The Email Deliverability Guide to Staying Out of Spam

Your email service provider says you have a 98% delivery rate. But your click rates are declining, replies are drying up, and you suspect something is off.

Here's the gap most senders miss: delivery and deliverability are not the same thing. Delivery means the receiving server accepted your message. Deliverability means it actually reached the inbox, not the spam folder, not the promotions tab, not a black hole where it quietly disappears.

The difference matters more than you'd think. According to Validity's 2023 Email Deliverability Benchmark Report, roughly one in six legitimate marketing emails never reach the inbox. Send a newsletter to 1,000 subscribers, and around 160 of them may never see it.

The financial stakes are real too. Email generates $36 in ROI for every $1 spent, but only when it reaches the inbox. Email Tool Tester's deliverability research found that 10.5% of permission-based emails land in spam, while another 6.4% vanish entirely.

This guide covers everything that affects whether your emails reach the inbox: authentication, provider requirements, sender reputation, domain warm-up, list hygiene, content, and monitoring. Whether you're setting up your first newsletter or troubleshooting why your click rates tanked, you'll find practical steps you can act on today.

Email authentication

If you only do one thing for deliverability, do this. Without authentication, mailbox providers have no way to verify your emails are legitimate, and they'll treat them accordingly.

Three protocols work together to prove your identity. Think of them as answering three different questions:

SPF (Sender Policy Framework) answers where did this come from? You publish a DNS record listing the servers authorized to send email on your behalf. When a receiving server gets your message, it checks that list. If the sending server isn't on it, the email fails SPF.

DKIM (DomainKeys Identified Mail) answers has this been tampered with? It adds a cryptographic signature to your outgoing messages. The receiving server uses a public key in your DNS records to verify the message arrived intact.

DMARC (Domain-based Message Authentication, Reporting & Conformance) answers is this really who they say they are? DMARC ties SPF and DKIM together by requiring that the domain in your "From" header aligns with the domain used in SPF or DKIM checks. It also lets you set a policy - monitor, quarantine, or reject - and receive reports on authentication failures.

SPF checks where, DKIM checks what, DMARC checks who. You need all three.

How much does this matter? After Google began requiring email authentication, unauthenticated messages reaching Gmail users dropped by 75%. Yet only 33.4% of the top 1 million websites have valid DMARC records. If you set up authentication properly, you're already ahead of most senders.

Setting up DMARC

You set up DMARC by adding a TXT record to your DNS at _dmarc.yourdomain.com. The record specifies your policy level and where to send reports.

DMARC has three policy levels. Progress through them gradually:

• p=none - Monitor mode. Emails are delivered normally, but you receive reports on authentication failures. Start here.
• p=quarantine - Failed emails go to the spam folder.
• p=reject - Failed emails are blocked entirely.

Begin with p=none and analyze your DMARC reports for a few weeks. This lets you catch legitimate email sources that aren't properly authenticated, like a third-party tool sending on your behalf, before you start enforcing. Once your reports are clean, move to p=quarantine, then eventually p=reject.

What Gmail, Yahoo, and Microsoft require

Authentication isn't just a best practice anymore - the three largest mailbox providers now enforce it. If you don't comply, your emails won't just land in spam. They'll be rejected outright.

Gmail

Google's email sender guidelines classify anyone sending 5,000 or more messages per day to Gmail accounts as a bulk sender. That classification is permanent - once you hit the threshold, you can't go back by reducing volume.

Bulk senders must:

• Authenticate with SPF, DKIM, and DMARC (at minimum p=none)
• Keep spam complaint rates below 0.10%, and never exceed 0.30%
• Support one-click unsubscribe for marketing emails (via List-Unsubscribe and List-Unsubscribe-Post headers)
• Use TLS for sending

Enforcement has been fully active since November 2025. Non-compliant mail is now rejected outright with permanent 5xx error codes, not filtered to spam but bounced before it ever reaches a mailbox.

Yahoo

Yahoo's sender requirements mirror Gmail's: SPF, DKIM, and DMARC with at least p=none. Spam complaint rates must stay below 0.30%. One-click unsubscribe is required for marketing messages. Yahoo hasn't published a specific volume threshold but applies these rules to anyone sending at "significant volume."

Microsoft Outlook

Microsoft followed a similar approach with the same requirements for domains sending over 5,000 emails per day to Outlook.com, Hotmail.com, or Live.com. Same deal: SPF, DKIM, and DMARC must be in place, and non-compliant messages are rejected outright.

The common thread

All three providers require the same core setup: SPF + DKIM + DMARC, one-click unsubscribe for marketing emails, and spam complaint rates below 0.30%. If you're sending newsletters, this is table stakes.

