How mailbox providers evaluate your emails (and what it means for deliverability)
About 90% of all email traffic is malicious — spam, phishing, and outright fraud, according to Litmus. That single number explains almost everything about why your perfectly legitimate campaign sometimes lands in spam. Mailbox providers aren't built to welcome your mail. They're built to filter out the nine-in-ten messages trying to scam their users, and your email has to prove it belongs in the other tenth.
Most deliverability advice tells you what to fix. This article is about something different — what's actually happening inside Gmail, Outlook, and Yahoo when they decide where your email goes. If you understand the scoring logic, the fixes stop feeling like superstition. (We've already written a separate guide on fixing spam-folder placement if you want the checklist version.)
The verdict happens in two stages, not one
Here's the distinction almost everyone misses. Campaign Monitor frames it cleanly: delivery and deliverability are two different events. Delivery is whether the receiving server accepts your email at all. Deliverability is whether it lands in the inbox or the spam folder once accepted.
The gap between those two is brutal. Omnisend, citing Validity's 2025 data, found that 98.5% of emails get delivered — but only 83.5% actually reach the inbox. So the server says "yes, I'll take it" almost every time, then quietly routes one in six to a folder nobody opens.
That second decision — the routing — is where mailbox providers do their real evaluation. And they make it per recipient, not per campaign.
Gate one: can the provider trust who you say you are?
Before any provider scores your content or your engagement, it checks whether you're really you. This is authentication — SPF, DKIM, and DMARC — and as of late 2025 it's no longer optional.
Litmus and Omnisend both flag the same shift: Gmail began enforcing authentication requirements in November 2025, and Microsoft enforced its own bulk-sender rules in 2025. Fail authentication now and you don't get a reduced score. You get rejected before the interesting evaluation even starts.
Think of it as the bouncer checking ID. It doesn't decide whether you're a good guest — it only decides whether you get through the door. Once you're in, the provider starts asking harder questions:
- Does this domain have a sending history I recognize?
- Has this IP behaved consistently?
- Do the authentication records actually align, or do they just exist?
Authentication gets you considered. It never gets you the inbox on its own.
Gate two: the engagement scoreboard
This is the part senders underestimate, and it's the most important shift in how modern filters think. Mailbox providers don't primarily punish bad reputation — they reward wanted mail. Litmus puts it as a near-philosophy: send mail users want, and let them decide.
So providers watch what recipients do, and they treat those behaviors as votes. HubSpot describes reputation as something earned through positive engagement and eroded through negative signals.
Positive votes — these build your score:
- Opens (weighted less than they used to be, thanks to privacy protections)
- Clicks
- Replies
- Forwards
- Marking "not spam" or adding you to contacts
Negative votes — these tear it down:
- Deleting without opening
- Marking as spam
- Unsubscribing
- Sustained silence
Gmail takes this furthest. HubSpot notes that Gmail uses machine learning to understand the meaning and intent of email at scale — it's not matching banned words, it's modeling whether mail like yours tends to get engaged with or ignored. That's why two senders with identical authentication can land in completely different places. The filter has watched their recipients behave differently.
The thresholds are surprisingly concrete. HubSpot's guidance on open rates reads almost like a placement map: above 25% suggests you're reliably in the primary inbox, 15–25% means there's room to optimize, below 15% indicates you're probably landing in spam, and at or below 10% the majority of your mail is in the spam folder. Your open rate isn't just a marketing metric — it's a rough readout of where the filter has been putting you.
Why the same email gets two different verdicts
Run a campaign and check your numbers by provider. You'll see something strange — the same message performs wildly differently depending on who received it.
Omnisend's 2025 placement data shows exactly this spread:
- Gmail — 87.2% inbox placement, the most forgiving major provider
- Yahoo / AOL — 86.0%, close behind
- Microsoft (Outlook, Hotmail, Live) — 75.6%, the toughest by a wide margin
That's an eleven-point swing between Gmail and Microsoft for mail that might be byte-for-byte identical. Microsoft simply runs a more aggressive filter, especially on cold or unfamiliar senders.
And it goes deeper than provider-level differences. HubSpot points out that inbox placement is personal — it varies by how each individual recipient has historically reacted to your mail. The person who opens every newsletter and the person who's ignored you for six months can get the same send routed to two different folders. The filter isn't scoring your email. It's scoring your email for them.
The signals that quietly sink you
Authentication and engagement are the headline gates. But providers fold in two more inputs that drag scores down before you notice.
Bounce rates and list quality
Bounces are a direct trust signal. Omnisend flags a bounce rate above 2% as evidence of poor list hygiene, and HubSpot is stricter still — a hard bounce rate of 1% or higher signals real reputation damage. To a provider, repeated bounces read as one of two things: you bought a list, or you're not maintaining one. Neither earns trust.
Spam complaints are even more sensitive. Litmus pegs the danger threshold at just 0.1% — one complaint per thousand sends. That's a tiny margin, and it exists because complaints are the single loudest negative vote a recipient can cast.
Content and structure
Modern filters don't run off a forbidden-word list, but structure still matters more than people think. Omnisend found that 74% of emails contain HTML structural issues — broken tags, malformed markup, the kind of thing your eye never catches but a parser does. Those issues make a message 18–25% more likely to land in spam.
The filter reads sloppy HTML the way it reads a bounce: as a signal that you might not be a careful, legitimate sender. Clean markup isn't a design nicety. It's part of your score.
What this costs in plain money
It's easy to treat a few percentage points of inbox placement as a rounding error. It isn't.
Omnisend ran the math on a sender pushing 50,000 emails a month. Drop from 95% to 80% deliverability and you're looking at roughly $7,500 in lost revenue every month — not from worse copy or a smaller list, just from mail the filter quietly rerouted. The same research found that strong deliverability correlates with a 17% higher conversion rate and a 40% lower bounce rate.
The emails you never knew were filtered are the most expensive ones you'll ever send.
How to think like the filter
Pull the frameworks together and a model emerges. Campaign Monitor calls it a shared-responsibility model: the platform provides the technical infrastructure, but you control list quality and the engagement your mail earns. Omnisend's three-pillar version says the same thing — authentication, list hygiene, and engagement optimization, working together.
The practical reframe for a small business or solo creator is this. Stop asking "how do I trick the filter?" and start asking "how do I give the filter reasons to trust me?" Those are opposite strategies. One fights the system. The other works with how it was actually built — to surface mail people want and bury the 90% they don't.
For us, that's the whole design philosophy behind Doxiefy. AI-assisted sequences that authenticate properly, respect engagement signals, and adapt to how recipients actually respond — because every send either builds your standing with these providers or chips away at it. There's no neutral email.
If you're building outreach for a small business or as a solo creator and you'd rather work with the filters than against them, join the Doxiefy waitlist — we'll let you know when it's your turn to try AI-powered campaigns built around how mailbox providers really think.