Email deliverability deep dive: complete technical guide
Master email deliverability: ISP filtering algorithms, SPF/DKIM/DMARC implementation, sender reputation management, spam triggers, infrastructure setup, and troubleshooting. Achieve 95%+ inbox placement.
Table of contents
Key Takeaways
- Deliverability is 35% sender reputation, 25% authentication, 20% content, 15% engagement, 5% infrastructure
- SPF, DKIM, DMARC are non-negotiable - without them, 40-70% of emails land in spam folders
- Domain warmup takes 6+ weeks - rushing it destroys reputation permanently and cannot be easily recovered
- Monitor inbox placement rate (target 95%+), spam complaints (<0.1%), bounce rate (<2%) daily
- High-risk spam triggers: all caps, 'FREE/GUARANTEED', excessive punctuation!!!, money symbols $$$
- Use subdomain for outreach (mail.yourdomain.com) to protect main domain reputation from risks
Email deliverability fundamentals: what ISPs really check
Understanding what ISPs (Gmail, Outlook, Yahoo, etc.) actually check when deciding inbox vs spam placement is critical for cold outreach success. Here's the weighted breakdown of factors that usually determine where your emails land:
ISP Algorithm Factor Weighting
These percentages represent the typical weight ISPs assign to each factor when determining inbox vs spam placement
Sender reputation
Authentication
Content quality
Engagement signals
Infrastructure
This weighting explains why many outreach campaigns fail despite "perfect" technical setup. Having SPF/DKIM/DMARC configured correctly (25% weight) won't save you if your sender reputation is poor (35% weight) or engagement signals are negative (15% weight). You need excellence across all factors.
Authentication protocols: SPF, DKIM, DMARC deep dive
Email authentication protocols are your proof of legitimacy to ISPs. Without them, 40-70% of your emails land in spam regardless of content quality. Here's exactly how to configure each protocol correctly with step-by-step instructions for major providers.
- Without SPF: 40-60% of emails go to spam automatically
- DKIM failure: 50-70% spam placement rate
- DMARC adds 15-25% deliverability improvement + protects brand from spoofing
- All three must work together - having only SPF or only DKIM isn't enough
- DNS propagation takes 10-60 minutes, full ISP recognition takes 24-48 hours
SPF (Sender Policy Framework) - Complete Setup Guide
What SPF does
SPF verifies that emails from your domain are sent from authorized servers. ISPs check your SPF record to confirm the sending IP is allowed to send on your behalf. Without it, ISPs assume spoofing/spam.
Common SPF mistakes
- Too many DNS lookups (10 limit)
- Using +all instead of ~all or -all
- Multiple SPF records (only one allowed)
- Forgetting to add new sending services
Google Workspace (Gmail)
Login to your domain registrar
Go to your domain provider (GoDaddy, Namecheap, Cloudflare, etc.)
Add new TXT record
Click 'Add Record' or 'Add DNS Record' button
Configure SPF record
Enter these exact values:
v=spf1 include:_spf.google.com ~all
If you use additional email services
Add their SPF includes BEFORE ~all
v=spf1 include:_spf.google.com include:servers.mcsv.net include:spf.protection.outlook.com ~all
Save and verify
Save the DNS record and wait 10-60 minutes for propagation
Microsoft 365 (Outlook)
Access DNS settings
Go to your domain registrar's DNS management panel
Create TXT record
Add new TXT record with these values:
v=spf1 include:spf.protection.outlook.com ~all
For multi-service setup
Combine multiple services in one SPF record:
v=spf1 include:spf.protection.outlook.com include:_spf.google.com ~all
Validate configuration
Use Microsoft's Remote Connectivity Analyzer
Cold email platforms (Instantly, Smartlead, Lemlist)
Get your platform's SPF include
Find SPF instructions in your platform's DNS settings or documentation
Combine with existing SPF
Add platform SPF to your existing record (don't create a new one)
v=spf1 include:_spf.google.com include:spf.instantly.ai ~all
Update DNS at your registrar
Find existing SPF TXT record and edit it (or create if none exists)
Verify in platform
Return to your cold email platform and click 'Verify DNS' or 'Check Authentication'
Verify your SPF setup
Use these free tools to confirm your SPF configuration is correct:
DKIM (DomainKeys Identified Mail) - Complete Setup Guide
What DKIM does
DKIM cryptographically signs your emails using a private key, allowing ISPs to verify emails haven't been tampered with using the public key in your DNS. This proves authenticity and prevents email modification.
