Email deliverability: why your UAE campaigns land in spam
A ten-minute check of your own domain: SPF, DKIM and DMARC, the spam-rate lines Gmail and Yahoo draw, and the list habits that quietly send campaigns to spam.
The short answer
Campaigns land in spam when the sending domain isn't authenticated, when too many recipients mark the mail as spam, when the list is old or bought, or when volume jumps overnight. Check authentication first, which takes ten minutes. Gmail and Yahoo both ask senders to keep spam complaints below 0.3%, so a bad list shows up quickly.
The quickest way to learn why a campaign went to spam is to send one email to yourself and read what Gmail says about it. Two clicks show whether SPF, DKIM and DMARC passed, and a fail on any of them is a cause you can fix this afternoon. This guide takes the checks in the order that finds problems fastest, with what to do when one fails.
What can you check on your own domain in ten minutes?
- Find out who controls your DNS. The records below live at your domain registrar or hosting company, and the login may belong to whoever built the website. If you don't know who holds it, ask before you do anything else. Our guide to who owns your website covers what to check.
- Send a test and read the result. Send an email from the address and platform you use for campaigns to a Gmail address you control. Open it, choose Show original from the three-dot menu, and read the top of the page. It shows SPF, DKIM and DMARC as PASS or FAIL. Anything other than PASS on all three is your first fix.
- Check SPF. SPF is a text record on your domain, starting v=spf1, that lists who may send mail as you. A domain should have exactly one, so merge duplicates. Your email platform, your website forms and your company mailboxes each need an entry in that one record. A record that chains in too many other services (the limit is ten lookups) fails outright, so remove services you no longer use before adding anything.
- Check DKIM. DKIM signs each message so receivers can tell it came from you and wasn't altered. Your email platform supplies the record to publish in your DNS and shows when it has verified. In Show original, the DKIM line should name your own domain. If it names the platform's domain, the signature is real but isn't yours, so ask the platform to set up authentication on your domain.
- Check DMARC. DMARC tells receivers what to do when SPF and DKIM don't match the address in your From line, and where to send reports. Look up the text record at _dmarc.yourdomain.ae, using your own domain. If there isn't one, publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.ae. The none policy only monitors, and it is the usual first step. The reports arrive as machine-readable files, so point them at a reporting service rather than a person's inbox. Move to quarantine or reject once the reports show only mail you recognise.
If you pay an agency or freelancer for email, ask for the results of these five checks in writing. Setting up and monitoring authentication should be the first job in any email and lifecycle service, and it takes them minutes to show you.
What do Gmail and Yahoo expect from a sender?
Since 1 February 2024, Google has required any sender above 5,000 messages a day to Gmail accounts to use SPF, DKIM and DMARC, keep their spam rate below 0.30% and support one-click unsubscribe on marketing mail. Yahoo's rules, enforced from February 2024, ask bulk senders to use SPF and DKIM, publish a DMARC policy, keep spam below 0.3% and honour unsubscribes within two days. The two-day window is Yahoo's, not Google's.
The spam rate is the share of delivered mail that recipients mark as spam. To see how small the allowance is, imagine 4,000 emails sent to Gmail users and 20 people clicking Report spam. The rate would be 0.5%, already past the 0.30% line, which would mean at most 12 reports. Google also recommends staying below 0.10%, which would mean at most 4 in the same send (all made-up figures).
Google's Postmaster Tools shows your domain's spam rate once you've verified the domain and send enough mail to Gmail for it to report. If it shows nothing, your volume is too low for the figure to exist, and your own test sends are the better guide.
What if authentication passes and campaigns still go to spam?
Authentication proves who you are. It doesn't prove anyone wants your mail. When all three checks pass and the folder is still wrong, work down this table.
| Cause | How to tell | What to do |
|---|---|---|
| Recipients are reporting you | A spam rate near 0.30% in Postmaster Tools, or replies asking who you are | For a few weeks, mail only people who clicked, bought or replied recently, and make the unsubscribe link easier to find than the spam button |
| A bought, old or business-card list | Bounces and complaints on the first send | Remove every address with no recorded source, and don't import them into your platform |
| A mailing sent from a staff mailbox with everyone in BCC | No unsubscribe link, no platform authentication, and every complaint lands on the mailbox your team uses for real mail | Stop. Send through an email platform, from a subdomain such as news.yourdomain.ae with its own records |
| A sudden jump in volume | A domain that sends a few thousand a month suddenly sends tens of thousands on a sale day such as White Friday | Warm up in steps: start with your most engaged contacts and widen the audience over several weeks before the big send |
| Unsubscribes that don't work | People reply "stop" or complain after they have already opted out | Click your own unsubscribe link, process opt-outs the same day, and remove the person from every list |
Content is the last place to look. Authentication, complaints and list quality come first, and rewording a subject line won't rescue a bought list.
Which list habits should you change this week?
- Remove hard bounces after the first send, so you aren't mailing addresses that don't exist.
- Delete or park every address without a recorded date and source. A business card handed over at an exhibition is permission for one personal email, not a subscription.
- Pause anyone who hasn't clicked, bought or replied in six months, and count clicks rather than opens, because a mail app that pre-loads images can register an open nobody made. Six months is a starting point, so adjust it to how often your customers buy.
- Process unsubscribes the same day, and remove the person from every list, not only the one they clicked from.
- Use double opt-in for web sign-ups if mistyped or fake addresses are a problem. A confirmation click proves the address is real and that its owner wants the mail.
The wider picture is in our full guide to email marketing in the UAE, and the glossary entry on email authentication defines the three records. Send the test to a Gmail address, open Show original and read three words: SPF, DKIM, DMARC. If any of them says anything but PASS, fix that before you change a single word of the campaign.
Questions people ask
Why do my emails go to spam?
Common causes are a sending domain without SPF, DKIM and DMARC, too many recipients marking the mail as spam, an old, bought or unconfirmed list, and a sudden jump in volume. Check authentication first by reading the headers of a test email in Gmail, then look at complaints and list quality.
What are SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for your domain. DKIM adds a signature that shows a message came from you and wasn't altered. DMARC tells receivers what to do when those checks don't match your From address, and where to send reports. Google and Yahoo both ask bulk senders to use them.
What spam rate do Gmail and Yahoo allow?
Both ask senders to keep spam rates below 0.3%. Google applies its rule to senders above 5,000 messages a day to Gmail accounts and recommends staying below 0.10%. Spam rate is the share of delivered mail that recipients mark as spam, which Google Postmaster Tools shows if you send enough volume.
Is the Gmail Promotions tab the same as spam?
No. The Promotions tab is where Gmail normally files marketing mail, and it is still the inbox. Spam is a separate folder. If your campaigns land in Promotions, that is ordinary for marketing mail and not a deliverability failure, so focus on clicks and replies instead.
How do I check whether my domain has SPF, DKIM and DMARC?
Send a test email to a Gmail address, open it, choose Show original and read the SPF, DKIM and DMARC lines, which show PASS or FAIL. You can also look up your domain's text records with a free DNS lookup tool, or ask whoever manages your DNS to read them out.