Your authentication is fine. Your audience isn't.

In late September an apparel brand asked me to look at its Gmail deliverability. In Google Postmaster Tools, its spam rate (the share of mail delivered to Gmail inboxes that people reported as spam) had gone over 0.1% on five of the last 30 days. On September 12 it reached about 0.37% (daily spam rate). Google asks bulk senders to keep that rate under 0.1% and never let it reach 0.3%.

I started where everyone starts, with authentication, and it was fine. The spikes came from who received the campaigns and how often. This was a consultation, so what follows is the diagnosis and my advice. I haven't seen the spam rate since.

The checklist passed

The emails were signed with DKIM on the brand's own domain, so they passed DMARC: 99.93% of 657,028 messages over 30 days (share of messages, count). Every legitimate sender passed, from the sending platform to the shipping tool. What failed was forwarded mail, with no sign of spoofing. One-click unsubscribe was in place.

One gap closed while I was looking. The default Return-Path was on the platform's domain, so SPF never aligned with the brand's. A custom Return-Path went live in late September, and the share of the platform's messages with SPF aligned went from 0.66% in the previous 30 days to 95.5% in the last seven.

A stray DMARC record sat at the root of the domain, where nothing reads it, so I told them to delete it. The DMARC monitoring tool also recommended moving from quarantine to reject, and I advised holding. Reject protects against spoofing, which wasn't happening, and does nothing about complaints. For some forwarded mail DKIM passed as little as 41% of the time (share of forwarded messages, count), so reject would have bounced real email.

None of that changes a spam rate. The rate counts people pressing "Report spam", and authentication only proves the mail came from you.

Reading a spam-rate spike

The spikes lined up with campaign days, which points at the audience. Two of the high days, September 20 and 21, had no campaign.

People report spam when they open the email, which can be a day or more after the send. On a quiet day few emails go out, mostly order and shipping emails and a few automations, so a handful of late reports from the last campaign can push the rate past 0.1% (daily spam rate). I think that explains both days.

So read the rate with the daily volume beside it, and read a quiet-day spike against the campaign before it.

Why zero complaints means nothing

The sending platform showed zero Gmail complaints on every send. Gmail doesn't report complaints for individual recipients, so that number is zero for any brand on any platform. Platforms count complaints from providers like Yahoo and Microsoft, which report each one.

What Gmail offers is the domain's rate in Postmaster Tools and a feedback loop that groups reports by the identifiers in each email's Feedback-ID header. The brand's header was the platform's default, with the slots for campaign identifiers left empty, so Gmail could say the domain drew complaints on September 12 and nothing about which email did it. My first ask for the platform was an identifier for every campaign and every automation.

Engaged meant opened

From mid-September, retail campaigns went to two segments. One was Gmail and Outlook addresses engaged in the last seven days, a definition that leaned on opens, about 38,000 of them at Gmail. The other was about 1,100 addresses the platform filed under "other domains". Those campaigns had open rates of 46% to 48% and click rates of 0.10% to 0.19% (share of recipients, per send). Four sends were credited with 34 orders between them.

Mailing Gmail only to engaged people was the right instinct. But Apple's Mail Privacy Protection loads every email's images, so an open is recorded whether anyone read it or not, and some security filters do the same. A segment built on opens fills up with people who never saw your last email, and with a seven-day window, everyone whose mail app opened the last campaign qualifies for the next. I advised defining engaged by clicks, orders and site visits. Issue 5 covers building engaged segments after a bounce day.

For Gmail I also suggested holding low-intent automations while the rate was high: browse abandonment, win-back, and anything going to people with no click in 90 days. Order and shipping emails keep going, even though they count toward the same rate. I said to plan on two to six weeks of careful Gmail sending before widening back to the full list.

The providers nobody was mailing

The "other domains" segment turned out to mean custom and business domains only. Yahoo, iCloud, AOL, Comcast, Verizon and Charter addresses had received no retail campaign since September 9, close to three weeks. That came from how the two segments were defined.

The brand's email lead built a new segment of about 21,000 for those providers. I advised sending it in batches, recent clickers first. Twenty-one thousand people who haven't heard from you in weeks, all on one day, is a spike of its own.

Do this Monday

Open Postmaster Tools and your send log side by side.

1. Pull 30 days of Gmail spam rate with each day's send volume and campaigns beside it. Mark every day over 0.1% (daily spam rate).
2. For a high day with no campaign, check the campaign one or two days earlier and how little went out that day.
3. In Gmail, open a recent campaign, choose "Show original" and find the Feedback-ID header. If it has no campaign identifier, ask your platform for one per campaign and per automation.
4. If your platform shows zero Gmail complaints on every send, stop reading that number for Gmail.
5. Put open rate next to click rate for your last ten campaigns. If engaged means opened, rebuild it on clicks, orders and site visits.
6. Count last month's campaign recipients by mailbox provider. Any provider at zero needs an explanation. Bring it back in batches.
7. While the rate is high, pause low-intent Gmail automations and keep order and shipping emails running.
8. Check authentication last, once: DKIM on your own domain, SPF aligned through a custom Return-Path, and one DMARC record at _dmarc.

---

In one line: when Gmail flags you and authentication passes, look at who you mail and how often, and put campaign identifiers in your Feedback-ID header so you can see which email drew the complaints.