Why Client Reports Go to Spam and How to Fix It

Why client reports go to spam and how to fix it

You sent the monthly report on the 1st. It is the 9th, the client has not replied, and on the call they say the words every agency owner dreads: "I never got it."

They probably did get it. It just landed in junk, in a quarantine digest nobody reads, or in an Outlook "Other" tab behind six weeks of newsletters. Client reports going to spam is not a client problem or a copy problem. It is an authentication and sender reputation problem, and it is fixable in an afternoon.

We run an email-first reporting platform, so deliverability is not an abstract topic for us - it is the product. Every report ReportsMate sends goes out as a branded email from the agency's own custom sending domain, so we watch what mail servers do with agency reports at scale. This post is what that data says, and what to change.

Last updated: September 2026

Key takeaways

• Across 2,819 report emails we tracked between April and September 2026, about 2% never reached a mailbox at all - rejected by the receiving server or hard bounced before any spam folder was involved.
• Every one of those failures went to a business or custom-domain mailbox. Zero went to Gmail or Outlook.com consumer addresses. Corporate mail filters, not consumer webmail, are where agency reports die.
• Open rates split sharply by mailbox provider: roughly 46% for Gmail, 27% for business domains and 15% for Outlook and Hotmail addresses. Some of that gap is real filtering; some is image blocking suppressing the tracking pixel.
• Reports that get opened get opened fast. Our median time to open is about 5 hours, roughly 30% inside the first hour and about three in four within 24 hours.
• So if a report has not been opened after 48 hours, do not assume it is sitting unread. Assume it never arrived.
• The fix is almost always the same three records - SPF, DKIM and DMARC - published on the domain you actually send from.

What this post covers

1. Why do client reports go to spam?
2. What our delivery data says about report email deliverability
3. The seven reasons marketing emails land in junk
4. How to fix sender reputation for agency emails
5. How to tell whether a report actually landed
6. How to make sure clients receive reports every month
7. FAQs

Why do client reports go to spam?

Client reports go to spam when the receiving mail server cannot verify that the sender is who they claim to be, or when the message pattern looks like bulk marketing. Both are common in agency reporting, because a monthly report is an automated, image-heavy, link-heavy email sent from software on your behalf.

Three things decide the outcome. First, authentication: does the sending domain publish SPF, DKIM and DMARC records that line up with the address in the From field? Second, reputation: has that domain and sending IP got a history of wanted mail? Third, content and engagement: does the message look and behave like something the recipient asked for?

Get authentication wrong and nothing else matters. Google's Email sender guidelines are explicit that mail failing authentication is more likely to be rejected or filtered, and Microsoft's anti-spam protection documentation for Microsoft 365 says the same in different words. These are the published rules of the two systems handling most of your clients' mail.

There is a wrinkle specific to agencies. Since 2024, Google and Yahoo have enforced stricter requirements on bulk senders - broadly, 5,000 or more messages a day to their users - covering SPF, DKIM, DMARC, one-click unsubscribe and a spam complaint rate under 0.3%. Microsoft applied comparable rules to Outlook.com in 2025. Most agencies send nowhere near that volume, so the bulk requirements do not bind you. The filtering standards behind them still apply to every message you send.

What our delivery data says about report email deliverability

Here is the part most deliverability articles cannot give you: numbers from real client reports, not newsletters. The figures below come from our own production logs covering 2,819 tracked report-email deliveries between 18 April and 3 September 2026.

Two findings matter for your agency.

Corporate mailboxes are the risk, not consumer webmail. Every rejection and hard bounce we recorded went to a business or custom-domain address. That is where Microsoft 365 quarantine rules, on-premise gateways like Mimecast or Proofpoint, and IT-set allow lists live. Your client's Gmail address is the easy case. Their @theircompany.com address is the one that needs work.

Read the open-rate gap carefully. A 46% Gmail figure against 15% for Outlook looks damning, and part of it is genuinely filtering. But open tracking works by loading a tiny invisible image, and Outlook and corporate clients block remote images by default far more often than Gmail, while Gmail pre-fetches images in a way that can register an open the recipient never made. Treat the direction as real and the exact numbers as soft. For the same reason we do not publish a click rate from this dataset - corporate link-rewriting makes click tracking too unreliable to quote.

