The email deliverability checklist

Authentication: the part that is pass/fail

Everything else on this page is a matter of degree. This part is binary, and it is where most spam-folder problems actually live.

• SPF. A DNS record listing who may send for your domain. Keep it under the ten-lookup limit — nested includes from old vendors silently break it.
• DKIM. A cryptographic signature on every message. Use a 2048-bit key and rotate it periodically.
• DMARC. Publishes what to do when SPF and DKIM fail, and gets you the reports that show who else is sending as you. Start at p=none to observe, move to quarantine, then reject once the reports are clean.
• Alignment. The visible From domain must match the SPF or DKIM domain. Passing both while aligning with neither still fails DMARC — a common and confusing outcome when a vendor signs with its own domain.
• Reverse DNS and TLS. Your sending IP needs a PTR record that resolves forward to the same host, and connections must be encrypted. Both are now table stakes, not optimisations.
• MTA-STS and TLS-RPT. Tell receiving servers to require TLS for your domain and send you a report when it fails. Cheap to publish, and a genuine security improvement.
• BIMI. Puts your logo beside the message in supporting clients. Requires DMARC at quarantine or reject, and a verified mark certificate for most providers. Do it last.

What the big providers now require

Google and Yahoo introduced a shared baseline in February 2024 for senders above roughly 5,000 messages a day to their consumer addresses. Microsoft brought Outlook.com, Hotmail and Live under the same rules in May 2025, and Google escalated from temporary deferrals to outright rejection of non-compliant traffic from November 2025.

The volume threshold is not the point. Treat the list as the standard whatever your volume — small senders are simply less likely to be noticed failing it.

• SPF, DKIM and DMARC. All three, with alignment. p=none is the minimum policy.
• Spam complaint rate. Below 0.1%. Reaching 0.3% is the line where providers stop helping you — and one bad campaign can cross it.
• One-click unsubscribe. List-Unsubscribe and List-Unsubscribe-Post headers per RFC 8058 on marketing mail, honoured within two days.
• Valid PTR, TLS and RFC 5322 formatting. Unremarkable when they work, and completely invisible until they do not.

Reputation

• Warm up new IPs and new domains. Start in the hundreds and roughly double every couple of days, sending to your most engaged people first. A cold IP with 100,000 messages on day one is the single fastest way to get blocked. Expect the ramp to take weeks.
• Be predictable. Steady volume reads as a real business. Silence for two months and then a blast reads as a compromised account.
• Separate the streams. Send transactional mail and marketing mail from different subdomains. A campaign that goes badly then cannot take your password resets down with it.
• Dedicated IP only if you can feed it. A dedicated IP needs consistent volume to hold a reputation. Below that, a well-run shared pool places better.

List hygiene

• Never buy or scrape a list. It is the single decision that damages a sending domain fastest and takes longest to undo.
• Validate at the form and at import. Typos and junk entries are most of what bounces. Catching them at collection costs nothing later.
• Suppress hard bounces permanently. A second send to a hard-bounced address is a signal providers remember. This must be automatic, not a habit.
• Sunset the unengaged. Long-silent addresses suppress placement for everybody else on the list, and some of them are now spam traps.
• Use confirmed opt-in where it hurts least. Especially for imported lists and free-tier signups. It costs you addresses that were never going to engage.

Watch it, or you are guessing

• Google Postmaster Tools. The only public view of your reputation at Gmail, and the closest thing to ground truth for complaint rate. Set it up before you need it.
• Feedback loops. Yahoo, Microsoft and others report complaints back. Wire them into automatic suppression.
• Your own bounce and complaint dashboard. Broken out by recipient domain. Problems almost always start at one provider before they spread.
• Blocklist checks and seed tests. Check the major blocklists periodically, and send a seed set to real accounts at the big providers with every campaign.

If you are already landing in spam

Stop sending broadly. Continuing to mail your whole list while you diagnose deepens the hole you are in.

Fix authentication first — it is the fastest thing to verify and the most common root cause. Then look at complaint rate by provider, and at what changed in the two weeks before it started.

Rebuild by shrinking. Mail only the people who opened or clicked in the last 30 days, keep the volume steady, and widen slowly as placement recovers. Recovery is measured in weeks, and there is no way to buy your way past it.

Common questions

Keep reading

• How to reduce email bounce rate
• What is a catch-all domain?
• SMTP relay or email API — which should you use?