# Email Deliverability: The Complete Guide to Reaching the Inbox

*Published: 2025-12-10*

**Email deliverability** is the foundation of email marketing. If your emails don't reach the inbox, nothing else matters—your brilliant copy, beautiful design, and perfect timing are all wasted.

This guide explains what affects deliverability, how to diagnose problems, and how to fix them.

## Key takeaways

- Delivery rate is whether the receiving server accepted the message. Inbox placement is whether it landed in the inbox. Those are different numbers.
- Authentication is SPF, DKIM, and DMARC alignment. [Gmail's bulk-sender page](https://support.google.com/a/answer/81126) requires that once you send 5,000 or more messages a day to personal Gmail.
- Keep spam reports under 0.1%, and never hit 0.3%. Split marketing and [transactional](/blog/transactional-emails) mail the way [Yahoo](https://senders.yahooinc.com/best-practices/) asks, on different IPs if you can.
- List hygiene and complaint rate beat clever subject lines. Agents do not get a courtesy lane. See [what still applies when an agent sends](/blog/agent-email-deliverability).

## What Is Email Deliverability?

Deliverability measures whether your emails reach subscribers' inboxes versus spam folders or being blocked entirely.

**Critical distinction:**

- **Delivery rate** = emails accepted by receiving servers (usually 95%+)
- **Inbox placement** = emails that actually reach the inbox (often much lower)

You can have 99% delivery rate but terrible inbox placement. The emails "delivered" might all be in spam.

## What Affects Deliverability

### 1. Sender Reputation

Your sender reputation is like a credit score for email. Mailbox providers track:

| Factor                     | Impact          |
| -------------------------- | --------------- |
| Spam complaints            | High negative   |
| Bounce rates               | High negative   |
| Engagement (opens, clicks) | High positive   |
| Spam trap hits             | Severe negative |
| Sending patterns           | Medium          |
| List quality               | High            |

Reputation is built over time and can take weeks to recover if damaged.

### 2. Authentication (SPF, DKIM, DMARC)

Three protocols verify you're a legitimate sender:

**SPF (Sender Policy Framework):**

- Authorizes which servers can send for your domain
- DNS TXT record listing approved senders
- Prevents spoofing of your domain

**DKIM (DomainKeys Identified Mail):**

- Digital signature proving email wasn't modified
- Cryptographic authentication
- Builds sender reputation

**DMARC (Domain-based Message Authentication):**

- Policy for handling failed SPF/DKIM
- Reporting mechanism for authentication failures
- **Required** on your sending domain for bulk senders (~5,000+ messages/day to personal Gmail/Yahoo accounts) since February 1, 2024 — a `p=none` policy is the accepted floor. A missing DMARC record draws Gmail error `4.7.31`.

### 3. Content Quality

Spam filters analyze your email content:

| Factor              | Watch Out For                       |
| ------------------- | ----------------------------------- |
| Spam trigger words  | "Free," "act now," excessive claims |
| Image-to-text ratio | Too many images, too little text    |
| Link quality        | Shortened URLs, suspicious domains  |
| HTML quality        | Broken code, hidden text            |
| Subject line        | ALL CAPS, excessive punctuation     |

### 4. List Quality

Your list directly impacts reputation:

| Metric          | Target | Problem Zone |
| --------------- | ------ | ------------ |
| Bounce rate     | <2%    | >5%          |
| Spam complaints | <0.1%  | >0.3%        |
| Engagement rate | >15%   | <5%          |
| List age        | Fresh  | Years old    |

## Google & Yahoo Bulk Sender Requirements (2024–2026)

Since February 1, 2024, Google and Yahoo enforce a shared set of requirements. They apply to **all senders**, with stricter rules for **bulk senders** — anyone sending close to **5,000 messages or more per day to personal Gmail accounts** (counted across your whole primary domain, including subdomains; the status never expires once you cross it).

**All senders must:**

- Authenticate with **SPF or DKIM**
- Have valid **forward and reverse DNS (PTR)** on the sending IP
- Transmit over a **TLS** connection
- Keep the [Postmaster Tools](https://postmaster.google.com) spam rate **below 0.3%** (aim for under 0.1%)
- Format messages to **RFC 5322**, with a valid `Message-ID` and a single `From:` address that honestly identifies the sender (no deceptive `Re:`/`Fwd:` or emoji-as-graphics)

**Bulk senders (~5,000+/day) must additionally:**

- Set up **both SPF and DKIM**
- Publish a **DMARC** record (`p=none` is an acceptable floor)
- **Align** the `From:` domain with the SPF or DKIM domain
- Support **one-click unsubscribe** — see below

### One-Click Unsubscribe (RFC 8058)

Marketing and subscribed messages must include one-click unsubscribe headers so recipients can opt out from within Gmail/Yahoo in a single click:

```
List-Unsubscribe: <https://yourdomain.com/unsubscribe/...>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
```

- The unsubscribe URL **must accept a POST** request. A `mailto:`-only or plain-link unsubscribe does **not** satisfy the requirement.
- A **clearly visible unsubscribe link must also exist in the message body**.
- Honor unsubscribe requests **within 48 hours (2 days)**.
- **Transactional messages** (password resets, receipts, reservation confirmations) are **exempt**.

