DEV Community

sky yv
sky yv

Posted on

Why Your Emails Go to Spam — And How to Diagnose It in 30 Seconds

#devops #opensource #tutorial #go

If you've ever sent a perfectly crafted email only to discover it landed in the recipient's spam folder, you know the frustration. The thing is, email deliverability isn't magic — it's a set of well-defined checks that receiving servers perform before they decide where to put your message. And the good news: you can diagnose almost all deliverability issues with a single command.

In this article, I'll walk you through the key factors that determine whether your email hits the inbox or the spam folder, and show you how to use an open-source CLI tool called smtp-probe to check everything at once.

The 4 Pillars of Email Deliverability

Before diving into the tool, let's understand what receiving mail servers actually check:

1. SPF (Sender Policy Framework)

SPF is a DNS TXT record that lists which IP addresses are authorized to send email on behalf of your domain. When a receiving server gets an email claiming to be from yourdomain.com, it looks up your SPF record and checks if the sending IP is on the list.

A valid SPF record looks like:

v=spf1 include:_spf.google.com include:mail.example.com ~all
Enter fullscreen mode Exit fullscreen mode

If you're missing SPF entirely, many receiving servers will automatically flag your email.

2. DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every outgoing email. The receiving server uses a public key published in your DNS to verify that the email wasn't tampered with in transit. It also proves that someone with access to your DNS configuration authorized the sending.

A DKIM record has a selector (like google, default, selector1) and looks like:

v=DKIM1; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ...
Enter fullscreen mode Exit fullscreen mode

If DKIM validation fails, the email is immediately suspect.

3. DMARC (Domain-based Message Authentication)

DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. It's the policy layer:

v=DMARC1; p=reject; rua=mailto:reports@example.com
Enter fullscreen mode Exit fullscreen mode
  • p=none — just report, don't reject (considered weak, some providers still penalize it)
  • p=quarantine — send to spam
  • p=reject — reject the email entirely

Without DMARC, anyone could forge your domain with zero consequences. Google and Yahoo now require DMARC for bulk senders.

4. IP Reputation and Blacklists

Even with perfect DNS records, if your sending IP is on a blacklist, your email gets blocked or filtered. Common blacklists include Spamhaus, Barracuda, SpamCop, and many others. Getting listed is surprisingly easy (a compromised server on your IP range, a previous tenant of your IP, etc.).

Check All of This at Once

Here is where smtp-probe comes in. It is an open-source Go CLI tool that runs all these checks from your terminal:

# Install (one command)
bash <(curl -fsSL https://raw.githubusercontent.com/monto-fe/smtp-probe/main/install.sh)

# Or from source
go install github.com/monto-fe/smtp-probe@latest
Enter fullscreen mode Exit fullscreen mode

Then check any domain:

$ smtp-probe check yourdomain.com

  SPF  :  PASS
         v=spf1 include:_spf.google.com ~all

  DKIM :  PASS
         v=DKIM1; p=MIIBIjANBg...

  DMARC:  PASS (policy: reject)
         v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

  MX   :  3 records found

  Score: 95/100 (Excellent)
Enter fullscreen mode Exit fullscreen mode

The score is on a 0-100 scale. Missing SPF costs you 20 points. No DKIM is -15. No DMARC is -20. Weak DMARC (p=none) is -10. It is a quick way to see exactly where your domain stands.

Blacklist Scan

If your IP is blacklisted, nothing else matters. smtp-probe checks 29 blacklists simultaneously:

$ smtp-probe blacklist 1.2.3.4

  Checked 29 blacklists: 1 listed

  zen.spamhaus.org       |  No
  b.barracudacentral.org |  No
  bl.spamcop.net         |  No
  rbl.megarbl.net        |  Yes    <- found here
  ...
Enter fullscreen mode Exit fullscreen mode

This tells you exactly which blacklists your IP is on, so you can file delisting requests directly.

SMTP-Level Verification

Beyond DNS checks, smtp-probe can actually connect to the receiving MX server and ask whether this address exists using the RCPT TO command, the same way email servers validate recipients:

$ smtp-probe verify user@example.com --bind-ip 1.2.3.4

  Result: Accepted (250 2.1.5 OK)
Enter fullscreen mode Exit fullscreen mode

This is useful for email list cleaning before campaigns, or debugging why a specific address keeps bouncing. The --bind-ip flag lets you specify which outbound IP to use, critical if you have multiple sending IPs.

Note: SMTP verification requires outbound port 25, which is blocked by most cloud providers (AWS, Azure, GCP, etc.). The check and blacklist commands work without port 25.

IP Pool Management (for Bulk Senders)

If you manage multiple outbound IPs, smtp-probe has built-in pool management with automatic failover:

# Add IPs to your pool
smtp-probe pool add 10.0.0.1 --domain mail-a.example.com
smtp-probe pool add 10.0.0.2 --domain mail-b.example.com

# Verify using the pool (auto-failover on blacklist/timeout)
smtp-probe verify user@example.com --pool

# Check health of all pool IPs
smtp-probe pool check
Enter fullscreen mode Exit fullscreen mode

When an IP in the pool gets blacklisted (5xx response), smtp-probe automatically marks it and retries with the next healthy IP, up to 3 times.

Disposable Email Detection

If you are running a signup form or API, you probably want to block disposable email addresses. smtp-probe includes this out of the box with 4 upstream data sources:

$ smtp-probe verify user@mailinator.com --disposable

  Result: Disposable (mailinator.com is a disposable email provider)
  SMTP verification skipped
Enter fullscreen mode Exit fullscreen mode

On first use, it automatically downloads the default blocklist (martenson, around 8k domains) and can be updated with:

smtp-probe disposable update
Enter fullscreen mode Exit fullscreen mode

HTTP API for Programmatic Use

If you want to embed these checks into your application, smtp-probe also runs as an HTTP server:

smtp-probe serve --port 8080
Enter fullscreen mode Exit fullscreen mode

Then call it via curl:

curl http://localhost:8080/v1/check?domain=yourdomain.com
curl http://localhost:8080/v1/blacklist?ip=1.2.3.4
curl "http://localhost:8080/v1/verify?email=user@example.com&bind_ip=1.2.3.4"
Enter fullscreen mode Exit fullscreen mode

All endpoints return JSON, easy to integrate into monitoring dashboards, CI pipelines, or customer onboarding flows.

Generate a Full Report

Want a shareable report of your domain email health?

# Terminal table
smtp-probe report yourdomain.com

# Markdown (great for docs/tickets)
smtp-probe report yourdomain.com --format md > report.md

# JSON (for integrations)
smtp-probe report yourdomain.com --format json
Enter fullscreen mode Exit fullscreen mode

What's Next?

smtp-probe is open source (MIT), written in Go, and ships as a single binary with zero dependencies. It handles the most common email deliverability diagnostics in one tool instead of ten.

If you work with email systems and have run into deliverability issues that this tool doesn't cover yet, I would love to hear about them. Open an issue on GitHub — the roadmap is shaped by real-world problems.

Links:

Top comments (0)