So, I've run simple Postfix + Django emails for transaction confirmations, password resets, and in a few cases, 2FA, for a bunch of different sites I've worked on since I started my freelance business 6 years ago. I've never had a single complaint that my emails weren't delivering, nor has an email ever gone to spam folder in testing. How did I do it? The answer is simple: I didn't send any spam!

The last time this came up on Hacker News, one of the top comments was something to the effect of "we did double confirmation and a variety of other measures to avoid being marked as spam, but ultimately the entire time we're just one bad email campaign away from being blacklisted".

One bad email campaign? Is there any other kind? That's just spam.

The user didn't say this, but I'd bet money their "double confirmation" starts with a default-checked checkbox with small text asking for permission to send emails.

Every time I've talked to someone who has problems with email deliver-ability, if I dig into what they're doing, it quickly becomes clear to me that they're sending spam, but they're so indoctrinated in corporate culture that they don't even know that what they're sending is spam. Here's some translations for you: Marketing email = spam. Lead generation = spam. In most cases, newsletter = spam. Sale announcement = spam. Promotion = spam.

I'm not claiming my experience is universal. I'm sure that there is a non-zero percentage of sites sending legitimate emails getting marked as spam. But it seems to me that more often than not, the reason your emails are marked as spam is that they are, in fact, spam. And most strategies people discuss for avoiding being marked as spam, are just avoiding the most obviously egregious forms of spam, and finding users with higher tolerance for spam.