How to Avoid Spam Filters: Two Ordered Checklists (Marketing and Cold)

To avoid spam filters, work in the order filters weigh things: authenticate your domain with SPF, DKIM and DMARC; send only to verified addresses that expect your mail; keep volume steady; keep complaints and bounces low; and only then tidy the content, with few honest links and no hidden text. Word lists come last. Below are two ordered checklists, one for marketing email and one for cold email, because the risks differ.

Most "avoid spam" advice starts with banned words. We don't, for reasons set out in do spam trigger words still matter: in SpamAssassin's published scores, phrase rules add a few points each, while rules about your IP and links score as high or higher, and Gmail and Microsoft lean on learned models and complaints. A filter is mostly asking "who sent this, and do people want it?"

What filters actually weigh

Identity, reputation and recipient reactions come first; the message itself comes last. In rough order:

Signal	What the filter is asking	Documented by
Authentication	Did this really come from the domain it claims?	Gmail, Yahoo and Microsoft sender requirements
Complaints	Do recipients report this sender?	Google's 0.3% line; Microsoft's bulk complaint level
Bounces	Does this sender know its recipients?	Google: "reduce the sending volume" when bounces start
Volume pattern	Is this sudden, from a new or quiet sender?	Google: avoid "sudden volume spikes"
Links and domains	Are the linked domains listed or deceptive?	Spamhaus DBL; SpamAssassin URI rules
Message structure	Hidden text, image-only, fake "Re:"?	Google sender guidelines
Wording	Classic spam phrases	SpamAssassin phrase rules, small and often reduced

The quotes are from Google's Email sender guidelines. The checklists follow this order.

Verify before you send: the bounce lines

Every platform and provider punishes repeated bounces, and verification is the step that removes most of them. The published lines:

Who	Line	What happens	Source
Klaviyo	Bounce rate under 1% "healthy"; over 2% "needs attention"	Guidance	Klaviyo help
HubSpot	Hard bounce rate of 5% in a month	Marketing email may be suspended	HubSpot KB
Instantly	5% by default, once 200 emails have gone	Campaign auto-paused	Instantly help
Gmail	No number	"Automatically unsubscribe recipients who have multiple bounced messages"	Google
Outlook.com	No number	After a permanent failure, senders "must not attempt to retransmit"	Microsoft policy

More platforms are in bounce rate thresholds by platform. The practical rule: verify any list you didn't collect yourself, any list older than a few months, and every cold list, before the first send. The free email verifier handles single addresses; SimpleVerifier verifies whole lists.

Why marketing and cold email need different checklists

The filters are the same; your starting position isn't. A newsletter goes to people who asked for it, so you have engagement history and a consent record to lean on. A cold email goes to strangers, so every negative signal counts for more and there's nothing to offset it.

	Marketing email	Cold email
Consent	Opted in	None; Google says "Don't send messages to people who didn't sign up"
Typical list source	Signup forms, purchases	Scraped, vendor data, guessed patterns
Biggest bounce risk	Old addresses and signup typos	Never-valid and stale addresses
Biggest complaint risk	Too frequent, or mailing people who forgot you	Irrelevant targeting and long sequences
Sending setup	ESP with a custom sending domain	Mailbox accounts on secondary domains
Volume	Large sends, ramped gradually	Small daily volumes per inbox
Format	Designed HTML is normal	Plain text works best
Unsubscribe	One-click header required by Gmail for marketing mail	A clear opt-out line, honoured everywhere

That's why checklist B is stricter on volume, format and stop rules, even though both lists start in the same place.

Checklist A: marketing email

For newsletters, promotions and lifecycle mail sent to people who opted in.

1. Authenticate the sending domain. SPF and DKIM passing, DKIM signed with your own domain, a DMARC record of at least p=none, aligned with the From address. Run the deliverability audit and fix anything red. Details: SPF, DKIM and DMARC explained.
2. Send through a custom sending domain on your ESP, not the platform's shared default, so alignment passes and reputation attaches to you.
3. Verify the list if it's imported, old or hasn't been mailed for a while. See how to clean an email list and mailing an old list.
4. Stop bad addresses at signup with double opt-in or real-time verification, plus typo correction.
5. Suppress hard bounces at once and limit retries on soft ones; see hard vs soft bounces.
6. Support one-click unsubscribe with RFC 8058 headers, plus a visible link in the body. Gmail requires it for marketing mail; see one-click unsubscribe.
7. Retire inactive subscribers. Run a re-engagement campaign, then apply a sunset policy. Inactive addresses are where complaints and recycled spam traps come from.
8. Keep volume steady. Ramp new domains or IPs gradually; see the warm-up schedule. Don't send to your entire list after months of silence.
9. Watch complaints. Keep the spam rate in Google Postmaster Tools under 0.1%; Google's hard line is 0.3%.
10. Tidy the content last: a text part alongside HTML, a sensible text-to-image balance, visible links on your own domain, no hidden text, an honest subject and From name.

