Email deliverability is the difference between a campaign that gets read and one that quietly disappears in spam. You can have a great offer, a clean design, and a perfect landing page, yet still lose the send because your domain, list, or message looks risky to mailbox providers.
Authenticate your domain with SPF, DKIM, and DMARC; send only to people who asked to hear from you; remove bounces and inactive contacts; and measure clicks, conversions, complaints, and bounces instead of relying on opens alone.
Why this matters
Deliverability affects revenue, support workload, and your sender reputation. A few campaigns sent to old or purchased contacts can increase complaints and hard bounces. Once providers see a pattern, even your useful messages may be filtered.
Think of your sender reputation like a credit history. One late payment is recoverable; repeated problems make every future request harder. The safest approach is to fix the basics before increasing volume.
1. Confirm that people expect your email
Permission is the first deliverability control. A contact should be able to answer, “Why did I receive this?” Keep the form copy specific: say what you send, how often you send it, and whether you will share the address.
Use a clear signup promise
“Get one practical email tip every Friday” is clearer than “Subscribe for updates.” Put the promise beside the form and repeat it in the confirmation message.
Use double opt-in when appropriate
Double opt-in asks the subscriber to confirm the address before regular mail begins. It adds friction, but it catches typing mistakes and helps prove that the address requested the content.
2. Authenticate the sending domain
Authentication tells a receiving provider whether your message is allowed to use your domain. The three records work together:
| Control | Plain-English job | What to check |
|---|---|---|
| SPF | A guest list of servers allowed to send | One TXT record, approved sources, lookup limit |
| DKIM | A tamper-evident signature on the message | Selector exists and signature passes |
| DMARC | Rules for failures plus reporting | Alignment, reports, gradual enforcement |
Start with the sending services you actually use: your newsletter provider, transactional email service, CRM, and any self-hosted server. Do not copy a DNS value from another domain.
SPF: publish one record
A simplified SPF record looks like this:
v=spf1 include:example-esp.com include:transactional.example -allReplace the example mechanisms with the values your providers document. Keep one SPF record per domain. Multiple SPF records cause a permanent error, and SPF also has a DNS lookup limit.
DKIM: enable the provider signature
Your provider normally gives you a selector and a public key, often as a CNAME or TXT record. Publish the exact record, then send a test message and inspect the headers for dkim=pass. A custom DKIM domain is preferable because it helps align the signature with your visible From address.
DMARC: begin with monitoring
DMARC uses SPF and DKIM results and checks whether they align with the From domain. Start with a monitoring policy:
v=DMARC1; p=none; rua=mailto:[email protected]Review reports for legitimate sources before moving to p=quarantine and eventually p=reject. A policy is only as safe as your sender inventory.
3. Check the list before every send
List hygiene is not a once-a-year cleanup. Before scheduling a campaign, remove hard bounces, suppress unsubscribes, and check whether a segment includes an old import.
- Hard bounce: suppress it immediately.
- Soft bounce: retry according to your provider’s rules, then review repeated failures.
- Complaint: suppress the address and investigate the source.
- Inactive contact: send a permission reminder or re-engagement message, then stop mailing if there is no response.
Keep the original signup source and consent date where possible. That context helps you answer support questions and identify a form or integration that is collecting low-quality addresses.
4. Make the message easy to trust
Mailbox filters evaluate patterns across the sender, audience, and content. A message does not need to be boring; it needs to be understandable.
Subject and From line
Use a recognizable From name and a reply address that someone monitors. Avoid pretending to be a reply, hiding the sender, or making a promise that the landing page does not keep.
Example:
- Weak: “URGENT!!! You have been selected!!!”
- Clear: “A three-step checklist for cleaner campaign launches”
Links and images
Use descriptive anchor text, HTTPS destinations, and a working unsubscribe link. Test the message with images disabled. A useful text version protects the reader experience when images are blocked.
Unsubscribe without friction
A visible unsubscribe link is a trust signal. Process it promptly, keep the address suppressed, and make sure a later import cannot silently reactivate it.
5. Warm up volume changes
If you normally send to 2,000 people, do not suddenly send to 100,000. Large changes can look like a compromised account. Increase volume in stages, beginning with your most engaged subscribers.
Warm-up is not a magic number. Watch bounces, complaints, delays, clicks, and replies after each step. Pause when an indicator changes sharply.
6. Measure what actually predicts success
Apple Mail Privacy Protection makes some open measurements less dependable. Treat opens as directional. Use metrics closer to the business outcome:
| Metric | What it tells you | What to do when it changes |
|---|---|---|
| Hard bounce rate | Address quality and list age | Suppress failures and review acquisition sources |
| Spam complaints | Whether people felt surprised or misled | Review permission, frequency, and expectations |
| Click-through rate | Interest in the offer | Improve relevance and the call to action |
| Engaged sessions | What visitors do after clicking | Check landing-page speed and message match |
| Conversion rate | Whether the campaign achieved its goal | Compare segments and one change at a time |
There is no universal “good” rate for every list. Compare similar campaigns sent to similar audiences. A high click rate with no conversions often points to a landing-page or offer problem rather than an email problem.
7. Troubleshooting: what if delivery suddenly drops?
Check authentication first
Send a test to an account you control and inspect the headers. Look for SPF and DKIM pass results and a DMARC result that aligns with the From domain.
Check recent changes
Review DNS edits, provider changes, new forms, imported contacts, and unusual login activity. A new integration may be sending without authentication or consent.
Check the campaign audience
Compare the affected segment with a recent healthy segment. Look for old addresses, a new source, a sudden volume jump, or a missing suppression list.
Reduce risk while investigating
Pause broad campaigns, send only to engaged contacts, and contact your provider’s deliverability team with timestamps and message IDs. Do not keep retrying the same failing send.
Common mistakes marketers make
- Publishing two SPF records.
- Sending from a new domain before authentication is complete.
- Measuring success with opens alone.
- Keeping inactive contacts forever.
- Changing subject, audience, offer, and landing page at the same time.
- Using a visible unsubscribe link that does not actually suppress the contact.
Quick pre-send checklist
| Check | Question |
|---|---|
| Permission | Did these people request this type of email? |
| Authentication | Do SPF, DKIM, and DMARC pass and align? |
| Audience | Are bounces, unsubscribes, and complaints suppressed? |
| Message | Are the From name, links, and unsubscribe path clear? |
| Measurement | Are UTMs and the conversion event ready? |
Conclusion
A reliable email deliverability checklist starts with permission and authentication, then continues through list hygiene, message testing, measured volume, and post-send review. Work through the list before your next campaign, record the result, and fix one cause at a time.
FAQ
Do SPF and DKIM both need to pass?
DMARC can pass when either SPF or DKIM passes and aligns, but having both configured gives you resilience when a provider changes its return path.
Should I use a strict DMARC policy immediately?
Usually no. Monitor first, identify legitimate senders, then enforce gradually.
Are opens useless after Apple MPP?
No, but they are less reliable. Use clicks, engaged sessions, conversions, bounces, and complaints as stronger decision signals.
How often should I clean my list?
Review failures after every send and run an engagement review regularly. The right interval depends on sending frequency and list age.
Next, review your domain records and run a small test campaign to a controlled segment before mailing the full audience.