The Email & CRM Vault

How Gmail, Yahoo & Outlook Spam Filters Really Work

Written by Beth O'Malley | 07/2025

 

Before you dig in, why don't you get access to RE:markable

RE:markable is the weekly email about emails. Dropping the latest email marketing news, updates, insights, free resources, upcoming masterclasses, webinars, and of course, a little inbox mischief.

 

 

Email deliverability often feels like some cryptic black box that marketers have to bow to.

One day, your emails are in the inbox and the next? Lost in the digital void of spam.

But here’s the truth most people don’t want to tell you: deliverability isn’t mysterious (or difficult to track, monitor and look after).

It’s not about praying to the gods of SPF, DKIM, and DMARC (although this is really important). And no, you don’t need to be an email engineer to land in the inbox.

Deliverability is mostly common sense. About 80% of it comes down to how your audience behaves, not the tech stack behind the send - and this is really good thing.

In this blog, we’re pulling back the curtain. You’ll learn how Gmail, Yahoo, and Outlook actually filter your emails, and how to turn all that noise into a practical, human-first strategy.

Why deliverability is mostly common sense

Let’s get this one straight first:

  • User behaviour outranks tech setup (most of the time)

Spam complaints, opens, deletes and dragging emails to folders…these actions train the filters more than any DNS record ever could.

PSA: Email authentication is a must, but Outlook has it's own rules on this and Gmail has other rules.

  • Permission means nothing without engagement
Yes, someone opted in. But if they ghost every single email you send? Gmail sees that as a signal and a very bad one. Engagement is the new permission.

  • Every recipient is judged individually

Every individual recipient's behaviour contributes to your senders reputation, especially on Gmail and Yahoo, where deliverability is highly personalised and based on individual user interaction history. So a handful of disengaged users won’t directly penalise your engaged ones — but they do dilute your overall sender reputation. And if you keep sending to disengaged users over time, that pattern can get flagged as spammy behaviour, reducing your inbox placement across the board. 

Yahoo and Gmail both use machine learning models that learn per recipient, but they also use aggregated signals to assess if a sender is “likely to be wanted” inbox-wide.


 

Gmail: The user is the algorithm

Gmail is the most behaviour-driven platform out there.

  • Gmail listens to people. It won’t auto-unsubscribe someone or block your emails on its own. It waits to see how users act.
  • Engagement = more than opens. Site visits. Brand searches. Interaction with your brand after the send. Gmail clocks it all.
  • Spam folder ≠ failure. Sometimes Gmail puts unfamiliar senders there as a sort of “soft launch.” It’s cautious, not punishing.
  • Reputation is fluid. New domains usually start in spam. Older domains get the benefit of the doubt—but only if they stay consistent.

 

How Gmail knows your post-send engagement

Gmail is not just an inbox. It’s part of the broader Google ecosystem and that gives it visibility into user behaviour well beyond the email itself.

Here’s how it works:

1. Web tracking via Chrome, Android, and Google Search

  • If a user receives your email, doesn’t open it, but Googles your brand 10 minutes later? Gmail links that behaviour.
  • If they visit your site while logged into a Google account (which most are)? Google connects that back to your domain activity.
  • If they frequently interact with your brand across YouTube, Google Ads, or Maps? That adds to your domain’s trust profile.

2. Gmail user signals = deliverability gold

Gmail watches what users do, not just what senders send.

Actions like:
  • Dragging your email out of the spam folder
  • Replying
  • Starring
  • Searching your email address in their inbox
  • Reading and scrolling…

…are all positive signals that your emails are valuable.

3. Behaviour after the send
Gmail infers relevance from downstream activity. For example:

If a recipient receives your email, ignores it, but visits your site via another route, that still counts.

Clickless conversions (i.e. they don’t click the email, but take action anyway) still improve your reputation.

4. Machine learning model per user

Gmail treats every recipient individually. So your sender reputation isn’t global; it’s personal per subscriber. A+ with one user, C- with another.

So what does that mean for you?

  • Don’t panic if your open rate looks low, Gmail sees the bigger picture
  • Focus on brand recall, consistency, and downstream impact
  • Show up in the inbox with relevance, not just frequency

5. Email authentication

If your SPF, DKIM, or DMARC setup fails or is missing, Gmail immediately treats your message as suspicious. Even if the content looks clean, unauthenticated messages are far more likely to land in Spam, especially for new or low-reputation senders. Gmail uses authentication to confirm you're really you, fail that, and you're flagged fast.

 

Yahoo: Playing the long game

Yahoo Mail might not get the same spotlight as Gmail, but its filtering systems are just as critical, and just as complex. While it leans on more traditional spam filtering models, Yahoo’s rules are no less strict, especially for senders with inconsistent behaviour or shaky domain reputation.

Your domain and IP reputation matter (a lot)

Yahoo evaluates sender reputation at both the IP and domain level, using historical data to determine how trustworthy your emails are. Factors that impact this include:

  • Frequency and volume of sending

  • Bounce rates and invalid addresses

  • Complaint rates (especially "Mark as Spam")

  • Spam trap hits

  • Consistency and cadence

If you send erratically, ramp up volumes too quickly, or switch IPs/domains without warming them up, Yahoo is likely to treat you cautiously, or block you outright.

Greylisting: The silent gatekeeper

Greylisting is Yahoo's way of saying, "Let’s wait and see." It’s a delay tactic, not an outright block, where Yahoo temporarily rejects messages from unknown or inconsistent senders. It does this to gauge:

  • If your server retries delivery (legitimate servers will)

  • How your sending behaviour develops over time

  • Whether user engagement follows (positive or negative)

What it looks like:

  • Delays in delivery (emails appear hours late)

  • No bounce message, but no immediate inbox placement either

  • Often affects new senders, new domains, or senders with volatile sending patterns

How to get through it: 

  • Maintain consistent sending volumes

  • Use warmed-up, reputable IPs and domains

  • Don’t suddenly start blasting large lists from a new setup

  • Monitor Postmaster Tools and soft bounces

User feedback is everything

Like Gmail, Yahoo trains its filters based on what users do:

  • Marking your emails as spam or junk = 🚩 red flag

  • Creating filters to move your emails = a sign you're not relevant

  • Ignoring or deleting emails consistently = weak engagement signals

To strengthen inbox placement:

  • Ask users to add you to their contact list or safe sender list

  • Use clear unsubscribe options (hard-to-leave = fast way to complaints)

  • Send based on behaviour: segment active users, suppress unengaged ones over time 

URLs can get you flagged

Yahoo's filters heavily scrutinise your email links. Using shady or mismatched URLs is one of the fastest ways to land in the spam folder.

Common red flags:

  • URL shorteners (bit.ly, tinyurl) without proper configuration

  • Domains with a history of abuse or flagged by blocklists

  • Misalignment between visible text and actual destination URL

  • Broken, expired, or dynamic links from unfamiliar domains

Best practice:

  • Use branded tracking domains

  • Ensure domain reputation is clean (check tools like Spamhaus, SURBL)

  • Keep a consistent domain identity across all email assets

Also, of course email authentication...

Yahoo’s spam filters treat authentication as a baseline trust signal. If SPF/DKIM/DMARC records are misconfigured or missing, your domain reputation suffers, and you're more likely to be greylisted, delayed, or dumped into Junk. It's one of the first things Yahoo checks before even looking at user behaviour.

 

Outlook & Microsoft: SmartScreen AI, SCL Scores & Control Freak Energy (Explained)

Microsoft’s email filtering stack is powerful, enterprise-grade, and very rules-based, but it’s also incredibly user-aware. Outlook (via Exchange Online Protection, or EOP) relies on a combination of machine learning, content scanning, reputation analysis, and Spam Confidence Level (SCL) scoring to decide where your email lands.

It can be frustratingly rigid if misunderstood. So here’s the play-by-play:

SCL (Spam Confidence Level): Your deliverability scorecard

Every email that passes through Microsoft’s email ecosystem is assigned an SCL score (0–9). This score determines whether your message goes to the Inbox, Junk folder, or gets outright blocked.

Key SCL thresholds:

  • SCL -1: Always deliver to inbox. Reserved for trusted senders like those on the safe sender list or internal domains.

  • SCL 0–1: Delivered to inbox. Considered not spam.

  • SCL 5–6: Likely spam. Routed to Junk Email folder.

  • SCL 9: High confidence spam. Often quarantined or rejected.

  • Microsoft SCL documentation (official)

  • EOP filtering technologies overview

 

SmartScreen: Microsoft’s AI Engine

SmartScreen is Microsoft's proprietary machine learning filter that assesses:

  • Content patterns (including word use, formatting, headers, metadata)

  • Sending behaviour (volume changes, list hygiene, historical complaints)

  • Reputation signals from your IP/domain

  • Global user interaction data across the Microsoft ecosystem (Outlook, Hotmail, Office 365)

Over time, it learns from feedback and adjusts filter thresholds based on whether people are:

  • Opening or replying

  • Deleting without reading

  • Marking as spam

  • Marking not spam (important signal)

SmartScreen doesn’t just judge your message once. It keeps adapting, which means if your emails consistently get ignored or flagged, you’ll sink - very fast.

SmartScreen Filter - Microsoft

User overrides: The secret backdoor

One of Outlook’s most unique features is how much control it gives users over their filtering experience.

Users can:

  • Mark a sender or domain as safe (SCL score is overridden)

  • Use custom mail rules to route messages

  • Add to Blocked Senders (message goes straight to Junk regardless of SCL)

  • Right-click and mark a message as “Not Junk” (feeds SmartScreen training and bypasses future filtering)

Safe and blocked senders in Outlook

Other key factors in Microsoft filtering

  • Authentication failures (SPF, DKIM, DMARC) = Instant suspicion

  • No engagement across multiple sends = Drops sender trust

  • Inconsistent “From” headers or reply addresses = Red flag

  • Use of dynamic or suspicious URLs = Common spam signal

  • Bulk sending patterns without segmentation = Lowered score

 

Now you know - here's what to do:

You can’t hack the system (and please don't try to), but you can align with it.

Inbox placement isn’t something you brute-force your way into. You’re not getting preferential treatment from Gmail or Outlook just because your SPF records are spotless or your DMARC policy sounds fancy.

You get into the inbox by sending better email. Email that people actually want. Email that lands when it makes sense. Email that respects the person reading it.

That means:

  • Relevant content based on real behaviour and lifecycle stage.

  • Timely sends that fit your customer’s journey, not your internal calendar.

  • Segmented lists that filter out the ghosts and serve the gold.

  • Consistent messaging that builds brand memory and trust.

Deliverability isn’t about tech perfection; it’s really about relationship consistency. And nothing tanks a relationship like shouting into someone’s inbox when they didn’t ask for it (or who has shown you they don't care after LONG time).

Measure impact, not just clicks

If your weekly KPI review still starts with "open rates," and "Click rates" we need to talk.

Open rates are shaky, click rates are shallow, and deliverability is bigger than any one campaign. Great email marketers have graduated from chasing vanity metrics to measuring real business impact.

So what should you actually be tracking?

Signals of impact:

  • Direct and organic traffic increases — people are Googling you or typing your URL after reading your emails.

  • Reply sentiment — are they writing back with enthusiasm or confusion?

  • Pipeline momentum — are email nurtures moving leads to sales conversations?

  • Brand search volume — are more people looking for you after campaigns land?

  • Retention curve stability — are subscribers sticking longer and engaging more?

  • Further action metrics - things like time to first action, next action - the actions that may be outside the emails too.
  • Correlation graphs - You improve your email strategy & sales are equally going up, leads, enquiries, brand searches, etc.

If you paused email for six weeks and your funnel slows down, that’s not a problem, it’s proof. That’s the signal. That’s impact. That means your emails are doing their job in the background, even if there’s no UTM tag to track it.

 

Let's do this

I’m Beth O’Malley, email consultant, strategist, and the person marketers and businesses call when they’re ready to transform how email works for their company. 

If your email strategy is more “send and hope” than structured and strategic, let’s change that. Whether you need a total reset, a smarter approach, or just want someone to tell you what’s worth fixing — I’ve got you.

Let’s have a conversation about working together.

 

 

Like this blog? You'll love RE:markable

RE:markable is the weekly email about emails. Dropping the latest email marketing news, updates, insights, free resources, upcoming masterclasses, webinars, and of course, a little inbox mischief.