The Complete Email
Deliverability Guide

What Is Email Deliverability?

Email deliverability is the ability of an email to reach a subscriber's inbox — not just any folder. It's distinct from:

• Delivery — whether the receiving server accepted the message (no bounce)
• Inbox placement — whether the accepted message landed in inbox vs. spam vs. promotions
• Open rate — whether the subscriber actually read it

A 98% delivery rate can still mean 30% of emails go to spam. That's why monitoring inbox placement — not just bounces — is essential.

Authentication: SPF, DKIM, DMARC

Authentication proves to receiving mail servers that you are who you say you are. Without it, your emails are treated as suspicious — regardless of your reputation or content quality.

SPF (Sender Policy Framework)

SPF is a DNS record that lists which IP addresses and services are authorized to send email for your domain. When a receiving server gets your email, it checks the sending IP against your SPF record. If it's not listed, the message fails.

Common SPF mistake: Forgetting to include new ESPs when you add them. Each addition is a DNS lookup — SPF has a 10-lookup limit before it becomes invalid.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every outgoing email. The receiving server uses your public key (published in DNS) to verify the signature — proving the message wasn't tampered with in transit. DKIM is required for DMARC alignment.

Enable DKIM in your ESP settings and publish the DNS record they provide. Most modern ESPs handle key generation; you just publish the TXT record.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC ties SPF and DKIM together. It tells receiving servers what to do when an email fails authentication — and it sends you aggregate reports so you can see who's sending mail as your domain.

BIMI (Brand Indicators for Message Identification)

BIMI is the next step after DMARC enforcement. Once your DMARC policy is at p=quarantine or p=reject, you can add a BIMI DNS record paired with a Verified Mark Certificate (VMC) to display your logo next to your emails in Gmail and Yahoo inboxes. Verified logos increase open rates by ~38% and brand recall by ~120%. BIMI requires DMARC enforcement — it can't be set up at p=none.

PTR Records & Forward-Confirmed Reverse DNS (FCrDNS)

Every sending IP has a reverse DNS (PTR) record — the hostname that resolves when an ISP looks up your IP. Forward-confirmed reverse DNS (FCrDNS) means that PTR record resolves back to your domain, and your domain's A record resolves back to that same IP.

Generic PTR records like mail123.provider.com signal shared hosting; ISPs trust custom records like mail.yourdomain.com more. If you use a dedicated IP, ask your hosting provider or ESP to set a custom PTR record pointing to your domain. Most ESP users won't configure this themselves — but it's a meaningful trust signal when warming a new dedicated IP.

Sender Reputation

Your sender reputation is a score maintained by each ISP (Gmail, Outlook, Yahoo) based on how recipients interact with your email. It's invisible, per-ISP, and constantly changing.

What ISPs Measure

• Spam complaint rate — Keep below 0.1% (Gmail's warning threshold). Above 0.3% risks blocking.
• Bounce rate — Hard bounces should stay below 2%. Clean your list aggressively before large sends.
• Engagement signals — Opens, clicks, replies, and "move to inbox" actions all improve reputation. Deletions without reading hurt it.
• Sending consistency — Sudden volume spikes (e.g., BFCM) can damage reputation. Warm up before peak campaigns.

Google Postmaster Tools

Gmail publishes your domain reputation directly via Google Postmaster Tools — one of the few ISPs that does. You'll see: domain reputation (HIGH / MEDIUM / LOW / BAD), spam rate, authentication pass rate, and IP reputation. Set up Postmaster Tools immediately if you haven't.

Yahoo Sender Hub

Yahoo provides complaint rate data via the Yahoo Sender Hub. The critical threshold is 0.10% — above that, Yahoo will start filtering your mail. Monitor your Yahoo complaint rate separately from Gmail; the two can diverge significantly.

Microsoft SNDS (Smart Network Data Services)

Microsoft Outlook's bulk sender enforcement tightened significantly in 2025–2026, with some senders seeing inbox placement fall below 30% on Outlook/Office365 domains. Microsoft SNDS gives you complaint rate data and trap hit reports for Outlook — it's the Postmaster Tools equivalent for Microsoft. Set it up alongside Google Postmaster Tools, not instead of it.

2026 note: Outlook now requires SPF + DKIM + DMARC alignment for bulk senders. Non-compliant messages route to Junk first, then face blocking — matching the Gmail/Yahoo enforcement model.

