Seed-List Inbox Placement Testing: Build an Auditable Panel, Read It Right, and Know Its Blind Spots
A seed panel does not tell you whether your mail hits the inbox — Gmail decides that per recipient. It answers one narrow question: with zero goodwill, does provider X filter this exact message to spam? Here's how to build a DIY IMAP seed panel, inject through the production path, read placement (including Gmail tabs) over IMAP, and cross-check the verdict against Postmaster and SNDS complaint data.
EvilMail TeamJuly 14, 202610 min read
A team ships a campaign. mail-tester says 9.8/10. GlockApps reports 94% inbox. Then real Gmail traffic lands in Promotions, opens crater, and people start asking whether the ESP is broken. Nothing is broken — the tools measured a different thing than the one you shipped to.
Seed placement and real placement answer different questions. A seed account has no history with your brand, so its verdict is the *cold-stranger* case, not the average case. Gmail personalizes placement per recipient using that recipient's own engagement, which a seed panel by definition cannot have. The aim here is narrow and honest: build a seed panel you can fully audit, read it without lying to yourself, and pair it with complaint data so you never ship a "97% inbox" number that evaporates on real traffic.
What a seed list actually measures (and what it can't)
A seed panel is a set of 20–80 monitored mailboxes across providers that no human ever reads. Because nobody opens, replies, or drags them to the inbox, the panel produces zero engagement signal. That is the point. Stripping out per-user personalization isolates the part of placement that is *not* about the individual recipient: your sending reputation, your authentication, and your content. The seed is the indifferent stranger — a useful floor, a misleading average.
Read that floor correctly and it earns its keep in exactly two jobs:
Regression detection. When a provider that inboxed yesterday drops to spam today, something in reputation, auth, or content changed. The panel catches it before you blast the list.
Hard-filter diagnosis. Content that trips SpamAssassin rules, a broken DKIM signature, a URL on a domain blocklist — these push even a neutral message to spam, and seeds see them clearly.
What seeds structurally cannot see:
Engagement-driven inboxing. The lift real subscribers give you from opens, replies, and "not spam" clicks. Seeds have none, so they systematically *underrate* placement for warm audiences.
Per-domain corporate filtering. A Mimecast or Proofpoint rule at one B2B tenant won't appear unless that exact tenant is in your panel.
Pre-SMTP blocks. If the receiving MX rejects or greylists at connection time, no copy is ever delivered. Seeds detect this only as an *absence* — the message simply never arrives.
One-line verdict: use seeds to catch regressions and hard filtering; use postmaster data to trust the real number.
Building the seed panel
Weight coverage to *your* audience, not a generic influencer list. Query your own recipient table and count by receiving domain before you decide the mix:
sql
SELECT lower(split_part(email,'@',2)) AS domain, count(*) AS n
FROM subscribers
WHERE status = 'active'
GROUP BY 1 ORDER BY n DESC LIMIT 25;
If 55% of your list is gmail.com, your panel should be roughly 55% Gmail — an equal split across eight providers measures a population you don't send to. The buckets that matter in 2026, each with its own filter:
Gmail consumer and Google Workspace — same infrastructure, different policy surface (Workspace admins add rules).
Outlook.com / Hotmail / Live and Microsoft 365 — consumer vs. tenant filtering diverge hard.
Yahoo / AOL — shared infra since the Verizon Media days.
Apple iCloud — quiet, but strict on auth alignment.
GMX / Web.de — DACH duopoly, own reputation system.
Mail.ru / Yandex — RU/CIS.
QQ / 163 — CN, if you send there at all.
Season the accounts. A fully dormant mailbox biases toward spam — a stone-cold account is its own artifact, not a clean baseline. Log into each seed weekly, receive some legitimate mail, open a few, move one or two from Junk to Inbox. You are not faking engagement with *your* domain; you are keeping the mailbox from looking abandoned, which is a signal in its own right.
Randomize seed position inside the injection batch. If seeds always sit at the tail of the send, one unlucky IP-hash or a per-recipient rate ramp can skew a whole provider's result. Shuffle them into the real send order.
Injecting the campaign through the production path
This is non-negotiable and the most common way DIY tests go wrong: send from the same IP, same DKIM selector, same envelope-from, same MTA/ESP as production. A test sent from a different path measures a different reputation and tells you nothing about the mail you'll actually ship.
Tag every send with a unique header so the poller finds exactly this message and nothing else. Set the 2024 bulk-sender compliance headers too, so the test reflects a message that is actually shippable:
javascript
await transporter.sendMail({
from: 'EvilMail <[email protected]>', // same From + sending domain as prod
to: seed.address,
subject: 'Weekly digest',
headers: {
'X-Seed-Campaign': campaignId, // uuid v4, unique per test run
'List-Unsubscribe': '<https://evilmail.pro/u/{{tok}}>, <mailto:[email protected]>',
'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click'
},
html, text
});
Without List-Unsubscribe-Post: List-Unsubscribe=One-Click, any sender over 5,000 messages/day to Gmail is already out of compliance with the Google/Yahoo rules in force since February 2024 — and a non-compliant test message isn't measuring your real deliverability, it's measuring a policy violation.