Sender reputation

Even with authentication in place, mailbox providers use your sender reputation to decide whether your emails land in the inbox or the spam folder. Your reputation carries more weight than your subject line, your email content, or your sending volume.

It has two components:

IP reputation is tied to the sending server's IP address. If you're on shared infrastructure, other senders on the same IP can drag your reputation down. Dedicated IPs give you full control but require enough volume to maintain.

Domain reputation is tied to your domain name. Unlike IP reputation, domain reputation follows you even if you switch email providers. It's harder to reset and takes longer to build. This is the one that matters most.

What affects your reputation

Mailbox providers watch six signals:

1. Spam complaints - The most impactful signal. Even a small percentage of recipients clicking "Report Spam" can tank your reputation overnight.
2. Bounce rates - High hard bounce rates suggest poor list quality. Providers notice.
3. Engagement - Opens, clicks, and replies tell providers your content is wanted. Low engagement says the opposite.
4. Sending patterns - Consistent volume and cadence signal legitimacy. Erratic spikes look suspicious.
5. Spam trap hits - Spam traps are email addresses that don't belong to real people. Some are old addresses that were abandoned and later repurposed by mailbox providers to catch senders with outdated lists. Others are placed on websites specifically to identify scrapers and list buyers. Sending to these addresses is a red flag that's hard to recover from.
6. Unsubscribe rates - High rates suggest recipients didn't want your emails in the first place.

How to check your reputation

Several free tools let you see where you stand:

• Google Postmaster Tools - Shows your domain and IP reputation for Gmail delivery, plus spam rates and authentication results. If Gmail makes up a big chunk of your subscribers, this is essential.
• Sender Score - Rates your IP on a scale of 0-100. Aim for 80+; below 70 needs attention.

We recommend checking your reputation every few months, and weekly if you're in the middle of a warm-up or recovering from a deliverability dip.

Domain warm-up

If you're just getting started with a small list, a few hundred contacts or fewer, you can skip ahead to list hygiene. At that volume, your sends are low enough that warm-up isn't a concern. Just focus on authentication and good list practices, and you'll build reputation naturally as your audience grows.

For senders migrating an established list to a new domain or email service provider, warm-up matters. Mailbox providers have zero history to judge a new domain on, and unknown senders don't get the benefit of the doubt, even on shared infrastructure with a solid IP reputation.

A practical warm-up schedule

The goal is simple: start small, send to your best subscribers, and ramp up gradually.

Week 1: Send 100–200 emails per day. Only send to your most engaged subscribers, people who have opened or clicked in the last 15–30 days. These recipients are the most likely to engage, which builds positive reputation signals from day one.

Weeks 2–4: Increase daily volume by 15–20% each week. Continue prioritizing engaged subscribers, then gradually expand to your broader list.

Weeks 5–8: By now, you should have enough sending history to reach your normal volume. Keep a close eye on your metrics during this stretch.

If bounces or spam complaints spike at any point, slow down and investigate before increasing volume again. Pushing through warning signs during warm-up is how new domains get burned.

Separate your sending streams

Don't send marketing newsletters and transactional emails (password resets, account confirmations) from the same domain or IP. If your marketing emails damage your reputation, you don't want that dragging down delivery of your transactional messages, the emails your users actually need.

Use a subdomain (like news.yourdomain.com) for marketing email to isolate reputation risk from your primary domain.

List hygiene

A dirty email list is one of the fastest ways to destroy your sender reputation. At least 23% of an email list degrades every year as people change jobs, abandon addresses, or switch providers, yet many senders never clean their lists at all. The ones who do have a real edge.

Bounce rate benchmarks

Keep your bounce rate below 4%. Above that threshold, email service providers (including Sendfully) will pause or restrict your sending.

Hard bounces are permanent failures, like sending to an address that no longer exists. Remove these immediately. Soft bounces are temporary, often caused by a full mailbox or an overloaded server, and they can resolve on their own. But if the same address keeps soft bouncing across several campaigns, it's time to cut it.

Spam complaint thresholds

Gmail recommends keeping your spam complaint rate below 0.10%, roughly 1 complaint per 1,000 emails. The hard ceiling is 0.30%. Exceed that, and your deliverability will drop across your entire list, not just for the subscribers who complained. Contacts who file a spam complaint should be removed from your list right away.

Practical list hygiene steps

Use double opt-in. When someone subscribes, send a confirmation email asking them to verify. This filters out typos, fake addresses, and bots. Many email marketers skip double opt-in, but it's one of the most effective ways to keep spam traps and invalid addresses off your list.

