Email Deliverability: The Complete Guide to Landing in the Inbox (2026)

Email deliverability is the ability of your emails to actually reach the recipient's inbox, rather than landing in spam or being blocked entirely. It is the single most overlooked factor in email and cold outreach: the best-written campaign converts at zero percent if it never gets seen. "Delivered" is not the same as "in the inbox", an email can be technically delivered but filtered straight to spam, where it does nothing.

This guide explains what email deliverability is, what affects it, how to improve it, and how to measure it.

TL;DR

• Email deliverability = whether your emails reach the inbox (not spam or blocked).
• The big levers: authentication (SPF, DKIM, DMARC), sender reputation, domain warm-up, list hygiene, and content.
• Warm a new sending domain for 2-3 weeks before real volume, this is the most common scaling failure.
• Use a separate domain for cold outreach so a deliverability hit never burns your main domain.
• Most "email didn't work" outcomes are actually spam-folder outcomes; fix deliverability first.
• Since February 2024, Gmail and Yahoo require bulk senders to have SPF, DKIM, a DMARC policy, an aligned From: domain, one-click unsubscribe, and a spam complaint rate below 0.30%.
• When placement drops, diagnose in a fixed order: authentication, then reputation, then list, then content. Guessing at content first is why drops take weeks to fix.

What affects email deliverability

Deliverability is determined by signals that inbox providers (Gmail, Outlook) use to decide whether to trust you:

• Authentication (SPF, DKIM, DMARC): these DNS records prove you are authorized to send from your domain. Missing them is the fastest route to spam, and major providers increasingly reject unauthenticated mail outright. So, set them up before hand and verify them with a DNS record lookup to ensure they are correctly published.
• Sender reputation: providers score your sending domain and IP based on history, complaints, bounces, and engagement. Good reputation = inbox; poor = spam.
• Domain warm-up: new domains have no reputation. Sending high volume from a cold, unwarmed domain looks like spam. Ramp gradually over 2-3 weeks.
• List quality: sending to invalid, dead, or unengaged addresses drives bounces and low engagement, which wreck reputation. Verify and clean lists.
• Engagement: opens, replies, and "not spam" signals build reputation; being ignored or marked spam destroys it.
• Content: spam-trigger words, ALL CAPS, too many links, and heavy images can trip filters.

SPF, DKIM and DMARC explained: what each record does

These three are usually listed as one job. They are three, and only the third protects the From: address your recipient actually reads.

SPF: which servers may send for your domain

SPF is a TXT record listing the servers permitted to send for your domain, for example v=spf1 include:_spf.google.com include:sendgrid.net ~all. The receiver checks the connecting IP against the SPF record of the envelope sender domain, which is the Return-Path, not the visible From: line.

Three things break it in practice. Two SPF records on one domain is a permanent error, not a merge, so extend the existing record when you add a tool. The ten-lookup limit counts every include, a, mx and redirect, including nested ones; stacking five or six sending tools exceeds it and returns permerror, which many receivers treat as a fail. Forwarding breaks SPF by design, because the forwarding server is not in your record. On the terminator, ~all is softfail and -all is hardfail: stay on ~all until you know every system that sends as you.

DKIM: a signature proving the message was not altered

DKIM adds a cryptographic signature to the message headers. You publish a public key at a selector such as selector1._domainkey.yourdomain.com, your platform signs with the private key, and the receiver verifies it. Unlike SPF, the signature travels with the message, so it survives most forwarding, and each platform uses its own selector, so multiple tools can sign for one domain with no conflict and no lookup ceiling. Google requires keys of at least 1024 bits and recommends 2048. But a valid signature only proves the signing domain, which need not be the From: domain.

DMARC: the policy and the reporting layer

DMARC is a TXT record at _dmarc.yourdomain.com, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. It does the two things SPF and DKIM cannot.

First, it requires alignment: the domain in the visible From: header must match the domain that passed SPF or the one that signed with DKIM. Passing either is enough. This is what stops a sender passing SPF on their own throwaway domain while displaying your brand.

Second, it sets policy and opens a feedback channel. p=none means report only, p=quarantine means treat as suspicious, p=reject means refuse. rua= is the address that receives aggregate XML reports, and it is the part people skip even though it is the most useful part of the record. p=none is enough to satisfy Gmail and Yahoo, so there is no reason to delay publishing one.

The sequence that works: publish p=none with a rua address, read the reports until you can account for every source sending as your domain, fix or remove the rest, then move to p=quarantine, then p=reject. Going straight to p=reject before you know your full sending inventory is how companies silently kill their own invoicing or help desk mail.

Check all three from the receiving side, not from your sending tool's settings page: send to an address you control at Gmail and use "Show original", which returns SPF, DKIM and DMARC as pass or fail plus the signing domain and Return-Path. A green "verified" badge in a sending tool only means it found the record it expected, not that alignment holds on real mail.

The Gmail and Yahoo bulk sender rules from February 2024

In February 2024 Google and Yahoo began enforcing a shared set of requirements on bulk senders, rolling out through the first half of that year. Google applies them to senders of roughly 5,000 or more messages per day to Gmail addresses.