Reading placement programmatically over IMAP
Poll each seed mailbox, walk INBOX plus that provider's junk folder, match on the campaign header, and record where it landed. The junk folder name differs per provider — hard-code the map:
Gmail: [Gmail]/Spam (or [Google Mail]/Spam)
Outlook / M365: Junk Email
Yahoo / AOL: Bulk Mail
iCloud: Junk
GMX / Web.de: Spamverdacht
Mail.ru / Yandex: Спам
For Gmail, folder alone is not enough — an inboxed message can still sit in Promotions, which craters opens even though it "reached the inbox." Request labels: true so imapflow fetches X-GM-LABELS, then read the tab off the label set:
javascript
import { ImapFlow } from 'imapflow';
async function placement(seed, campaignId) {
const c = new ImapFlow({
host: seed.host, port: 993, secure: true,
auth: { user: seed.user, pass: seed.pass }
});
await c.connect();
try {
for (const box of ['INBOX', seed.spamFolder]) {
const lock = await c.getMailboxLock(box);
try {
// Fetch the tag header + Gmail labels for every message in the box.
// Match client-side: Gmail IMAP won't SEARCH arbitrary custom headers.
for await (const m of c.fetch('1:*',
{ uid: true, labels: true, headers: ['x-seed-campaign'] })) {
const hdr = m.headers?.toString() ?? ''; // imapflow -> may be undefined
if (hdr.toLowerCase().includes(campaignId.toLowerCase())) {
const labels = [...(m.labels ?? [])]; // a Set on Gmail, empty elsewhere
const tab = labels.find(l => l.startsWith('CATEGORY_')) ?? null;
return { provider: seed.provider, folder: box, tab };
}
}
} finally { lock.release(); }
}
return { provider: seed.provider, folder: 'MISSING', tab: null }; // blocked/greylisted
} finally {
await c.logout();
}
}
Two implementation notes that bite people. First, imapflow returns msg.envelope, msg.flags, and msg.headers as possibly undefined — use optional chaining everywhere, as above. Second, the Gmail label vocabulary decodes to real destinations: \\Inbox and CATEGORY_PERSONAL = Primary; CATEGORY_PROMOTIONS / CATEGORY_SOCIAL / CATEGORY_UPDATES / CATEGORY_FORUMS = the respective tabs; \\Spam = the spam folder. A folder: 'MISSING' return is not a bug — it means the message was blocked or greylisted before delivery, the one failure mode seeds can only observe by absence.
The output is a four-outcome matrix per provider, and the four outcomes are genuinely different failures:
Interpreting the numbers without fooling yourself
Before you trust any placement percentage, open one delivered copy and read its Authentication-Results header. If SPF, DKIM, or DMARC is anything but pass, the placement number is noise — fix auth first. Here's what a clean result looks like on Gmail:
Note adkim=s; aspf=s — strict alignment. iCloud and Yahoo are unforgiving here: a message that passes DKIM on a subdomain but whose signing domain doesn't *align* with header.from will still fail DMARC.
Now set honest thresholds. Aim for >90% inbox across the panel as a directional floor, not a trophy. The real signal is movement: a single provider newly dropping to spam is a regression worth blocking the send over, even if the aggregate still reads 92%. Map each outcome to its fix:
Primary / Inbox — good, no action.
Promotions tab — a *content* signal (heavy HTML, image-to-text ratio, marketing language). It's placement, not filtering; fix only if opens matter.
Spam — *reputation* or *auth*. Check Authentication-Results first, then your Postmaster reputation bucket.
Missing — *blocklist or greylisting*. Check Spamhaus/Barracuda for your IP and retry; greylisting resolves on the second attempt, a blocklist does not.
Cross-checking against real-world signal
Seeds are the floor. Complaint data is the truth, because it comes from the recipients seeds can never emulate.
Google Postmaster Tools. Watch domain and IP reputation (High / Medium / Low / Bad) — domain reputation dominates content placement. Keep the user-reported spam rate under 0.10% as Google recommends, and never let it cross the 0.30% cliff the bulk-sender rules explicitly name; past that, Gmail filters you wholesale regardless of what your seed panel says.
Microsoft. Enroll your sending IPs in SNDS for the color-coded complaint bands (green / yellow / red), and pair it with the JMRP feedback loop so Outlook.com "report junk" clicks come back to you.
The tell that justifies this whole practice: when seed inbox % stays high but the Postmaster spam rate climbs, real users are complaining and your panel is blind to it. That gap — high seed score, rising complaint rate — is exactly why you never ship on seed data alone. A DIY IMAP panel plus postmaster data beats a $79/mo SaaS score you can't audit, because you can see *both* halves of the picture and reconcile them.
Pre-flight checklist
Run this before every meaningful send. If any line fails, hold the campaign.
SPF, DKIM, and DMARC all show pass on the actual delivered copy — not just in a DNS lookup.
DMARC policy at least p=quarantine with strict alignment (adkim=s; aspf=s).
List-Unsubscribe header present, plus one-click List-Unsubscribe-Post: List-Unsubscribe=One-Click.
Seed accounts seasoned this week (logged in, received legit mail, nothing dormant).
Sent via the production IP, DKIM selector, envelope-from, and MTA — no side channel.
Unique X-Seed-Campaign header set so the poller matches this run only.
Poller checks Gmail tabs via X-GM-LABELS, not just INBOX — Promotions is not a pass.
Google Postmaster Tools and Microsoft SNDS enrolled, reputation green, spam rate under 0.10%.
Seed result within tolerance of your last known-good baseline; investigate any provider that moved.