Checklist B: cold email

For outreach to people who haven't heard of you. Everything in checklist A that applies still applies; these are the extra or different steps.

1. Check the law for the recipient's country before building anything; see the cold email guide.
2. Verify every address, every time. Cold lists come from scraping, vendors and guessed patterns. Handle catch-all and role addresses deliberately.
3. Send from secondary domains with full authentication; see cold email domain setup.
4. Warm each new inbox before campaigns start. Warm-up helps a new inbox start; it doesn't excuse a bad list.
5. Cap volume per inbox. Cold tools commonly suggest 30 to 50 a day; see cold emails per day per inbox. Scale with more inboxes and domains via inbox rotation.
6. Turn off open tracking, or use a custom tracking domain. A pixel makes a plain-text email HTML with a remote image; see open tracking and cold email deliverability and custom tracking domains.
7. Write plain text with at most one link, to your own domain. No shorteners, no attachments on a first email.
8. Never fake a reply. Google says not to start subjects with "Re:" or "Fwd:" "unless the messages are actual replies or forwards".
9. Include an opt-out and honour it across every inbox and tool.
10. Set stop rules: any reply, any removal request and any bounce ends the sequence for that person. Keep sequences short; see how many follow-ups to send.

For the cold infrastructure in launch order, see cold email deliverability.

The content checks that do count

Wording is a weak signal, but a few content properties are documented by filters and providers. These are worth checking before any send, marketing or cold:

Check	Why it matters	Source
Links point to domains you control, with no shorteners	Spamhaus's Domain Blocklist checks domains found in message bodies; shared shorteners get abused	Spamhaus DBL
Link text matches the destination	Google: links "should be visible and easy to understand"	Google
No hidden text	Google: "Don't use HTML and CSS to hide content in your messages"	Google
A text part alongside HTML, and real text, not one big image	Rule-based filters score HTML-only and image-heavy messages	Spam trigger words post
Subject and From name are accurate	Google asks that subject, headers and display names "accurately represent the sender identity"	Google

Notice what's not on the list: individual words. If you want the scoring detail, the spam trigger words post walks through SpamAssassin's published rule scores.

Test before a big send

A quick test catches broken setup; it can't predict how real recipients will react. Before a large campaign or a new sending domain:

1. Send a test to accounts you control at Gmail, Outlook.com and Yahoo, and open the headers. SPF, DKIM and DMARC should all show pass for your domain. The email header analyzer reads them for you, and how to read email headers explains each line.
2. Click every link from the test message, on a phone too, and confirm each one loads over HTTPS on the domain you expect.
3. Run a seed test if you have one, but read it as a snapshot. Seed accounts have no engagement history, so they can't show how your real recipients' inboxes treat you; see inbox placement seed tests.
4. Send to your most engaged segment first and check bounces and complaints before releasing the rest.

What doesn't work

Most popular anti-spam tricks either do nothing or make things worse.

• Spelling "free" as "fr33". It reads as evasive to the human recipient, and the word wasn't the problem.
• Relying on a spam-word checker. It checks your text against a phrase list. It can't see your reputation, your links' listing status or how recipients reacted to your last send.
• Sending more to "push through". Volume on a damaged reputation deepens the damage. Slow down and fix the cause.
• Switching to a fresh domain without fixing the list. The new domain inherits the same bounces and complaints within weeks.
• Hiding the unsubscribe link. People who can't leave report you instead, and complaints weigh more than unsubscribes.

If you're already in spam

Stop or slow sending, then read the evidence before changing anything. The headers of a test message show whether SPF, DKIM and DMARC passed; paste them into the email header analyzer. Then diagnose by provider: why emails go to spam in Gmail and why emails land in Outlook's junk folder. Check your domains and IPs with the blacklist check. If bounces spiked, see what to do after a high bounce rate. For a longer list of symptoms and causes, see why are my emails going to spam.

The short version

Authenticate, verify, keep volume steady, keep complaints and bounces low, then tidy the content. For cold email, add secondary domains, warm-up, low per-inbox volume, plain text and strict stop rules. If your bounce rate is the weak link, SimpleVerifier checks whole lists before you send; the first 100 email checks are free, and plans are on the pricing page.