Feedback Loops (FBLs)

A feedback loop (FBL) is an ISP service that notifies you directly when a recipient marks your email as spam. Unlike Postmaster Tools — which gives aggregate complaint rate percentages — FBLs deliver individual complaint notifications so you can suppress specific complainers in real time.

FBLs vs. Postmaster Tools

Which ISPs Offer FBLs

• Yahoo / AOL — Register at postmaster.yahooinc.com. Delivers ARF-format complaint reports per message.
• Microsoft / Outlook — Register via jmrp.io (Junk Mail Reporting Program). Covers Outlook.com and Hotmail.
• Comcast — Register at postmaster.comcast.net. Smaller footprint but worth registering at high volume.
• Gmail — No traditional FBL. Use Google Postmaster Tools for aggregate spam rate data instead.

Most ESPs handle FBL registrations automatically for dedicated IPs. On shared IPs, your ESP receives FBL complaints and suppresses complainers on your behalf. On a dedicated IP, you register yourself and pipe reports into your suppression list.

Inbox Placement Testing

Inbox placement testing (also called seed list testing) tells you exactly where your email lands — inbox, spam, or promotions — at specific mail providers. Without it, you're flying blind.

How Seed List Testing Works

1. A set of real mailboxes at major providers (Gmail, Outlook, Yahoo, Apple Mail, etc.) is added to your campaign list
2. You send your campaign as normal
3. The testing platform checks each mailbox and reports where the email landed
4. Results are available within minutes of the send

This gives you a pre-send or post-send view of placement across 20+ providers — letting you catch problems before they affect your real subscribers.

When to Run Placement Tests

• Before any major campaign (BFCM, product launches, win-back flows)
• After changing ESPs, IP pools, or sending domains
• When open rates drop unexpectedly
• During IP warm-up to verify inbox acceptance

IP Strategy & Warming

Your sending IP — shared or dedicated — is one of the primary signals ISPs use to assess trust. Understanding when to use each type and how to warm a new IP prevents deliverability disasters when scaling.

Shared IPs vs. Dedicated IPs

Most senders under 500K emails/month are better off on shared IPs from a reputable ESP. The warm-up burden and fragility of a dedicated IP outweigh the control benefits at lower volumes. If your ESP's shared pool has reputation problems, switching ESPs is usually faster than switching to a dedicated IP.

IP Warming Schedule

A new dedicated IP starts with zero reputation. ISPs need to observe consistent, low-complaint sending before they trust it. Start small and roughly double volume every 3–5 days:

Always warm with your most engaged subscribers first — recent openers and clickers. Never warm on a cold or purchased list. After each volume increase, run an inbox placement test to catch placement degradation early.

List Hygiene & Health

A clean list is the foundation of good deliverability. Sending to unengaged, invalid, or purchased addresses is the fastest way to tank your reputation.

Core List Hygiene Practices

• Remove hard bounces immediately — Hard bounces mean the address doesn't exist. Keep hard bounce rate below 2%.
• Sunset inactive subscribers — Create a sunset flow: re-engagement series → remove non-openers after 6–12 months. Don't just keep mailing people who never open.
• Never mail purchased lists — Purchased lists have terrible engagement and extremely high complaint rates. They will damage your sender reputation fast.
• Use confirmed opt-in — Double opt-in adds friction at signup but produces far cleaner lists with higher engagement rates long-term.
• Suppress unsubscribes globally — Honor unsubscribes across all lists and automations, not just the specific list they opted out from.

Bot Detection

Security scanners and automated bots click links in emails to check for malware — inflating your click rates with fake engagement. These phantom clicks pollute your segmentation, automation triggers, and A/B test results. Filtering bot clicks out is essential for accurate data.

Email Compliance Laws

Compliance failures carry two costs: regulatory fines and deliverability damage. Spam filters treat non-compliant emails — missing unsubscribe links, deceptive subject lines, no physical address — as strong spam signals. Meeting legal requirements and meeting spam filter requirements are largely the same work.

Key Laws at a Glance

Requirements That Apply Everywhere

• Working unsubscribe — Every commercial email needs a visible, one-click opt-out. CAN-SPAM requires honoring opt-outs within 10 business days; GDPR requires immediate removal.
• Physical mailing address — CAN-SPAM mandates a valid postal address in every email. Most jurisdictions have equivalent requirements.
• Honest subject lines and headers — "From" names and subject lines must not deceive. Deceptive headers also directly trigger spam filters.
• Sender identification — Recipients must be able to identify who sent the email. Hiding behind a generic sender name increases both compliance risk and complaint rate.

