Why do bid invitation emails go to spam?

"We never got it" is the most common thing a sub says on bid day. It's true more often than estimators expect. Here's what goes wrong between Send and the sub's inbox, with fixes ordered from the ones you can do this afternoon to the ones that need IT.

Why invitations get flagged as spam: what receiving servers check

Before a human sees your email, the receiving server asks roughly three questions:

1. Is the sender who they claim to be? Authentication: SPF, DKIM, DMARC.
2. Does this sender have a good reputation? Has the domain sent spam? Does its mail get ignored or deleted?
3. Does this look like spam? Content, links, attachments, how many people got the same message.

Fail badly on one and the message goes to Junk or is dropped. Fail mildly on a couple and it lands in Other or Promotions, where nobody looks.

6 estimating-side fixes (today)

1. Stop sending to Bcc lists. Forty recipients looks like a marketing blast because it is one. Individual emails look like correspondence. Mail merge does this without the typing.
2. Stop attaching big files. A 40 MB attachment bounces on many servers, and "many attachments to many people" is a spam signal. Link to the documents.
3. Send from a person, to a person. "estimating@" to "estimating@" is two robots talking. A named sender to a named recipient is correspondence, to filters and to the recipient.
4. Watch the formatting. No capitals in the subject, no strings of exclamation marks, no image-only signature, one link rather than eight.
5. Fix bounces immediately. Every address you keep sending to that bounces counts against your domain. A list with 10 percent dead addresses slowly poisons delivery to the other 90.
6. Don't blast from a new address. A "bids@" mailbox created yesterday sending 300 invitations today looks like a spammer with a fresh domain. Warm it up over a couple of weeks, or send from an established personal address.

The platform question

Invitations sent through a bidding platform come from the platform's domain. Their deliverability is their job and the large vendors handle it competently. But corporate mail systems learn that mail from that domain is automated notifications and sort it into Other or Promotions. Not spam; just not the inbox. That's why "I never got it" is more common with platform invitations than with personal ones.

The alternatives are sending from your own domain (Outlook merge, or a tool that connects to your Microsoft 365 or Google Workspace mailbox and sends as you, which is exactly how Invite All, our product, works), or phoning the important trades after each send to confirm arrival. Either way, "sent" and "in the inbox" are different things.

3 IT-side fixes (this month)

Send this section to whoever manages your domain and email.

1. SPF

A DNS record listing which servers may send mail for your domain. If it's missing, or doesn't include a service you send from (a bidding platform, accounting software, a merge add-in), that mail looks forged. Check with any SPF checker; it should exist and pass.

2. DKIM

A cryptographic signature on each message proving it came from your domain unaltered. Microsoft 365 and Google Workspace both support it but it isn't always on by default. Check by sending yourself a test to a Gmail account, opening "Show original," and looking for "DKIM: PASS."

3. DMARC

A policy record telling receivers what to do when SPF or DKIM fails and where to send reports. Even a monitoring-only policy improves how your mail is treated. Google and Yahoo began requiring these records from bulk senders in 2024 and Microsoft followed in 2025; a domain without them is on borrowed time.

The shared-mailbox trap

Sending from "estimating@" with "send as" permissions is fine when it's configured in your own tenant. It goes wrong when a third-party tool or old on-premises server sends as that address without SPF and DKIM covering it, making your invitations technically forgeries. Any tool that sends on your behalf should do so through your actual mailbox (OAuth into Microsoft 365 or Google), not by spoofing the From address.

The 15-minute test

Before the next bid round:

1. Send a real invitation with your normal template to three addresses: a Gmail account, an Outlook.com account, and a colleague at another company on Microsoft 365.
2. Note where each landed: Inbox, Other, Promotions, Junk.
3. In Gmail, "Show original." Look for SPF, DKIM and DMARC. You want three passes.
4. Anything off, use the lists above.

If the message lands in Other on your colleague's corporate Outlook, assume it does for a third of your subs, and phone the important ones after each send until it's fixed.

Short version

Individual emails, from a person, to a person, with a link instead of attachments. Fix bounces the day they happen. Get IT to set up SPF, DKIM and DMARC. And if you send through a platform, remember that delivered and seen are not the same.