Why Are Salesforce Marketing Cloud Emails Going to Spam?

Salesforce Marketing Cloud emails usually go to spam because your sending domain isn't authenticated as your own (no Sender Authentication Package or private domain, so DMARC can't pass), because new dedicated IPs weren't warmed properly, or because you're mailing subscribers who stopped engaging long ago. Marketing Cloud gives you industrial-strength sending. It doesn't stop you from using it on a list that doesn't want the mail.

Marketing Cloud tends to be used by large brands with large databases and several teams sending. That combination makes it easy for one team's campaign to hurt everyone's placement.

How Marketing Cloud sends email

The product Salesforce calls Marketing Cloud Engagement has a few pieces that decide how your mail looks to a receiver:

• Sender Authentication Package (SAP). Salesforce describes SAP as a bundle: an authenticated private domain, link and image wrapping on that domain, a dedicated IP, and reply mail management. Link and image wrapping is only available with SAP.
• Private Domain. A paid product that adds SPF and DKIM authentication for your sending domain. Salesforce says these together satisfy DMARC.
• Without either. Salesforce's own example of an account without SAP shows the return path on bounce.exacttarget.com, links on click.exacttarget.net, images on image.exacttarget.net, and no DKIM domain. That's mail with nothing that aligns with your From domain.
• Send classifications. Each send uses a classification that combines a sender profile (From name and address), a delivery profile (header and footer, including the physical address and unsubscribe link) and a CAN-SPAM type: Commercial, which honors opt-outs, or Transactional.

The common causes, most likely first

1. Your domain isn't authenticated

If you're sending from example.com without SAP or a private domain for it, DKIM and SPF pass for Salesforce's domains, not yours, and DMARC fails. Gmail and Yahoo require DMARC-passing authentication for bulk senders, and Microsoft has tightened its requirements for high-volume senders to Outlook.com too. See 550 5.7.515, DMARC fail and the Gmail and Yahoo bulk sender requirements.

2. Dedicated IPs that weren't warmed

SAP comes with a dedicated IP, and Salesforce recommends one for anyone sending more than 100,000 messages a month, with more than one IP above 2 million a day. A dedicated IP starts with no reputation. Salesforce's guidance is to build at least 30 days of positive sending history, longer for some senders. Moving a big program onto new IPs and sending full volume on day one is a reliable way to end up in spam or deferred. See 421 4.7.0.

3. Stale data extensions

Marketing Cloud audiences live in data extensions and lists, and it's easy for someone to send to a data extension built two years ago. Old addresses mean bounces, spam traps and people who don't remember you. Marketing Cloud stops mailing addresses that bounce repeatedly (a subscriber goes to Held status after three or more consecutive bounces with the first and last more than 14 days apart), but that's after the damage is done. See emailing an old list.

4. Several business units, one reputation

Large accounts often have several business units or teams sending from the same domains and IPs. One team's aggressive promotion raises complaints for everyone. If you can't see who sent what volume to whom, you can't find the cause.

5. Marketing mail sent as transactional

A Transactional send classification is for messages triggered by a purchase, an opt-in or similar activity. Using it for promotional mail to get around unsubscribes is a legal problem as well as a deliverability one: people who unsubscribed and keep getting mail report it as spam.

6. Links and images on shared domains

Without SAP, links and images point to Salesforce's shared domains. With SAP, they're wrapped on your own. Corporate filters in particular weigh link domains; see why Proofpoint is blocking your emails.

How to fix it, step by step

1. Read the headers of a message in spam with the header analyzer. Check the d= domain in the DKIM signature, the return path domain and the DMARC result.
2. Get your domain authenticated. If DKIM isn't signed by your domain, talk to your Salesforce account team about SAP or a private domain for your sending (sub)domain.
3. Check DNS from outside Salesforce. Run the domain through the email checker and publish a DMARC record if it's missing; the DMARC generator will build one.
4. Check the unsubscribe headers. Look for List-Unsubscribe and List-Unsubscribe-Post in the headers of a live marketing send. Gmail and Yahoo require one-click unsubscribe for bulk senders.
5. Audit recent sends. List the data extensions mailed in the weeks before placement dropped. Look for unusually large or old audiences and for new data sources.
6. Restrict to engaged subscribers. Build an engagement-based audience (opens or clicks in recent months) and send only to it until placement recovers.
7. Re-warm if you've changed IPs or let volume drop for weeks, increasing daily volume gradually.
8. Check send classifications and make sure promotional mail uses a Commercial classification.

How to confirm it's fixed

Watch Google Postmaster Tools (spam rate and authentication), Microsoft SNDS for your dedicated IPs, and your own bounce and complaint reporting in Marketing Cloud. Send to seed accounts at Gmail, Outlook and Yahoo before large sends. Recovery is usually measured in weeks.

How to keep it from coming back

• Give every team sending from the account a clear owner for its audiences and volumes.
• Make engagement-based audiences the default and retire subscribers who haven't engaged in months.
• Warm any new IP before it carries real volume, and keep volume steady once it does.
• Keep spam rate under 0.1% and check it weekly. See Gmail spam rate threshold.

If placement dropped without warning, start with Why are my emails suddenly going to spam? For other platforms, see Marketo, Braze and SendGrid.

When to get help

If several teams send from one account and nobody can tell which program caused the problem, or your authentication passes and placement still isn't recovering, an outside review of the account's send history and audiences usually gets to the cause quicker. Get in touch.

FAQ

Do I need SAP in Salesforce Marketing Cloud?

If you send meaningful volume from your own domain, effectively yes. SAP (or at minimum a private domain) is what lets your mail authenticate as your domain, and Salesforce recommends a dedicated IP above 100,000 messages a month.

What does Held status mean in Marketing Cloud?

Marketing Cloud stops mailing a subscriber after repeated bounces: three or more in a row, with the first and last more than 14 days apart. It's a bounce safeguard, not a spam signal on its own.

Why does Gmail show "via" and a Salesforce domain next to my From address?

Gmail shows "via" when the domain the message was sent from doesn't match the From domain, which here means the message is authenticated with Salesforce's domain rather than yours. Setting up SAP or a private domain so DKIM signs as your domain fixes it.

Can a transactional send classification fix deliverability?

No. It changes which subscribers Marketing Cloud mails, not how mailbox providers judge the message. Promotional content sent as transactional usually makes complaints worse.