Deliverability is plumbing. When the plumbing is right, nobody notices it; when it is wrong, nothing else you do matters. The three records below are the foundation.

SPF — who is allowed to send

SPF is a list of servers permitted to send mail for your domain, published as a DNS TXT record. It typically includes your mailbox provider and every tool that sends on your behalf.

The common mistake is exceeding the ten lookup limit, which silently invalidates the whole record. Keep the list short, and remove tools you no longer use.

DKIM — proof the message was not altered

DKIM adds a cryptographic signature to each message. Your provider generates a key pair and gives you a selector and public key to publish. Receivers use it to confirm the message genuinely came from your domain and was not modified in transit.

DMARC — the policy

DMARC tells receivers what to do when SPF or DKIM fail, and where to send reports. Start with a policy of none, collect reports for two to four weeks, fix whatever the reports reveal, and only then move to quarantine and finally reject.

The sending habits that keep you in the inbox

  • Use a separate domain for cold outreach, not your main business domain
  • Warm the inbox for two to three weeks before any real volume
  • Keep under thirty to fifty emails per inbox per day
  • Personalise the first line so the message does not look bulk
  • Plain text, at most one link, always a working opt out
  • Send from a real person, not a no-reply address

Monitor weekly, not monthly

Watch bounce rate and complaint rate every week. A sudden drop in open rates usually signals a reputation problem that started days earlier, and early detection is the difference between a warning and a blocklist.

Also monitor your DMARC reports. They reveal who is sending as your domain — including spammers you have never heard of, which is one of the reasons DMARC exists in the first place.

What to do when something breaks

Pause sending immediately. Do not send more volume to fix a deliverability problem; that makes it worse. Check the records, check the blacklists, check the content, and then restart slowly with a smaller, better-targeted list.

Reputation is built in weeks and lost in hours. Treating it as a system rather than an accident is the entire discipline.