GDPR-Specific Requirements

• Explicit consent before sending — Pre-ticked checkboxes and implied consent are insufficient. Consent must be freely given, specific, informed, and unambiguous.
• Right to erasure — Subscribers can request complete data deletion, not just suppression from your mailing list.
• Data Processing Agreements (DPAs) — You need a DPA with your ESP if they process EU personal data. Most major ESPs provide these in account settings.

Content Quality

Even with perfect authentication and a clean list, spammy content will trigger spam filters. Modern spam filters use machine learning — they don't just look for keywords, they analyze the entire message. In 2026, Gmail's Gemini integration means AI evaluates your content for clarity, structure, and genuine value before deciding how prominently to display it — even among emails that technically land in the inbox.

Content Best Practices

• Avoid obvious spam triggers — "FREE!!!", "Act Now", "Guaranteed", excessive exclamation marks, ALL CAPS subject lines
• Healthy text-to-image ratio — Image-only emails with no text are treated as highly suspicious. Include meaningful text content.
• Clear, easy unsubscribe — Make it visible and one-click. Hiding the unsubscribe link leads to more spam complaints, which is far worse.
• Avoid URL shorteners — Services like bit.ly are shared across millions of senders including spammers. ISPs distrust shortened URLs.
• Send from a real reply-to address — noreply@ addresses signal that you don't want engagement, which hurts deliverability.
• Consistent From name and address — Changing these frequently confuses ISPs and subscribers alike.

Monitoring & Alerting

Deliverability problems don't announce themselves. Spam rates creep up quietly. DMARC failures start small. Blacklisting happens overnight. By the time you notice open rates dropping, the damage has been done for days or weeks.

What You Need to Monitor

• Inbox placement rate — Are emails actually landing in the inbox across Gmail, Outlook, Yahoo?
• Domain reputation — Google Postmaster domain reputation score (HIGH / MEDIUM / LOW / BAD)
• Spam complaint rate — Gmail and Yahoo both provide this; keep it below 0.1%
• Authentication status — SPF, DKIM, DMARC passing/failing rates
• Blacklist status — Are your sending IPs or domain on any major blacklists?
• DMARC alignment — Are unauthorized senders spoofing your domain?

Blacklist Monitoring

Real-time blocklists (RBLs) are databases of IPs and domains known to send spam. ISPs query them in real time when deciding whether to accept your email. A listing — even brief — can tank inbox placement across dozens of providers simultaneously.

Major Blacklists to Monitor

• Spamhaus — The most widely used blacklist family. SBL (spam sources), XBL (exploited systems), PBL (policy blocks), DBL (domain list). A Spamhaus listing is the most urgent to remediate — delist within hours.
• Barracuda (BRBL) — Used by Barracuda security appliances, common in enterprise environments. Listings disproportionately affect B2B deliverability.
• SpamCop (SCBL) — Complaint-based. High complaint volume triggers automatic listings. Delist by reducing complaints, not just submitting a removal request.
• UCEPROTECT — Three levels: L1 (individual IPs), L2 (netblocks), L3 (ASNs). Level 2/3 listings may affect shared infrastructure outside your direct control.

What Causes Listings

• Spam trap hits (invalid addresses that exist solely to catch spammers)
• High spam complaint rates from recipients
• Sending to purchased or harvested lists
• Sudden volume spikes from an IP with no warm-up history

For Spamhaus: identify the root cause first, fix it, then submit a removal request via their lookup tool. Submitting without fixing leads to re-listing and eventual permanent blocks. SpamCop listings auto-expire within 24–48 hours if no new complaints arrive.

2026: What's Changed

The fundamentals of deliverability haven't changed — but the environment has. Here's what's different in 2026 that affects every sender, regardless of ESP or list size.

Deliverability Is No Longer Binary

Gmail's Gemini AI integration means emails are no longer simply "inbox" or "spam." Gmail now creates a gradient of visibility: an email can land in the inbox but be deprioritized, summarized without being opened, or shown only in an AI-generated digest. Up to 40% of emails that technically reach the Gmail inbox may be deprioritized by AI filtering. The new question isn't just "did it land in the inbox?" — it's "did a human actually see it?"

Engagement Quality Outweighs Engagement Volume

ISPs now weight engagement quality over engagement quantity. Traditional open rates are increasingly unreliable as a reputation signal (Apple MPP inflates them; Gemini may open emails to summarize them). What matters now: actual clicks, replies, time spent reading, and whether subscribers move emails out of promotions/spam. A small highly-engaged list outperforms a large low-engagement list — both for reputation and for AI prioritization.

