Email deliverability, explained for an owner.

SPF, DKIM, and DMARC are three DNS records the sending domain must publish for mail to reach the inbox at Gmail, Yahoo, and Microsoft. SPF lists which services are allowed to send mail for the domain. DKIM signs each outgoing message so the recipient can verify it came from the authorized platform. DMARC is the policy telling mailbox providers what to do when a message fails SPF or DKIM, and where to send reports. All three are hard requirements for any sender over 5,000 messages per day to Gmail or Yahoo users, as of February 2024. For an SMB sender below that volume, publishing all three is still the baseline, because the policies are becoming universal.

A safe starting DMARC policy for a small sender is p=none with a rua= reporting address, which asks mailbox providers to send authentication failure reports without changing how any mail is treated. After two to four weeks of clean reports (no legitimate sources failing authentication), the policy moves to p=quarantine, which routes failures to spam. After another two to four weeks of clean reports, the policy moves to p=reject, which rejects failures entirely. Starting at p=reject before confirming reports are clean is the single most common deliverability mistake, because it silently rejects legitimate mail from authorized but unaligned sources (invoices, calendar invites, support systems).

The spam complaint rate ceiling for a sender in 2026 is 0.3 percent, as published by Google in its bulk sender guidelines, with a target of staying under 0.1 percent on healthy sends. A send that crosses 0.3 percent complaint rate has its sender reputation downgraded at Gmail, which routes future mail to spam or the Promotions tab for days to weeks afterward. The practical implication: a single bad send to a stale segment can degrade deliverability for every subscriber on the domain. The protection is to exclude dormant segments from broadcasts, cap send volume growth to 50 percent per week during warm-up, and watch Google Postmaster Tools weekly.

Google Postmaster Tools (postmaster.google.com) is Google's free dashboard showing a sending domain's reputation at Gmail. It reports spam complaint rate, delivery errors, authentication pass rate, and overall domain reputation (High, Medium, Low, Bad). Setup takes one hour: verify the sending domain by publishing a DNS record Google provides, wait 24 to 48 hours for data to populate, then check it weekly. For an SMB sender, this is the single most useful deliverability tool and it costs nothing. Microsoft and Yahoo offer similar programs (SNDS for Microsoft, Yahoo Sender Hub), both worth signing up for.

A new sending domain is warmed up by increasing send volume gradually across the first two to four weeks, starting at 500 to 1,000 messages per day and no more than doubling the daily volume per week. The warm-up should go to the most engaged segment of the list first (fully-engaged, recent subscribers), because high open and click rates on early sends signal to mailbox providers that the new domain is legitimate. Sending the first large batch to a cold or imported list spikes complaints, which assigns the new domain a bad reputation at Gmail before it has had a chance to earn a good one.

If the sending domain is already on a blocklist (Spamhaus, SURBL, SpamCop, Barracuda), the practical first step is checking which specific list through a free multi-blocklist checker such as MXToolbox. Most blocklists have a self-service de-listing process that takes 24 to 72 hours. The important part is identifying what caused the listing first, because a de-listing without a fix (removing the bad list source, improving list hygiene, pausing the problematic sequence) results in a relisting within the week. Repeated listings make de-listing harder each time.

Shared sending IPs rarely cause deliverability problems for an SMB sender below 100,000 messages per month, because the sending platform (HubSpot, Mailchimp, Klaviyo) manages the IP pool's reputation. The sending domain's own reputation is what matters at the mailbox provider, not the IP. Dedicated IPs are worth paying for only above 500,000 messages per month, where the sender has enough volume to maintain the IP's own reputation. For a 10 to 50 person B2B company, shared IPs are the right default; the deliverability work goes into domain authentication and list hygiene instead.

One-click unsubscribe is RFC 8058, which requires bulk senders to honor an unsubscribe request made by a single click or HTTP POST, without a confirmation page. Gmail and Yahoo made this a hard requirement for senders over 5,000 messages per day, as of February 2024. Implementation is on the sending platform's side: it must emit two headers on every outbound message, List-Unsubscribe (with both mailto: and https:/ URIs) and List-Unsubscribe-Post: List-Unsubscribe=One-Click. Every major sending platform supports it. The owner's job is to verify the headers are being sent, by viewing the raw headers of a received message after the next send.