Remove inactive subscribers. Flag anyone who hasn't opened or clicked in 6–12 months. Run a re-engagement campaign first, a simple "Do you still want to hear from us?" email. If they don't respond, remove them. Keeping disengaged subscribers around drags down your engagement metrics and increases the chance they'll mark you as spam.

Never buy or rent email lists. Purchased lists are full of spam traps, addresses specifically designed to catch senders with poor practices. Hitting a spam trap can get your domain blocklisted, and recovering from that is painful.

Clean regularly. Quarterly cleaning - removing bounces, suppressing unengaged contacts, verifying addresses - keeps your list healthy.

How to avoid the spam folder

Authentication and reputation matter more than content for deliverability. But once those foundations are solid, your email content can still trip spam filters if you're not careful.

The numbers back this up: 80% of recipients mark emails as spam simply because they "look like spam." Your design and formatting choices send signals to both readers and automated filters.

Formatting guidelines

Maintain a 60/40 text-to-image ratio. SpamAssassin and similar filters flag emails that are image-heavy with little text. Emails that are just one big image with a link are likely to get flagged.

Include a plain-text version. Sending both HTML and plain-text versions signals legitimate intent.

Limit links. Too many links in a single email can trigger filtering. Keep it reasonable, and avoid URL shorteners - they mask the destination, which is a technique associated with phishing and spam.

Subject line rules

Skip the tricks. Misleading RE: or FW: prefixes, ALL CAPS, excessive punctuation, and emoji-heavy subject lines all correlate with spam filtering. Write subject lines that accurately describe your content.

Watch your word choice when combined with other spam signals. Words like "Free," "Buy now," "Act fast," and "Limited-time offer" don't automatically trigger spam filters on their own, but they add to an overall spam score. If your authentication is weak or your reputation is shaky, these words push you over the edge.

Make unsubscribe easy

This sounds counterintuitive, but making it easy to unsubscribe actually improves your deliverability. When someone can't find the unsubscribe link, they hit "Report Spam" instead, and that's far more damaging to your reputation than an unsubscribe.

Place your unsubscribe link clearly in the footer, and make sure your emails include List-Unsubscribe headers for one-click unsubscribe.

Maintaining email deliverability

Deliverability isn't something you set up once and forget about. It requires ongoing attention, but most senders never check their inbox placement after the initial setup.

Metrics to track

• Inbox placement rate - The percentage of emails that reach the inbox (not just get accepted by the server). You can't measure this from your sending data alone. Tools like GlockApps test your placement across major providers. If this drops below 90%, investigate immediately.
• Bounce rate - Track hard and soft bounces separately. A sudden spike in hard bounces means something is wrong with your list.
• Spam complaint rate - Monitor via feedback loops. Stay below 0.08%.
• Open and click rates - Declining engagement is often the first warning sign. If your click rate drops without a change in content or list size, dig into it.
• Unsubscribe rate - A gradual increase may signal content fatigue. A sudden spike after a specific campaign tells you something went wrong.

Tools for monitoring

Google Postmaster Tools is free and shows Gmail-specific metrics: domain reputation, IP reputation, spam rate, authentication results, and delivery errors. If Gmail makes up a meaningful portion of your subscribers, set this up immediately.

MXToolbox and similar services check whether your domain or IP has been added to any blocklists. Landing on a major blocklist can cause a sudden drop in deliverability.

Send consistently

Spammers send in unpredictable bursts. Consistent sending at predictable intervals - weekly, biweekly, monthly - signals to mailbox providers that you're legitimate. If you normally send once a week and suddenly blast three campaigns in a day, expect filtering.

Pick a cadence that matches your content capacity and stick to it. Your subscribers will develop expectations around your schedule, and mailbox providers will develop confidence in your sending patterns.

Putting it all together

Email deliverability comes down to a few things done consistently:

1. Authenticate your domain with SPF, DKIM, and DMARC. Non-negotiable.
2. Meet provider requirements from Gmail, Yahoo, and Microsoft. Support one-click unsubscribe and keep spam complaints under 0.10%, as required by Gmail.
3. Build and protect your sender reputation. Check it regularly with free tools like Google Postmaster Tools and Sender Score.
4. Warm up new domains gradually. Start small, send to engaged subscribers, and ramp up over weeks, not days.
5. Maintain list hygiene. Use double opt-in, remove bounces immediately, and cut inactive subscribers after a re-engagement attempt.
6. Write clean, clear emails. Keep a healthy text-to-image ratio, skip the spam tricks, and make unsubscribing easy.
7. Monitor continuously. Track inbox placement, bounce rates, and engagement. Catch problems before they snowball.

The senders who consistently reach the inbox are the ones who treat deliverability as an ongoing practice, not a box they checked once during setup.