Common DKIM mistakes
- Not publishing public key in DNS
- Key rotation not implemented
- Signature breaks due to email forwarding
- Multiple selectors configured wrong
Google Workspace
Generate DKIM key in Google Admin
Login to admin.google.com
Click 'Generate new record'
Select your domain and click 'Generate new record'
Copy DKIM record details from Google
Google shows you DNS Host name and TXT record value - these are unique to your domain
Add to DNS at your registrar
Go to your domain registrar's DNS management
Activate in Google Admin
Return to Google Admin console
Verify DKIM is working
Send test email to a Gmail account
Microsoft 365
Access Microsoft 365 admin center
Login to admin.microsoft.com
Enable DKIM signing
Go to: Security → Email Authentication Settings → DKIM
Get DKIM CNAME records from Microsoft
Microsoft shows two CNAME records to create - these are unique to your domain
Add CNAME records to DNS
Create both CNAME records at your domain registrar
Enable signing in Microsoft 365
Return to Email Authentication Settings
Cold email platforms
Access DNS settings in platform
Login to your cold email platform (Instantly, Smartlead, etc.)
Copy DKIM record provided by platform
Platform generates a unique DKIM key for your domain and shows the exact DNS record to add
Add to DNS registrar
Go to your domain registrar and create new TXT record
Verify in platform
Return to cold email platform and click 'Verify' or 'Check DNS'
Test DKIM signing
Send test email from platform
Verify your DKIM setup
Use these free tools to confirm your DKIM configuration is correct:
DMARC (Domain-based Message Authentication) - Complete Setup Guide
What DMARC does
DMARC tells ISPs what to do when SPF or DKIM fail (none/quarantine/reject) and sends you reports about authentication failures. This protects your brand from spoofing and gives visibility into deliverability issues.
Common DMARC mistakes
- Starting with p=reject (too aggressive)
- Not monitoring DMARC reports
- Missing subdomain policy (sp=)
- Wrong or missing reporting addresses
Universal DMARC setup (all providers)
Ensure SPF and DKIM are working first
DMARC requires SPF and DKIM to be properly configured
Start with monitoring policy (p=none)
Create basic DMARC record to collect data without blocking emails
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensics@yourdomain.com; pct=100
Set up email addresses for reports
Create email addresses to receive DMARC reports
Add DMARC record to DNS
Go to your domain registrar's DNS management
Monitor reports for 2-4 weeks
Check daily DMARC aggregate reports sent to your email
Gradually increase policy strictness
After confirming SPF/DKIM pass consistently, strengthen policy
Week 1-2: p=none (monitoring) Week 3-4: p=quarantine; pct=10 (quarantine 10%) Week 5-6: p=quarantine; pct=50 Week 7+: p=quarantine; pct=100 (or p=reject if confident)
Final production DMARC record
Recommended DMARC policy for cold outreach
v=DMARC1; p=quarantine; sp=quarantine; pct=100; rua=mailto:dmarc-reports@yourdomain.com; adkim=r; aspf=r; fo=1
Verify your DMARC setup
Use these free tools to confirm your DMARC configuration is correct:
Sender reputation: the invisible score that determines inbox placement
Sender reputation is the single most important deliverability factor (35% of the algorithm), yet it's mostly invisible. ISPs maintain reputation scores for your sending domain and IP based on historical behavior, engagement, and complaints. Here's what actually matters:
Domain Reputation
Domain age
Target: 6+ months old
Historical sending volume
Target: Consistent growth pattern
Domain purpose
Target: Dedicated to email sending
Blacklist presence
Target: Zero listings
IP Reputation
IP warmup status
Target: Fully warmed (6+ weeks)
Shared vs dedicated
Target: Dedicated for high volume
IP age and history
Target: Clean history, 3+ months
Reverse DNS setup
Target: Properly configured PTR
Engagement Metrics
Open rate
Target: 25-40% for cold outreach
Click-through rate
Target: 2-5% minimum
Reply rate
Target: 5-10% target
Spam complaints
Target: <0.1% (1 per 1000)
List Quality
Bounce rate
Target: <2% per campaign
Hard bounce rate
Target: <0.5%
Catch-all addresses
Target: Minimal usage
Email verification
Target: 100% verified before send
The challenge with sender reputation is that it's cumulative and slow-changing. One bad campaign can damage reputation you spent months building, but recovering from poor reputation takes 6-12 weeks of perfect behavior. This is why list quality, proper warmup, and engagement optimization matter so much.
