Why Are Marketo Emails Going to Spam?

Marketo emails usually go to spam because authentication isn't fully branded (DKIM not set up for your domain, or the return path still on Marketo's domain), because the database includes contacts who never agreed to marketing email, or because corporate spam filters don't trust your links or sending IPs. Marketo Engage handles the sending, but the domain setup and the database are yours, and B2B databases have a way of filling up with people who didn't ask to be there.

Most Marketo senders are B2B, which changes the picture a little. A lot of your mail goes to company domains protected by security gateways, not just to Gmail and Outlook.com, and those filters have their own opinions.

How Marketo sends email

• Shared IPs by default. Marketo's docs say there's no minimum volume or extra charge for a shared IP, and that the trade-off is less control: other senders' practices can affect your mail, and problems can be harder to resolve. Marketo also has a separate Trusted IP range; ask your account team whether you qualify.
• Dedicated IPs for higher volume. Marketo says that if you send fewer than 100,000 emails a month, or fewer than two mailings a month, you probably won't benefit from a dedicated IP, because it's hard to keep warm.
• SPF and DKIM on your domain. Marketo's setup steps have you add include:mktomail.com to your SPF record and publish DKIM records for each sending domain, then verify them under Admin > Email > DKIM.
• A return path you may need to brand. The return path (envelope sender, the address bounces go to) is on Marketo's domain unless you set up a branded one. Adobe says branded return path is "key for authentication using DMARC," because SPF can only align with your From domain if the return path is on your domain too.

The common causes, most likely first

1. DKIM isn't set up or verified

Without DKIM signed by your domain, and with the return path on Marketo's domain, your mail has nothing that aligns with your From domain, so it fails DMARC. Gmail and Yahoo require DMARC-passing authentication from bulk senders. Adding include:mktomail.com to SPF doesn't fix this on its own, because SPF is checked against the return path domain, not the From domain. See DMARC fail and the Gmail and Yahoo bulk sender requirements.

2. Contacts who never opted in

B2B databases collect contacts from trade shows, webinars run with partners, purchased or enriched lists, and sales imports. Put those people into a nurture program and you get complaints and spam trap hits. Marketo automatically unsubscribes people who complain through mailbox provider feedback loops (with the reason "Customer Complaint Received from ISP"), but that only works at providers that send complaint data. Gmail doesn't send it to Marketo per recipient, so you won't see those complaints in Marketo at all.

3. Old, unengaged records

Marketo instances often hold years of leads. Job changes are constant in B2B, so old business addresses go dead, and some dead addresses end up as spam traps. Mailing a database you haven't cleaned in a while is the fastest way to a blocklisting. See emailing an old list and how to find and remove spam traps.

4. Corporate filters and your links

Proofpoint, Mimecast and Cisco gateways look closely at links. Marketo lets you brand your tracking links with a CNAME on your own domain, and its setup guide advises against CNAMEs like "track" or "link," which it says are often flagged as spam. If your links still point to Marketo's default domain, you're sharing link reputation with everyone else using it. See why Proofpoint is blocking your emails and why Mimecast is blocking your emails.

5. Shared IP neighbors

On a shared IP, someone else's bad campaign can affect your mail. It's usually not the main cause, but if your authentication and list are clean and placement still drops across the board, ask Marketo support about the pool. See my ESP's shared IP is blacklisted.

6. Missing role accounts

Marketo's setup guide says any domain in your From address needs working postmaster@ and abuse@ mailboxes. They're the standard contact addresses for mail problems, and a receiver trying to reach you about one should get through.

How to fix it, step by step

1. Read the headers of a message that landed in spam with the header analyzer. You want dkim=pass with d= set to your domain, and dmarc=pass. Note the return path domain while you're there.
2. Set up DKIM for each From domain in Admin > Email > DKIM, publish the records and verify them.
3. Check SPF includes mktomail.com and stays under the lookup limit with the SPF analyzer. Marketing teams add services over time; see the 10-lookup limit.
4. Ask about a branded return path through your Adobe account team, so SPF can align too.
5. Publish a DMARC record if you don't have one. Start at p=none with reporting; the DMARC generator will build it.
6. Brand your tracking links with a CNAME on your domain that's different from your landing page CNAME.
7. Segment by engagement. Build a smart list of people who opened or clicked recently and mail only them until placement recovers.
8. Remove or re-permission contacts without a clear opt-in source. Purchased and enriched lists go first.

How to confirm it's fixed

Check Google Postmaster Tools for domain reputation and spam rate, since Gmail complaints won't show up in Marketo. Send to seed mailboxes at Gmail, Outlook and Yahoo, and if you mail mostly businesses, to a few test addresses behind Proofpoint or Mimecast if you have them. Watch your bounce reasons in Marketo for gateway rejections.

How to keep it from coming back

• Keep a record of where every lead came from, and keep purchased or enriched data out of marketing programs.
• Add a sunset rule so leads who haven't engaged in months stop getting nurture email.
• Re-check authentication whenever you add a new From domain or brand.
• Watch spam rate in Postmaster Tools weekly. See Gmail spam rate threshold.

If placement dropped without warning, start with Why are my emails suddenly going to spam? For other platforms, see Salesforce Marketing Cloud, HubSpot and Braze.

When to get help

If your authentication passes and your lists are clean but corporate recipients still aren't getting your mail, or you've been blocklisted and can't tell which program caused it, it's worth an outside look. Get in touch.

FAQ

Do I need a dedicated IP in Marketo?

Probably not unless you send more than 100,000 emails a month on a regular schedule. Marketo's own guidance says lower or irregular volume makes a dedicated IP hard to keep warm.

Why does SPF pass but DMARC fail on my Marketo email?

Because SPF passes for Marketo's return path domain, not yours. DMARC needs SPF or DKIM to align with your From domain. Set up DKIM for your domain, and consider a branded return path.

Why don't I see Gmail spam complaints in Marketo?

Gmail doesn't send individual complaint reports to Marketo. Use Google Postmaster Tools to see your spam rate at Gmail.

Does Marketo unsubscribe people who mark my email as spam?

Yes, at mailbox providers that send feedback loop reports to Marketo. Those leads are unsubscribed with the reason "Customer Complaint Received from ISP."