How to avoid the spam folder with email automation

The CIQRA team29 September 2026 8 min read

To keep automated email out of the spam folder, authenticate your sending domain with SPF, DKIM and DMARC, send only to people who asked to hear from you, make unsubscribing a one-click action, and keep complaint rates low. Since February 2024 Gmail and Yahoo have treated most of this as a requirement rather than advice, and in 2025 Outlook added its own rules for high-volume senders. Automation helps because triggered, relevant messages draw fewer complaints than blasting the whole list.

Why automated email ends up in spam

Mailbox providers decide where a message lands using two broad signals: whether they can prove who sent it, and how recipients react to it. A message from an unauthenticated domain looks the same as a spoofed one. A message that many people mark as spam, ignore, or cannot easily unsubscribe from teaches the filter that the sender is unwanted. Most deliverability problems trace back to one of those two gaps, not to a single "spammy" word in the subject line.

Automation cuts both ways: a good cart reminder reaches one person when it is relevant, while a bad flow keeps mailing people who never opted in or have already bought.

Step 1: Authenticate your domain

Authentication lets receiving servers confirm that mail claiming to come from your domain really does. You need three DNS records, published for the domain that appears in your From: address.

  • SPF lists the servers allowed to send mail for your domain. Google notes that if a third-party sender, such as your store platform or newsletter tool, is missing from the SPF record, its messages are more likely to be marked as spam.
  • DKIM adds a cryptographic signature that proves the message was not altered in transit. Gmail requires a key of at least 1024 bits for mail to personal accounts and recommends 2048 bits where your provider supports it.
  • DMARC tells receivers what to do with mail that fails SPF and DKIM, and sends you reports about who is sending in your name. To pass, the domain that authenticates the message must match the domain in the From: header. That is called alignment.

A practical order: publish SPF and DKIM for every service that sends on your behalf, then publish DMARC with a policy of p=none and a reporting address. Read the reports for a few weeks to find senders you forgot, and only then consider moving toward quarantine or reject. Tightening too early can block your own legitimate mail.

Step 2: Meet the Gmail, Yahoo and Outlook sender requirements

From February 1, 2024, Gmail requires every sender to personal Gmail accounts to set up SPF or DKIM, have valid forward and reverse DNS for sending IPs, use TLS, and keep the spam rate reported in Postmaster Tools below 0.3%. Senders of more than 5,000 messages a day to Gmail accounts must also:

  • set up SPF, DKIM and DMARC (a DMARC policy of none is enough);
  • align the From: domain with the SPF or DKIM domain;
  • support one-click unsubscribe in marketing and subscribed messages, plus a clearly visible unsubscribe link in the body.

Google's FAQ goes further than the headline threshold: it tells senders to keep the user-reported spam rate below 0.1% and never let it reach 0.3%, and it recommends processing unsubscribe requests within 48 hours. Google also says that starting in November 2025 it is ramping up enforcement, with non-compliant messages facing temporary and permanent rejections. Transactional messages such as password resets and reservation confirmations are excluded from the one-click unsubscribe requirement.

Yahoo's rules, enforced from February 2024, closely mirror Google's: SPF or DKIM for everyone, and SPF plus DKIM plus a DMARC policy of at least p=none for bulk senders. Bulk senders also need a working one-click List-Unsubscribe header, a visible unsubscribe link, unsubscribes honored within 2 days, and a spam rate below 0.3%.

Microsoft announced in 2025 that domains sending more than 5,000 emails a day to Outlook consumer addresses must comply with SPF, DKIM and DMARC, with enforcement starting May 5, 2025. Non-compliant mail can be routed to Junk and, according to Microsoft, eventually rejected.

Even below 5,000 messages a day, treat the bulk-sender list as your baseline; small stores grow.

How one-click unsubscribe works

One-click unsubscribe is defined in RFC 8058. Your email includes two headers: List-Unsubscribe, which points to an HTTPS address, and List-Unsubscribe-Post: List-Unsubscribe=One-Click. When a recipient uses the unsubscribe option the mailbox shows near the sender name, the provider sends a POST request to that address, and your system removes the person without asking them to log in or confirm. Most sending platforms add these headers for you. Check the headers of a test message to confirm.

Step 3: Get consent you can prove

Authentication proves who you are. Consent shows that the recipient wanted the message, and in many countries it is also a legal requirement.

