The message is full of other people's domains

SPF passes. DKIM passes. DMARC passes.

The message left through the correct sending platform. It still lands in spam.

That is the point where authentication stops being the whole investigation.

The filter reads more than the sender

Authentication tells a receiving system whether the message is allowed to claim the domain it claims. It does not tell the receiver that everything inside the message is trustworthy.

Filtering can consider the links inside the message, the domains behind them, redirects, remote images, tracking infrastructure, message construction and other signals.

Authentication is increasingly a baseline. The rest of the message still matters.

Your logo lives somewhere

A useful place to start is the images. A production email may load its logo or banner from a generic object-storage URL, a shared CDN or even a development environment that was never replaced in the final template.

That does not automatically make the message unsafe. It does introduce infrastructure unrelated to the domain you thought you were managing.

Where practical, important production assets should live on infrastructure you deliberately control or trust. That also makes troubleshooting much simpler. You know who owns the host, why it exists and whether it should still be there.

Tracking domains matter too

Click and open tracking add more domains to the message. A branded tracking subdomain gives you more control but still needs to be monitored. A shared tracking domain supplied by a platform carries reputation created by many customers, not only you.

If that infrastructure develops a problem, your SPF and DKIM records can remain perfectly healthy. Deliverability can fall while the authentication dashboard stays green.

That is why a deliverability review should include the domains inside the message, not only the one in the From field.

Look at what your tools added

Most outbound messages are assembled by more than one system. Marketing platforms, applicant tracking systems, signature tools, scheduling services and outreach products can all insert links or content.

Sometimes the result is harmless but untidy. Sometimes it contains long redirect chains, stale tracking hosts or a link whose visible text suggests one destination while the actual link goes somewhere else.

That last construction deserves attention because it is also common in phishing. A mail filter does not know that the redirect was inserted by your legitimate signature platform. It sees the finished message.

Security-sensitive mail deserves less machinery

Password resets, verification links and one-time codes deserve an even stricter look. These are the messages users need to trust immediately.

They often inherit templates and features originally built for marketing: open tracking pixels, click wrapping, hosted assets and campaign analytics. That can create unnecessary dependencies in the most security-sensitive stream you send.

An open-tracking pixel on a password-reset message also creates a record that the recipient opened it. A wrapped reset link can make the visible security action depend on an unrelated tracking domain.

Neither feature is automatically malicious. The better question is whether either one provides enough value to justify being present in authentication mail.

For password resets, verification and one-time codes, simpler is usually better:

• No unnecessary tracking.
• No unnecessary redirects on security-relevant links.
• Few third-party dependencies.
• A sending identity separated from campaign traffic.

The objective is not a message that performs. It is a message that arrives reliably and looks unsurprising when the user needs to trust it.

Read the finished message

The useful test is simple. Take a real production email and inspect what was actually sent.

• List the remote images.
• List every link.
• Follow redirects to the final destination.
• Note every domain involved and identify who owns it.

Do the same for each important sending stream because your marketing platform, transactional system and corporate mailbox may produce completely different messages. Repeat the exercise when a vendor or template changes. You are inspecting the finished product rather than the configuration that was supposed to create it.

The check worth running

Take one live message from your highest-volume sending stream and one password-reset or authentication message. List every domain appearing in each. Include images, links, tracking hosts, redirects and unsubscribe endpoints where applicable.

Then answer two questions: Who controls each domain? Would you deliberately choose to have this type of mail depend on it today?

Explore this expertise: Email Deliverability

All technical notes