Password resets stopped arriving. Invoices land in junk. The content did not change, so the cause is almost always mechanical - authentication that does not align, a sending identity with no reputation, or a configuration that was correct for the previous provider and silently is not for the new one. Each is verifiable in minutes once you know what to check.
01Check alignment, not just presence
SPF, DKIM and DMARC all being present does not mean they pass. DMARC requires alignment: the domain in the visible From header must match the domain validated by SPF or DKIM. A provider that sends using its own envelope domain will pass SPF for that domain while failing alignment for yours, and the message is treated as unauthenticated.
Read the message headers on a delivered example rather than trusting the provider dashboard. The authentication results header states plainly whether each mechanism passed and which domain it validated, which is the fact that matters.
| Mechanism | Validates | Common failure |
|---|---|---|
| SPF | Sending IP is authorised | New provider not added to the record |
| DKIM | Message signed by the domain | Key not published or rotated |
| DMARC | From domain aligns with SPF or DKIM | Passes SPF for the provider, not for you |
02A new sending identity has no reputation
Reputation attaches to the sending IP and the domain, and a new one starts from nothing. Moving providers means starting again, and sending your usual volume immediately from a cold identity looks exactly like the behaviour of a spam operation, because that is what spam operations do.
Warm up gradually. Start with low volume to your most engaged recipients - people who open and reply - and increase over two to four weeks. Engagement signals early in that window establish the reputation that later volume depends on.
03Subdomains inherit less than people assume
Reputation is largely tracked per sending domain. A well-established parent domain does not automatically confer good standing on a newly used subdomain, which is why mail from a fresh notifications subdomain can go to junk while mail from the parent domain arrives normally.
This separation is a feature when used deliberately. Isolating streams means a problem in one does not contaminate the others, but each stream needs its own warm-up and its own monitoring rather than being assumed healthy because the organisation's main domain is.
| Stream | Subdomain | Why separate |
|---|---|---|
| Password resets, receipts | mail or txn | Must never be blocked by campaign complaints |
| Marketing campaigns | news or mktg | Higher complaint rate is expected |
| Internal notifications | alerts | Different volume and recipient profile |
04Enable DMARC reporting before enforcing
A DMARC policy of none with reporting enabled collects data on every source sending as your domain without affecting delivery. Those reports routinely reveal legitimate systems nobody remembered - a billing platform, a CRM, an old application server - all of which need authorising before enforcement.
Move to quarantine and then to reject only once reports show legitimate mail passing consistently. Enforcing first is how organisations discover their invoicing system was sending unauthenticated mail, generally by having it stop.
05Content matters, but less than authentication
Once authentication is correct and reputation is established, content becomes the marginal factor: link shorteners, a single large image with almost no text, mismatched display and link URLs, and missing unsubscribe handling all push scores in the wrong direction.
Prioritise correctly. Rewriting subject lines while DMARC alignment is failing is effort spent on the smaller variable. Fix authentication, warm the identity, separate the streams, and then tune content.
Topics
Aarav Patel
Principal Engineer · SyncTrix
Writes about the engineering decisions behind production systems - architecture, delivery and the trade-offs that only show up at scale.
Building something like this?
SyncTrix engineers AI, SaaS, platform and cloud systems for enterprises and high-growth teams. Tell us what you're shipping and we'll scope it with you.
Talk to an engineer