Published 
Updated
You write a strong email, hit send and then hear silence. Deliverability decides whether that message gets a chance at all.
Deliverability is the chance that your message lands in the recipient's main inbox. Everything that comes after, from subject line to offer to button, only counts once that spot is secured.
You as a business owner focus on the copy and leave the technology behind it alone. That is understandable, because you see the copy while the technology stays invisible. Yet it is precisely that invisible layer that decides whether Gmail, Outlook and Apple Mail trust your message.
The good news is that deliverability largely comes down to rules you set up correctly once. Three DNS records, a correct unsubscribe link and a healthy list take you further than any subject line. Once that foundation is in place, you build on reputation. And reputation is the only thing that counts in the long run.
This page walks through the whole chain. First the three authentication standards, then the requirements the big mailbox providers have set since 2024, next the reputation metrics they steer by and finally a check you can carry out yourself today.
Your sending software almost always reports success. That figure only says that the receiving server accepted the message. It says little about where the message ended up afterwards.
Between acceptance and the main inbox sit three decisions. The receiving server first checks whether you are authorised to send on behalf of your domain. Next it weighs the reputation of your domain and sending IP. Only then does it judge the content of the message itself.
That order explains why content tricks achieve so little as soon as the first two steps wobble. A perfectly written email from an unverified domain rarely reaches the main inbox. Conversely, an ordinary newsletter from a trusted domain almost always does.
There is also a hard variant, by the way. When your mail breaks the requirements of Google or Microsoft, a permanent rejection follows at SMTP level. In that case Microsoft responds with error code 550 5.7.515 and delivers the message nowhere, so the spam folder is out too. The recipient then sees literally nothing.
SPF is a rule in your DNS that lists which servers may send mail with your domain as the sender. The recipient reads that list and compares it with the server that presents itself.
You recognise an SPF record by its structure. It starts with a version tag, then lists the permitted senders and closes with an instruction for everything outside that list. You set that closing part to a strict variant as soon as you are sure every legitimate sender is on the list.
The classic pitfall is forgotten senders. Your newsletter software is in it, while your accounting package, your webshop and your contact form also send mail. Each of those systems belongs in the record. Otherwise it is precisely your invoices and order confirmations that fall through the cracks.
A second pitfall is the number of lookups. SPF allows ten DNS lookups and many services quietly add a few. Go over that number and the check fails entirely. An SPF checker counts this for you.
DKIM puts a digital signature on every message you send. The recipient retrieves the matching public key from your DNS and uses it to check whether the message stayed the same in transit.
Where SPF only assesses the sending server, DKIM protects the content. That difference matters as soon as mail is forwarded, because forwarding changes the server while the signature stays intact. For mailing lists and forwarding rules, DKIM is therefore the stronger of the two.
Your mail provider usually supplies ready-made records. You add them to DNS, wait for propagation and then check whether the signing succeeds. A test message to a checking service shows within a minute whether everything is right.
Watch the key length. A 1024-bit key still works, while 2048 bits is now the standard. Rotate the key periodically as well, especially when you switch mail providers.
DMARC ties SPF and DKIM together and adds two things. It sets out what the recipient does with mail that fails the check. It also sends you reports on everything that goes out on behalf of your domain.
You always start in monitoring mode. That produces weeks of reports while all mail simply keeps flowing. In those reports you see which systems send on your behalf, including the ones you had forgotten yourself.
Once that picture is complete, you tighten the setting. First you send failing mail to the spam folder, later you move to full rejection. That final setting protects your brand against spoofed mail and that is exactly what the big providers like to see.
Many domains stay stuck in monitoring mode for years. That delivers the reports and postpones the protection. So from day one, put a date in your diary for the next step.
The reports come in two flavours. The aggregate version arrives daily and lists, per sending source, how many messages came through and how many of them passed. The forensic version describes individual messages that failed. You use it when tracking down a specific problem.
