# Keeping email out of the spam folder

Read this when setting up sending, before a big or unusual send, or when
the owner says emails are going to spam.

## The set-up that protects the business

- **Send marketing from a subdomain**, for example `news.theirdomain.com.au`,
  never from the main domain the owner uses for quotes and invoices. If a
  campaign goes badly, the damage stays on the subdomain.
- **SPF, DKIM and DMARC all pass**, aligned with the From address. DMARC can
  start at `p=none` on the subdomain and tighten to quarantine once mail has
  passed cleanly for a few weeks. Never change the main domain's DMARC to
  set up marketing.
- **A branded link domain** (for example `links.news.theirdomain.com.au`)
  rather than a shared tracking domain. Never use URL shorteners in email.
- **Never bulk-send from the owner's own Gmail or Microsoft 365 mailbox.**
  Those accounts have daily limits and outbound spam controls, and a
  suspension takes the owner's everyday email with it. Small personal
  batches are a different thing (see `asking-permission.md`).

## Starting a new sending address (warm-up)

New addresses have no reputation. Build it over about two weeks: a small
first day, growing each day, most engaged people first (recent customers and
recent clickers). One schedule that works: 150 on day one, 700 by day four,
2,000 by day seven, then the full list. A sudden big send from a new or
long-silent address looks like a spammer.

In Awesomate each approved email goes to everyone on its list who may be
emailed, so warm up by list: the smallest, most engaged list first (often the
customers list), then the bigger ones over the following weeks.

## List hygiene

Awesomate does the first of these for you: anyone who unsubscribes,
hard-bounces or marks an email as spam is left out of every later send, and
every marketing email carries one-click unsubscribe.

- Hard bounces and spam complaints: suppressed immediately, for good.
- Soft bounces: retry; suppress after several in a row.
- Quiet for six to twelve months (no click, reply, booking or purchase): one
  "still want these?" email, then stop sending to anyone who doesn't respond.
  Old, unread addresses are where spam traps live.
- Never buy, rent or scrape a list. Never import an event attendee list
  someone else ran.
- Watch for typo domains on sign-up forms (gmial.com, hotmial.com).

## What the big inboxes require

Google and Yahoo (since February 2024): every sender needs SPF or DKIM,
valid DNS and TLS, and a low spam complaint rate. Senders of roughly 5,000
or more messages a day to them also need SPF, DKIM and aligned DMARC, and
one-click unsubscribe (the `List-Unsubscribe-Post` header, RFC 8058) on
marketing mail, honoured within two days. Keep the complaint rate below
0.1%; at 0.3% Gmail starts filtering or rejecting. Microsoft applies similar
rules to high-volume senders to Outlook.com addresses. Build to the bulk
standard even for small lists: it costs nothing and the thresholds are
measured across everything sent from the domain.

## Content that hurts

Image-only emails, missing plain-text version, link text that doesn't match
the link, URL shorteners, attachments, a different From name every send,
and subject lines the body doesn't pay off. "Spam words" matter far less
than people think; reputation and complaints matter far more.

## Diagnosing "we're going to spam"

1. **Check authentication** on a received copy: the headers should show
   `spf=pass`, `dkim=pass`, `dmarc=pass` for the sending domain.
2. **Check complaint rate and reputation**: Google Postmaster Tools for the
   sending domain; the platform's complaint numbers.
3. **What changed?** A new import, an old segment, a jump in frequency, a
   new link domain, a new From address. The cause is almost always one of
   these.
4. **Fix the cause, then recover slowly**: send only to the most engaged for
   a couple of weeks, then widen.

Don't "fix" spam placement by rewording subject lines while the real cause
(an old list, high complaints) is still there.