Spam-folder triage — when you wake up to "users say it is in spam"
A 30-minute runbook for the most common cause of "this email never arrived". Works at 9pm on Sunday too.
The pattern: a customer reports that a transactional email never arrived. You check the logs and the message was sent and accepted. The mail is in the spam folder. Here is how to triage in under 30 minutes.
Step 1 — confirm the spam-folder hypothesis
Ask the customer to check the spam folder. Most "never arrived" reports are spam-folder placement, not actual delivery failures. Confirm before you spend any other time.
Step 2 — was it just this user?
Send the same email to a fresh test inbox in the same domain (e.g. a Gmail test account). If it lands in the inbox, the original recipient has a personal filter or a corporate one. If it lands in spam, the issue is broader.
Step 3 — check the headers
Open the spam-foldered message, view raw headers, and look for:
- spf=fail or spf=softfail — your SPF needs work.
- dkim=fail or dkim=neutral — DKIM signature did not validate.
- dmarc=fail — alignment failure between From: and the auth domains.
- X-Spam-Score above 5 — your content tripped a Bayesian filter.
- Authentication-Results header missing entirely — receiver dropped your auth attempt.
Step 4 — check the dashboard
Open Postmaster Tools (or the VoltMail dashboard) and check your domain reputation. A drop to LOW or BAD is a signal you have been folded for hours, not minutes.
Step 5 — recent changes
Did you recently push a new template? Add a new sender domain? Change SPF? 80% of incidents trace to a change in the previous 48 hours.
Step 6 — the immediate fix
If the issue is per-user: ask the user to mark "not spam" and add the sender to contacts. If it is per-domain: roll back recent changes, then file a Postmaster delisting request if needed. If it is per-IP: pause that IP, investigate the upstream cause.