Why this email passed every spam check and is still spam
Last reviewed
Your mail server checked the message. The sending domain was allowed to send it (SPF). The message was signed and the signature held (DKIM). The domain's policy agreed that the visible sender matched the signer (DMARC). Three passes, green ticks all the way down, and the message is still a stranger asking whether you have "fifteen minutes next week."
That is not a failure of the checks. The checks did exactly what they were built to do. They answered a narrow question, "did this message really come from the domain it claims?", and the honest answer was yes. Nobody asked whether the domain was registered three weeks ago, whether it exists only to send these messages, or whether the person behind it has any business writing to you.
This article walks through why those two questions are separate, and what a sender has to do to make the first one come back clean.
What the three checks actually prove
Each of the three is a statement about the domain in the From address, not about the person using it. SPF says "this server is allowed to send for this domain." DKIM says "this message was signed with a key that this domain published." DMARC says "the domain's owner wants receivers to trust those two results, and here is what to do when they disagree."
Every one of those statements is true for a freshly registered domain with a correctly configured mailbox. The controls are in the sender's hands, and the sender set them up.
Getting a pass is a setup checklist, not a reputation
Sending platforms hand out the DNS records for SPF and DKIM at signup. Publishing a DMARC record is a one-line addition. A person who has never sent an email before can have a domain that passes all three in an afternoon, and the tools that sell cold-email campaigns include the step by step.
Where the trust actually comes from
Filters lean on history: how long the domain has existed, how much mail it has sent, how many people opened it, replied, or complained. A new domain has none of that, which is why the same tools also sell a warming period where mailboxes trade friendly messages with each other for a few weeks before the pitch goes out.
Why the lookalike domain matters
The pitch usually names a real company, but the From address is one word off from that company's domain. That keeps the real domain's reputation clean, keeps complaints away from the real inbox, and gives the sender a domain they fully control for the authentication records above.
What this means for you
If a message passes authentication and still looks like cold sales email, both things are probably true. Authentication is a reason not to worry about forgery. It is not a reason to reply.
What we do with these on this site
Every record here shows the authentication results as they were when the message arrived, alongside the domain's age and what its website was doing that day. Seen together, the pattern is usually obvious.