Email Deliverability for Law Firms: Why Your Newsletters Land in Spam

12 September 2026·5 min read

Quick answer: Newsletters land in spam mostly for three reasons: your domain's authentication records (SPF, DKIM, DMARC) aren't set up properly, your list has gone stale with unengaged or invalid addresses, or your subject lines and content are tripping spam filters. None of these require a technical background to fix — they need a checklist and about an hour with whoever manages your domain. Below is that checklist, explained in plain English, plus three worked examples. 🚀

A law firm sends a beautifully written client update, hits send, and it's never seen — not bounced, not unsubscribed, just quietly filed in spam by half the inbox providers on the list. Deliverability is invisible until you check for it, and most firms never do. 💖

Please note: general information, not legal advice — check current official guidance before relying on it.

What most firms get wrong

Assuming a "sent" email means a "delivered" email — your email platform will happily report a 100% send rate while inboxes quietly filter half of it.
Never touching domain records — SPF, DKIM and DMARC are usually set up once, by whoever built the website years ago, and never revisited.
Keeping every contact forever — old, unengaged or bounced addresses on your list actively hurt delivery to everyone else on it.
Writing subject lines like an ad — "URGENT: Free Legal Update!!" reads to a spam filter almost exactly like it reads to a person.
Sending from a personal inbox at scale — bulk-sending a newsletter from an everyday email address rather than a proper email platform.

The plain-English deliverability checklist

SPF: a record that lists which servers are allowed to send email from your domain — think of it as a guest list for your own name.

DKIM: a digital signature added to every email proving it genuinely came from you and wasn't altered in transit.

DMARC: a policy that tells inbox providers what to do with email that fails the above checks — reject it, quarantine it, or let it through.

List hygiene: regularly removing bounced, invalid and long-unengaged addresses, rather than mailing everyone who ever gave you a business card.

Content check: avoiding spam-trigger language (ALL CAPS, excessive exclamation marks, "free," "urgent," "act now") in subject lines and opening copy.

The first three are one-off technical setup (usually done through your domain host or IT provider); the last two are ongoing habits. Both matter — good records with a stale list still lands in spam.

Worked examples

Same underlying problem — sender trust — showing up differently depending on what the firm had neglected. 📱

Family law firm: A quarterly client newsletter had strong open rates on paper but was mostly landing in the "Promotions" or spam folder. The fix: DMARC had never been set up on the domain at all; adding it alongside existing SPF and DKIM records lifted inbox placement within a couple of sends.

Commercial law firm: Deliverability had quietly declined over two years of never removing bounced addresses from a 3,000-contact list. The fix: a one-off clean-up removing hard bounces and anyone who hadn't opened an email in over 12 months, followed by a smaller, more re-engaged send list.

Conveyancing firm: A "Time-Sensitive Update — Act Now!!" subject line on a routine settlement reminder was consistently filtered as spam. The fix: plainer, calmer subject lines ("Your settlement update from [Firm]") sent from a consistent, properly authenticated address.

How to actually fix this

Start with authentication: ask your website or IT provider (or your email platform's support team, most walk you through it) to confirm SPF, DKIM and DMARC are correctly set up for your sending domain — this is usually a half-hour job once, not an ongoing task. Then clean your list: remove hard bounces immediately, and consider re-engagement or removal for contacts who haven't opened anything in six to twelve months. Finally, review your last few subject lines for spam-trigger language and tone them down. Send a test to a few different email providers (Gmail, Outlook, a work address) before a big send to check where it actually lands.

💡 Heads up: A smaller, more engaged list that opens your emails almost always outperforms a bigger, stale one — inbox providers watch engagement closely, and a list full of people who never open anything actively drags down delivery for the contacts who do.

Mistakes to avoid once you start fixing this

Setting up authentication and never checking it again — records can break silently after a website migration or hosting change.
Buying or scraping contact lists — this is one of the fastest ways to tank sender reputation, and the addresses are rarely engaged anyway.
Sending too rarely, then too much — a sudden burst of emails after months of silence can look suspicious to inbox providers.
Ignoring unsubscribes and complaints — a rising complaint rate is one of the strongest signals filters use against you.

Frequently asked questions

What's the difference between SPF, DKIM and DMARC, really?

SPF says which servers can send as you, DKIM proves the email wasn't tampered with, and DMARC tells inbox providers what to do if either check fails. You generally want all three set up together — having one without the others gives inbox providers less confidence in your domain.

How often should we clean our email list?

A light pass every quarter (removing hard bounces) and a bigger review every six to twelve months (removing long-unengaged contacts) is a reasonable rhythm for most small firms — busier senders may want to check more often.

Will fixing deliverability guarantee our emails land in the inbox every time?

No — inbox providers use dozens of signals, some of which change without notice, so no fix is a permanent guarantee. What this checklist does is remove the common, self-inflicted causes; occasional filtering can still happen even with everything set up correctly.

Can our email platform fix this for us automatically?

Most reputable platforms handle a chunk of this well (DKIM signing, bounce handling) but authentication records like SPF and DMARC usually still need to be added at the domain level by whoever manages your DNS — it's rarely fully automatic end to end. 🌴

Keep reading 🤍

Written by

Kate, founder of Chronically Online

I help Gold Coast and Brisbane businesses grow with branding, websites and marketing that actually works.

Work with me ✦