Deliverability is plumbing. When the plumbing is right, nobody notices it; when it is wrong, nothing else you do matters. The three records below are the foundation.

SPF — who is allowed to send

SPF is a list of servers permitted to send mail for your domain, published as a DNS TXT record. It typically includes your mailbox provider and every tool that sends on your behalf.

The common mistake is exceeding the ten lookup limit, which silently invalidates the whole record. Keep the list short, and remove tools you no longer use.

DKIM — proof the message was not altered

DKIM adds a cryptographic signature to each message. Your provider generates a key pair and gives you a selector and public key to publish. Receivers use it to confirm the message genuinely came from your domain and was not modified in transit.

DMARC — the policy

DMARC tells receivers what to do when SPF or DKIM fail, and where to send reports. Start with a policy of none, collect reports for two to four weeks, fix whatever the reports reveal, and only then move to quarantine and finally reject.

The sending habits that keep you in the inbox

  • Use a separate domain for cold outreach, not your main business domain
  • Warm the inbox for two to three weeks before any real volume
  • Keep under thirty to fifty emails per inbox per day
  • Personalise the first line so the message does not look bulk
  • Plain text, at most one link, always a working opt out
  • Send from a real person, not a no-reply address

Monitor weekly, not monthly

Watch bounce rate and complaint rate every week. A sudden drop in open rates usually signals a reputation problem that started days earlier, and early detection is the difference between a warning and a blocklist.

Also monitor your DMARC reports. They reveal who is sending as your domain — including spammers you have never heard of, which is one of the reasons DMARC exists in the first place.

What to do when something breaks

Pause sending immediately. Do not send more volume to fix a deliverability problem; that makes it worse. Check the records, check the blacklists, check the content, and then restart slowly with a smaller, better-targeted list.

Quick answers to common questions

Do I need all three records? Yes. They cover different failures, and receivers expect all three on a serious sending domain.

Can I skip a warm-up? No. A fresh inbox that suddenly sends hundreds of messages looks exactly like abuse.

Should I use my main domain? Usually not. A separate domain contains any damage and keeps the primary brand safe.

How long does recovery take? A warning can clear in days; a blocklist can take weeks, which is why prevention is cheaper.

Does a high open rate mean I am safe? Not necessarily, since some mail clients hide or prefetch tracking pixels.

Two habits support everything above. Start from a list that is genuinely verified, covered in how to verify email addresses, and keep the sending volume human. The end-to-end process for a safe list is in how to build a verified B2B email list.

Keep a written record of every change to the DNS records and the sending setup. When reply rates move, a dated log turns guesswork into diagnosis and saves hours of checking settings one by one.

Reputation is built in weeks and lost in hours. Treating it as a system rather than an accident is the entire discipline.