The inbox rate on your main sending domain dropped over the weekend, and nothing in the campaign changed.

You’ve re-sent with a new subject line and paused sending for two days.

Neither addresses anything if the actual cause is a DMARC alignment failure that’s been silently broken for weeks — the same symptom comes from five different causes with five different fixes.

The next 10 minutes give you the five categories, the order to rule them out in, and the pattern that tells you a second cause is still active after a fix.

If you’re reading this on day three of an incident with a fix that only half worked, you’re in the right place.

Run a free audit → — paste your email headers and see every failing check, with the fix for each. No account.

Why “It’s in Spam” Isn’t an Answer

A dropped inbox rate is an observation. It tells you that something’s wrong, not what. Treating the observation itself as the diagnosis is why so much spam-folder troubleshooting doesn’t work: someone re-sends the campaign, or tweaks subject lines, or pauses sending for a few days — none of which addresses anything if the actual cause is, say, a DMARC alignment failure that’s been silently misconfigured for weeks.

Finding the cause just means working through the actual candidate causes in a deliberate order, ruling each out with evidence, until you find the one that’s actually active — rather than reaching for whatever fix is most familiar.

The Five Places the Cause Can Be

1. SPF, DKIM and DMARC. One of the three misconfigured, or an alignment failure where individual checks pass but DMARC still fails. This is the fastest category to check and the most common single-cause incident, because it’s also the easiest to break silently — an ESP migration, a new subdomain, or an added sending source can break a record set that was correct a month ago. Check with the DNS Checker; if something’s off, the SPF, DKIM, and DMARC generators rebuild it correctly.

2. How providers score your domain. Complaint rate, spam-trap hits, or a blacklist listing dragging down how mailbox providers score your sending IP or domain. Unlike the DNS records, this isn’t binary pass/fail — it’s a trend, visible in Google Postmaster Tools’ reputation graph or Microsoft SNDS, and it degrades gradually before a sharp drop, which is why checking it only after the drop already happened misses the earlier warning signal. Cross-check active blacklist status with the Blacklist Checker.

3. Content and engagement. Spam-trigger language, an unusually high image-to-text ratio, or — more often — low actual engagement (opens, clicks, replies) from the send itself. Mailbox providers weight recipient engagement heavily; a technically clean, correctly signed email to a low-engagement segment still lands in spam because the provider is scoring the audience’s behavior, not just the message.

4. Infrastructure. A shared IP with other senders whose behavior degrades the pool’s collective standing, a new domain or IP sending at volume before it’s warmed, or an ESP-side infrastructure change (a new sending range, a reused IP with an unknown history) that you didn’t initiate and may not be immediately visible to you.

5. List quality. Stale, invalid, or role-based addresses generating high bounce or spam-trap rates. This one compounds with category 2 — a dirty list doesn’t just bounce, it actively drags down how providers score the domain over repeated sends, which is why it often shows up as a domain-health problem rather than being caught at the list level first.

Working Through Them in Order

The order above isn’t arbitrary — it’s roughly fastest-to-check to slowest-to-check, and checking in that order means you rule out the quick categories before spending time on the slow ones:

  1. SPF, DKIM and DMARC first — a DNS lookup, done in seconds, either confirms clean records or hands you the exact misconfiguration.
  2. Domain health second — Google Postmaster Tools, Microsoft SNDS, and a blacklist check together take a few minutes and cover the two mailbox providers where most B2B and consumer volume lands.
  3. Content and engagement third — requires looking at your own campaign data (open/click rates by segment, recent content changes) rather than an external check, so it’s slower but still same-day.
  4. Infrastructure fourth — often requires an ESP support ticket or checking IP history via a reputation lookup, which introduces a wait.
  5. List quality last — usually requires a list audit or a validation pass, the most time-consuming to actually execute even once identified.

When More Than One Cause Is Active

Real incidents aren’t always single-cause. A domain that providers score marginally (category 2) is more sensitive to a content pattern (category 3) that a healthy domain would tolerate without issue. This shows up as a specific pattern: you fix the obvious cause, inbox rate partially recovers, then plateaus below where it should be. A plateau after a fix is itself a signal — it means a second category is still active, not that the fix didn’t work.

Frequently Asked Questions

What does it mean to find the cause of a spam-folder problem?

Tracing a symptom (a dropped inbox rate, a spam-folder spike, a blacklist listing) back to the underlying condition that produced it, rather than reacting to the symptom itself. The five usual categories are SPF/DKIM/DMARC, domain health, content/engagement, infrastructure, and list quality — most real incidents trace to exactly one, but the symptom alone never tells you which.

Why doesn’t fixing the symptom fix the problem?

Because the same symptom — say, emails landing in spam — can come from five completely different causes with five completely different fixes. Re-sending, changing subject lines, or warming up a new IP without first identifying the actual cause often does nothing, or masks the problem temporarily while the underlying issue keeps dragging down how providers score your domain.

How long does finding the cause usually take?

Manually, checking SPF, DKIM and DMARC, then the Postmaster and SNDS dashboards, then content/engagement, then infrastructure, then list quality in sequence can take anywhere from 30 minutes (obvious cause, first category checked) to several days (subtle cause, requires waiting on DMARC report data or a blacklist delisting confirmation). Automated correlation across these signal sources cuts this to minutes because it checks all five simultaneously instead of one at a time.

Can more than one cause be active at once?

Yes, and it’s more common than it should be — a domain that Gmail already scores marginally is also more sensitive to a minor DKIM or alignment gap that a healthy domain would tolerate. When multiple causes compound, fixing only the more obvious one often produces a partial recovery that plateaus, which is itself a signal to keep looking rather than declare the incident resolved.