How to improve email deliverability, in the order that works

Fix deliverability in four passes, in this order: authentication and alignment, sending reputation, list quality, then monitoring. The ordering matters more than the list itself, because an authentication failure invalidates every measurement downstream, and a stale list defeats every infrastructure improvement upstream.

One clarification first, because it causes more confusion than any other term. Delivery rate is not deliverability. A 99.4% delivery rate means 99.4% of your messages were accepted by the receiving server. It says nothing about whether they went to the inbox, to Promotions, or to spam. Deliverability is placement, and your ESP cannot see it — only a seed network or real recipient feedback can.

Pass 1: Authentication and alignment

1. Publish SPF, DKIM and DMARC, then confirm they actually pass. Publishing is not passing. Open a message as delivered and read the Authentication-Results header. You want spf=pass, dkim=pass and dmarc=pass with the header.from domain aligned to whichever of SPF or DKIM authenticated. DKIM alignment is the one to rely on, because it survives forwarding and SPF does not.

2. Audit the SPF record against its limits. SPF allows a maximum of 10 DNS-querying mechanisms and 2 void lookups per evaluation. Each include: can expand into several. Exceeding either limit produces permerror, which many receivers treat as a failure. Flatten or consolidate includes, and publish exactly one SPF record per domain — two records is an automatic permerror.

dig txt example.com +short
"v=spf1 include:_spf.google.com include:amazonses.com ~all"

3. Move DMARC from `p=none` to enforcement. p=none is a monitoring mode: it gives you reports and no protection. Read the aggregate reports until every legitimate source authenticates, then move to p=quarantine with a pct ramp if your tooling still supports it, then p=reject. Google and Yahoo require bulk senders to publish at least p=none, so publishing nothing is not an option. Be aware DMARC was re-standardised as DMARCbis, which replaced the Public Suffix List with a DNS tree walk, removed pct, rf and ri, and added np, psd and t — if you rely on pct, plan for its removal.

_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s"

4. Lock down the mechanical requirements. Outbound TLS enabled. A PTR record for every sending IP that resolves forward to the same IP. An EHLO name that matches the PTR. Valid RFC 5322 formatting — one From header, a Message-ID, a Date. These are not optimisations; Google's bulk sender requirements name them, and malformed mail is rejected before any content is scored.

Current provider requirements, briefly: Google and Yahoo's bulk sender rules took effect in February 2024 — SPF and DKIM, a DMARC record, aligned From, TLS, one-click unsubscribe honoured within two days, and a spam complaint rate under 0.3%. Microsoft announced equivalent requirements for high-volume senders to Outlook.com, with enforcement beginning in May 2025. Every requirement is evaluated per sending domain, so a second or third domain doubles and triples the maintenance surface rather than inheriting the first one's standing.

Pass 2: Build sending reputation before you need it

5. Warm up every new domain and every new mailbox. A domain with no sending history has no reputation, and receivers treat unknown as suspicious. Warm-up means a low initial daily volume, a gradual ramp, and real two-way engagement — opens, replies, moves out of spam — not just outbound volume. A new domain should also simply exist for a few weeks before it starts sending; age is an input.

6. Ramp volume gradually, and never spike. As a working rule, do not increase daily volume by more than about 30–50% day over day while reputation is young, and watch deferrals as your signal. A 421 or 450 is the receiver telling you to slow down. Backing off is the correct response; retrying harder converts a defer into a block.

7. Separate mail streams. Put transactional mail, marketing mail and cold outreach on different subdomains with different From addresses, and ideally different sending infrastructure. A campaign that collects complaints should not be able to take your password resets down with it. Keep the organisational domain itself for person-to-person mail.

8. Choose shared or dedicated IPs on volume, not prestige. A dedicated IP is only better if you send enough, consistently enough, to keep a reputation warm — low, irregular volume on a dedicated IP looks like a cold IP every time. Below that threshold, a well-managed shared pool at a reputable provider gives you better placement.

Pass 3: Clean the list, because this is where spam placement starts

9. Remove hard bounces immediately and enforce the suppression list. A suppression list that exists but is not applied at send time is the most common cause of a sudden relapse. Keep hard bounces under 1%, treat 2–5% as a problem and above 5% as a stop-sending event.

10. Verify imported, old and pattern-generated lists before the first send. Syntax and MX checks are deterministic. SMTP probes are unreliable at Microsoft 365, which commonly accepts at RCPT TO and bounces later, so hold "unknown" and catch-all verdicts out of bulk sends rather than mailing them hopefully.

11. Sunset disengaged addresses. An address that has not opened, clicked or replied in six to twelve months is a reputation liability: it drags down engagement signals and it is where recycled spam traps live. Run one re-engagement attempt, then stop sending. Removing addresses feels like losing reach; it is the single most reliable way to raise placement.

Pass 4: Make it visible

12. Honour one-click unsubscribe properly. Send both List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click on bulk mail, and make the endpoint act on a POST within two days with no login and no second click. Easy opt-out is what keeps complaints under the 0.3% threshold.

13. Monitor the three numbers that matter. Spam complaint rate (target under 0.1%), hard bounce rate (under 1%), and inbox placement per provider. Google Postmaster Tools gives you spam rate and authentication rates — note the domain reputation chart was retired, so use the spam rate and user-reported spam graphs instead. Microsoft SNDS covers your IPs at Outlook.com.

14. Check blocklists on a schedule, not after a crisis. Spamhaus (SBL/XBL/CSS/DBL), Barracuda, SpamCop, UCEPROTECT and Abusix, plus URI lists for your link domains. Validity launched the Heatwave blocklist on 3 September 2026. Remove any check against SORBS, which shut down in June 2024.

15. Measure placement with seeds, continuously. Placement is the only metric that answers the actual question. Run it per provider, because Gmail, Microsoft and Yahoo disagree constantly, and run it continuously so a decline shows up as a trend rather than as a quarter of missing replies.

What not to do

• Do not start with subject lines and spam-word lists. Content is the last 5%.
• Do not jump to p=reject before you have read your DMARC reports.
• Do not change domain, IP, ESP and template in the same week — you lose all attribution.
• Do not request blocklist delisting before stopping the cause; the listing returns and repeat listings are harder to clear.
• Do not test placement by mailing your own inbox. Your own mailbox has engagement history with you.
• Do not buy lists. Nothing in this article survives that decision.

MailPilot runs passes 2 and 4 continuously: warm-up over OAuth (Gmail, Outlook) or SMTP/IMAP including SendGrid, Amazon SES, Mailgun and Postmark, SPF/DKIM/DMARC checks against delivered mail, daily per-mailbox reputation tracking, and real per-provider inbox placement from a seed-inbox network.