Email deliverability, accurately.

Email deliverability is decided by three things: whether the receiving mailbox can prove the message really came from you, whether the people receiving it want it, and whether your sending behaviour looks consistent over time. Proof is SPF, DKIM, and DMARC, three DNS records that authenticate the sending source and tie it to the domain in your From header. Want is permission, list hygiene, and engagement, measured by clicks, replies, and complaint rate rather than opens. Consistency is volume, cadence, and reputation built per sending domain and per IP. Since February 2024, Google and Yahoo have enforced most of this as a requirement for bulk senders rather than treating it as best practice.

The three records, and what each one actually proves

SPF

SPF is a TXT record on your domain that lists which servers are permitted to send mail on its behalf, using mechanisms such as include, a, mx, and ip4. It authenticates the envelope sender, the address the receiving server sees in the SMTP conversation, which is not the same as the From address a human reads. Two details trip people up constantly. First, SPF evaluation is capped at ten DNS-querying mechanisms, and every include from every vendor counts toward that cap, so a domain with a mail platform, a CRM, a helpdesk, and an invoicing tool can silently exceed it and produce a permanent error that behaves like a failure. Second, SPF breaks on forwarding, because the forwarding server is not in your list. Publish one SPF record per domain, never two, and flatten or audit your includes when the count creeps up.

DKIM

DKIM adds a cryptographic signature to outbound messages covering selected headers and the body, with the public key published in DNS at a selector record under _domainkey on your domain. The receiver fetches the key and verifies the signature, which proves the message was authorised by the domain in the signature and that it was not modified in transit. Use 2048-bit keys where your provider supports them, sign with a selector per sending platform so keys can be rotated independently, and rotate on a schedule. Unlike SPF, DKIM survives simple forwarding, which is why it is the more durable of the two.

DMARC and alignment

DMARC is a TXT record at _dmarc on your domain that does two jobs. It tells receivers what to do when authentication fails, through a policy of none, quarantine, or reject. And it introduces alignment, which is the part that matters most and is understood least. DMARC passes only if SPF or DKIM passes and the domain that passed matches the domain in the visible From header. Relaxed alignment allows an organisational domain match, strict alignment requires an exact one. This is why a message can show SPF pass and still fail DMARC: the email platform authenticated its own bounce domain, not yours. Only one aligned mechanism is needed, so aligned DKIM alone is enough.

The rollout order is not optional if you value your own inbox. Publish p=none with an aggregate report address, collect reports for several weeks, and use them to find every system in your company that sends mail as you. Authenticate each one. Then move to quarantine, then to reject, and set a subdomain policy deliberately rather than letting it inherit. Skipping the observation phase is how companies discover, on a Friday, that their own invoices are being rejected.

The Google and Yahoo bulk sender requirements

In October 2023 Google and Yahoo announced closely matching sender requirements, with enforcement beginning in February 2024. Google defines a bulk sender as one who sends close to five thousand messages or more to Gmail addresses in a single day, counted per sending domain. The requirements are published and specific rather than open to interpretation.

• Authenticate fully. Bulk senders must publish both SPF and DKIM, and have a DMARC record on the sending domain. A policy of p=none satisfies the minimum requirement.
• Align. For directly sent mail, the domain in the From header must align with either the SPF domain or the DKIM domain.
• One-click unsubscribe. Marketing and subscribed messages must include the List-Unsubscribe headers described in RFC 8058, supporting a single click, and the request must be honoured within two days.
• Stay under the spam threshold. Google asks senders to keep the user-reported spam rate below 0.3 percent as measured in Postmaster Tools, and states that lower is better.
• Get the basics right. Valid forward and reverse DNS records for sending IPs, TLS on transmission, a properly formatted From header, and no impersonation of Gmail in the From line.

Microsoft subsequently announced comparable authentication requirements for high volume senders to its consumer mail domains, so the direction of travel across the major mailbox providers is consistent. The practical reading is simple: authentication is no longer a deliverability optimisation, it is the entry ticket, and the differentiators have moved to permission quality and engagement.

