Email deliverability basics: getting into the inbox, not just out the door.

Delivered is not the same word as inbox.

Almost every sending platform reports a delivery rate above ninety-five per cent, and almost every small sender reads that number as good news. It is not the number you think it is.

Delivered means the receiving server accepted the message rather than rejecting it at the door. It says nothing about what happened next. The same message can be delivered and filed into a spam folder nobody opens, or a promotions tab somebody checks on Sundays, or the inbox. Senders cannot see placement directly — no honest tool can tell you your inbox rate, because that information is not exposed to the people sending the mail.

What you can do is understand the questions a receiving mailbox provider is asking, because every technique in this guide is an answer to one of them. There are three, and they run in order.

The order this guide runs in

Authentication first, because it is a one-time cost with a permanent effect. Then the sending domain, because the decision is hard to reverse later. Then warmup, hygiene, engagement and complaints, which are the four habits that build the reputation the first two gates let you have. The last two sections are for the week something breaks: a triage order, and the four numbers that would have warned you.

Three DNS records, published in an order that cannot break anything.

Authentication has a reputation for being an IT project. It is three records, an afternoon, and one two-minute test — as long as you publish them in the right order and resist the urge to skip to the strict setting.

Each record answers a different question. SPF says which servers may hand mail to the internet on your behalf. DKIM attaches a signature that proves the domain owner vouches for the message and that it arrived unaltered. DMARC ties the two together, tells receivers what to do when both fail, and sends you reports about it.

Alignment is the part people miss

A message can pass SPF and still fail DMARC. That sentence is responsible for most of the confusion in this subject, and the reason is simple once stated: DMARC does not care that something passed, it cares that the thing that passed matches the domain your reader sees in the From line. Mail sent through a platform can easily pass SPF for the platform’s own domain while your domain sits unauthenticated in the visible header. That is a fail.

In practice, alignment is what you get when you complete your provider’s domain authentication setup properly rather than partially. If their instructions offer a quick path and a full path, the full path is the one that produces alignment. Verify it rather than assume it.

Publish in this order, and only tighten later

1. 01SPF, as one record, with everything in it. A domain may have exactly one SPF record. Every service that sends as you — sending platform, invoicing tool, help desk, calendar, form processor — belongs inside that single record. Two SPF records is a failure, not a merge. Watch the DNS lookup ceiling as you add services: exceeding it turns the whole record into a permanent error.
2. 02DKIM, from your provider’s exact instructions. Your platform generates the key pair and gives you records to publish at a named selector. Publish them exactly as issued, including any trailing characters your DNS panel wants to helpfully strip. If you later change platforms, the old selector should be retired rather than left to rot.
3. 03DMARC at p=none, with a reporting address. This changes nothing about how your mail is treated. What it does is turn on the reports, which are the first complete list you will ever see of the systems sending as your domain. Nearly everyone finds at least one they had forgotten.
4. 04Read the reports for a few weeks. You are looking for one thing: every legitimate stream passing with alignment. Fix the ones that are not — usually a tool missing from SPF, or one that needs its own DKIM signing set up. Reports are dense XML; any of the free parsers will render them into something readable.
5. 05Then move to quarantine, then to reject. Only once the reports are clean, and with a gap between the two steps so problems surface while the consequence is still a spam folder rather than a rejection. Publishing p=reject on day one is the single most common way a small business silently stops its own invoices from being delivered.

v=DMARC1; p=none; rua=mailto:[dmarc@yourdomain.com]; fo=1

The verification that takes two minutes

Send a real campaign — not a preview — to an account you own at each of the two or three largest providers on your list. Open the message, view the original or the full headers, and read the authentication results line. You are looking for a pass on SPF, a pass on DKIM, and a pass on DMARC. If DMARC fails while the others pass, you have an alignment problem and the domain in your From line is the place to look. Do this after every change to your DNS or your sending platform; it is the whole test.

Separate the mail that sells from the mail that has to arrive.