Speed is the useful signal. Median time from send to first open in our data is about 5.2 hours, with roughly 30% opened inside the first hour and about 74% inside 24 hours. Clients who open reports open them almost straight away. If you want the full picture on that, we broke down report engagement analytics separately.

The seven reasons marketing emails land in junk

Marketing emails landing in junk almost always trace back to one of seven causes. Work down this table in order, because the top three account for most cases we see.

Cause 5 is the one agencies resist. A 4MB PDF attached to a monthly report hits attachment scanning, gateway size limits and mobile data reluctance all at once. That is a big part of why we argue for reports in the body of the email rather than as PDF attachments - the deliverability case is as strong as the readability case.

How to fix sender reputation for agency emails

Sender reputation for agency emails is built on one thing: consistently sending authenticated mail from a domain you control. Here is the sequence, in order, and it is genuinely an afternoon's work.

1. Pick one sending domain and stick to it. Use a subdomain of your agency domain, something like reports.youragency.com. A dedicated subdomain keeps your reporting reputation separate from your sales outreach, so a cold-email campaign gone wrong cannot take your client reports down with it.

2. Publish an SPF record. SPF (Sender Policy Framework) is a DNS record listing which servers may send mail for your domain. Add your reporting platform's sending infrastructure to it. One SPF record per domain, no exceptions - two records break authentication entirely.

3. Publish DKIM. DKIM (DomainKeys Identified Mail) signs each message cryptographically so the receiver can verify it came from your domain unaltered. Your platform supplies a selector and public key to add as a DNS record.

4. Set the Return-Path. The Return-Path is the invisible bounce address behind the message. If it sits on the platform's domain while your From address sits on yours, DKIM can pass while DMARC alignment fails, and strict receivers will still junk you. This is the step most agencies miss, and the one that silently costs them.

5. Publish DMARC. DMARC ties SPF and DKIM to the visible From address and tells receivers what to do on failure. Start at p=none with a reporting address, then move to p=quarantine once your sends are clean.

6. Use your own tracking domain. If your open and click links resolve to a shared vendor domain, you inherit whatever reputation that domain carries. A CNAME on your own domain fixes it.

7. Verify, then send. Do not assume DNS propagated. Check every record reads verified before the first client report goes out.

None of this is proprietary advice. It is the baseline the industry itself publishes: the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) sender best practices have recommended domain authentication, a valid bounce path and gradual volume ramp-up for years, and every major mailbox provider has since built its filtering around exactly those signals.

That chain - custom sending domain, DKIM, Return-Path and tracking CNAME - is what proper white-labelling actually means. Putting your logo on a report is the easy 10%. Our white-label email reports setup checks each record before it lets you send, rather than letting you discover the problem a month later; the troubleshooting docs cover the usual DNS culprits.

We built ReportsMate email-first because, after years around agency reporting, the login-required dashboards clients were handed almost never got logged into. The report that lands in the inbox is the one that gets read - which makes deliverability the whole ballgame, not a footnote.

How to tell whether a report actually landed

You can tell whether a report landed by combining two signals: the delivery event from your sending platform and the open timing. Neither alone is enough.

A "delivered" event means the receiving server accepted the message. It does not mean the message reached the inbox - a Microsoft 365 tenant will accept mail and then file it in Junk or hold it in quarantine. So "delivered, never opened" is the ambiguous state you have to investigate.

This is where our timing data becomes a working rule. The median open happens around 5 hours in and about three quarters land inside 24 hours, so a report still unopened at 48 hours is very unlikely to be an inbox message the client simply has not got to. Treat 48 hours as your trigger to check, not the end of the month.

When you do investigate, ask three specific questions rather than "did you get it?":

• Can you search your junk folder for the sender address?
• If you are on Microsoft 365, can you check your quarantine digest or ask IT to check the quarantine portal?
• Can you add our sending address to your safe senders list and confirm it saved?

Adding your sender to a client's allow list at onboarding is the highest-value five minutes in the whole relationship. Do it on the kickoff call, not after the first report goes missing.

How to make sure clients receive reports every month

To make sure clients receive reports reliably, treat delivery as part of your reporting cadence rather than a one-off setup task. Reporting cadence is how often and how predictably reports go out, and that predictability is what builds the engagement signals keeping you out of junk.

