How do AI spam filters decide what reaches the inbox?

AI spam filters use several signals to classify a message; there is no public sender-facing formula that guarantees the inbox. Providers describe machine-learning detection alongside authentication, sender and link reputation, complaints, message patterns and recipient-side policy. A valid SPF, DKIM or DMARC result checks identity; it does not prove that recipients want the mail. Diagnose the outcome at the receiving provider before changing a subject line or template.

If your campaign is authenticated but lands in spam, the next question is which part of the receiving system acted. A reputation problem, a suspicious link and an organisation’s blocked-sender rule call for different responses. The word “AI” does not make those differences disappear.

This guide explains the provider-published parts of filtering. For the wider sending programme, see the email deliverability guide; for the mechanics of authentication, see SPF, DKIM and DMARC.

Is there one AI score that decides inbox versus spam?

No single public score describes the whole decision. In a December 2024 account of Gmail’s defences, Google said it had added a large language model (LLM) trained on phishing, malware and spam. It also described another AI model that evaluates hundreds of threat signals when a risky message is flagged. That account explains part of Gmail’s defence against abuse; it does not publish a formula for placing each legitimate marketing email.

Microsoft’s Defender for Office 365 detection list is more explicit about the categories an administrator may see. Its Advanced filter uses machine-learning models to detect phishing and spam, and a separate LLM content analysis category concerns harmful email. The same list includes bulk complaint level, domain and IP reputation, URL reputation, fingerprint matching, analyst heuristics and mixed analysis when several filters contributed.

That distinction matters to a sender. “The AI filter disliked my copy” is a hypothesis. A real message classified by a bulk threshold or a reputation signal points to a different investigation. These Microsoft 365 controls describe an organisation’s protected mailboxes; they are not a published map of consumer Outlook.com filtering.

Which signals do the providers disclose?

Providers disclose different categories, including authentication, sending reputation and complaints, message and link detections, and recipient-side policy. The categories help identify what to investigate; they do not reveal the weight of each signal in one inbox decision.

The table is a diagnostic map, not a list of weights. It does not say how much any signal contributed to one Gmail message. Nor does a Microsoft 365 detection label prove the same factor was used by Gmail.

Why can an authenticated email still land in spam?

Authentication answers who is allowed to send for a domain. It does not answer whether that domain has a healthy sending history or whether a recipient wanted the message. For mail to personal Gmail accounts, Gmail’s sender guidelines require SPF or DKIM for all senders and SPF, DKIM and DMARC above its bulk-sender threshold. Google says authenticated messages are less likely to be rejected or marked as spam; it does not promise inbox placement. It also says frequent spam reports can lower a domain’s reputation and make later messages more likely to be marked as spam.

There is a further measurement trap. Google’s Postmaster Tools documentation says its spam-rate dashboard covers DKIM-authenticated messages sent to personal Gmail accounts and counts those engaged recipients mark as spam after inbox delivery. If Gmail automatically routes many messages to spam, fewer people see them in the inbox to report them. A low reported rate can therefore coexist with poor reputation or spam placement. Do not read a near-zero complaint rate by itself as proof that the problem is solved.

For a Microsoft 365 recipient, classification and final action are also distinct. Microsoft lists spam, high-confidence spam, phishing, high-confidence phishing and bulk verdicts. The receiving organisation’s policy can route most of those verdicts to Junk or quarantine; high-confidence phishing is always quarantined. Its troubleshooting guide also shows that mail-flow rules, connection filtering and a user’s blocked-sender list can change the outcome. A message in Junk is not automatically evidence that a machine-learning model rejected its wording.

How should a sender investigate a placement problem?

Start with a real affected message, its receiving provider, the date and the observed outcome. Record whether it was accepted, temporarily failed, rejected, delivered to Junk or quarantined. Keep the campaign or message identifier and the sending domain so the checks refer to the same send. Then check that provider’s authentication, complaint, available reputation or policy evidence before changing the message or sending behaviour. A generic “spam score” from a separate tester cannot replace the receiving provider’s evidence.

Then follow the branch that matches the recipient:

1. For personal Gmail recipients, check the sending domain in Postmaster Tools. Google’s dashboard help lists authentication, reputation, spam-rate and delivery-error views. A separate Google notice says the old Domain and IP Reputation dashboards will be retired and the current Reputation dashboard replaced, without giving a date; check which reputation views your account currently offers. The data is not real time, and low-volume days may have missing data, so a blank chart is not a clean bill of health.
2. For a Microsoft 365 organisation, ask its administrator for the message verdict and detection detail. Microsoft’s documentation describes the email entity page in Defender for Office 365, where the organisation has it, and message-header evidence. The administrator can check whether the outcome came from a spam or bulk classification, a policy override or a user block. The sender alone may not have access to those recipient-side records.
3. Change the cause you can actually support. Correct failed authentication or a sending-domain mismatch when the identity check fails. If the provider shows complaints or weak reputation, examine the affected audience and sending pattern and follow its sender guidance. If a real URL or message is flagged, investigate that item. If a recipient-side rule acted, the receiving organisation owns that rule.

Keep the before-and-after evidence on the same provider and comparable sends. A fix to DNS does not establish that a complaint problem has cleared; an improved complaint rate does not prove every message reaches the inbox. If you need to diagnose the whole sending setup, continue with the deliverability guide.

Frequently asked questions

Does passing SPF, DKIM and DMARC guarantee inbox placement?

No. For mail to personal Gmail accounts, Google describes authenticated messages as less likely to be rejected or marked as spam, while also documenting reputation and recipient complaints. Authentication verifies the sending identity; it does not settle the provider’s other signals or the receiving organisation’s policy.

Can a low Gmail spam rate mean my mail is being filtered?

Yes. For DKIM-authenticated messages sent to personal Gmail accounts, Google’s Postmaster Tools help says the dashboard counts reports by engaged recipients after inbox delivery. If Gmail automatically routes many messages to spam, the reported rate may look low because fewer recipients saw them in the inbox. Check any reputation data Postmaster Tools still shows. Its delivery-error view covers SPF- or DKIM-authenticated messages that were rejected or temporarily failed, so a clean chart does not rule out spam placement.

Can changing a subject line beat an AI spam filter?

The Gmail and Microsoft documents cited here describe no subject-line change that overrides a provider’s decision. First find the affected provider and its available authentication, reputation, complaint, message or policy evidence. Change the part that the evidence identifies, then check the received result again.