Two reputations decide your fate: the one attached to the domain in your From address, and the one attached to the IP that hands the message over. On shared infrastructure the IP is not yours. The domain always is — which makes it the part worth structuring deliberately.

Every business sends at least two kinds of mail. There is the mail that has to arrive: receipts, invoices, password resets, course access, calendar confirmations, and the replies you write to individual people. And there is the mail that sells: broadcasts, newsletters, launches, invitations. The second kind is where complaints come from. The first kind is where the damage lands if you let them share a reputation.

A subdomain, not a different domain

The standard arrangement is to send marketing from a subdomain of the domain you already own — mail.yourdomain.com, news.yourdomain.com, go.yourdomain.com — while everything transactional and personal keeps leaving from the main domain. Receivers treat subdomain reputation as related to but distinct from the parent, so a bad month in the marketing stream does not take your invoices down with it. The separation is real without being absolute, which is the correct amount of separation for a small business.

What not to do is register a fresh, unrelated domain for marketing. It inherits nothing, starts from no history, and no history is not a neutral position — an unknown domain sending bulk mail looks exactly like the throwaway domains that exist for that purpose. A subdomain of a domain with years of ordinary business mail behind it starts from a much better place.

Three From-line rules worth keeping

• →Never send bulk mail from a free-mailbox address. The large consumer mail domains publish strict policies for their own domains, which means a campaign sent through any platform with that address in the From line fails authentication on arrival. Use a domain you control. This is not a preference; it is a mechanical failure.
• →Send from a monitored mailbox, not a no-reply. Replies are one of the strongest positive engagement signals available, and a no-reply address throws them away by design. It also tells the reader that the relationship runs one way, which is the opposite of what a marketing email is trying to establish.
• →Keep the From name recognisable and stable. People report as spam what they do not recognise. The From name should be the thing they signed up to hear from — your name, your business name, or the two together — and it should not change between sends because a campaign felt like it needed a fresh angle.

The dedicated IP question

A dedicated IP sounds like an upgrade and is often a downgrade. Reputation on an IP is built from consistent traffic; an address carrying occasional sends never accumulates enough history to be judged generously, and a single unusual campaign moves it a long way because there is nothing to average against. Shared infrastructure with a well-managed sender pool is normally better until your volume is both large and regular — at which point a dedicated IP starts to give you isolation from other people’s mistakes rather than exposure to your own.

The honest framing: the dedicated sending domain is the change that helps almost every small sender. The dedicated IP is the change that helps a specific kind of large, predictable sender, and hurts everyone else. If you are unsure which you are, you are the second one.

A new domain has no reputation, and no reputation is not neutral.

The instinct with a new sending domain is to move the whole list across on a Tuesday and carry on. That single send is the most dangerous thing you will do to it, because a domain with no history sending thousands of messages at once is indistinguishable from the thing receivers are built to stop.

Warmup is not a technical procedure. It is the deliberate accumulation of evidence that mail from this domain is wanted — and the only evidence that counts is recipients opening, clicking, replying and not complaining. Which means the way to warm a domain is to start with the people most likely to do those things, and widen only while they keep happening.

An illustrative ramp

The table below is illustrative arithmetic rather than a standard — the shape matters far more than the specific numbers, and the right volumes depend entirely on your list size. Read it as a rule with a schedule attached: start with the warmest people, roughly double at each step, and only double if the previous step held.

The condition attached to every step is the part that does the work: if bounces rose, complaints appeared, or clicks fell compared with the previous step, do not double. Hold at the same volume and audience until it stabilises, or step back one level. A ramp that pauses for a week costs you a week. A ramp that ignores its own signals costs you the domain.

