Email Deliverability: How to Reach the Inbox
You can write the perfect email, and it can still fail — quietly, invisibly — if the mailbox provider decides it belongs in spam or refuses it altogether. Deliverability is the discipline of making sure the messages people asked for land where they can see them. It is less glamorous than subject lines, and matters far more.
This guide explains what deliverability really means, why it outranks vanity metrics like the open rate, and the levers you actually control: authentication, sender reputation, list hygiene, content, and the new bulk-sender rules from Gmail and Yahoo. It is education, not a guarantee — no one can promise you the inbox — but understanding the mechanics gets you most of the way.
- Delivered is not inboxed. A message can be accepted by a server and still be filed as spam — that is the gap deliverability closes.
- Authentication is the price of entry. SPF, DKIM and DMARC together prove you are who you claim to be; skip one and you look like a spoofer.
- Reputation is earned slowly. A new domain or IP must be warmed, and engagement — opens, clicks, replies — is what builds trust.
- Clean lists beat big lists. Permission, double opt-in, bounce handling and sunsetting protect the reputation everything else depends on.
- The 2024 rules are now table stakes. Gmail and Yahoo require authentication, one-click unsubscribe and a low complaint rate from bulk senders.
What deliverability actually means
People use "delivered" loosely, but three different outcomes hide inside that word. Delivered means the receiving server accepted your message instead of bouncing it. Inbox-placed means it was accepted and filed in the primary inbox where a human is likely to see it. Spam-placed means it was accepted but routed to the junk folder, where it may never be opened. Your email provider usually reports the first number — the delivery rate — because it is the one they can measure directly. Inbox placement is harder to see and matters far more.
The distinction is the whole game. A campaign can show a 99% delivery rate and still fail if most of those messages were quietly filtered into spam. When people say "our emails aren't getting through," they rarely mean bounces; they mean inbox placement has slipped. Everything below is about closing the gap between "accepted" and "actually seen."
Delivery is whether the door opened. Deliverability is whether you were welcomed into the room or shown to the basement.
Why deliverability beats the open rate
The open rate has always been a rough proxy, and it is now genuinely unreliable. Apple's Mail Privacy Protection and similar features pre-load tracking pixels whether or not a human opened the message, inflating opens. But even a perfectly measured open rate sits downstream of deliverability: you cannot open what you never received. If placement drops, opens drop with it — and you blame your copy when the real problem was the junk folder.
That is why deliverability is the foundation beneath every other email metric. Improve inbox placement and your opens, clicks and revenue all rise together, because more of the audience you already earned is actually reached. It is the quiet multiplier on all the list-building and sequence work covered in email marketing for beginners — get placement wrong and the best campaign performs like your worst.
Proving who you are: SPF, DKIM and DMARC
Email was designed in an era of trust, so by default anyone can put your domain in the "From" line. Authentication closes that hole: a set of DNS records that let receivers verify a message genuinely came from you and was not altered in transit. There are three layers, and mailbox providers increasingly expect all three — skipping any one makes a legitimate sender look like a forger.
SPF (Sender Policy Framework) is a DNS record listing which servers are allowed to send mail for your domain. When a receiver gets your message, it checks whether the sending server appears on that list. It proves the mail came from an authorised source — but on its own it does not protect the visible "From" address, and it breaks when mail is forwarded. The full mechanics are defined in IETF RFC 7208.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message using a private key; receivers verify it against a public key in your DNS. It proves two things: the message really came from your domain, and it was not altered in transit. Unlike SPF, a DKIM signature survives forwarding, which is why it carries more weight with mailbox providers.
DMARC ties the other two together. It tells receivers what to do when SPF or DKIM fails to align with the domain your reader actually sees, and it sends you reports on who is mailing as you. You choose a policy — monitor, quarantine, or reject — so you can watch first, then tighten. It is specified in IETF RFC 7489. Start at p=none to gather reports before enforcing.
Why all three? SPF alone leaves the visible From address unprotected, and DKIM alone can't stop a fraudster signing a lookalike sub-domain. DMARC is the referee that says "these must line up with the domain the human reads" — and only when they do is the message trusted.
Reputation and warming a new sender
Authentication proves your identity; reputation decides whether that identity is welcome. Every provider keeps a running score of your sending domain and IP based on how recipients react — opens, clicks and replies raise it; spam complaints, unknown-user bounces and dead-address hits lower it. A strong reputation is the difference between the inbox and the junk folder for two otherwise identical messages.
Reputation cannot be bought or rushed, which is why a brand-new domain or dedicated IP must be warmed. Blasting ten thousand messages from a cold domain looks exactly like a spammer who just bought a list, and providers will throttle or junk you. Warming means starting with a small volume to your most engaged subscribers and increasing gradually over days and weeks, letting positive signals accumulate before you scale.
Marketing mail is often sent from a subdomain (like news.yourbrand.com) so its reputation stays separate from the domain that sends your critical transactional email. Damage to one does not automatically sink the other.
List hygiene, consent and complaints
Nothing protects reputation like a clean, permission-based list — and nothing destroys it faster than a dirty one. The principle is simple: only mail people who genuinely asked, and keep mailing only the ones who still want it. That starts at signup, which is why building your list the right way matters so much: a list grown through double opt-in, where subscribers confirm by clicking a link, is verified, engaged, and far less likely to generate complaints or hit spam traps.
