Deliverability is whether your email reaches the inbox rather than the spam folder or nowhere at all. It has two layers: authentication, which proves you are who you claim to be, and reputation, which determines whether recipients want what you send.
Authentication is a configuration task you complete once. Reputation is an ongoing consequence of how you behave.
The three authentication records
SPF is a DNS record listing which servers may send mail for your domain. A receiving server checks whether the sending server is on the list. The main constraint is a limit of ten DNS lookups, which large organisations exceed easily by chaining multiple services; exceeding it causes SPF to fail entirely.
DKIM adds a cryptographic signature to each message, verified against a public key in your DNS. It proves the message was authorised by the domain owner and was not altered in transit. Unlike SPF, it survives forwarding.
DMARC ties the two together. It tells receiving servers what to do when a message fails authentication — do nothing, quarantine it, or reject it — and where to send reports. It also enforces alignment, meaning the domain the recipient sees must match the authenticated domain.
All three are now effectively mandatory. The major mailbox providers require authentication for bulk senders, and unauthenticated bulk mail is increasingly rejected outright rather than filtered.
Rolling out DMARC safely
Going straight to a reject policy will block legitimate mail from services you forgot about. The standard sequence takes a few weeks and avoids that.
- Publish SPF and DKIM for every service that sends on your behalf — marketing platform, transactional provider, helpdesk, CRM, invoicing, recruitment tools. The list is always longer than expected.
- Publish DMARC with a policy of none and a reporting address. This changes nothing and starts collecting data.
- Read the reports for two to four weeks. They show every source sending as your domain, which is how you find the three systems nobody remembered.
- Fix the legitimate sources that fail.
- Move to quarantine, initially on a percentage of mail.
- Move to reject once reports are clean.
Aggregate reports are XML and unpleasant to read by hand; a reporting service is worth the modest cost.
What actually drives inbox placement
Authentication gets you considered. Placement is decided mostly by engagement.
Positive signals: opens, replies, forwards, moving a message out of spam, adding the sender to contacts. Replies are weighted heavily, which is an argument for sending from a monitored address rather than no-reply.
Negative signals: spam complaints, deletion without opening, and persistent non-engagement. Complaint rate is the one that causes abrupt damage; above roughly 0.3% and filtering tightens quickly.
Technical signals: bounce rate, hitting spam traps, sudden volume changes, and a poor sending IP or domain history.
The practical consequence is counterintuitive: sending to fewer, more engaged people improves placement for everyone on the list. Sending to your whole list regardless of engagement degrades it for all of them.
List hygiene
Four practices, in order of importance.
Confirmed opt-in where you can bear the volume loss. It roughly halves list growth and dramatically improves engagement and complaint rates.
Remove hard bounces immediately and repeated soft bounces after a few attempts. Continuing to mail invalid addresses is a strong negative signal.
Suppress non-engagers. Subscribers who have not opened in six months should be moved to a re-engagement track and then suppressed, which is the first and most valuable split in any segmentation scheme. This feels like discarding reach; it is the single most effective deliverability action available.
Never buy or scrape lists. Purchased lists contain spam traps, generate complaints, and can damage a domain’s reputation for months.
Warming a new domain or IP
A new sending domain with no history that suddenly sends 50,000 emails will be filtered. Warming means building volume gradually while engagement stays high.
A typical ramp starts with a few hundred messages a day to your most engaged subscribers, roughly doubling every few days over two to four weeks, monitoring bounces and complaints at each step and pausing if either rises.
Use a subdomain for marketing mail, separate from the domain used for transactional and employee email. That way a marketing reputation problem does not stop your invoices and password resets arriving.
Diagnosing a deliverability problem
When open rates fall suddenly, work through this order.
Check authentication first — a DNS change or an expired DKIM key explains a surprising number of incidents. Then check whether the problem is universal or provider-specific; if one mailbox provider is filtering and others are not, it is a reputation issue with that provider. Check complaint and bounce rates over the preceding weeks. Check whether you are on any public blocklist. And review what changed: a new list source, a volume increase, a new sending service, or a change in content.
Seed testing — sending to accounts you control across the major providers — tells you where mail is landing, which is information your own platform’s open rate cannot give you.
Recovering
Reputation recovers slowly and only through behaviour change.
Cut back to your most engaged segment only, suppress everyone who has not opened recently, fix whatever caused the complaints, and rebuild volume gradually as if warming. Expect several weeks.
Do not switch domains to escape the problem. The behaviour that damaged the first domain will damage the second, and starting over discards whatever positive history remains.
Content and formatting signals
Content matters less to filters than reputation does, but several patterns still attract scrutiny.
A large image with almost no text is a classic spam shape and also fails for recipients who block images. Keep a reasonable proportion of real text.
Link shorteners are heavily associated with abuse. Use your own tracking domain, authenticated to match your sending domain.
Mismatched or misleading subject lines. A subject that does not reflect the content drives complaints, which is the signal that actually causes damage.
A missing or hidden unsubscribe link. Required by law in most jurisdictions and by mailbox provider policy. A hard-to-find unsubscribe converts people who would have left quietly into people who report you as spam.
No plain-text alternative. A multipart message with a readable text version is the long-standing convention and its absence is noticed.
What to monitor continuously
Deliverability problems are much cheaper to fix early, which means watching a small set of numbers rather than reacting to a collapse.
- Delivery rate and bounce rate per campaign, with any sudden change investigated the same day.
- Complaint rate, from feedback loops where the provider offers them.
- Open rate by mailbox provider. A divergence between providers is the clearest early signal of a reputation problem with one of them.
- DMARC reports, reviewed monthly, which also reveal anyone spoofing your domain.
- Blocklist status for your sending domain and IPs.
Most of this can be assembled into one weekly view. The point is not the dashboard but noticing a change in the week it happens rather than the quarter.
Frequently asked questions
Is a dedicated IP better than a shared one?
Only above roughly 100,000 messages a month consistently. Below that, a dedicated IP has too little volume to establish a stable reputation, and a well-managed shared pool performs better.
Do open rates still measure engagement?
Imperfectly. Privacy features in some mail clients pre-fetch images, inflating opens. Clicks, replies and conversions are more reliable, though mailbox providers still use their own engagement signals internally.
What complaint rate is acceptable?
Below 0.1% is healthy. Above 0.3% causes active filtering at most providers and needs immediate attention.
Should transactional and marketing email be separated?
Yes, on separate subdomains and ideally separate sending infrastructure, so marketing reputation problems cannot interrupt password resets and receipts.