Gmail additionally requires TLS for transmission, valid forward and reverse DNS where the sending IP matches the IP of the hostname in the PTR record, and compliance with RFC 5322 with headers that are not misleading. Two details are worth checking first.

One-click unsubscribe is a header, not a link. It means List-Unsubscribe plus List-Unsubscribe-Post: List-Unsubscribe=One-Click, so the mail client can unsubscribe someone with no landing page. The visible body link is required as well. Established platforms add these headers; a custom SMTP integration will not unless someone wrote it in.

The 0.30% spam rate is not a rate over everything you send. Google defines it as the share of messages delivered to an engaged recipient's inbox that the recipient then marked as spam. Mail the filter diverted on its own is not counted. So as placement gets worse, fewer messages reach an inbox to be complained about, and the reported rate can look calm while delivery collapses. Read it next to inbox placement, never alone.

How to warm up a new sending domain

Reputation is a history, and a new domain has none. Warm-up is not about hitting a volume number by a date; it is about accumulating enough positive engagement at each step that the next step looks ordinary rather than sudden.

A workable ramp: a handful of sends per mailbox for the first few days, to real people who will open and reply; roughly doubling every couple of days through week one while replies hold; continuing toward steady state across weeks two and three; then holding. Reputation decays, so a domain that goes quiet for a month needs a short re-ramp. The rules matter more than the exact numbers:

• Spread volume across several mailboxes rather than into one. It is safer, and it limits the damage when one address gets burned. A new mailbox on an already-warm domain still needs its own short ramp.
• Watch reply rate, not send count. If replies fall as volume rises, stop raising volume. You are building a reputation out of engagement, not throughput.
• Automated warm-up pools carry a cost. Networks where tool users mutually open and reply to each other's mail manufacture engagement no real recipient produced. Providers can identify that pattern, and your domain carries whatever conclusion they draw.
• Warm the domain before you need it. Register and start weeks ahead of the campaign, not the week of.

Email list hygiene: what to remove, and when

Bounces and complaints are the two inputs that damage reputation fastest, and both come from the list rather than the message.

Before the first send: run the list through verification to drop invalid addresses and domains with no MX record; remove role addresses such as info@ and support@ unless they are genuinely the intended recipient; and remove anything whose origin you cannot explain. Purchased and scraped lists carry spam traps, addresses that exist only to catch senders who did not collect consent, and one hit can move a domain from watched to blocked.

Then, continuously:

• Suppress hard bounces immediately and permanently. The mailbox does not exist. Sending again signals that you do not process bounces, which is itself a spammer characteristic. Treat soft bounces as a counter instead: a full mailbox is not fatal, but the same address failing repeatedly over a couple of weeks should be suppressed.
• Run a sunset policy. Pick a window of no opens, clicks or replies, commonly 90 to 180 days depending on send frequency, send one re-engagement attempt, then suppress. Unengaged recipients dilute the engagement rate that feeds reputation.
• Process unsubscribes immediately. Yahoo requires them honoured within two days, and complaints from people who already asked you to stop are the most damaging kind.
• Segment by engagement when reputation is fragile. Sending only to people who opened in the last 30 days produces exactly the signal a recovering domain needs.
• Prefer double opt-in at capture. It produces a smaller list with cleaner behaviour, because every address is confirmed reachable and every recipient took a second deliberate action.

How to measure email deliverability

Track inbox placement rate (what share actually reaches the inbox vs spam, the truest metric), bounce rate (hard bounces especially), spam-complaint rate (keep it very low), and engagement (opens/replies as reputation signals). A sudden drop in replies or a spike in bounces is an early warning that deliverability is slipping, pause and diagnose rather than sending harder.

How to diagnose an email deliverability drop

When replies fall off a cliff, the instinct is to rewrite the subject line. Work the layers in order instead, so you never spend a week on copy when the cause was a DNS edit.

1. Establish what changed, and when. Write down the date replies started falling and list every change around it: a DNS edit, a new tool added to SPF, a platform migration, a list import, a new template, a volume increase. A drop with no matching change points instead at reputation decay from accumulated complaints.

2. Confirm authentication still passes on live mail. Send to a Gmail address you control and check "Show original". This catches a frequent cause: a sending tool added to SPF pushing it past the ten-lookup limit, or a DNS migration dropping the DKIM selector. Confirm the Return-Path domain aligns with the From: domain, because alignment can fail while SPF itself passes.

3. Read Postmaster Tools, and read the right box. Google's free tool gives you the receiving side's view of your domain. Domain reputation is rated Bad, Low, Medium or High; Google describes High as very low spam rates and guideline compliance, Medium as legitimate mail that occasionally sends spam, and Low or Bad as likely or almost always to be marked as spam. A move from High to Medium is the earliest reliable warning you get. Authentication shows the percentage passing SPF, DKIM and DMARC, where anything short of effectively 100% means a source is misconfigured. Delivery errors shows authenticated mail rejected or temporarily failed, by reason, including rate limiting, suspected spam, reputation and RBL listings, which is where a block appears explicitly rather than by inference. Two caveats: data can be withheld on low-volume days to protect user privacy, and it covers Gmail only.