Four rules that matter more than the numbers

• →Send on a schedule, not in bursts. Consistency is itself a signal. A domain that sends something every few days looks like a business; a domain that is silent for three weeks and then emits twenty thousand messages looks like a compromised account, which is a category with very unforgiving handling.
• →Warm with your best content, not your hardest ask. The welcome sequence and the genuinely useful weekly note are the right material for a ramp. A launch sequence is the wrong material, because the ask lowers engagement precisely when you need engagement to be unusually high.
• →Never introduce an unverified import into a warming domain. A list you bought, rented, scraped or collected from a badge scanner at a conference will contain dead addresses and possibly traps. Introducing that during a ramp is the fastest route to a domain that has to be abandoned. There is no volume at which this becomes acceptable.
• →Keep the old domain running during the move. If you are migrating platforms, do not switch everything on the same day. Move the marketing stream gradually onto the new sending domain while transactional mail continues from the established one, and let the new domain earn its position before it carries anything that matters.

The sunset rule: decide who stops receiving mail, in writing, in advance.

Every list ages. Addresses are abandoned, people change jobs, interest fades. Without a written rule for retiring contacts, the default policy is “keep mailing everyone forever”, and that policy has a cost that arrives all at once.

Start with the mechanical part. A hard bounce means the address does not exist; it should be removed from sending permanently after a single failure, and every serious platform does this automatically. Verify that yours does, because continuing to send to addresses that do not exist is one of the clearest signals of a sender who is not paying attention. Soft bounces — full mailboxes, temporary rejections — are worth a few retries and then the same treatment.

Why abandoned addresses are worse than useless

Mailbox providers reclaim long-abandoned addresses and, in some cases, reactivate them as traps: addresses that exist only to identify senders mailing people who stopped reading years ago. There is nothing you can do to detect one, which is exactly the point. The only defence is not to be a sender who keeps mailing addresses that have shown no sign of life. A second kind of trap has never belonged to a person at all — those are seeded to catch scraped and purchased lists, which is one of several reasons never to touch one.

Writing the rule

A sunset rule has three parts: a window, a last attempt, and an outcome. The window should match your cadence — a weekly sender can reasonably treat ninety days of silence as dormant, while a monthly sender needs something closer to six months for the same number of ignored messages. Count opens and clicks together, and lean on clicks, since opens are the less reliable of the two.

1. 01Define dormant against your own cadence. No opens or clicks across the last N sends, where N is enough messages that the silence means something. Write it as a number of sends rather than a number of days if your cadence is irregular — the point is the count of ignored chances, not the calendar.
2. 02Give them one real attempt to come back. A short re-engagement sequence, sent while they are still reachable, that offers something worth returning for and makes leaving easy. The re-engagement campaign guide covers what to send and how to read the result.
3. 03Suppress the non-responders from routine sending. Not deleted. Suppressed: no longer part of broadcasts and sequences, still present as a customer record with their history intact. The distinction matters commercially as well as sentimentally — a past buyer who stopped opening marketing email is still a past buyer.
4. 04Run it on a schedule, not when you remember. Monthly or quarterly, as a standing task. Hygiene done reactively is hygiene done after the damage. The rule is worth more than any individual decision it makes, because it removes the temptation to keep a big number looking big.

Quality at the point of entry

Hygiene is cheaper at the front door than anywhere else. Use a form that rejects obvious typos, send the first email immediately so a bad address bounces while you can still see why, and record where every contact came from. If a particular source produces addresses that never engage, source data is what lets you find that out — and a welcome sequence that arrives while people still remember subscribing is the single highest-engagement mail you will ever send, which makes it warmup material as well as marketing.

Confirmed opt-in — where a subscriber has to click a link in a first email before joining the list — is the strongest version of this. It costs you some subscribers who never confirm, and buys a list where every address is real and every person acted twice. Whether that trade is worth it depends on where your contacts come from; if any part of your acquisition is untrusted, it is.

Engagement is the currency. Everything else is the bank.

Authentication proves you are who you say. The sending domain gives you somewhere to build a history. What that history is made of is recipient behaviour — and the receiving side reads it as a ratio, which changes what you should do about it.

