail's extra bulk rules apply once you send close to 5,000 messages or more to personal Gmail accounts in 24 hours, and Google says senders who meet that once are permanently considered bulk senders. Outlook.com's rules apply to domains sending over 5,000 emails per day. A launch day can push a small SaaS over these lines, and the all-sender rules apply at any volume, so it is simpler to meet the bulk rules from day one. ### Should transactional and marketing emails use different domains? Use different subdomains of your main domain, for example one for sign-in and reset mail and one for newsletters. Resend recommends sending from one or more subdomains to isolate sending reputation, and Postmark keeps transactional and broadcast traffic on separate IPs. Google counts messages from subdomains of the same primary domain together for the bulk sender threshold, so separation protects reputation but does not dodge the bulk rules. ### How do I test if my emails go to spam for free? Send a real message to Mail-Tester, which lets you run manual tests without an account, and to Learn DMARC, which visualises how a server checks SPF, DKIM and DMARC. Check your DNS with Google Admin Toolbox Check MX. Then set up Google Postmaster Tools for your sending domain to see your Gmail spam rate, authentication and compliance status over time.