Three-Provider Enforcement: Gmail + Yahoo + Outlook

For years, "deliverability" mostly meant Gmail. In 2026, Outlook has joined with matching bulk sender requirements (SPF + DKIM + DMARC alignment mandatory), and Yahoo continues enforcing its 0.10% complaint threshold. You now need monitoring across all three providers — Postmaster Tools, Yahoo Sender Hub, and Microsoft SNDS — to see the full picture of your inbox placement.

The Inbox Is Now a Curated Feed

Gmail's AI Inbox and AI Overviews mean subscribers may consume your emails via a generated summary rather than reading the full message. Clarity, a strong opening sentence, and a single clear call-to-action matter more than ever — because the AI that summarizes your email is also the one deciding whether to surface it.

ESP Cost & Deliverability

Most ESPs charge by contact count or email volume. If 20–40% of your list hasn't opened an email in 12+ months, you're paying to mail people who will never convert — and those unengaged contacts actively harm your deliverability by dragging down your engagement rate.

The Hidden Cost of a Bad List

• Lower engagement rate → lower sender reputation → lower inbox placement
• Higher ESP bill (paying for contacts who will never buy)
• Inflated metrics that make campaigns look worse than they are

The fix: identify unengaged segments using engagement data, run a re-engagement campaign, then suppress everyone who doesn't re-engage. Done right, this cuts your ESP bill by 30–50% with zero revenue impact.

Mailstream Architecture

Mailstream architecture means separating different email types onto distinct subdomains, DKIM keys, and IP pools — so a reputation problem in one stream cannot contaminate others. It's one of the highest-leverage structural changes a mid-to-large sender can make.

The Three Streams to Separate

• Transactional email (receipts, password resets, account notifications) — Highest deliverability priority. Recipients expect these immediately. Use a dedicated subdomain like mail.yourdomain.com.
• Marketing email (newsletters, promotions) — Highest complaint risk of your owned streams. Keep isolated on em.yourdomain.com or news.yourdomain.com.
• Cold outreach (prospecting, sales sequences) — Must live on a separate domain entirely (not a subdomain of your main domain) to prevent blowback from affecting transactional or marketing reputation.

How to Implement

• Create separate subdomains per stream and publish unique DKIM keys for each
• In your ESP, configure distinct sending domains and — where available — separate IP pools per stream
• Set separate DMARC rua reporting addresses so you can identify which stream generates failures
• Never send cold outreach from your primary domain — use a purpose-built domain with its own warm-up history

Quick Wins Checklist

If you're starting from scratch or auditing an existing program, work through this list in order:

Week 1 — Authentication

• ☐ Publish SPF record for your sending domain(s)
• ☐ Enable DKIM in your ESP and publish the DNS record
• ☐ Add DMARC at p=none with an rua reporting address
• ☐ Verify all three pass with the free Deliverability Checker
• ☐ Ask your ESP or host to set a custom PTR/reverse DNS record for your sending IP (dedicated IPs only)

Week 2 — Monitoring Setup

• ☐ Connect Google Postmaster Tools (requires 5K+ sends/month to Gmail)
• ☐ Set up Yahoo Sender Hub if you send significant volume to Yahoo
• ☐ Run an inbox placement test via Seed List to see your baseline
• ☐ Check if your sending IPs are on any blacklists with the Blacklist Checker

Week 3–4 — List Health

• ☐ Segment by engagement (opened in last 90 / 180 / 365 days)
• ☐ Remove hard bounces
• ☐ Create a sunset flow for subscribers inactive 6+ months
• ☐ Suppress non-re-engagers after the sunset flow

Ongoing

• ☐ Monitor spam complaint rate weekly (target: under 0.05%)
• ☐ Run placement tests before major campaigns
• ☐ Advance DMARC policy when reports confirm all legitimate mail passes
• ☐ Review ESP cost quarterly — suppress new unengaged cohorts
• ☐ Verify FBL registration for Yahoo, Microsoft, and Comcast (or confirm your ESP handles this on shared IPs)

2026 Additions

• ☐ Set up Microsoft SNDS to monitor Outlook reputation alongside Postmaster Tools
• ☐ Audit your email's first 100–200 characters — Gmail Gemini uses these for AI summaries
• ☐ Replace open-rate-only automation triggers with click or reply signals
• ☐ Add BIMI record once DMARC reaches p=quarantine or p=reject
• ☐ Verify one-click unsubscribe uses RFC 8058 POST method (Gmail/Yahoo mandate)