There is no single spam rule you can learn and route around. Gmail and Microsoft both run layered systems that look at who you are, how you have behaved, what you sent and how real people reacted to it. Each layer can rescue or sink a message, and neither provider publishes the exact weights.
What they do publish, plus what you can observe from placement testing, is enough to build a useful working model. Here is that model, layer by layer, and then what it means for someone sending cold email.
Layer 1: is the sender who they claim to be?
Before anything else, the receiving server checks identity. SPF confirms the sending IP is allowed to send for the envelope domain. DKIM confirms the message was signed by the domain and was not altered. DMARC ties both to the visible From address and tells the receiver what to do when they fail. A reverse DNS (PTR) record on the sending IP is also expected.
Authentication does not earn you the inbox. It earns you the right to be judged on reputation. Without it, Gmail, Yahoo and Microsoft increasingly reject outright rather than filter; the sender requirements guide covers the specifics.
Layer 2: what is this sender's track record?
Reputation is held at several levels at once: the sending IP, the sending domain, the domains in your links, and increasingly the individual mailbox. Domain reputation has become the heavier signal at Gmail in particular, because domains are harder to rotate than IPs.
Reputation is built from history: volume consistency, bounce rates, spam trap hits, complaint rates and engagement. A brand new domain has no history, which is why it needs a ramp. A domain or IP that shares infrastructure with poor senders inherits some of their reputation, which is the core argument for dedicated sending infrastructure. The guide to IP, domain and mailbox reputation explains how the levels interact.
Layer 3: what does the message look like?
Content still matters, but less in the way people expect. Modern filters are not counting "spammy words" from a list. They look at structure and patterns:
- Link count and where links point, including redirect chains and link shorteners.
- Image to text ratio and heavy HTML.
- Tracking pixels and tracking domains, especially shared ones.
- Near-identical messages arriving in volume from many senders.
- Attachments from senders with no history.
A short, plain message that reads like one person writing to another passes this layer easily. Our guide to copy that reads human goes further, and the spam checker flags the obvious structural problems.
Layer 4: how do recipients behave?
Gmail in particular weighs what recipients do with your mail. Positive signals include opening, replying, moving a message out of spam, adding the sender to contacts and starring. Negative signals include deleting without reading and, most heavily, clicking "Report spam". Microsoft uses similar behaviour, plus explicit "Junk" and "Not junk" actions.
Replies are the strongest positive signal a cold sender can get, because a reply is a two-way conversation. Spam reports are the strongest negative. Google asks senders to keep their reported spam rate below 0.3%, and recommends staying under 0.1%.
Gmail: tabs are not the spam folder
Gmail makes two separate decisions. The first is spam or not spam. The second, only for mail that passed, is which tab it goes to: Primary, Promotions, Social, Updates or Forums, for users who have tabs turned on.
Landing in Promotions is a categorisation, not a penalty. It usually means the message looks like marketing: heavy HTML, branded templates, multiple links. Plain text one-to-one messages tend to land in Primary. For cold email, Promotions is a sign your message looks like a newsletter rather than a note, which hurts reply rates even though it is technically delivered.
Microsoft: SCL, Junk and Focused/Other
Microsoft runs two related environments: consumer mailboxes (Outlook.com, Hotmail, Live) and business mailboxes on Microsoft 365, protected by Exchange Online Protection. Both assign each message a Spam Confidence Level, from -1 (bypassed filtering) up to 9. In Microsoft 365, a score of 5 or 6 is treated as spam and 7 to 9 as high-confidence spam, which by default go to the Junk Email folder. You can see the SCL in the X-MS-Exchange-Organization-SCL header, which the header analyzer will surface.
Separately, Focused Inbox splits non-junk mail into Focused and Other, much like Gmail tabs. Other is not spam, but cold email in Other gets far less attention.
Two practical differences show up in placement testing. Microsoft tends to react faster and harder to sudden volume from new senders, and business tenants can add their own rules on top of Microsoft's defaults, so two Microsoft 365 recipients can see different outcomes for the same message.
The two side by side
| Aspect | Gmail | Microsoft |
|---|---|---|
| Spam destination | Spam folder | Junk Email folder |
| Non-spam sorting | Tabs (Primary, Promotions and others) | Focused and Other |
| Visible score in headers | No public score | SCL in headers |
| Sender data portal | Postmaster Tools | SNDS (IP data) and sender support portal |
| Admin overrides | Workspace admins can set rules | Tenant admins often add rules on top |
What a cold sender can actually control
Out of all those layers, here is what is genuinely in your hands:
- Authentication, fully. Get it right once and monitor it.
- Infrastructure: dedicated IPs and separate sending domains keep your reputation yours.
- Volume and pacing: gradual ramps, steady daily volume, sensible per-mailbox limits.
- List quality: verified addresses and real relevance, which drive bounces and complaints down and replies up.
- Message structure: plain, short, few links, no attachments.
- Measurement: regular placement tests, so you learn about spam-foldering from a seed list rather than from a dead campaign.
Sendbox is built around that list: dedicated IPs, automatic warmup, per-mailbox health and blacklist monitoring, and unlimited inbox placement tests. None of it replaces sending email people actually want to answer. That part is still on you.