Hygiene is ongoing, not a one-time cleanup. The table below breaks the routine work into what to watch and why:
| Practice | What it means | Why it protects deliverability |
|---|---|---|
| Permission & double opt-in | Only add people who explicitly confirmed they want your email | Verified, wanted mail earns engagement and avoids complaints |
| Handle bounces | Remove hard bounces (dead addresses) immediately; watch soft bounces | Repeatedly hitting invalid addresses signals a purchased or stale list |
| Manage complaints | Honour unsubscribes instantly and keep the "mark as spam" rate low | Complaint rate is a direct, heavily weighted reputation input |
| Sunset inactive subscribers | Try to re-engage the long-silent, then stop mailing those who stay quiet | Sending to people who never open drags down engagement scores |
Sunsetting feels counter-intuitive — you worked hard for those subscribers — but mailing people who never open teaches providers that your mail is ignorable, hurting placement for the people who do care. A smaller engaged list almost always out-delivers a bloated stale one.
Content and design that trips spam filters
Once you are authenticated and reputable, content is the last thing filters weigh. Modern filters care less about banned words than about signals that, taken together, look like junk. A single "free" won't sink you, but a pile of risky patterns will:
- Text-to-image ratio. One big image with almost no text is a classic spam pattern; balance images with real, readable text.
- Broken or mismatched links. Link shorteners, mismatched display URLs, and links to poor-reputation domains all raise flags.
- Spammy formatting. ALL CAPS SUBJECT LINES, rows of exclamation marks, and "act now!!!" urgency read as junk to filters and people alike.
- Missing plain-text version. A multipart message with both HTML and plain text looks more legitimate than HTML alone.
- No clear unsubscribe. Hiding the exit makes people hit "spam" instead — the most damaging action a recipient can take.
The through-line is honesty: say what the email is, make it easy to read, and make leaving effortless. The same relevance that makes a welcome sequence or automated drip campaign convert is what keeps it out of spam — engaged readers who open and click are the strongest positive signal you can send a provider.
The 2024 bulk-sender rules and how to monitor
In early 2024, Gmail and Yahoo turned long-standing best practice into hard requirements for bulk senders — broadly, those sending large volumes (Gmail draws the line around 5,000 messages a day to its users). Three things are now required rather than recommended, and both providers publish their expectations openly in Google's email sender guidelines and Yahoo's sender best practices.
The three requirements are straightforward: authenticate your mail with SPF, DKIM and DMARC; offer one-click unsubscribe (a list header the client can act on, honoured promptly); and keep your spam-complaint rate low — under 0.3%, ideally well below 0.1%. None of this is exotic; it is the same hygiene above, now enforced.
You cannot manage what you cannot see, so monitor continuously. Google Postmaster Tools and Yahoo's equivalent show your domain reputation, authentication pass rates, and the spam-complaint rate straight from the provider. Seed tests — sending to a spread of test inboxes across providers before a big send — reveal where a campaign is actually landing. Run through this checklist before you press send:
- SPF, DKIM and DMARC are published and passing for this sending domain
- DMARC is at least at p=none with reports being collected and reviewed
- A new domain or IP is being warmed gradually, not blasted
- The list is permission-based, with double opt-in at signup
- Hard bounces are removed and long-inactive subscribers are sunset
- Every email carries a working one-click unsubscribe and a postal address
- Spam-complaint rate is tracked in Postmaster Tools and kept under 0.3%
- A seed test confirmed inbox placement before the full send
Common questions
Why do my emails go to spam even though I have permission?
Permission is necessary but not sufficient. Check the other pillars: are SPF, DKIM and DMARC all passing and aligned? Is your sending domain new and unwarmed? Are you mailing a lot of inactive addresses, which drags engagement down? Placement problems are usually a combination of authentication gaps and weak reputation rather than a single cause.
Do I really need DMARC if I already have SPF and DKIM?
Increasingly, yes. Gmail and Yahoo now expect DMARC from bulk senders, and it is the only one of the three that protects the exact "From" address your reader sees and reports on abuse. Start with a monitoring policy (p=none) so you can watch your reports safely before moving to quarantine or reject.
How long does it take to warm a new sending domain?
There is no fixed number, but plan for weeks rather than days. Start with small volumes to your most engaged subscribers and increase gradually as positive signals build. Rushing the ramp is the fastest way to earn a poor reputation that then takes far longer to repair.
Is a low open rate a deliverability problem?
It can be, but open rates are now distorted by privacy features that pre-load tracking pixels. Treat a sudden drop as a signal to investigate placement — check Postmaster Tools and run a seed test — rather than proof on its own. Clicks and replies are more trustworthy engagement signals.
Where to go next
Deliverability underpins everything else you do with email, so treat it as ongoing maintenance rather than a one-time setup. If you are still assembling the basics, start with email marketing for beginners to get lists, sequences and metrics in order. To grow the engaged, permission-based audience that keeps your reputation healthy, work through the list-building guide. And once subscribers are arriving, put welcome and nurture flows in place with email automation and drip campaigns — engaged readers are the best deliverability insurance there is.