Most deliverability problems are not solved at the content layer. Senders spend hours rewriting copy when their DKIM is broken or their list hygiene has collapsed.
This guide covers the deliverability stack from the layers that matter most to the layers that matter least. Start at the top; work down only as needed.
Layer 1: Authentication (SPF / DKIM / DMARC)
Authentication is the floor. Without it, nothing else compensates. Since 2024, Gmail and Yahoo require DMARC for bulk senders; getting authentication wrong is a guaranteed deliverability disaster.
SPF
SPF (Sender Policy Framework) declares which servers are authorized to send mail for your domain. Published as a DNS TXT record. Looks like:
v=spf1 include:_spf.google.com include:sendgrid.net include:mailchimp.com -all
What to verify:
- Single SPF record per domain. Multiple SPF records cause failures. If you have two, merge them.
- Under 10 DNS lookups. SPF has a hard limit; some include: entries themselves do additional lookups. Tools like dmarcian.com show you the lookup count.
- -all at the end (strict policy) rather than ~all (softfail) once you've verified all senders. Strict policies enforce; soft policies just suggest.
DKIM
DKIM (DomainKeys Identified Mail) cryptographically signs your outgoing email. The signature lives in the email headers; the public key lives in DNS. Receivers verify the signature against the public key.
What to verify:
- DKIM signature present on every send. Run a test send to Mail-Tester or check the raw headers of an arriving email. The DKIM-Signature: header should be present and dkim=pass should appear in Authentication-Results:.
- 2048-bit keys rather than 1024-bit. Older keys still work but are increasingly weak; rotate to 2048-bit when you can.
- Selector rotation every 6-12 months. Not strictly required but good hygiene.
DMARC
DMARC sits on top of SPF and DKIM. It tells receivers what to do when authentication fails and where to send reports about failures. Published as a DNS TXT record at _dmarc.yourdomain.com. Looks like:
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100
The policy options:
- p=none. Monitor only. Receivers report failures but don't act on them. Use this when first deploying DMARC to learn what's failing.
- p=quarantine. Receivers send failing mail to spam. Move here after a month or two of p=none with clean reports.
- p=reject. Receivers reject failing mail outright. Strongest policy; appropriate once you're confident all senders pass.
What to verify:
- DMARC alignment. The domain that passes SPF or DKIM must match the visible From: domain. Misaligned mail fails DMARC even if SPF and DKIM pass individually.
- Receiving DMARC reports. The rua= address should be a real inbox you check; the reports tell you which senders are failing and why.
- Subdomain coverage. DMARC on the parent domain doesn't automatically cover subdomains. Publish DMARC records on each subdomain you send from.
Authentication audit checklist
Run this checklist quarterly:
- [ ] SPF record exists, single record, under 10 lookups, -all at end.
- [ ] DKIM signing on every send, dkim=pass in arriving headers.
- [ ] DMARC published at minimum p=none, working up to p=quarantine or p=reject.
- [ ] DMARC reports being received and reviewed.
- [ ] Subdomains have their own DMARC records.
If any item is unchecked, work on it before anything else. Authentication problems compound; content optimization on top of broken auth is wasted effort.
Layer 2: Sender reputation
Reputation is the trust score mailbox providers assign to your domain and IP. Authentication is the prerequisite; reputation is the ongoing variable.
How reputation is built
The signals that feed reputation:
- Engagement metrics. Opens, clicks, replies, 'not spam' marks, moves to Primary tab.
- Complaint rates. Recipients marking mail as spam. Goal: under 0.1%.
- Bounce rates. Hard bounces directly damage reputation. Goal: under 2%.
- List-Unsubscribe behavior. Recipients who unsubscribe via one-click vs. complaining is a positive signal.
- Sending volume consistency. Sudden ramps look like list-buying.
How to monitor reputation
- Google Postmaster Tools. For Gmail-side reputation. Free; verifies via DNS TXT record. Shows IP reputation, domain reputation, spam rate, IPv6 status, encryption rate, and authentication breakdown.
- Microsoft SNDS. For Outlook-side reputation. Free; verifies via DNS or domain ownership. Shows complaint rate, RCPT data, and trap hits.
- Yahoo Sender Hub. For Yahoo-side reputation. Newer; provides similar dashboards.
