Symptoms#
- Messages landing in spam despite previously good placement
- Bounces mentioning policy, authentication, or reputation
- Provider dashboards showing a drop in reputation or authentication pass rate
Diagnosis steps#
- Confirm the configuration is live: query DNS from an external resolver and check the sending platform's settings page.
- Send to a seed mailbox and read the full headers, especially Authentication-Results.
- Compare the domains in From, Return-Path, and DKIM d= for alignment.
- Check provider dashboards (Google Postmaster Tools, Microsoft SNDS) for reputation and error rates.
- Review recent changes: new vendors, DNS edits, list imports, volume spikes.
Likely causes#
- Bundling marketing consent into terms of service acceptance.
- Losing consent records during a CRM migration.
Fix and re-verify#
- Use an unchecked checkbox or a dedicated signup form; never pre-tick.
- Record timestamp, IP, source, and the exact wording shown at consent.
- Use double opt-in for marketing lists where feasible.
- Separate consent for different purposes (newsletter vs partner offers).
- Refresh consent for contacts older than two years with no engagement.
Frequently asked questions#
Is double opt-in required by law?
Not explicitly in most jurisdictions, but it is the easiest way to prove consent under GDPR and CASL and it improves list quality.