  • European Union. The ePrivacy Directive (2002/58/EC, Article 13) allows email direct marketing only to people who have given prior consent. The exception is the so-called soft opt-in: a business that obtained a customer's email address in the context of a sale may market its own similar products or services, as long as the customer is clearly given a free, easy way to object when the address is collected and in every message. National laws implement the details differently, so check the rules where your customers live.
  • Proof and withdrawal. Under the GDPR (Article 7), when you rely on consent you must be able to demonstrate it, and withdrawing consent must be as easy as giving it. Article 21 gives people the right to object to direct marketing at any time. Record when and where each subscriber signed up, and never use pre-ticked boxes.
  • United States. The CAN-SPAM Act does not require opt-in, but the FTC's compliance guide requires honest headers and subject lines, your valid physical postal address in every commercial message, a clear way to opt out, and opt-outs honored within 10 business days.

Double opt-in, where new subscribers confirm their address from a first email, is not always legally required, but Google recommends confirming each recipient's address before subscribing them. It keeps typos, fake sign-ups and spam traps off your list.

Step 4: Keep your list clean

  • Never buy or rent lists. They produce complaints, bounces and spam-trap hits, and they fail the consent test. Yahoo explicitly tells senders not to purchase mailing lists.
  • Remove hard bounces immediately. Google suggests automatically unsubscribing recipients who have multiple bounced messages.
  • Sunset inactive subscribers. Send a short re-engagement series to people who have not opened or clicked in several months, then stop mailing those who stay silent. Google suggests considering unsubscribing recipients who don't open or read your messages.
  • Honor the frequency people signed up for. Yahoo warns against turning a weekly or monthly list into a daily one.
  • Keep one suppression list across every tool, so an unsubscribe from the newsletter also stops promotional flows.

Step 5: Use automation to send fewer, better emails

The flows with the fewest complaints are the ones recipients expect:

  • Welcome series, sent right after sign-up while the subscriber still remembers you.
  • Abandoned-cart reminders: one or two messages, then stop. End the flow as soon as the order is placed.
  • Post-purchase messages: order and shipping updates, then a single review request or care tip.
  • Win-back campaigns for lapsed customers, with a clear exit if they are not interested.

Build exit conditions into every flow: anyone who buys, unsubscribes or complains leaves all related sequences at once. Cap weekly promotional emails per person across all flows.

Content that doesn't look like spam

Google's guidelines are concrete: use a single From: address and a display name that identifies you, not the offer ("Last chance" is not a sender name). Don't start subject lines with "Re:" or "Fwd:" unless the message really is a reply or forward, don't hide content with HTML or CSS, and make links visible and predictable.

Step 6: Monitor and fix quickly

Register your domain in Google Postmaster Tools to see your spam rate and authentication results, and read your DMARC reports. Track complaints, bounces and unsubscribes per flow, not just overall, so you can find the one sequence causing trouble and pause it.

Email and SMS on CIQRA

On CIQRA, store notification emails go out from your own domain, and SMS notifications can be sent through Twilio, Vonage, MessageBird, NetGSM or İleti Merkezi. Online stores can send automatic reminder emails for abandoned carts, and newsletter subscribers sign up on your site and are managed in the admin. Site forms support reCAPTCHA v3 and quarantine suspicious entries for 30 days, and while a new site is in its password-protected preview, it never sends notifications to real inboxes. Authentication still depends on your DNS, so confirm that SPF, DKIM and DMARC are published for the domain you send from.

FAQ

Do the Gmail and Yahoo rules apply if I send fewer than 5,000 emails a day?

Some do. Every sender to personal Gmail accounts needs SPF or DKIM, valid forward and reverse DNS, TLS, and a spam rate below 0.3%. The DMARC, alignment and one-click unsubscribe requirements formally apply to bulk senders, but they are good practice at any volume.

Do order confirmations need a one-click unsubscribe?

No. Google excludes transactional messages from the one-click unsubscribe requirement. Keep them transactional, though: loading them with promotions makes them marketing email.

Should my DMARC policy be p=reject?

Not straight away. Start with p=none and reporting, confirm that every legitimate sender passes, then tighten step by step.

Sources

Share LinkedIn X Facebook Email

Written by
The CIQRA team

Related articles