- Apple iCloud. No public dashboard. Monitoring relies on inbox-placement testing.
For most senders, Gmail Postmaster Tools is the single highest-value monitor. Check it weekly. Sudden domain-reputation drops are early warnings.
How to recover reputation
If reputation is damaged:
- Stop the bleeding. Identify the cause (bad list, broken auth, content issue) and fix it before sending more.
- Suppress disengaged subscribers. Drop sends to anyone who hasn't engaged in 90+ days.
- Warm slowly. Reduce volume to 10-25% of normal; ramp back up over 4-6 weeks while monitoring reputation metrics.
- Prioritize engaged segments. Send only to your most-engaged 20-30% during recovery.
Reputation recovery is slow. Expect 4-8 weeks to fully restore. The fastest recovery is via consistent positive engagement; there's no shortcut.
Layer 3: List hygiene
Healthy lists out-deliver large lists. Aggressive list hygiene is the single biggest unforced-error in deliverability.
Bounce processing
- Hard bounces: suppress on first bounce. Most ESPs do this automatically.
- Soft bounces: retry; convert to hard bounce after 5-10 consecutive failures.
- Universal: never re-add a hard-bounced address to your list.
Engagement-based suppression
Subscribers who haven't opened or clicked in 90 days should be moved to a low-frequency segment. After 180 more days of no engagement, suppress them entirely.
Counterintuitively, this lifts your aggregate engagement metrics, which improves your reputation, which improves inbox placement on the remaining subscribers. The math compounds.
Permission passes
Every 6-12 months, ask dormant subscribers if they want to stay. The 'are we good?' email gives them a single-click way to confirm. Most won't click; suppress them. The few who do are now re-confirmed and engaged.
List validation
Before any cold campaign or any send to an addresses set you haven't sent to recently, validate the addresses. Tools like ZeroBounce or NeverBounce check deliverability before you send and waste reputation on bounces.
Avoid list buying
Purchased lists are deliverability disasters. The addresses are saturated with spam traps, your competitors have already burned them, and the consent provenance is unverifiable. The structural alternative — slowly building your own opt-in list — is the only viable long-term play.
Layer 4: Content patterns
Content matters less than authentication, reputation, or list hygiene, but it still matters at the margin. Specific content patterns that move the needle:
Patterns that hurt
- ALL CAPS in subject lines or excessive caps in body. Still a meaningful negative signal.
- More than 2 exclamation points in a subject or more than 3 in a body. Pattern-matches spam corpus.
- Image-to-text ratio above 70%. Image-heavy emails are filtered harder than text-rich ones. Always include real text alongside images.
- All-image emails with no text alternative. The single fastest way to land in spam.
- Currency symbols stacked ("$$$ Make money fast $$$"). Fossilized spam pattern still tripped.
- Links to suspicious domains. Bit.ly and other URL shorteners pattern-match spam. Use your own domain for tracked links.
- HTML body with no plain-text alternative. Multipart messages should always include a text/plain version.
Patterns that help (or don't hurt)
- Real text alongside images. Every email should have skimmable text content.
- Plain-text-flavored emails for cold outreach and high-touch B2B sends. Plain text often outperforms HTML for these contexts.
- List-Unsubscribe header with both mailto: and HTTPS variants. Required by Gmail/Yahoo for bulk senders since 2024.
- One clear CTA rather than dense link lists. Link density above 1 per 30 words pattern-matches promotional/spam.
What stopped mattering
A short list of 2015-era folklore that no longer applies:
- "Free" in the subject line, used naturally. Neutral.
- "Buy now" in CTAs. Standard.
- "Click here" as anchor text. Bad UX, not a deliverability issue.
- "100% guaranteed" in body. Updated filter rules.
- Single emoji in subject (in context). Neutral or slightly positive depending on the brand.
Layer 5: Infrastructure
The plumbing layer. Mostly invisible when correctly configured.
Sending domain strategy
- Transactional sends: dedicated subdomain (e.g., notifications.yourdomain.com).
- Marketing sends: dedicated subdomain (e.g., mail.yourdomain.com).
- Cold outreach: dedicated subdomain (e.g., outreach.yourdomain.com).