The aggregate version arrives as XML in an archive file, which makes reading it by hand heavy going. The forensic version comes in as individual messages in its own report format. A processing service turns them into an overview that shows the status per sending source. Free versions exist for small domains.
Take the time to review those first weeks properly. Almost every domain turns out to send mail from systems nobody had on their radar any more, from an old webshop to a form service to an accounting package.
DMARC asks for more than a passed SPF or DKIM check. It requires the domain in that check to match the domain the recipient sees in the From line. That match is called alignment.
This is where the misunderstanding lies. Your sending software passes SPF neatly, but it does so on its own domain rather than on your visible sender. For DMARC only the latter counts. Only one of the two standards needs to be aligned, as long as at least one is.
The solution is called a custom sending domain. You create a subdomain, assign it to your sending software and send from there. SPF, DKIM and the visible sender then share the same domain and the check passes completely.
Check this explicitly, because this is exactly where many senders come unstuck. A reporting tool shows per sending source whether the alignment passes.
Since 2024, Google and Yahoo have set requirements for senders of larger volumes. Google draws the line at five thousand messages a day to Gmail addresses, while Yahoo deliberately leaves out any number. Microsoft followed in May 2025 with its own rules for Outlook, Hotmail and Live.
The core consists of three points. Your mail is authenticated with SPF and DKIM and your domain has a DMARC record, which all three providers require. Your marketing mail contains an unsubscribe link that works in one click, a hard requirement at Google and Yahoo and a recommendation at Microsoft. And your spam complaints stay below the limit set by Google and Yahoo.
The threshold of five thousand belongs to Google and counts per day across traffic to Gmail addresses. At Yahoo the requirement applies regardless of your volume. You as a business owner think you are well below it and still hit that limit during a campaign week. So treat the requirements as a baseline for everyone.
Enforcement is strict these days. Google permanently rejects mail that breaks the requirements at SMTP level, so even the spam folder is out. Microsoft does the same with its own error code. Where providers used to sort quietly into the spam folder, they now reject out loud.
Marketing mail needs an unsubscribe link that works in a single action. Technically you set that up with two header lines in the message, defined in the RFC 8058 standard.
As a result, the recipient sees an unsubscribe button at the top of their mail program, separate from the link at the bottom of your message. That button sends a request straight to your system. Logging in, filling in a form or giving a reason are explicitly kept out of it.
You have two days to process such a request. That sounds generous, yet in practice it calls for an automated connection, especially when you work with multiple lists.
Transactional mail falls outside this requirement. Password resets, order confirmations and shipping notifications keep their own route. The rule targets promotional and marketing messages.
See the unsubscribe button as an ally. Someone who can unsubscribe easily files a spam complaint far less often. And those complaints weigh heavily.
Of all the figures in email, this is the one that makes or breaks your deliverability. Google applies an upper limit of 0.30% and advises staying below 0.10%.
Those percentages look small and they are. With a thousand delivered messages, 0.30% already means three complaints. So three people pressing the spam button are enough to cross the limit.
Recovery takes time as well. After you have removed the cause, your domain stays outside Google's support until the rate has stayed below the limit for seven days in a row. One bad campaign can therefore echo on for almost two weeks.
Complaints almost always come from the same sources. Recipients do not recognise the sender well enough, the frequency surprises them, the content is a poor fit or the unsubscribe link is hidden. You solve each of those four with clarity up front.
Measure this figure actively. Google Postmaster Tools shows your spam complaint rate per day for Gmail traffic and Microsoft offers a comparable programme. Both are free and both require a one-time verification of your domain.
A real-world example from our own setup. Our DNS runs on Cloudflare and our mail goes through Hostinger, a combination many business owners use that comes with one specific pitfall.
The three DKIM records were neatly in place in DNS and the signing still failed. The cause lay in a setting that looks helpful at first glance. Cloudflare puts new records behind its own network by default, which works perfectly for websites but throws a spanner in the works for DKIM. A recipient requesting the key then gets Cloudflare's address back instead of the key itself.
The fix took three clicks. We switched the three key records from proxied to DNS only, waited for propagation and sent a test message to a checking service. There, MX, SPF, DKIM and DMARC all turned green and the DKIM check passed.
The lesson behind it is broader than this one button. Every record a recipient must be able to read belongs directly in DNS. That applies to DKIM keys, to SPF and to your DMARC rule. If you keep DNS and mail with different providers, check this first as soon as the signing falters.
A fresh domain has zero reputation. Send thousands of messages from it straight away and that reads like spammer behaviour. The filters respond accordingly.
Warming up works with a rising schedule. You start with a few dozen messages a day to your most engaged recipients, a group that opens and clicks above average. Those early signals build trust. Then you double the volume every few days, keeping an eye on complaints and bounces at each step.
Two to four weeks is usually enough for a normal list. With large volumes you stretch that out. If your sending software changes, the same rhythm applies again, because reputation is tied to the combination of domain and sending IP.
Order helps here. Start with transactional mail, because it is almost always opened. Only add marketing mail after that.
Reputation is tied to a domain. If you send invoices and newsletters from the same address, they share that reputation and the weakest stream drags the strongest down.
The solution is to separate by purpose. Your transactional mail gets its own subdomain, your marketing mail a second one and your personal correspondence stays on the main domain. Each subdomain then builds its own history.
The benefit becomes visible as soon as something goes wrong. A campaign with lots of complaints then only affects the marketing subdomain, while your order confirmations and password resets keep arriving as normal. That is exactly the mail you want to keep running, because your service depends on it.
Keep the names short and recognisable. A recipient reading the sender should recognise your brand in it straight away, so variants that look like random characters backfire.
Then set up each subdomain fully with its own SPF rule, its own DKIM keys and coverage from the DMARC setting on your main domain. Warm them up separately too, because each subdomain builds its reputation on its own.
A clean list is the cheapest deliverability tool there is. Addresses that bounce, addresses that stay silent for years and addresses you once bought all drag down your reputation.
Remove hard bounces immediately. An address that fails permanently keeps failing. Continuing to send to it reads as sloppiness. Most sending software does this automatically once you switch the setting on.
Also set a limit for silence. Recipients who have been quiet for six to twelve months get one win-back message, after which you archive them. That feels counterintuitive and almost always results in better delivery for the people who do listen.
Watch out for spam traps. These are addresses providers use to recognise bad lists, often old addresses that have been reactivated. They stay silent with every message, which is exactly why you clean out addresses that have been silent for a long time.
Double opt-in closes the loop. The extra confirmation step gives you a smaller list and a considerably cleaner one. That trade-off always works out well for deliverability.
BIMI shows your logo next to every message in the inbox of supporting providers. It is a visible trust signal and works as a reward for senders who have their authentication in order.
The entry requirement is strict. BIMI requires a DMARC setting at the spam folder level or stricter, so you already have the whole chain in place before you start on this. That makes BIMI above all a welcome nudge to actually tighten DMARC.
For Gmail you also need a verified mark certificate, which you request from a recognised issuer and which comes back as a cost every year. You also supply your logo in a specific SVG format.
Weigh this up calmly. BIMI is the finishing touch for brands that send a lot of mail and it comes well behind the three authentication standards in the queue.
This check takes fifteen minutes and gives you a clear picture.
If everything turns green, your attention shifts from the technology to relevance. From that point on, your offer and your timing determine the result.
More in this series on email marketing
The next step
Discover your biggest growth opportunities with a free opportunity analysis (worth β¬416) β a tailor-made report, free of charge and with no obligation.
About the author
Dominic Pietersz
Your dedicated point of contact
Dominic helps SMEs grow through Google and other channels. With his international experience, he turns challenges into concrete growth.
Follow Dominic on LinkedInInspiration Β· At the cash machine I realised that email is really just like a cash machine. That comparison became this piece on actually getting your emails opened.
