Deliverability
Why your first test email lands in junk — and how to reach the inbox. Spoiler: it's normal, it's fixable, and it's mostly not about your DNS.
Your first test went to spam. That's expected.
You verified your domain, sent your first email, and found it in the junk folder. Before you file a support ticket: this happens to nearly every new sender on every email provider, and it usually has nothing to do with a misconfiguration.
Look at what the receiving mail server saw:
- A sender address like
test@yourdomain.com— real humans rarely send fromtest@, but spammers probing infrastructure do it constantly - A subject like "Test email" and a one-line body — a classic spam-filter signature
- A domain the receiver has never seen mail from before — zero sending history means zero trust
Any one of these raises the spam score. All three together will junk a message from almost any new sender — regardless of which email API is behind it.
What Quolle already handles for you
Authentication is the part filters check first, and it's the part your domain setup already covers. When your domain shows verified, all of this is in place:
| Standard | What it proves | Status |
|---|---|---|
| SPF | Quolle's servers are authorised to send for your domain | Set up during domain verification |
| DKIM | The message was cryptographically signed by your domain and not altered | Set up during domain verification (the 3 CNAME records) |
| DMARC | Your domain publishes a policy for handling authentication failures | Included in your DNS records |
| Custom MAIL FROM | The technical Return-Path uses your domain, not a generic one — Gmail shows "mailed by: yourdomain.com" | Configured automatically (the MX + TXT records on mail.…) |
If authentication were failing, you'd typically see outright rejections, not junk placement. Junk placement with passing authentication means the filter's objection is content or reputation — the two things only you control.
Send a realistic test instead
Use a real sender, with a display name
Send from hello@, notifications@, or receipts@ — never test@. Include a display name: "Acme <hello@mail.acme.com>" renders as a recognisable sender in the inbox and scores better with filters.
Write real content
Test with the actual email your product will send — an OTP, a receipt, a welcome message. Proper HTML structure, a plain-text part (Quolle auto-generates one if you omit text), and a footer with your company name and address. Avoid the word "test" in the subject.
Train the destination mailbox
If a message still lands in junk, mark it "Not junk" and add the sender to safe senders. This matters twice over: it fixes placement for that mailbox immediately, and it feeds positive signals back into the provider's filter.
Warm up your domain
Reputation is earned with history. Send consistent, modest volumes to real, engaged recipients for the first 2–4 weeks rather than blasting your full list on day one. Opens, replies, and "Not junk" clicks build trust; bounces and complaints destroy it.
The Microsoft 365 / Outlook case
Microsoft runs the strictest spam filtering of the major providers, and it leans heavily on sender history — a brand-new domain starts with a deficit at Outlook and Microsoft 365 even when everything is configured perfectly. Expect your first sends there to junk, and expect it to improve over the first weeks of consistent sending.
To see exactly how Microsoft judged a message, open the junked email and choose View message source, then find these two headers:
Authentication-Results: spf=pass ... dkim=pass ... dmarc=pass ...
X-Forefront-Antispam-Report: ... SCL:5 ...Authentication-Results— all three ofspf,dkim, anddmarcshould saypass. If any fail, re-check your domain verification.X-Forefront-Antispam-Report—SCLis Microsoft's spam score. 5+ goes to junk. If authentication passes but SCL is high, the cause is content or reputation, not configuration.
If real production mail starts junking
A checklist, in the order most likely to help:
- Check your bounce and complaint rates in the dashboard — high rates poison reputation fast, and Quolle pauses sending automatically if they cross safety thresholds.
- Respect the suppression list. Quolle automatically suppresses addresses that bounced or complained; repeatedly emailing bad addresses is the fastest way to ruin a domain.
- Review recent content changes — new links, link shorteners, image-heavy layouts, or ALL-CAPS subjects can flip a filter's verdict.
- Read your DMARC reports. Your DMARC record includes a
ruareporting address — aggregate reports show how receivers judge your authentication over time. - Watch engagement. Filters track whether recipients open, reply, or delete-without-reading. Sending mail people ignore erodes placement even with perfect infrastructure.
Authentication-Results) and we'll diagnose it with you.List hygiene & bounces
The fastest way to wreck a good domain is to send to addresses that don't exist. Every hard bounce tells inbox providers you aren't checking who you email — and a sudden spike almost always traces back to fake or fraudulent sign-ups (bots creating accounts with made-up addresses). Your welcome email fires, the mailbox doesn't exist, it bounces.
Keep these two numbers in the safe zone:
- Bounce rate under 5%. Above ~8% Quolle pauses your account automatically to protect your sender reputation.
- Complaint rate under 0.1% — the share of recipients who mark you as spam.
Quolle already suppresses every address that hard-bounces or complains — for your account and platform-wide — so you can never re-send to a proven-bad address. But suppression only stops the second bounce. Stopping the first one is list hygiene, and that lives in your sign-up flow:
Use double opt-in (the biggest win)
Don't bulk-mail someone the moment they sign up. Send one "Confirm your email" message with a link, and only treat them as a real subscriber once they click. Fake and mistyped addresses never confirm, so they never enter your list — this alone eliminates most bounce problems.
Validate the address at sign-up
Check the format is valid, the domain actually accepts mail (has MX records), and it isn't a disposable/throwaway domain. For higher assurance, a verification API (ZeroBounce, Kickbox, NeverBounce) flags dead mailboxes before you ever send.
Stop bots at the form
Seeing waves of fake accounts? Add a CAPTCHA (Cloudflare Turnstile is free), rate-limit sign-ups per IP address, and block known disposable-email domains.
Only email people who asked
Never send to purchased, scraped, or "found" lists — they're full of dead addresses and spam traps, and they'll sink your reputation fast.
To spot the problem in your own account, open your dashboard Logs and filter by status Bounced. A cluster of similar-looking addresses — e.g. name0030@outlook.com — is the classic signature of fake sign-ups.
Open and click tracking
Tracking is off by default on new sending domains, and you turn it on per domain under Domains → your domain.
It's off by default because it isn't free. Open tracking adds an invisible pixel to every message; click tracking rewrites every link to pass through a redirect. Both are normal on marketing email, where open and click rates are the point. On transactional mail — password resets, OTPs, receipts — they cost you inbox placement in exchange for numbers nobody reads: a redirect domain plus a tracking pixel is a shape spam filters weight heavily.
A reasonable setup is tracking on for the domain you send campaigns from, and off for the one your OTPs go out on.
Custom tracking domain
If you do turn tracking on, open pixels and click links point at Quolle's shared tracking domain by default — which means you share its reputation with every other sender using it. Point them at your own domain instead, so every link in your email stays on yourdomain.com. Recommended for anyone with tracking enabled.
- In the dashboard, open Domains → your domain → Tracking and enter a subdomain like
track.yourdomain.com. - Add the CNAME record we show you (your tracking subdomain → Quolle's tracking host).
- Click Verify. Once the CNAME resolves, new sends use your tracking domain automatically. HTTPS for the subdomain is provisioned for you.