Why your email lands in spam (and what it says about your host).
Receivers score your sending IP, its reverse DNS, and its neighbours before your content. Half your deliverability is inherited from your host.
In this article 4 sections
- Receiving mail servers score your sending infrastructure before your content: does reverse DNS match forward DNS, what has this IP sent before, and what have its neighbours sent.
- You inherit about half of that score from your host: whose address space it is, and whether the host polices what the rest of the range sends.
- The half you control has a fix order: reverse DNS that agrees with your HELO name, then SPF, DKIM, DMARC, then warm-up and list hygiene.
- The half you inherit has a fix too: send from a network that holds its own space and catches its own spammers. Ask; the paperwork is checkable.
It is one of the more demoralising support tickets to write. The password-reset mail a customer swears never arrived. The outreach that lands in spam despite an SPF record you triple-checked and content that could pass a compliance review. You debug the message for a day. The message was never the problem. The receiving server made half its decision before it read a single word, and that half was about infrastructure: yours, and your host's.
How receivers actually score you
When a server connects to deliver mail, the receiver checks whether the connecting IP has a reverse-DNS name at all, whether that name resolves forward to the same IP (forward-confirmed reverse DNS), and whether it matches what the sending server announced as its HELO name. It weighs what this IP has sent in the past. It weighs the reputation of the surrounding range. Only after all of that does it start scoring your subject line and your content. Mail from an IP with no PTR, a mismatched PTR, or a bad neighbourhood begins the conversation as a suspect.
- Reverse DNS (PTR)
- Exists, and matches the forward record and the HELO name
- The IP's history
- What this address sent before you rented it
- The neighbourhood
- What the surrounding range sends, and whether anyone polices it
- Authentication
- SPF, DKIM, DMARC: whether the domain vouches for the sender
- Only then
- Your subject line and your content
Rows one to three are infrastructure. Two of them belong to your host, not to you.
The half you inherit
Start with the half you did not build. First, whose space it is: our customers send from IPv4 space we hold directly from RIPE, so the range's history is ours to own and its reputation does not change hands upstream when a carrier relationship shifts. You can confirm the holder on the public registry. Second, whether anyone polices the street: on our network, outbound spam from a compromised site is caught and stopped at our edge before the upstream blocklists notice, and repeat offenders on a shared range meet real consequences with a documented release path. A range whose spammers get evicted is a range whose legitimate tenants inherit a clean score.
The half you control, in the right order
Reverse DNS first
Get a PTR record on your sending IP that matches your mail server's forward record and its HELO name.
SPF
End the record with a hard fail policy once you are confident it is complete.
DKIM
Sign your mail, with the signing key's selector published in DNS, so receivers can verify nothing was altered in transit.
DMARC
Set a policy for mail that fails the checks, and turn the reports on so you can see who is sending as you.
Then behave like a good sender
Warm up new IPs gradually, keep your lists clean, and make unsubscribing instant. Authentication earns you the benefit of the doubt; behaviour keeps it.
Authentication built on top of broken reverse DNS is a suit on a suspect.
“Receivers don't score your IP in isolation. They score the street it lives on, and your host is the landlord.”
What the paperwork says about the host
Here is the wider point, the one worth taking to every host you evaluate. DNS that agrees with itself, ranges that get policed, address space held in the provider's own name: none of it is glamorous, all of it is checkable, and it correlates with everything you cannot check from the outside. A host that cannot keep reverse-DNS records coherent is telling you how the rest of the network is run. Deliverability trouble is often the first visible symptom of a network run loosely. Treat it as the free audit it is.
Straight answers
Why do my emails go to spam even with SPF set up?+
SPF is one row of a much bigger scorecard. Check reverse DNS first: does your IP's PTR exist, resolve back to the same address, and match your mail server's name? Then DKIM and DMARC. Then the part nobody checks, your IP's sending history and the reputation of its neighbouring range, both of which you inherit from your host.
What is a PTR record and why does it matter for email?+
A PTR record is the reverse-DNS entry mapping your IP back to a hostname. Receivers check that it exists, resolves forward to the same IP, and matches the name your server announces. A missing or mismatched PTR is one of the fastest routes to the spam folder.
Does my hosting provider affect deliverability?+
Substantially. They own the IP's past, the reputation of the surrounding range, and whether that range is policed. A provider that catches outbound spam from compromised customers protects every legitimate sender nearby. One that does not spends your reputation for you.
How do I check an IP's email reputation and neighbourhood?+
Query the public blocklists for both the IP and its surrounding range, look the address space up on the registry to see who actually holds it, and verify forward-confirmed reverse DNS. All of it is public, and all of it is a pre-signup check.
What's the right order to fix deliverability?+
Reverse DNS, then SPF, then DKIM, then DMARC, then sending behaviour like warm-up and list hygiene. And if the neighbourhood itself is the problem, the fix is a better network, not a better subject line.
Mail landing in spam and you're out of ideas?
Send us your sending IP and domain. We'll read the scorecard the receivers read: PTR, authentication, history, and the neighbourhood you're inheriting.
Talk to an engineerYou’ve reached the end.
Put the reading to work
What are
you running?
Tell us about the workload, traffic and recovery requirements. Start with the server builder, or talk through the details with an engineer.
Written by the engineers who build and run the infrastructure it describes.Talk to an engineer
