Email deliverability basics: how to avoid spam and reach the inbox

Email deliverability is whether a message that was accepted by the receiving mail server ends up in the inbox, the spam folder, or nowhere at all. Three things determine the outcome: authentication, sender reputation, and the content and list behind the send.

Authentication: the baseline, not the whole story

Three DNS records do the authentication work:

• SPF lists which mail servers are allowed to send on behalf of your domain. A receiving server checks the sending IP against this list.
• DKIM signs outgoing mail with a private key; the receiver checks the signature against a public key published in DNS, confirming the message wasn't altered in transit.
• DMARC tells receivers what to do when SPF or DKIM fail, and requires that at least one of them pass *and* align with the visible "From" domain.

Passing all three is table stakes at Gmail, Yahoo and Outlook in 2026 - without them, a message is far more likely to be junked or rejected outright, especially from an unfamiliar domain. But passing authentication does not guarantee inbox placement; it just removes one reason to block you.

Sender reputation: the part that compounds

Reputation is built from how recipients and mailbox providers respond to your mail over time:

• Complaint rate (recipients marking mail as spam) - the single most damaging signal.
• Engagement (opens, replies, mail moved out of spam) - positive signal, though complicated by Apple Mail Privacy Protection and Gmail's image-proxy prefetching, both of which generate "opens" that aren't a real human reading the mail.
• Bounce rate - sending to invalid addresses signals poor list hygiene.
• Spam-trap hits - sending to addresses that exist only to catch poor list practices, usually from old, unmaintained, or purchased lists.

Reputation is tracked per sending domain (and increasingly per subdomain) rather than purely per IP at the major providers now, which is why a new domain - even one sending from a reputable ESP - starts with no track record and needs to build one gradually.

Why a new domain needs to warm up

Sending high volume immediately from a brand-new domain looks identical, from the receiving server's perspective, to a spammer standing up fresh infrastructure to evade a block. Mailbox providers respond by rate-limiting or filtering the domain until it demonstrates a pattern of legitimate sending - gradually increasing volume while maintaining low complaints and bounces is what "warming up" means in practice.

What actually moves a message to spam

• A spam-rate above Google's bulk-sender threshold of 0.30% on that domain (aim for under 0.10% as working headroom).
• Sending to addresses that haven't engaged in a long time, especially in large batches.
• A sudden volume spike with no sending history to support it.
• Content patterns associated with abuse - excessive links, URL shorteners, spoofed sender names - though content filtering is a much smaller factor today than authentication and reputation.

What not to do

• Don't buy lists. Purchased lists are the fastest route to spam-trap hits and a ruined domain reputation.
• Don't assume "delivered" means "inboxed" - a 250 OK response from the receiving server only means it accepted custody of the message.
• Don't ignore Gmail's Promotions tab in your placement numbers. Promotions still carries the INBOX label internally, so label-based checks can report mail as "inbox" when it never reached Primary.

A minimal authentication record set, worked out

For a domain example.com sending through a single ESP, a working baseline looks like this:

example.com.                TXT  "v=spf1 include:_spf.yourespprovider.com ~all"
esp1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."
_dmarc.example.com.          TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; fo=1"

p=none here means "report on failures, don't block anything yet" - the correct starting policy while you confirm every legitimate sending source is actually included in SPF and signing with DKIM. After two to four weeks of clean aggregate (rua) reports, move to p=quarantine and eventually p=reject.

A side-by-side comparison of outcomes

That last row is the one worth checking directly: authentication passing isn't enough on its own - the DKIM signing domain (the d= tag) has to match the visible From domain for DMARC alignment to succeed.

MailPilot handles the gradual-volume warm-up for new or re-activated mailboxes over OAuth or SMTP/IMAP, checks SPF/DKIM/DMARC against what's actually published, and runs real inbox-placement tests per provider - so the basics above are measured rather than assumed.