Why Order Confirmation Emails Go to Spam

The customer paid. The ESP says the receipt was delivered. The customer is searching spam for an order number, and then they are emailing support. That is a placement failure on the one message you cannot treat as optional.

It is usually not the order template. It is the reputation sitting on the domain or IP that sent it. A customer who just paid you can still get your receipt in spam, because Gmail scores the sending domain, not the purchase. That holds when receipts share a From domain with your campaigns; if receipts come from a separate, authenticated stream, look at the vendor’s alignment first.

Last verified: 26 September 2026, against Google’s sender guidelines and Yahoo’s sender best practices.

Delivery is not the inbox

If the receipt bounced, this is the wrong page. A bounce means the server refused it. Start with SMTP 4xx vs 5xx. If the ESP says delivered and the customer found it in spam, the server accepted the message and a filter filed it. That distinction is delivered but not received.

Why order confirmation emails go to spam: one reputation for two kinds of mail

Gmail scores the domain. Your promotional complaints, ignored blasts, and a cold win-back all teach Gmail about the From domain on your receipt if they are the same domain. Yahoo’s complaint rate is also tied to the mail that domain delivered to the inbox.

Yahoo’s best-practices page recommends sending marketing and transactional mail from different IPs or different DKIM domains. Google’s sending-practices section recommends a different IP for each message type when you already send from more than one IP, and it says not to put promotions inside receipt messages. Both are guidelines on those pages, not the bulk-sender authentication requirements. You should still separate the streams, because a marketing complaint problem does not stay politely inside the campaign folder.

How to split subdomains, IPs, and platforms is already written. Use sending architecture and subdomain setup. The learn page on transactional vs marketing is the Klaviyo-oriented definition. This page does not repeat those setup steps.

While you are separating them, do not pause receipts in order to “cool off” the domain. Pause the promotional stream that is generating complaints. The first 24 hours of a marketing incident is containment of the mail people did not just pay for. Receipts to people who ordered today stay on, once you know that stream itself is authenticated.

The other cause: your receipt sender is not your store

Order mail, shipping mail, and password resets often leave through different products. A review app, a payment receipt, and a login email can each sign with their own domain. DMARC then fails alignment even though “the store’s email authenticates” in a test of the marketing domain.

Check the message the customer actually received:

• dkim=pass on your domain, aligned, and still in spam: this is reputation or filtering, not a missing record. Look at complaints on that domain.
• dkim=pass on a vendor domain, DMARC fail: the vendor is not aligned. That is the alignment problem, fixed on the vendor, not by rewriting the order HTML.
• SPF and DKIM both fail: the vendor was never added. A marketing-domain checker will look green and miss it.

Password resets that vanish while receipts arrive are almost always this split. Suppressions inside the identity tool are the other common cause. Klaviyo will not show a suppression that lives in a different product.

What not to change first when receipts land in spam

Do not stuff the receipt with extra text to “fix the image ratio.” Content studies on this site did not find that lever. Content signals versus reputation cites them. A receipt is short and transactional. Making it look like a newsletter does not borrow the newsletter’s reputation.

Do not move receipts onto a brand-new domain on a Friday and send the full day’s orders through it. A new domain is cold. Warmup failure applies even when the template is a receipt. Authenticate first, send a small set you can see, then cut over.

Then watch your receipt stream on its own. Send one seed receipt to Gmail, Yahoo, AOL, and Outlook, separate from the campaign seed. Check Postmaster spam rate on the receipt domain, not only the campaign domain. Read bounce text on the receipt path, because a 5xx there is not a marketing complaint. After any app update, confirm the vendor’s DKIM d= on a real order, which the email header analyzer shows in one paste.

Sources

• Email sender guidelines, Google. Bulk-sender rules apply by volume to personal Gmail accounts, not by campaign type.
• Sender best practices, Yahoo. Authentication and complaint-rate requirements, plus the recommendation to separate marketing and transactional mail.
• Postmaster Tools, Google. Spam rate is calculated on delivered, authenticated mail that a user marks as spam.