4. Split the problem by receiving provider. Gmail fine and Outlook collapsed is a Microsoft-specific problem with a different remedy. Every provider dropping at once points at authentication or your sending IP. One client affected on a shared platform points at that client's list, not your infrastructure.

5. Read the actual bounce messages. SMTP rejections usually say why in plain text and people rarely look. A 5.7.1 policy rejection, a message naming a blocklist, or a rate-limit notice each point somewhere specific. Check the sending IP and domain against the major public blocklists; a listing names its reason and its delisting process, and a shared IP can be listed because of a neighbour.

6. Run a seed test for placement, not delivery. Sending to addresses you control across Gmail, Outlook and Yahoo and then inspecting them is the only direct measurement of inbox placement you have, because your platform can only report acceptance.

7. Only now look at content. Look at what changed in the template rather than at a spam-word checklist: a new tracking domain with no reputation, a link shortener, a shared redirect domain, a switch to an image-heavy layout. Link and tracking domains carry their own reputation.

While you diagnose, cut volume rather than pushing harder and send only to your most engaged segment. Recovery means accumulating good history at reduced volume, so the ramp back up is essentially a warm-up and takes weeks rather than days. Returning to full volume as soon as the fault is fixed usually restarts the drop, because the reputation that caused it has not changed yet.

Why deliverability is the foundation of email and cold outreach

For agencies and businesses running cold email at scale, deliverability is everything, it is why separate, warmed domains per client and strict list hygiene are core to the email marketing for agencies playbook. It is also the most common hidden reason campaigns "fail": the copy was fine, the emails just never reached the inbox. Fix deliverability first, then optimize the message. (If you are seeing deliverability problems on a specific platform, see GoHighLevel email deliverability problems.)

FAQ

What is email deliverability?

Email deliverability is the ability of your emails to reach recipients' inboxes rather than landing in the spam folder or being blocked. It is distinct from "delivery", an email can be technically delivered to the mail server but still filtered into spam, where it has no effect. Deliverability is determined by signals like authentication, sender reputation, list quality, and engagement that inbox providers use to decide whether to trust and inbox your mail.

How do I improve my email deliverability?

Set up SPF, DKIM, and DMARC authentication on every sending domain, warm up new domains gradually over 2-3 weeks before sending real volume, use a separate domain for cold outreach to protect your main domain, verify and clean your list to remove invalid and unengaged addresses, keep sending volume consistent rather than spiking, and write engaging, plain-text emails without spam-trigger language. Then monitor bounce and complaint rates and prune dead contacts. Authentication and warm-up are the highest-impact starting points.

What are SPF, DKIM, and DMARC?

They are DNS records that authenticate your email and prove you are authorized to send from your domain. SPF specifies which servers may send on your behalf, DKIM cryptographically signs your messages so they cannot be tampered with, and DMARC tells receiving servers what to do with mail that fails SPF or DKIM and gives you reporting. Together they are essential for deliverability, missing them is one of the fastest ways to land in spam, and major providers increasingly reject unauthenticated email.

Why are my emails going to spam?

The most common causes are missing or misconfigured authentication (SPF/DKIM/DMARC), sending from a new, unwarmed domain, sending too much volume too fast, a poor sender reputation from past complaints or bounces, sending to invalid or unengaged addresses, and spammy content (trigger words, ALL CAPS, too many links or images). Subject lines are only one small factor. Fix the technical and reputation issues first, since a clean message cannot rescue a domain with bad authentication or reputation.

What is domain warm-up and why does it matter?

Domain warm-up is the process of gradually increasing your sending volume from a new domain over a few weeks so inbox providers learn to trust it. A brand-new domain has no sending reputation, so blasting high volume from it immediately looks like spam and tanks deliverability. Warming up, starting with a small number of sends and ramping steadily over 2-3 weeks, builds reputation safely. Skipping warm-up is a common reason cold email campaigns fail to reach the inbox at scale.

What are the Gmail and Yahoo bulk sender requirements?

Since February 2024, both require bulk senders to authenticate with SPF and DKIM, publish a DMARC policy (p=none is enough), align the From: domain with either the SPF or DKIM domain, offer one-click unsubscribe on marketing mail alongside a visible unsubscribe link, and keep the spam complaint rate below 0.30%. Gmail also requires TLS and valid forward and reverse DNS, and applies the rules to senders of roughly 5,000 or more messages a day to Gmail addresses.

Related reading

• Cold email templates
• Email marketing for agencies
• Cold email subject lines
• How to find your SMTP credentials

Explore More

• Best Email Marketing Software - Email still returns more per dollar than any other channel
• Email Marketing Automation - What email marketing automation is, the core automated flows that drive revenue, real examples
• Feature: SMS and Email - Reach leads on the channel they answer
• Feature: Workflow Automation - Automate the follow-up you keep forgetting
• Pricing - Plans built for Instagram businesses