Deliverability is the probability that an accepted email reaches the intended inbox rather than spam, quarantine, or silent filtering. It depends on authentication, domain and IP reputation, recipient consent, list quality, sending patterns, content, infrastructure, and engagement. No subject-line trick or “warm-up†service can compensate for unwanted mail.
The control map
| Layer | Required control | Evidence |
|---|---|---|
| Identity | SPF, DKIM and DMARC with alignment | DNS checks, authentication results and DMARC reports |
| Infrastructure | Correct DNS, TLS, reverse DNS where applicable and stable sending path | Provider logs and header inspection |
| Permission | Documented consent and clear expectation | Signup records and policy version |
| List hygiene | Bounce, complaint, unsubscribe and inactivity suppression | ESP events and suppression audit |
| Volume | Predictable sending with controlled ramp | Daily volume by domain and stream |
| Content | Honest sender, subject, body, links and accessible unsubscribe | Seed tests and campaign QA |
| Monitoring | Reputation, blocks, deferrals, complaints and conversions | Postmaster data, provider dashboards and analytics |
Authenticate every sending domain
SPF authorizes services to send using the envelope domain. Publish one SPF record per domain and include only legitimate senders. Too many nested DNS lookups can invalidate evaluation, so consolidate and remove old services carefully. SPF alone does not protect the visible From address.
DKIM adds a cryptographic signature. Use a strong key size supported by the provider, rotate keys under policy, and ensure the signing domain aligns with the visible From domain for DMARC. Test that forwarding or gateways do not break the signature unnecessarily.
DMARC tells receivers how to evaluate alignment and report failures. Begin with p=none only while collecting and analyzing reports, then progress toward quarantine or reject after every legitimate sender is aligned. Use a dedicated aggregate-report mailbox or analysis service. Strict policy without inventory can block payroll, support, or vendors that send on the company’s behalf.
Gmail requires bulk senders to use SPF, DKIM, and DMARC, and alignment matters. Yahoo and Microsoft have also strengthened high-volume sender expectations. Follow each provider’s current official guidance, because thresholds and enforcement can evolve.
Separate mail streams
Transactional mail—password resets, receipts, security alerts—has different consent, urgency, and reputation needs from promotions. Send through separate subdomains or configurations where architecture supports it, while preserving recognizable branding and authentication. Do not use a marketing platform for critical resets if queueing and unsubscribe behavior are unsuitable.
Separate high-risk acquisition programs from customer operations. A complaint spike in a cold or poorly qualified stream should not jeopardize receipts. Domain separation is not permission to send abuse; mailbox providers can connect related infrastructure and brands.
Dedicated IPs provide control only when volume is high and consistent enough to maintain reputation. Most smaller senders benefit from a well-managed shared pool. Ask the provider about pool governance, onboarding, rate handling, and incident support.
Build consent and expectations
Use clear forms describing the sender and frequency. Avoid purchased, scraped, appended, and rented lists. Confirmed opt-in provides stronger evidence and catches mistyped addresses, though requirements vary by program and jurisdiction.
Store signup source, timestamp, IP where lawful, form version, consent text, and preferences. Do not bundle optional marketing into a required transaction. A person who downloads a receipt has not necessarily subscribed to a newsletter.
Send the promised first message quickly. Long delays cause recipients to forget the signup. Use a preference center for topics and frequency, and provide a visible unsubscribe in every promotional message. Bulk mail should support one-click unsubscribe where provider rules require it.
Clean the list continuously
Suppress hard bounces immediately. Handle soft bounces by code and repeated pattern rather than retrying forever. Process complaints and unsubscribes quickly across every connected system. Maintain a global suppression list that migrations cannot accidentally overwrite.
Validate addresses at entry for syntax and obvious disposable or role-account policies, but do not treat third-party validation as consent. Avoid sending a “re-engagement†campaign to years of addresses that have never responded.
Define active engagement using reliable signals: recent click, reply, website session, purchase, product use, or preference update. Opens are unreliable because Apple Mail Privacy Protection and other systems preload pixels. Gradually reduce frequency for inactive recipients, then suppress them.
Control volume and cadence
New domains, subdomains, and IPs need a gradual introduction based on genuine engaged recipients. Begin with recent customers or active subscribers and expand as delivery remains healthy. Do not use artificial warm-up networks that exchange fake opens and replies; they violate trust and can create suspicious patterns.
Avoid sudden spikes caused by a full-database blast. Segment campaigns by relevance and spread operationally when appropriate. Monitor deferrals and rate-limit responses by mailbox provider. A provider may accept less volume temporarily; repeated aggressive retries can worsen the problem.
Maintain consistent From names and addresses. Keep cadence predictable enough that subscribers remember the relationship. A monthly newsletter that suddenly sends five promotions in one day will generate complaints.
Fix content and technical hygiene
Use a truthful subject and recognizable sender. Include a physical address and required legal information. Balance text and images, provide alt text, avoid image-only designs, and use accessible live text. Check that every link uses a trusted domain and valid HTTPS certificate.
Tracking and redirect domains should be authenticated or branded according to provider capabilities. Shared shorteners are frequently abused. Remove broken links, malformed HTML, excessive code, hidden text, and suspicious attachments.
Create both HTML and sensible plain-text versions. Test MIME structure, encoding, From, Reply-To, Message-ID, Date, List-Unsubscribe, and List-Unsubscribe-Post headers where applicable. Send seed messages to major clients and inspect raw authentication results.
Monitor the right signals
Track accepted, deferred, bounced, blocked, complained, and unsubscribed messages by provider and stream. Separate hard and soft failures. Monitor time to delivery for transactional mail. Compare clicks with landing-page sessions to identify scanners.
Google Postmaster Tools and provider-specific dashboards can reveal reputation, spam rate, authentication, and delivery issues when enough data exists. Microsoft SNDS and JMRP apply to relevant infrastructure. DMARC aggregate reports expose unauthorized or misconfigured senders.
Keep complaint rates well below published provider thresholds; treat any material rise as an incident. Conversion per delivered recipient and unsubscribe trends are better program measures than open rate.
Incident response
When performance drops, pause unnecessary campaigns. Segment by receiving domain, sending stream, IP, template, and time. Inspect SMTP codes, authentication, DNS changes, list source, recent volume, complaints, and content links.
Do not switch domains to evade a damaged reputation. Fix the cause. Contact the sending provider with evidence, use official remediation channels, and resume gradually with engaged recipients after the issue is resolved.
Document the incident timeline, affected mail, root cause, remediation, and prevention. Test password-reset and receipt delivery separately from marketing.
A 30-day implementation plan
Week one: inventory every sender and domain; validate SPF, DKIM, DMARC, TLS, return paths, and tracking domains. Week two: reconcile consent, suppressions, bounces, complaints, and inactive segments. Week three: separate streams, standardize templates, test unsubscribe and seed inboxes. Week four: build provider dashboards, alerts, and an incident runbook.
Assign owners for DNS, ESP configuration, CRM consent, campaign operations, and incident response. Review authentication and vendor inventory quarterly and before any platform migration.
Verdict
The durable deliverability formula is authenticated identity, wanted mail, clean data, predictable volume, honest content, and fast suppression. SPF, DKIM, and DMARC are mandatory foundations, but reputation is earned through recipient behavior.
Begin with a sender inventory and DMARC reporting, then remove unengaged and nonconsensual addresses before increasing volume. Measure complaints, bounces, delays, and conversions by provider. If a program depends on tricks to reach the inbox, redesign the program.