Positive signals are the obvious ones and a few less obvious: opening, clicking, replying, moving a message out of spam, adding you to contacts, keeping messages rather than deleting them unread. Negative signals are deleting without opening, reporting as spam, and long stretches of total non-response. The important part is that these are weighed as proportions of what you send. Adding recipients who will never open does not add neutral volume — it dilutes the ratio for everybody, including the people who were reading you happily.

That single mechanism is why segmenting is a deliverability action and not only a marketing one. Sending your best campaign to everyone, every time, actively lowers the chance that the people who wanted it will see it. Sending to people likely to engage protects placement for the whole list. The segmentation guide for a small list covers how to do this with a few thousand contacts and no data team.

A word about open rates

Opens are the metric everybody watches and the one to trust least. Mail privacy features at the major consumer providers pre-fetch images on the recipient’s behalf, which registers as an open whether or not a human ever looked at the message. The effect is not uniform across providers or devices, so your headline open rate is an average of a distorted number and a real one.

Use them for trend, within a consistent segment, and never as the sole basis for a decision. Clicks are harder to fake and harder to inflate. Replies are better still. And the number that tells you the most about list health is the share of your list that has done anything at all in ninety days, which is a ratio and therefore immune to the flattery of a growing contact count.

Practical ways to earn the signal

• →Ask a question in the first email and read the answers. A reply is a strong positive signal and it teaches the receiving provider that this correspondence is two-way. It also gives you the words your audience uses, which is worth more than the deliverability benefit.
• →Tell new subscribers what to expect and then do that. What produces complaints is surprise. A first email that names the cadence and the subject matter converts a future complaint into either an early unsubscribe or an informed reader, and both of those are wins.
• →Send something worth opening on a predictable rhythm. Predictability is a deliverability feature as much as a marketing one — for the reader and for the receiving system. The cadence guide and the newsletter system are about how to keep that rhythm without burning out.
• →Make the first thirty days count. Engagement is highest immediately after someone subscribes and declines from there. A welcome sequence that arrives promptly captures that window; a list that hears nothing for six weeks after signing up has already spent it.
• →Segment the ask, not just the content. People who have bought, people who have never bought, and people who have gone quiet have different tolerance for being sold to. Sending the same pitch to all three lowers engagement in two of them for no additional revenue in the first.

An unsubscribe is a cost. A complaint is a debt.

When somebody presses the report-spam button, the receiving provider records it against your sending domain and, where relevant, the IP. It is the most direct negative signal available, and it is measured in fractions of a per cent — which has an awkward consequence for small senders.

Complaint rate is a proportion of messages delivered to that provider. The published bulk-sender guidance from the largest providers asks senders to stay well under a third of a per cent and to treat a tenth of a per cent as the level to aim for. On a send of a few thousand, that arithmetic is unforgiving: a handful of complaints is enough to breach a threshold. The response is not to send less honestly — it is to send to people who remember agreeing to hear from you.

Why people report mail they once wanted

• →They do not recognise you. Six months between the signup and the first email is enough for anyone to forget. The fixes are a prompt welcome, a stable From name, and a line in the footer saying where and roughly when they subscribed.
• →The volume surprised them. Somebody who expected a monthly note and received four emails in a week reports the fourth one. Set the expectation in the first message, and when a campaign week raises the volume, make it visibly finite.
• →The unsubscribe link was hard to find or hard to use. This is the one that converts a harmless exit into a damaging one. A link that requires a login, a preferences page that fails on a phone, or an unsubscribe that asks for a reason before it works are all ways of persuading somebody to press the spam button instead.
• →The mail was irrelevant to them specifically. A pitch for a beginner course to somebody who finished the advanced one reads as carelessness. Complaints from that cause are a segmentation problem wearing a deliverability costume.

Make leaving easy, deliberately

The unsubscribe link is deliverability infrastructure. It should be visible rather than hidden in six-point grey, it should work in one click without a login, and the list-unsubscribe header should be switched on at your platform so mail clients can offer their own unsubscribe control next to the spam button. Where the client offers both, people take the gentler option — but only if it is there.

