Step 1: confirm authentication is actually correct
Before anything else, verify SPF, DKIM, and DMARC are all published and passing for the domain actually sending the mail — not a domain that looks similar, and not just the domain in the "From" address if a third-party service sends on your behalf. A surprisingly common cause of deliverability problems is a marketing tool, CRM, or transactional-email provider sending as your domain without ever having been added to the SPF record.
If DMARC is already in enforcement (p=quarantine or
p=reject), check the aggregate reports first — they'll show
every source claiming to send as your domain and whether each one is
passing, which is often faster than guessing which sender is misconfigured.
Step 2: check blacklists
Even with perfect authentication, mail from a blacklisted IP or domain gets filtered or rejected outright. Blacklisting can happen for reasons entirely outside your control — a shared IP previously used by a spammer, a compromised account on the same mail server, or a spike in bounce rate from an old, unmaintained mailing list. Check both the sending IP and the sending domain; they're listed independently.
Step 3: look at bounce and complaint rates
Mailbox providers (Gmail, Outlook, Yahoo) track sender reputation continuously, and a sudden spike in hard bounces (invalid addresses) or spam complaints will degrade deliverability even for an authenticated, non-blacklisted sender — this is reputation-based filtering, not a binary pass/fail check. A list that hasn't been cleaned in years is a common, underestimated cause: addresses that were valid five years ago bounce hard today, and a high hard-bounce rate on a single campaign can suppress delivery for weeks afterward.
Step 4: check content and sending patterns
If authentication, blacklist status, and reputation all check out, the remaining suspects are content-based spam filtering and sending-pattern anomalies: a sudden large volume increase from an account that normally sends a handful of messages a day, heavy use of URL shorteners, or content patterns common in spam campaigns. These are the hardest to diagnose precisely since mailbox providers don't expose their exact filtering criteria, but a sudden, unexplained drop in delivery rate with everything else checking out clean usually points here.
Why the order matters
Fixing content or sending patterns while authentication is still broken wastes effort — no amount of careful copywriting overcomes a message that fails SPF and DKIM outright. Working top-down (authentication → blacklists → reputation → content) means each step you skip past is one you've actually ruled out, not one you've guessed past.