How do mailbox providers decide where to place an email?

Every time an email lands at a mailbox provider, a decision gets made in milliseconds. Inbox, spam, promotions, maybe the updates tab. That decision isn't a single rule. It's a layered process, and understanding each layer tells you exactly where your sending can break down.

Here's how it actually works, in order.

1. Authentication check

The first thing a mailbox provider checks is whether your email is legitimately from you. SPF confirms your sending IP is authorized. DKIM verifies the message wasn't tampered with in transit. DMARC tells the provider what to do if either of those checks fails. Fail all three and you're in trouble immediately. Pass them and you've cleared the first gate, but only the first.

2. Reputation lookup

And once authentication passes, the provider checks your history. Two reputations matter here: your sending IP address and your sending domain. If your IP has a record of high complaint rates or spam trap hits, that follows you. Domain reputation is stickier and harder to rebuild. A brand new IP or domain starts with no reputation at all, which is why warming up gradually matters so much. Think of it like a credit score. You can't borrow trust you haven't earned.

3. Content analysis

Still the email itself gets scanned. Providers look for patterns that match known spam (certain link structures, suspicious URLs, phrases historically associated with phishing or unsolicited mail). A clean, plain email from a trusted sender sails through this step. A heavily formatted email from a cold domain with a link-shortener URL is going to raise flags.

4. Engagement prediction

This is where it gets personal. Providers like Gmail and Outlook track what recipients actually do with your emails. Do they open them? Click? Delete without opening? Mark them as spam? All of that feeds into a prediction about whether this particular recipient will want this particular message. High historical engagement means you get the benefit of the doubt. Low engagement means the system starts routing you away from the inbox.

5. User-specific signals

Beyond collective reputation, providers factor in the individual relationship between a sender and that specific recipient. Has this person ever emailed you back? Added your address to their contacts? Moved your emails out of spam before? These signals carry serious weight. They tell the provider this user has a real relationship with this sender, override the reputation defaults in many cases.

Which factor matters most?

Authentication is the floor. Without it, nothing else saves you. Reputation is the ceiling. You can't compensate for a bad sending history with good content alone. But engagement is what separates inbox from promotions for clean, well-authenticated senders. If your list isn't engaging, your reputation drifts down over time regardless of how good your authentication is.

All of these signals feed machine learning models that adapt constantly. There's no single rule that says "do X and land in inbox." The decision is probabilistic, which is why placement can vary for the same email sent to different people at the same provider.

If you want to check where your authentication stands right now, our free SPF checker and DKIM checker take about 30 seconds. Authentication is the one thing you can fully control, so it's the right place to start.