### Enforcement is now permanent

Through 2024–2025 non-compliant mail was mostly _deferred_ with temporary `4xx` errors. **As of November 2025, Google escalated to permanent `5xx` (550) rejections** — non-compliant messages are refused outright and not retried. Enhanced status codes tell you what failed: `5.7.25` (PTR), `5.7.27` (SPF), `5.7.29` (TLS), `5.7.30` (DKIM), `4.7.31` (missing DMARC), `4.7.32` (From misalignment), and `4.7.28` (rate limited — stop sending for at least 10 minutes).

> **On Brew:** authentication, TLS, PTR, one-click unsubscribe headers, and body-link enforcement are handled for you on every marketing send. Publish your DNS records (including DMARC), keep your list clean, and watch your spam rate.

## Diagnosing Deliverability Problems

### Warning Signs

🚩 Open rates declining across all [segments](/blog/email-segmentation)
🚩 Bounce rate consistently above 2%
🚩 Spam complaints above 0.1%
🚩 Test emails landing in spam
🚩 Sudden engagement drops
🚩 Subscribers saying they didn't receive emails

### Diagnostic Tools

**Google Postmaster Tools:**

- Gmail-specific reputation data
- Spam rate monitoring
- Authentication status
- Free to set up

**Microsoft SNDS:**

- Outlook/Microsoft reputation
- IP-level data
- Spam trap hits

**MXToolbox:**

- Authentication verification
- Blacklist checking
- DNS record validation

**Mail Tester:**

- Send test email, get score
- Identifies specific issues
- Quick sanity check

### Checking Authentication

Run these checks:

1. SPF: Does your DNS have the correct TXT record?
2. DKIM: Is the signature valid and matching? (Gmail requires a key of 1024 bits or longer — 2048 recommended.)
3. DMARC: Do you have a policy? Is it enforced?
4. Reverse DNS (PTR): Does your sending IP resolve to a hostname, and does that hostname resolve back to the same IP? (Gmail requires matching forward + reverse DNS — error `5.7.25` when missing.)
5. TLS: Is mail transmitted over a TLS connection? (Required for all senders — error `5.7.29` when absent.)

> On a managed platform like Brew, SPF and DKIM are generated for you, TLS and PTR are handled by the sending infrastructure, and DMARC is provided as a record to add. Your job is to publish the records and keep your spam rate low.

## Fixing Deliverability Problems

### Step 1: Fix Authentication

**SPF Setup:**

```
v=spf1 include:youresp.com ~all
```

Replace with your email platform's SPF include.

**DKIM Setup:**
Follow your email platform's instructions to add the DKIM record.

**DMARC Setup:**
Start with monitoring:

```
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
```

Progress to enforcement over time:

```
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
```

### Step 2: Clean Your List

Remove:

- Hard bounces (immediately, automatically)
- Soft bounces (after 3-5 consecutive)
- Inactive subscribers (no engagement 6+ months)
- Role addresses (info@, support@)
- Known spam traps (purchased lists)
- Obvious typos (gmial.com, yaho.com)

### Step 3: Improve Engagement

Higher engagement = better reputation:

- Segment and send relevant content
- Optimize send times for your audience
- [Write better subject lines](/blog/email-subject-lines)
- Make unsubscribing easy (reduces complaints)
- Send consistently (not erratically)

### Step 4: Warm Up New IPs/Domains

If starting fresh or recovering:

| Week | Daily Volume  | Target              |
| ---- | ------------- | ------------------- |
| 1    | 100-500       | Most engaged only   |
| 2    | 500-1,000     | Engaged subscribers |
| 3    | 1,000-5,000   | Broader engaged     |
| 4    | 5,000-10,000  | Most active         |
| 5+   | Normal volume | Full list (engaged) |

Monitor reputation closely throughout.