Honour both unsubscribes and complaints quickly; the published guidance asks for within two days, and there is no good reason to take longer. A preference centre offering “fewer emails” or “only product news” alongside “unsubscribe from everything” is worth building, with one condition: only offer options you will actually honour, and never make the full unsubscribe harder to find than the alternatives.

Finally, enrol where the providers let you. The large mailbox operators publish sender tooling that reports complaint rates and reputation for domains you can prove you own, and some support feedback loops that tell you when a message was reported. It costs a DNS record and it is the only view you get of the number that matters most.

The opens fell off a cliff. Work it in this order.

The instinct is to change six things at once — new subject lines, fewer images, a different send time, maybe a different platform. That guarantees you will not learn which one mattered. The order below moves from cheapest and most likely to most expensive and least likely.

1. 01Confirm it is real before you act on it. Compare like with like: the same segment, the same kind of message, a similar day and time. One send to a different audience is not a deliverability event, and a broad average across mixed sends can move for reasons that have nothing to do with placement. Opens in particular are a noisy metric now that mail privacy features pre-fetch images on the recipient’s behalf — a change at a provider can move your open rate without a single message landing anywhere new.
2. 02Split the last few sends by recipient domain. This is the single most useful thing you can do and almost nobody does it first. Deliverability problems are rarely uniform. Group opens, clicks and bounces by the mailbox provider on the right-hand side of the address. If one provider fell and the rest held, you have a reputation problem at that provider. If everything fell at once, look for something you changed — a record, a domain, a template, a volume spike.
3. 03Verify that authentication still passes. Send to an account you own at a major provider, open the message headers, and read the authentication results for a pass on all three plus alignment. Records rot: somebody added a new tool to the SPF record and pushed it over the lookup limit, a DNS migration dropped a line, the provider rotated a DKIM key, or a registrar helpfully reformatted a value. This check takes two minutes and rules out the cause that is cheapest to fix.
4. 04Read what the providers will tell you directly. The large mailbox providers publish sender tooling — reputation and complaint reporting for their own traffic — and enrolling your domain costs nothing but a DNS record. Read the bounce messages too: an SMTP rejection usually names the reason and links to the provider’s policy page, which is more specific than anything you can infer from a dashboard.
5. 05List what changed on your side in the last month. New sending domain, new provider, a large import, a dormant segment reactivated, a sudden volume spike, a template rebuilt around one big image, a link shortener added, a new offer that reads more aggressively than usual. Deliverability changes are almost always downstream of a decision somebody made and did not connect to the outcome. Write the list before you theorise.
6. 06Then look at the list, not the emails. Rising bounces, rising complaints, falling clicks among people who used to click: that pattern is an ageing list, and it usually starts weeks before placement moves. Check what share of the list has engaged at all in the last 90 days. If most of it has not, the problem is who you are sending to, and no subject-line change will address it.
7. 07Cut back to the engaged core and rebuild slowly. Send only to people who engaged recently, keep the cadence steady, make the mail worth opening, and stay there for a few weeks before widening again. Reputation falls faster than it recovers, and the recovery is built out of the same evidence the damage was: a run of messages that people wanted. Widen in steps, watching each provider separately, exactly as though you were warming a new domain — because in practice you are.

Most deliverability emergencies resolve at step two or three: one provider is unhappy, or a record broke during a change nobody connected to email. The cases that reach step six are usually not emergencies at all — they are a list that has been ageing for a year and finally crossed a line.

Four numbers, once a month, in ten minutes.

Deliverability is not a project you finish; it is a small amount of attention paid regularly. These four are enough to catch almost everything early, and none of them requires a specialist tool.

Add one habit to the four numbers: keep accounts at the two or three largest providers on your list, include them in every significant send, and look. It is the closest thing to a placement check that exists, it takes seconds, and it has caught more problems for more senders than any dashboard.

Finally, keep a short written record of changes: the day you added a tool to SPF, the day you moved sending domains, the day the import ran, the day the cadence changed. When something moves three weeks later, that log turns an afternoon of theorising into a one-minute answer.