Why your phishing simulations land in spam (and the SPF / DKIM / DMARC fix that actually works)

Every security awareness program eventually has the same conversation: "We sent the campaign yesterday. The dashboard says it went out. But nobody clicked, and three people on Slack are asking why they didn't get the test email." Then somebody opens their spam folder and finds the simulated phish sitting next to a Nigerian prince. The campaign isn't broken. The deliverability is. I've spent enough time debugging this for HailBytes SAT customers that I can write the post-mortem from memory. Here