A short standing checklist:

• Authenticate once, properly. SPF, DKIM, DMARC and Return-Path on a dedicated reporting subdomain.
• Send on a fixed schedule. Regular, expected mail from a stable sender scores better than sporadic bursts. Whether that is weekly or monthly matters less than that it never changes.
• Keep the From name human. "Sarah at YourAgency" beats "noreply@". A no-reply address kills the replies that teach filters this mail is wanted.
• Add the sender to the allow list at onboarding. Make it a line item in your kickoff checklist.
• Watch bounces properly. A hard bounce means the address is dead - fix it that day rather than sending to it for another six months.
• Never send from the client's own domain. It is the fastest way to a DMARC rejection, and it breaks the white-label logic anyway: the report should carry your agency's identity, not a spoofed version of theirs.

If you want to see how the connect, schedule and send flow works end to end, our how it works page covers the whole path from platform connection to delivered email.

FAQs

Q: Why do my client reports go to spam when nothing changed?

A: Nothing changing on your end does not mean nothing changed on theirs. The most common cause is a change at the receiving end - a client moves to Microsoft 365, their IT team turns on a stricter anti-spam policy, or a new mail gateway gets installed. The second most common cause is a reputation drift on your sending domain, usually because the same domain got used for cold outreach. If reports were arriving and now they are not, check whether the client's mail setup changed, then check whether anyone in your agency started sending bulk mail from the same domain.

Q: Does adding SPF, DKIM and DMARC guarantee inbox placement?

A: No, and be wary of any tool that promises it. Authentication is the entry ticket, not the whole show. It stops your mail being rejected or auto-junked for being unverifiable, which removes the largest and most fixable cause of failure. Placement after that depends on reputation and engagement - whether recipients open, reply and never mark your mail as spam. In our own data every hard delivery failure hit a business or custom-domain mailbox, which is exactly the population where authentication matters most.

Q: Should I send client reports as a PDF attachment or in the email body?

A: Send them in the body. Attachments face size limits, attachment scanning and quarantine rules that body content does not, and a PDF forces a download before the client sees a single number. Body-first reports render on a phone in three seconds, which is where most first opens happen. Attach or link a PDF only when a client explicitly needs one for their own filing. We compared both approaches in detail in our earlier post on PDF versus email marketing reports.

Q: What open rate should I expect on client reports?

A: Higher than a newsletter, because a client report is expected mail sent to someone paying you. Across our tracked sends the recorded open rate sits around 31% overall, but it varies a lot by mailbox provider, and image blocking means the true figure for corporate recipients is almost certainly higher than what tracking shows. Use your own trend as the benchmark rather than an industry average. If you want context on how to read the number, see our guide on what a good email open rate looks like.

Q: Can I send reports from my client's own domain so they look internal?

A: No. Sending as a domain you do not control is spoofing, and DMARC exists specifically to stop it. Modern receivers will reject or quarantine it, and you will have no visibility into why. White-labelling means the report carries your agency's branding on your agency's verified sending domain - custom logo, colours, sender identity and reply address. That is legitimate, it authenticates cleanly, and it still reads as your work rather than a tool's.

Q: How long should I wait before chasing an unopened report?

A: Two days. Our median time to first open is around 5 hours and roughly 74% of opens land inside 24 hours, so a report sitting unopened at 48 hours is more likely missing than ignored. Follow up with a short message asking the client to check junk and quarantine rather than resending the same email to the same filter. Resending an identical message to an address that already filtered it usually produces an identical result.

Final tips

Deliverability is not a marketing problem you solve with better subject lines. It is a plumbing problem, and the plumbing is DNS. Publish SPF, DKIM and DMARC on a dedicated reporting subdomain, point the Return-Path at your own domain, get on the client's allow list during onboarding, and stop attaching heavy PDFs. That covers the causes behind almost every case of client reports going to spam we see.

Then measure it. Watch delivery events and open timing together, and use the 48-hour rule as your trigger to chase rather than finding out on the quarterly call that three months of reports went to junk. A client who thinks you have not reported in a quarter is a client already taking calls from another agency.

Stop losing clients to a spam filter. Start your free 14-day trial - no credit card, no setup fees, cancel anytime. Your clients get branded, authenticated reports in their inbox automatically, sent from your own verified domain.