Cloudflare transactional emails keep going to spam. What settings should I double-check?

I’m using Cloudflare to send transactional emails from my SaaS application, and I’m having an issue with some (well, most) of the messages getting dumped into spam.

Before I start changing a bunch of things blindly, I’m trying to make sure I have the email side configured correctly.

These are normal transactional emails like work order notifications, system updates, password/account-related emails, etc. Not marketing or bulk email.

For anyone using Cloudflare for transactional email, what should I be checking?

I’m mainly wondering about things like:

• SPF
• DKIM
• DMARC
• Return-Path / envelope sender
• From address/domain alignment
• Reverse DNS, if that even applies here
• Whether I should use a dedicated subdomain for transactional mail
• Anything specific in Cloudflare that is easy to configure incorrectly

I’d also be interested in what you guys use to test deliverability. I’d like something that will tell me, “this DNS record is wrong” or “this header/alignment is causing a problem” instead of just giving me a generic spam score.

The emails are being delivered, so it isn’t a complete failure. They’re just landing in spam more often than I’m comfortable with.

If you’re sending transactional email through Cloudflare successfully, I’d appreciate knowing what your setup looks like and what you would check first.