Cold Email Deliverability Forensics in 2026: Diagnosing Spam Placement

TL;DR

Begin with scope: identify the affected recipient providers, sender domains, mailboxes, IPs, messages and time window before changing anything.
Use placement tests, Google Postmaster Tools, Microsoft SNDS, DMARC aggregate data, bounce evidence and blocklist context as complementary signals.
No single tool measures the real inbox rate for every recipient. Seed panels and provider dashboards have specific coverage and thresholds.
Change one variable at a time, preserve a timeline and stop sending when continued activity could deepen the problem.

Quick comparison
Frame the decision before comparing tools
The leading options
How to evaluate the shortlist
Implementation pattern
Risks and operating controls
Investigate the change before replacing the stack
FAQ

Quick comparison

Option	Strong fit	Verify before purchase
GlockApps or another seed test	The team needs controlled evidence of folder placement across a monitored panel	seed composition, repeatability, headers and the limits of extrapolating to production
Google Postmaster Tools	The affected stream sends enough eligible volume to Gmail for aggregate provider data	domain verification, dashboard availability, spam rate, reputation and authentication interpretation
Microsoft SNDS	The team or provider controls sending IPs reaching Outlook.com consumer services	IP registration, complaint or trap evidence, coverage and responsibility for remediation
DMARC and DNS analysis	Investigators need to confirm authentication alignment and unexpected senders	aggregate-report coverage, SPF limits, DKIM selectors, alignment and forwarding effects

Frame the decision before comparing tools

Forensics starts with a timeline. Record the last known healthy period, campaign and infrastructure changes, volume, bounce codes, complaint evidence and affected domains. Determine whether failures concern delivery, spam-folder placement, category tabs, missing replies or tracking. These symptoms require different investigations.

The leading options

GlockApps or another seed test

A seed-placement service can show how a controlled message lands in its monitored accounts. It is useful for comparing providers and changes, but should be labelled as seed evidence rather than a universal inbox rate.

Google Postmaster Tools

Google Postmaster Tools provides aggregate signals for qualifying Gmail traffic. Where data is available, it can help distinguish a Gmail-specific reputation or complaint problem from a broader issue.

Microsoft SNDS

Microsoft SNDS exposes network data for registered IP space sending to Outlook.com. It is particularly useful when the infrastructure owner can map the affected IP to the outbound stream.

DMARC and DNS analysis

DMARC reports and direct DNS inspection can reveal unauthorised sources, broken alignment and configuration drift. They establish authentication evidence, not recipient engagement or message relevance.

How to evaluate the shortlist

Send controlled tests without repeatedly hammering the same seeds. Compare complete headers, authentication, receiving provider and message. Check live DNS, DMARC aggregates, provider dashboards, blocklist listings with context and SMTP response codes. Reproduce from an unchanged control, then test one suspected variable.

Implementation pattern

Maintain a case file with evidence, hypothesis, change, owner and result. Pause the affected stream when risk is material. Separate domains and mailbox cohorts so a provider-wide incident is not mistaken for one message problem. After remediation, resume with a bounded cohort and watch provider-specific production evidence.

Risks and operating controls

Do not rotate domains merely to escape reputation consequences, manufacture engagement or treat a blocklist lookup as a universal verdict. Seed panels can overstate small changes, and aggregate dashboards can hide low-volume segments. Protect suppression and reply state during any migration. Fix targeting and complaint causes before adding capacity.

Investigate the change before replacing the stack

If replies fall after a new list source is introduced, compare that cohort with the previous source using the same sending setup. If the fall affects every cohort at once, inspect shared infrastructure and provider events. Changing mailboxes, copy and data simultaneously makes it harder to learn which change caused the problem.

FAQ

Does passing SPF, DKIM and DMARC guarantee inbox placement?

No. Authentication is necessary infrastructure evidence, while reputation, complaints, content and recipient context also matter.

Is a blocklist listing always the cause?

No. Check whether the receiving providers actually use it and correlate the timing and affected IP or domain.

Should copy be changed first?

Only when evidence supports a content hypothesis. Preserve a control and avoid several simultaneous changes.

Can a seed test report the campaign inbox rate?

No. It reports results for its controlled panel and test conditions.

When should sending resume?

After the likely cause is addressed, with a small monitored cohort and a defined rollback threshold.

Sending software is one part of the operating setup. Our guide to cold email deliverability tools covers the adjacent options.

Sources and comparison method

The recommendations are editorial assessments of workflow fit, not results from a comparative product test. Supporting product references are linked below; prices and plan entitlements should be confirmed for the configuration being purchased.

Work with Forma Nôrden

Forma Nôrden runs deliverability investigations as evidence-led incident work. We help teams isolate the affected stream, test defensible hypotheses and restore sending without hiding the root cause. Explore how we work.

For enquiries about this article: partnerships@formanorden.com