Email Deliverability: What to Fix First

Your email can be well written, well timed and sent to people who asked for it, and still never be read. It lands in the spam folder, or it never lands at all, and the first sign is a campaign that went out to a few thousand people and drew a handful of clicks.

Email deliverability is the share of your messages that reach the inbox. Three things decide it before a reader sees a word: whether the receiving server can confirm that you are who you say you are, whether recipients press report spam, and whether the addresses on your list still want what you send.

Since February 2024, Gmail and Yahoo have treated those three things as rules for anyone sending bulk mail. Microsoft followed for its consumer domains in May 2025. What used to be a best practice is now the entry fee. A sender who skips it usually finds out from the bounce log, not the inbox.

So the order matters. Authentication comes first, because nothing else counts while the receiving server cannot verify the sender. Complaints come second, because they decide whether the good work keeps its place. Warm-up and list cleaning come after, and they are how a new or neglected sender earns trust back.

The steps below run in that order, with the numbers attached.

Email deliverability starts with three DNS records

Authentication is three records in your domain's DNS, and each one answers a separate question for the receiving server. SPF lists the servers allowed to send for your domain. DKIM attaches a signature that proves the message was not altered in transit. DMARC tells the receiver what to do when either check fails, and it sends you reports about every source using your domain.

Google's sender guidelines ask every sender to use SPF or DKIM, and bulk senders to use all three. Yahoo's Sender Hub asks for SPF or DKIM at a minimum and strongly urges a DMARC policy on every domain that sends mail. Microsoft's high-volume sender rules require all three for senders of 5,000 or more messages a day to its consumer addresses, in force from May 5, 2025.

The three providers agree on the core. The table is the minimum to check before you send to any of them.

Set these up in this order. Each step ends with a check you can run in a few minutes.

1. List every tool that sends mail as your domain. That means the newsletter platform, the sender for receipts and password resets, the CRM, the help desk, and any form that emails a confirmation. Most authentication failures come from the tool nobody remembered, so write the list down before you touch DNS.
2. Publish one SPF record for the domain. It is a single TXT record that begins with v=spf1 and carries one include for each sending tool and nothing else. Check that the record ends in ~all or -all, and that exactly one SPF record exists on the domain. Two records make the check fail.
3. Turn on DKIM in each tool. Each one gives you a selector and a key, usually as a CNAME or TXT record. Add them exactly as the tool specifies. Check: send a test to a Gmail address, open the message, choose Show original, and confirm the headers say dkim=pass.
4. Publish a DMARC record at _dmarc followed by your domain, starting at p=none with a reporting address. A working first record looks like v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Check: the record resolves in any DNS lookup tool.
5. Read the aggregate reports for two weeks. They list every source that sent mail as your domain and whether it passed. A legitimate tool that fails is a tool whose SPF or DKIM you have not finished.
6. Move to p=quarantine, then p=reject, once every legitimate source passes. Keep the reporting address in place. Check: for seven days running, the reports show no legitimate source failing.

The usual failure is a domain with two SPF records, one from the website host and one from the mail tool, so both fail without anyone noticing. The other is DKIM switched on in the newsletter tool while the receipt sender still signs with nothing. Both show up in the DMARC reports, which is why step five exists.

If the list is the bigger problem, email marketing for small business covers the sending side in more depth.

Complaints are the number that decides the campaign

Authentication gets the message through the door. The complaint rate decides whether it stays in the room.

Gmail asks bulk senders to keep the spam rate reported in Postmaster Tools below 0.3%. Yahoo sets the same line for bulk senders. The rate is the share of delivered messages a recipient marked as spam, measured per day, so one large send can move it.

Here is the arithmetic. Say you send 1,500 newsletters to Gmail addresses and four people press report spam. The rate is 0.27%, under the line.

Send the same newsletter to 1,500 people and get five complaints, and it is 0.33%, over. One reader moved it.

Spread the same five complaints across a 15,000-person send and the rate falls to 0.03%. Small lists feel the threshold hardest, because the number of readers is the whole denominator.

1. Verify your domain in Google Postmaster Tools and check the spam rate chart every Monday. Google only shows data for domains with enough Gmail volume, so a small list may see a blank chart for weeks. Check: a blank chart is not a passing grade. Use the complaint feedback your sending tool gives you until the chart fills in.
2. If you send to Yahoo, sign your mail with DKIM and enrol in Yahoo's Complaint Feedback Loop. Once it is on, Yahoo can send you a copy of each complaint when a reader clicks report spam. Check: the complaint copies arrive in the same place as your other sending data, so you can match each one to a send date.
3. When the rate climbs, find the segment before you change the copy. Sort the send by when each address joined and where it came from. Most spikes trace back to one old import, one form that added people without asking, or one re-engagement email sent to readers who had already stopped reading.

Watch the trend, not one day's figure. A rate that rises across three sends in a row is a list problem, even when no single send crossed the line.

Warm up a new domain or a dormant list before you send volume

Providers judge a sender on its history. A domain with no sending record, or one that has been silent for a year, looks to a filter like a spam run that just started. Send 5,000 messages on the first morning and the filter has nothing to compare them with except the volume.