Authentication gets you considered. Engagement gets you delivered. Nothing gets a purchased list into an inbox.

List hygiene, which is where most damage originates

Every serious deliverability problem we have been called into started with how the list was built. Purchased and scraped lists are the obvious offender, not only because recipients complain but because such lists reliably contain spam traps, addresses that exist purely to catch senders who did not collect permission. Recycled traps are old abandoned addresses reactivated by a provider, which is exactly why mailing people who have not engaged in two years is risky rather than merely unproductive.

The disciplines are unremarkable and they work. Use confirmed opt-in for any source you cannot vouch for, and for all sources if your industry is high risk. Remove hard bounces immediately and set a threshold for repeated soft bounces. Run a sunset policy: define engagement by clicks and conversions rather than opens, attempt one re-engagement sequence, then suppress. Validate any list you inherit before the first send, while remembering that validation proves an address exists, not that its owner asked to hear from you. And segment by engagement so your most active subscribers receive each campaign first, which gives the mailbox provider a positive early signal before the colder portion of the list is touched.

Engagement signals and sender reputation

Mailbox providers do not publish their filtering models, so anything stated as a complete list of signals is inference. What they do publish, and what deliverability practitioners consistently observe, points the same way: recipient behaviour dominates. Marking as spam is the most damaging action available to a recipient. Deleting without reading, and never interacting again, are quieter negatives. Replying, clicking, forwarding, moving a message out of the spam folder, and adding the sender to contacts are the strong positives.

Opens deserve a specific warning. Since Apple introduced Mail Privacy Protection, image pixels are pre-fetched for users who enable it, which inflates open counts and makes open-based automation unreliable for a substantial share of most lists. If your sunset rules, re-engagement triggers, or send-time optimisation run on opens, they are running on noise. Rebuild them on clicks and conversions.

Reputation itself accrues to the sending domain and the sending IP, which is why volume consistency matters. A new domain or a new dedicated IP needs warming, meaning volume ramped gradually to the most engaged segment first over a period of weeks. A dedicated IP is only an advantage above a consistent volume threshold; below it, a well-managed shared pool is usually better, because an IP that sends sporadically never establishes a reputation at all. Instrument the feedback channels the providers give you: Google Postmaster Tools, Yahoo complaint feedback, and the Microsoft sender programmes. Those are the closest thing to a live deliverability dashboard that exists.

The deliverability checklist, in order

1. 01 Inventory every system that sends mail as your domain, including the ones marketing does not own.
2. 02 Publish a single SPF record and audit it against the ten lookup limit.
3. 03 Enable DKIM signing on every sending platform, with a distinct selector per platform and 2048-bit keys.
4. 04 Publish DMARC at p=none with an aggregate report address, and route the reports somewhere a human reads.
5. 05 Fix alignment: set a custom return path on your own domain, or confirm the DKIM signing domain matches your From domain.
6. 06 Split streams by subdomain, so marketing volume cannot damage transactional delivery.
7. 07 Turn on RFC 8058 one-click unsubscribe headers and confirm your platform honours them within two days.
8. 08 Connect Google Postmaster Tools and the equivalent feedback programmes, and set a weekly review of spam rate.
9. 09 Clean the list: hard bounces out, stale non-clickers into a re-engagement flow, then suppressed.
10. 10 Rebuild any automation that triggers on opens so it triggers on clicks or conversions instead.
11. 11 Send in engagement order, most active segment first, on a consistent cadence.
12. 12 Once reports are clean for several weeks, step DMARC to quarantine, then to reject.

Two things this article deliberately does not do. It does not quote an industry benchmark inbox placement rate, because those figures vary enormously by sector, list source, and provider mix, and a national average tells you nothing about your domain. And it does not promise a percentage improvement, because deliverability is a reputation system with memory: the recovery curve depends on how the list was built and how long the damage ran. What can be committed to is the configuration, the hygiene, and the monitoring, which is how our email and SMS program starts on every account, and the revenue reporting for it lives in the same analytics stack as everything else.