## Deliverability Best Practices

### List Building

✅ Double opt-in for best quality
✅ Clear expectations at signup
✅ Immediate [welcome email](/blog/welcome-email-sequence)
✅ Regular list hygiene

❌ Never buy lists
❌ Don't add people without consent
❌ Avoid aggressive scraped contacts
❌ Don't use old, cold lists

### Sending Practices

✅ Consistent sending schedule
✅ Segment for relevance
✅ Honor unsubscribes immediately
✅ Monitor engagement metrics
✅ Regular list cleaning

❌ Don't send to cold lists suddenly
❌ Avoid erratic volume spikes
❌ Never ignore bounce handling
❌ Don't send to entire list always

### Content Best Practices

✅ Clean, valid HTML
✅ Plain text version included
✅ Balanced text-to-image ratio
✅ Valid, reputable links
✅ Clear sender identity

❌ Don't use excessive link shorteners
❌ Avoid spam trigger words in excess
❌ Don't hide text (tiny fonts, white on white)
❌ Never mislead with subject lines

## Platform-Specific Tips

### Gmail

- Sender reputation is domain-based
- Engagement heavily weighted
- Tabs (Promotions, Updates) affect visibility
- Enable BIMI for brand visibility

### Microsoft/Outlook

- IP reputation matters more
- Use Microsoft SNDS for monitoring
- Junk mail feedback loop available
- Can be stricter than Gmail

### Yahoo/AOL

- Slower to update reputation
- Consistent sending helps
- Authentication is critical
- Complaint feedback loop available

## Recovering From Deliverability Issues

### If You're Hitting Spam

1. **Pause sending** — Stop making it worse
2. **Identify the cause** — Check reputation, authentication, content
3. **Fix root issues** — Clean list, improve content, verify authentication
4. **Warm up again** — Start with most engaged subscribers only
5. **Monitor closely** — Check placement with every send

### Recovery Timeline

| Severity                     | Recovery Time            |
| ---------------------------- | ------------------------ |
| Minor (temporary dip)        | 1-2 weeks                |
| Moderate (reputation damage) | 4-6 weeks                |
| Severe (blacklisted)         | 2-3 months or new domain |

## Maintaining Good Deliverability

### Weekly Checks

- [ ] Review bounce rates
- [ ] Check spam complaints
- [ ] Monitor open rate trends
- [ ] Verify sends are going out

### Monthly Checks

- [ ] Review authentication records
- [ ] Check Google Postmaster data
- [ ] Clean inactive subscribers
- [ ] Audit content practices

### Quarterly Checks

- [ ] Full list hygiene pass
- [ ] Re-engagement campaigns
- [ ] Platform/IP reputation review
- [ ] Authentication audit

## Deliverability and Email Platforms

Different platforms have different deliverability characteristics:

**Shared IP platforms** (most small business tools):

- Reputation shared with other senders
- Less control but easier setup
- Quality varies by platform

**Dedicated IP** (enterprise/high volume):

- Your reputation only
- More control but more responsibility
- Requires warm-up

[Brew](/) handles deliverability infrastructure for you, with best practices built into the platform.

## The Bottom Line

Deliverability isn't glamorous, but it's essential. The best email in the world is worthless if it never reaches the inbox.

Focus on:

1. **Proper authentication** (SPF, DKIM, DMARC)
2. **Clean, engaged lists**
3. **Relevant, wanted content**
4. **Consistent sending practices**

Ready to send emails that actually arrive? Try Brew for email marketing with deliverability best practices built in.

For the legal split, read transactional emails. For opens after Apple prefetch, read [email metrics that matter](/blog/email-metrics-that-matter). To contact us about this article, write [Brew support](/support).

## How to use this page

**Email deliverability** is whether the message reaches the inbox, not whether the ESP says sent.

**Authentication** is SPF, DKIM, and DMARC on the domain you send from.

**A complaint rate** is the share of recipients who mark the mail as spam.

For example, a bought list can look large in the ESP and still fail Gmail's spam-rate ceiling.

| Move | Why it matters |
| --- | --- |
| Authenticate first | Volume without SPF, DKIM, and DMARC is a fast way to the spam folder |
| Clean quiet names | Dead addresses teach mailbox providers the wrong lesson |

US commercial mail still follows the [FTC CAN-SPAM guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) and [16 CFR 316.3](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316/section-316.3). Bulk sending still has to meet [Gmail's sender requirements](https://support.google.com/a/answer/81126). To contact us about this article, use the support link above.

## Frequently asked questions

### What is email deliverability?

Deliverability is whether your mail reaches the inbox instead of spam or a block. A high delivery rate can still mean most accepted mail landed in junk.

### What does Gmail require from bulk senders?

[Gmail's sender requirements](https://support.google.com/a/answer/81126) apply at 5,000 or more recipients a day to personal Gmail. Authenticate with SPF, DKIM, and DMARC. Put one-click unsubscribe on marketing mail. Stay under a 0.1% spam rate.

### Should transactional and marketing share an IP?

[Yahoo](https://senders.yahooinc.com/best-practices/) tells high-volume senders to split them. A cart campaign that shares an IP with password resets puts receipts in the same reputation bucket as the campaign.

### What is one-click unsubscribe?

[RFC 8058](https://www.rfc-editor.org/rfc/rfc8058.html). You need `List-Unsubscribe` plus `List-Unsubscribe-Post: List-Unsubscribe=One-Click`. A footer link that dumps someone on a preferences page is not enough.