Overloop's 2026 deliverability guide tells senders to ramp volume gradually, and OneAway's cold email guide puts the minimum warm-up at 14 to 21 days before full volume. Both are vendor guides, not provider rules. Treat the timeline as a starting point, and let the numbers below decide when you move on.

1. Days 1 to 3: send 50 messages a day to the people who opened or clicked something in the last 30 days. Those figures are a starting point this post suggests, not a rule from any provider.
2. Days 4 to 7: move to 150 a day, same segment.
3. Week two: roughly double every three days, and add the next most engaged segment each time you double.
4. Week three onward: send to the full list only after seven days in a row with complaints under 0.3% and hard bounces under 2%.

Each morning, compare the complaint rate with the day before. If it rises two days running, hold the volume where it is for three days before you raise it again.

A dormant list is a new domain in disguise. The people who have not opened in a year are the most likely to report you, because they no longer remember why they signed up. If your list holds 8,000 addresses and 2,000 have been silent for twelve months, the first send goes to the 6,000 who still read. The 2,000 get a separate re-permission email. Do not send them the newsletter as if nothing happened.

For a list that is new or small, how to start a newsletter that lasts covers the first few sends, and the same order applies. The email marketing guides cover what comes after deliverability is sorted.

List hygiene is the cheapest fix you have

Most senders spend their effort on the copy and none on the list. The list is where the complaints come from. Cleaning it costs an afternoon and no money.

1. Suppress hard bounces the same day. An address that returns a permanent failure should never receive another send. Overloop's guide sets a working target of hard bounces under 2% of sends. That is a vendor's target, not a provider rule, but a list that bounces at 2% is telling you its sources are stale.
2. Sort the list by last open or click. Put anyone with no engagement in 90 days into a separate segment. Ninety days is the window this post suggests for a first cut. Pick the window that fits how often you send, and say in the email what the window is.
3. Send the quiet segment one re-permission email: a single line asking whether they still want the mail, with a one-click link. Check: two weeks later, remove everyone who did not click.
4. Stop importing lists you did not collect yourself. A purchased list is the fastest route to a complaint rate above 0.3%, because the people on it never asked for you.
5. Make unsubscribe one click. Gmail requires a clearly visible unsubscribe link in marketing and subscribed messages, with one-click support. Check: send yourself a test, find the link in the body, click it, and confirm the address is removed without a login page.

An unsubscribe costs you a name. A report-spam click costs the domain its reputation with every provider that reads it. Make leaving easy, and the reader takes the exit you offered instead of the button that hurts you.

Take the same 8,000 addresses from the dormant example. Remove 1,200 that have not engaged in 90 days and 60 that bounced, and you send to 6,740. The 1,260 you removed were the least likely to read and the most likely to report, so the complaint count on the next send should fall even though the volume did too. Check the number against the send before you call it a win.

If the list is new, how to build an email list from zero shows how to start one that stays clean.

Read four numbers every week

Pick one morning a week and read these before you write anything new. Monday works for most teams.

• Spam complaint rate for Gmail recipients, from Postmaster Tools. The line is 0.3%.
• Hard bounce rate per send. Act above 2%.
• DMARC pass rate from the aggregate reports. Any legitimate source failing needs fixing before anything else.
• Rejections in your sending logs. A Microsoft rejection with code 550 5.7.15 means the message was refused under its bulk sender rules, not filtered to a junk folder. dmarcian's explanation covers the enforcement timeline.

If one of the four moved since last week, find the segment or the sending tool behind it before you change a subject line. The number is the diagnosis. The copy is rarely the cure.

When the copy is the problem

Writing is rarely the first cause of a deliverability problem, though it is the one people fix first. Lists of spam-trigger words are a weak lever. A filter cares more about who complains and who ignores you than about whether a subject line says free. A rewrite cannot repair a list that readers have stopped opening.

The copy problem that does hurt is the mismatch. A subject line promises one thing, and the email sells another. Readers who feel tricked press report spam, and that feeds straight into the complaint rate.

You can test for this without guessing. Split a clean segment of 1,000 engaged readers into two groups of 500. Send subject A to one group and subject B to the other, and wait 48 hours. Count complaints per send for each group, not opens. The subject that draws more complaints per send loses, whatever its open rate says, and the winner is the subject whose first line the email actually delivers.

Once a subject line wins, check whether the first line of the email keeps its promise in the first sentence. If the subject says a checklist and the email opens on a story, the complaints will show it within a day. Fix the match before you run the next test. For more on the first line, a launch email that gets opened walks through the same mismatch on a larger send.

Your first hour on this

Work through these in order. Each one takes a few minutes, and together they cover the failures that most often sit behind a weak inbox rate.

1. Open a blank document and list every tool that sends mail as your domain. Count them. A number under three is unusual for a business with a newsletter and a receipt sender, and the count tells you how many DKIM records you need to publish.
2. Look up the SPF record for the domain in any DNS lookup tool. Check: one record that begins with v=spf1. If there are two, merge them into one before you do anything else.
3. Send one test from each tool to a Gmail address and open Show original. Check: dkim=pass and spf=pass on every one. Any tool that fails goes on a fix list, with its name next to it.
4. Put the four weekly numbers in a note on your calendar for next Monday, with the Postmaster Tools link beside the complaint rate.

That hour is the cheapest work in this post, and every later number depends on it.