Symptoms#
- Messages landing in spam despite previously good placement
- Bounces mentioning policy, authentication, or reputation
- Provider dashboards showing a drop in reputation or authentication pass rate
Diagnosis steps#
- Confirm the configuration is live: query DNS from an external resolver and check the sending platform's settings page.
- Send to a seed mailbox and read the full headers, especially Authentication-Results.
- Compare the domains in From, Return-Path, and DKIM d= for alignment.
- Check provider dashboards (Google Postmaster Tools, Microsoft SNDS) for reputation and error rates.
- Review recent changes: new vendors, DNS edits, list imports, volume spikes.
Likely causes#
- Adding upsell banners to receipts, which reclassifies them as marketing under many laws.
- Using one shared IP pool for both streams.
Fix and re-verify#
- Send transactional mail from a dedicated subdomain (for example mail.yourdomain.com) or separate stream.
- Send marketing from a different subdomain (news.yourdomain.com).
- Keep promotional content out of transactional messages to preserve their exemption.
- Apply DMARC to the organizational domain so both subdomains are covered.
Frequently asked questions#
Do transactional emails need an unsubscribe link?
Not under CAN-SPAM if purely transactional. Gmail's bulk-sender rules still expect one-click unsubscribe for anything sent at volume, so many senders include it anyway.