When a password reset lands in spam, the first instinct is to rewrite the email.

That is usually the wrong place to start.

Transactional email deliverability is mostly decided before the message body matters: authentication, domain alignment, IP reputation, list hygiene, and link domains.

1. Check authentication first

Start with the sending domain, not the template.

  • SPF exists and stays under the lookup limit
  • DKIM is configured with the selector actually used by the sender
  • DMARC exists and has a reporting address
  • the From domain aligns with the authenticated domain

Run the domain through a scanner:

https://mailers.email/scan/

If DMARC is missing, fix that before changing copy.

2. Check alignment, not just records

A domain can have SPF and DKIM and still fail DMARC if the visible From domain does not align.

This is common when:

  • marketing sends through one provider
  • transactional mail sends through another
  • the Return-Path uses a different subdomain
  • a third-party platform rewrites links

Read the actual headers, not only the DNS records.

3. Check the link domain

Links to a newly registered domain, a redirect chain, or a domain with a poor reputation can hurt inbox placement.

Use one consistent, authenticated link domain. Avoid URL shorteners in transactional mail unless you control them.

4. Check list hygiene

Transactional mail should not go to purchased lists. But even transactional lists collect stale addresses.

  • suppress hard bounces
  • process complaints immediately
  • stop sending to invalid domains
  • do not retry a hard bounce indefinitely

5. Check volume changes

A sudden 10× increase from a new IP or domain looks like abuse. Ramp volume gradually and monitor bounce and complaint rates.

6. Check the content last

Content matters, but usually after authentication and reputation.

Look for:

  • mismatched From name and domain
  • excessive links
  • image-only emails
  • misleading subject lines
  • missing plain-text alternative

A quick debugging order

  1. Scan the domain.
  2. Check SPF, DKIM, DMARC and alignment.
  3. Read the full headers.
  4. Check the link domain and redirects.
  5. Check bounce and complaint handling.
  6. Check recent volume changes.
  7. Only then rewrite the template.

Tools: