The Technical Anatomy of Inbox Placement

• July 2022
• Engineering Memo · External Release

Inbox placement — whether a delivered message appears in the inbox or the spam folder — is often discussed as if it were a single decision made by a spam filter evaluating message content. The technical reality is more complex: inbox placement is the outcome of a multi-layer classification process that evaluates signals at the connection layer, the authentication layer, the reputation layer, and the content layer, in sequence. Understanding how each layer contributes to the final placement decision enables more precise diagnostics when inbox placement is below target and more targeted interventions when it needs improvement.

Layer 1: The Connection Layer

The first evaluation occurs at the SMTP connection, before any message content is transmitted. The receiving MTA evaluates the connecting IP against its blocklist database: Spamhaus SBL, XBL, DBL, PBL; Barracuda BRBL; SpamCop; Microsoft SNDS; and proprietary ISP blocklists. An IP that appears on any checked blocklist generates an immediate connection rejection (typically 550 5.7.1 or 421 deferral) without the message ever being transmitted.

The connection layer also evaluates the PTR record for the connecting IP. A correctly configured PTR record (pointing to a fully qualified domain name that resolves back to the connecting IP — forward-confirmed reverse DNS) is expected by all major ISPs. An IP without a PTR record, or with a PTR that does not resolve forward to the connecting IP, is treated as lower-trust at the connection layer. This reduced trust does not necessarily cause rejection, but it contributes a negative signal to the downstream reputation evaluation.

EHLO hostname alignment is the third connection-layer signal: the hostname presented in the EHLO command should match the PTR record for the connecting IP. An EHLO hostname that does not match the PTR — for example, EHLO mail.domain.com when the PTR resolves to mx1.otherservice.com — is flagged as a potential deception or misconfiguration indicator. Connection-layer misconfigurations are the earliest and most fundamental infrastructure problems to address because they affect all subsequent message delivery before any authentication or content evaluation occurs.

Layer 2: The Authentication Layer

After connection acceptance, the receiving MTA performs authentication evaluation on the delivered message. SPF is evaluated against the envelope sender domain (the MAIL FROM domain) and the connecting IP. DKIM is evaluated by extracting the DKIM-Signature header, looking up the public key at the specified selector, and verifying the signature against the message body and headers. DMARC is evaluated by checking whether the authenticated domain (from SPF or DKIM) aligns with the From: header domain, and whether the alignment satisfies the sender's published DMARC policy.

The authentication evaluation produces four possible DMARC outcomes: pass (at least one authentication mechanism passes alignment), fail (both authentication mechanisms fail or misalign), temperror (a transient DNS error prevented evaluation), and permerror (the SPF record or DKIM configuration has a permanent error). Only DMARC pass produces unambiguously positive authentication signals at this layer; the other outcomes contribute negative signals of varying severity (permerror is worse than fail, which is worse than temperror) to the overall inbox placement decision.

Authentication failure does not automatically cause spam classification — many major ISPs deliver DMARC-failing messages to the inbox when the sender has strong IP and domain reputation. But authentication failures remove the positive authentication signal that authentication passes provide, and they shift the reputation evaluation to apply stricter thresholds before inbox placement is granted. A sender at Medium reputation who consistently passes authentication may achieve inbox placement; a sender at the same Medium reputation who consistently fails authentication may not.

Layer 3: The Reputation Layer

The reputation layer is the primary determinant of inbox placement for authenticated senders. The reputation model evaluates: IP reputation (historical signal quality from the connecting IP — complaint rate, spam trap hits, bounce rate, engagement signals from that IP's sending history); domain reputation (historical signal quality attributed to the DKIM signing domain across all IPs that have sent under that domain); and engagement patterns (recent user interactions with messages from this IP and domain — open rates, spam markings, not-spam actions, reply rates).

At Gmail, the domain reputation tier (High/Medium/Low/Bad) is the primary inbox placement signal for authenticated messages. High domain reputation produces consistent inbox placement across a wide range of content types and sending behaviours. Medium domain reputation produces variable inbox placement — some messages reach the inbox, some go to spam, depending on per-message engagement patterns and content signals. Low domain reputation produces predominantly spam classification regardless of content quality. Bad domain reputation produces near-universal spam classification or rejection.

The reputation layer's evaluation is not binary — it produces a continuous signal score that is combined with the outputs of the other layers to produce the final inbox/spam classification. A sender at High reputation with a mild authentication failure may still achieve inbox placement, because the reputation signal is strong enough to offset the authentication gap. A sender at Medium reputation with clean authentication and excellent content may achieve inbox placement because the combination of signals crosses the inbox threshold even though the reputation alone would not. The layer combination is why single-variable analyses of inbox placement are unreliable — the placement decision reflects all layers together, not any one layer independently.

Layer 4: The Content Layer

The content layer evaluates the message body, headers, and linking structure for signals associated with spam or phishing. At major ISPs for authenticated senders with established reputation, content signals are the marginal layer — they can shift inbox/spam classification for senders near the boundary between the two outcomes but are dominated by the reputation layer signals for senders well within either the inbox or spam category.

The content signals that major ISPs evaluate: header consistency (From: header domain matches DKIM signing domain and is consistent with previous sends), URL reputation (domains in hyperlinks checked against URL reputation databases), HTML structure (excessive obfuscation, redirect chains, image-to-text ratios), and subject line pattern matching (subject lines matching known phishing or spam patterns). For senders with High reputation, these content checks apply at low sensitivity — only clear phishing content or known spam URL patterns trigger spam classification. For senders at Medium reputation, the content checks apply at higher sensitivity — even borderline content signals may produce spam classification.

Using the Anatomy for Deliverability Diagnosis

When inbox placement is below target, the layer anatomy provides the diagnostic framework: which layer is producing the blocking or degrading signal? Start at Layer 1 (check for IP blocklist presence, PTR misconfiguration, EHLO misalignment), then Layer 2 (check DMARC aggregate reports for authentication failures), then Layer 3 (check Postmaster Tools domain reputation and SNDS IP status), then Layer 4 (check content for URL reputation issues or phishing-pattern triggers). The layer that produces the blocking or degrading signal is the layer to address; addressing the wrong layer produces no improvement.

Most inbox placement problems are resolved by Layer 3 improvements — the reputation layer is where the primary placement decision is made for the majority of senders. Layer 1 problems (blocklist hits, PTR misconfiguration) are less common but produce the most dramatic delivery failures and require the most urgent resolution. Layer 2 problems (authentication failures) are moderately common in programmes with complex ESP configurations and produce measurable inbox placement impact for senders near the Medium/Low reputation boundary. Layer 4 problems (content) are the least common cause of inbox placement degradation for established senders with strong reputation.

The multi-layer anatomy is the technical framework that makes deliverability a diagnosable system rather than an opaque black box. Map each layer's current status, identify which layer is underperforming, apply the targeted intervention, and verify the improvement through the appropriate monitoring tool for that layer (Postmaster Tools for Layer 3, DMARC aggregate reports for Layer 2, blocklist check tools for Layer 1, URL reputation scanners for Layer 4). The systematic approach produces faster, more accurate diagnosis and more precisely targeted interventions than the trial-and-error approach that treats inbox placement as a single variable to improve without understanding which layer it is coming from.

How Each Layer Interacts with the Others

The four layers do not operate in strict sequence — they interact and the output of one layer modifies how other layers are applied. A strong Layer 3 reputation signal (High domain reputation) causes Gmail to apply Layer 4 content checks at lower sensitivity: the same URL or subject pattern that would trigger spam classification for a Medium-reputation sender may produce no spam classification for a High-reputation sender, because the content check threshold is calibrated to the reputation context. Conversely, a weak Layer 1 signal (IP on a PBL soft block) causes downstream reputation evaluation to apply stricter thresholds — the connection-layer weakness puts the reputation layer on higher alert.

The interaction model means that improving a lower layer can unlock the full benefit of a higher layer. A programme with excellent Layer 3 reputation (High domain, clean IP) but persistent Layer 2 authentication failures (SPF permerror on one source) may find that fixing the Layer 2 issue produces a measurable inbox placement improvement even though the Layer 3 reputation did not change — because the authentication gap was applying a penalty coefficient that depressed the effective inbox placement below what the Layer 3 reputation alone would produce.

This interaction also explains why monitoring across the full stack is more valuable than deep monitoring of a single layer. A programme that monitors Postmaster Tools (Layer 3) daily but never reviews DMARC aggregate reports (Layer 2) may have persistent authentication failures suppressing its inbox placement without ever identifying the cause. The Layer 3 data shows Medium domain reputation; the Layer 2 data would show the authentication failure source that is contributing to the Medium tier rather than High. Without the Layer 2 data, the programme cannot make the targeted intervention that would improve the outcome.

Per-ISP Variation in Layer Weighting

Each major ISP weights the four layers differently in their spam classification model. Gmail weights Layer 3 domain reputation most heavily and Layer 4 content very lightly for authenticated senders with established sending history. Microsoft weights Layer 1 IP signals (SNDS) and Layer 3 IP reputation more heavily than Gmail, and applies Layer 2 authentication checks with particular emphasis on DMARC alignment for senders claiming to send from major domains. Yahoo applies a combined Layer 1/Layer 3 model that is less publicly documented than Gmail's but that is known to weight IP reputation significantly alongside domain-level signals.

This per-ISP variation means that optimising for one ISP's layer weighting may not transfer to another ISP. A programme that achieves excellent inbox placement at Gmail by building strong Layer 3 domain reputation may still struggle with Microsoft inbox placement if the Layer 1 IP configuration (PTR records, EHLO alignment, SNDS status) is suboptimal. The four-layer approach — optimising all four layers to the best achievable quality — produces good inbox placement across all major ISPs simultaneously, rather than optimising for one ISP's specific model at the expense of others.

The per-ISP layer weighting variation also explains why deliverability improvement projects that focus on a single signal type (only optimising DKIM, or only focusing on IP reputation) often produce uneven results: significant improvement at some ISPs and no improvement at others. The whole-stack approach produces more balanced improvement across the full ISP landscape because it addresses the signals that each ISP weights most heavily rather than optimising only the signals one ISP values most.

The Inbox Placement Measurement Gap

A critical operational challenge in managing inbox placement is that the most direct measurement — checking whether specific messages appear in inbox or spam folder at major ISPs — requires seed list testing that most programmes do not have access to. Postmaster Tools provides domain spam rate (the fraction of messages Gmail users marked as spam, which is a strong proxy for inbox placement) and domain reputation tier, but not a direct inbox placement rate. SNDS provides IP reputation but not inbox placement. FBL data provides complaint rate but not placement rate.

Commercial seed testing services (250ok, GlockApps, Litmus, SendForensics) fill this gap by providing dedicated seed email addresses at major ISPs that the programme can send to, with reporting on whether messages delivered to inbox or spam at each ISP. These services are the most direct measurement of the current inbox placement rate, and their data is particularly valuable when investigating unexplained deliverability changes that the proxy metrics (reputation tiers, complaint rates) do not fully explain.

For programmes without seed testing services, Postmaster Tools spam rate is the most actionable proxy: a spam rate below 0.03% at Gmail correlates strongly with inbox placement above 90%; a spam rate above 0.08% correlates with significant spam folder placement. Tracking the spam rate trend daily provides the leading indicator of inbox placement changes before commercial impact becomes visible in campaign revenue metrics.

The technical anatomy of inbox placement — four layers, each contributing its signals to the final classification decision, with per-ISP variation in layer weighting and interaction effects between layers — is the complete picture of what determines whether messages reach the inbox. Understanding it enables precise diagnostics, targeted interventions, and accurate predictions of what will happen when specific aspects of the sending configuration are changed. Every deliverability investment decision — which signals to improve, which monitoring tools to use, which interventions to prioritise — is made more accurately with this layer model as the analytical framework. Use it, and deliverability management becomes a systematic engineering discipline rather than an empirical art form.

Building the Layer-by-Layer Baseline Assessment

The starting point for any new deliverability improvement initiative is a layer-by-layer baseline assessment that documents the current state of each layer for the programme. The assessment questions and tools:

Layer 1 assessment: Are any sending IPs listed on major DNSBLs (check with MXToolbox or similar tool)? Do all sending IPs have correctly configured, forward-confirmed PTR records? Does the EHLO hostname for each IP match the PTR record? Run these checks for every IP in every sending pool. Document any gaps and the planned remediation for each.

Layer 2 assessment: Run DMARC aggregate report analysis for the past 30 days. Identify all sources sending with the programme's domain, their SPF and DKIM authentication results, and any permerror or temperror conditions. Verify that all legitimate sources achieve DMARC pass. Document any sources with DMARC failures and whether they are legitimate (requiring authentication correction) or illegitimate (requiring investigation as potential spoofing).

Layer 3 assessment: Check Postmaster Tools for each sending domain and subdomain registered as a property. Note the current domain reputation tier and the spam rate trend for the past 90 days. Check SNDS for each sending IP and note the current SNDS status (Green/Yellow/Red) and complaint rate trend. This Layer 3 baseline is the most operationally significant data point in the assessment — it reveals the current inbox placement capability of the infrastructure.

Layer 4 assessment: Run a representative sample of recent campaign messages through a URL reputation scanner (Google Safe Browsing API, SURBL, URIBL) to check all linked domains. Review the message HTML for common spam-pattern triggers (excessive image use without text, JavaScript, unusual encoding). Check that the unsubscribe link is prominent and functional. Document any content issues identified.

The completed baseline assessment provides the current state of all four layers and identifies the specific interventions needed in each layer. The prioritisation framework: Layer 1 issues first (blocklist removals and PTR corrections), then Layer 2 (authentication gap corrections), then Layer 3 (reputation building — the longest-lead investment), then Layer 4 (content quality improvements). This priority order reflects both the layer weighting in the inbox placement decision and the relative speed of resolution: Layer 1 and 2 issues can be corrected within days; Layer 3 improvements take weeks to months; Layer 4 improvements are ongoing refinements.

Inbox Placement as a System: Optimising All Four Layers Together

The layer model reveals an important principle for deliverability investment: inbox placement is a system, and system improvements compound when all layers are optimised together. A programme at High domain reputation (strong Layer 3) with clean authentication (Layer 2) and blocklist-free IPs with correct PTR records (Layer 1) achieves inbox placement that is better than any single layer could produce independently. The layers work together: the strong reputation allows content to be evaluated at lower sensitivity; the clean authentication confirms the reputation attribution is correct; the correct connection configuration ensures the reputation signals are being evaluated against the right identity.

Conversely, a programme with excellent Layer 3 reputation but persistent Layer 2 authentication failures and unresolved Layer 1 PTR misconfiguration achieves significantly lower inbox placement than its reputation alone would predict — the layer gaps cancel part of the reputation benefit. Optimising all layers together — addressing each one to its achievable best quality — extracts the full value of the reputation investment by ensuring the lower layers are not subtracting from the placement quality that the reputation layer earns.

The programmes that achieve and sustain inbox placement above 95% at all major ISPs are those that maintain all four layers at or near optimal simultaneously. They are not programmes with extraordinary reputation — they are programmes with systematically well-configured infrastructure that produces consistent positive signals at every layer. The technical anatomy of inbox placement describes exactly what they maintain and why maintaining it produces the results it does. Build to the anatomy, maintain each layer, and the inbox placement the system produces will reflect the investment at every layer it touches.

Four layers. Each contributing its signals. All interacting. The inbox is what results when all four are well-configured and consistently maintained. Map the anatomy, address each layer systematically, and the inbox placement the system produces will reflect the quality of the infrastructure that sends from it.

Four layers, one outcome. Understand each, optimise all, and inbox placement becomes the predictable result of well-configured infrastructure rather than a variable to wonder about after every campaign send.

Inbox placement is a system outcome, not a single-variable decision. Know the system. Optimise each layer. Monitor every layer. The inbox that results is the inbox the infrastructure earns.

Every layer matters. No layer is optional. Optimise all four and the inbox is the outcome.