Separating sending domains isolates reputation. A marketing-side problem shouldn't break transactional delivery; cold-outreach reputation shouldn't poison marketing.
IP strategy
- Under ~50k emails per month: stay on shared IPs. Your reputation pools with the ESP's other customers; your own send volume isn't enough to build a clear reputation on dedicated IPs.
- Above ~50k per month: consider dedicated IPs. Your own reputation becomes the dominant signal.
- Either way: IP warming is essential when starting on new IPs. Ramp 50-100 emails/day, double every 2-3 days, reach target volume after 4-8 weeks.
Warmup and ramping
- New domain warmup: 4-6 weeks of slow ramp.
- New IP warmup: 4-8 weeks of slow ramp.
- Returning after a long pause (3+ months of inactivity): treat like a new domain; warm slowly.
Warmup is non-negotiable. Cold-sending high volume from a fresh domain is a deliverability suicide.
Layer 6: Monitoring
Continuous monitoring catches problems before they escalate.
What to monitor
- Per-MBP delivery latency. If sends to Gmail are taking 4 hours when other MBPs take minutes, you're being throttled.
- Bounce rate by send. Sudden spikes indicate list-acquisition or auth issues.
- Complaint rate by send. Goal: under 0.1%. Above 0.3% is danger.
- Engagement metrics by cohort. Cohort-level engagement decay reveals problems that aggregate metrics hide.
- Inbox placement. Seed-list testing or panel-based services. Goal: 95%+ to primary inbox; not 'delivered.'
Tools we recommend
- Google Postmaster Tools (free) — Gmail reputation, spam rate, encryption rate.
- Microsoft SNDS (free) — Outlook reputation, complaint rate.
- Mail-Tester ($) — single-send inbox-placement test.
- GlockApps / Litmus Spam Testing ($$) — panel-based inbox-placement testing across many MBPs.
- Postmark / Resend dashboards (if using these ESPs) — built-in reputation and delivery monitoring.
For most sender programs, Postmaster Tools + ESP dashboards + a monthly Mail-Tester run covers 90% of the monitoring need.
Layer 7: Recovery from incidents
When deliverability collapses, the order of operations:
- Stop sending. Pause campaigns until you understand the cause.
- Check auth. SPF, DKIM, DMARC. The most common root cause of sudden collapses.
- Check bounce / complaint rates. Spikes indicate the immediate cause.
- Check Postmaster Tools. Domain reputation, spam rate. If dropped, you've identified the immediate issue.
- Identify the bad send. What did you send most recently that might have triggered this? List acquisition, content change, volume spike?
- Suppress aggressively. Drop any unengaged segments. Reduce send volume.
- Slow-restart. Once you've fixed the cause, restart at low volume to engaged segments. Ramp gradually.
Recovery from a major incident takes 4-8 weeks. Don't expect overnight return to baseline.
A useful checklist
Run this checklist quarterly:
- [ ] SPF, DKIM, DMARC all configured and aligned.
- [ ] DMARC at p=quarantine or p=reject.
- [ ] List-Unsubscribe header present on every marketing send.
- [ ] Bounce rate under 2% on every send.
- [ ] Complaint rate under 0.1% on every send.
- [ ] No sends to subscribers unengaged for 180+ days.
- [ ] Google Postmaster Tools reviewed weekly.
- [ ] Permission pass run within last 12 months.
- [ ] Authentication audit run within last 12 months.
- [ ] No purchased lists in the program.
Most senders fail at 3-5 of these. Closing the gap is the highest-ROI deliverability work available.
What our tool catches
Our deliverability lint checks content-level issues automatically — ALL CAPS, exclamation density, image-to-text ratio, missing unsubscribe, suspicious-domain links. The tool also surfaces what it can't fix: if your auth is broken or your reputation is poor, lint passes won't solve placement. We're honest about the layered model.
For the deeper terminology, our glossary covers each concept in detail. And our blog post on spam-trigger words goes into which content patterns still matter in 2026.
The discipline
Deliverability rewards the patient. Authentication once, list hygiene monthly, reputation monitoring weekly, content quality per send.
The teams that compound an advantage over years aren't the ones with the cleverest content; they're the ones with the cleanest plumbing. Build the plumbing first.