Reputation recovery timeline
- 1Week 1-2: Identify and stop reputation-damaging behavior (high bounces, spam complaints, low engagement)
- 2Week 3-4: Reduce sending volume 50%, switch to highly engaged segments only, verify all recipients
- 3Week 5-8: Gradually increase volume 20% per week if metrics improve, maintain <0.1% complaints
- 4Week 9-12: Return to normal volume if inbox placement >90%, continue monitoring closely
- 5Month 4+: Reputation usually fully recovered if maintaining good practices, can resume growth
Note: This assumes you fixed the root cause. If you continue the same behavior, reputation will never recover.
Content optimization: avoiding spam triggers and improving engagement
Email content accounts for 20% of deliverability decisions. Even with perfect authentication and good reputation, spam-triggering content gets filtered. Here's what ISPs actually flag:
High-risk spam triggers (avoid always)
These words and patterns trigger spam filters aggressively. Using them usually results in 50-80% spam placement:
Medium-risk triggers (use sparingly)
These can work in context but raise spam scores. Use maximum 1-2 per email:
Content structure issues
Technical content problems that hurt deliverability:
- Large images with minimal text (image-heavy emails)
- All-image emails with no text version
- Broken HTML or CSS
- JavaScript or forms in email body
- Shortened URLs (bit.ly, tinyurl) without context
- Attachments in cold outreach emails
Formatting problems
Design and formatting issues that trigger filters:
- Excessive use of red or bright colors
- All caps paragraphs or sentences
- Multiple font colors in short email
- Massive font sizes (especially in subject)
- Poor text-to-image ratio (aim for 60:40)
- Hidden text (white text on white background)
- Keep text-to-image ratio at 60:40 or higher (mostly text)
- Use 1-2 short paragraphs max, keep total length 50-150 words
- One clear call-to-action, avoid multiple links
- Personalize beyond just {'{'}firstName{'}'} - reference specific company info
- Write like a human - contractions, conversational tone, no corporate jargon
- Test every email template with mail-tester.com before sending (target 8+/10)
Remember: content optimization is about passing filters AND driving engagement. Even if your email reaches the inbox, low engagement (no opens, clicks, or replies) damages future deliverability. Write emails that recipients actually want to read and respond to, not just emails that avoid spam filters.
Infrastructure setup: domains, IPs, and sending patterns
Infrastructure is only 5% of the deliverability algorithm, but getting it wrong breaks everything else. Here's how to set up domains, IPs, and sending patterns correctly:
Domain Strategy
Use subdomain for cold outreach
HighWhy: Protects main domain reputation from outreach risks
How: outreach.yourdomain.com or mail.yourdomain.com
Multiple sending domains for scale
HighWhy: Distribute volume, reduce per-domain risk, improve deliverability
How: 1 domain per 1,000 emails/day target volume
Domain age before outreach
MediumWhy: New domains lack reputation and trust with ISPs
How: Wait 30-60 days after registration, age domains before warmup
Match From address to domain
CriticalWhy: Mismatched From/sending domains hurt authentication
How: firstname@outreach.yourdomain.com sends from that domain
IP Configuration
Dedicated IPs for volume >100k/month
HighWhy: Full control over reputation, not affected by other senders
How: One dedicated IP per sending domain
IP warmup schedule
CriticalWhy: Cold IPs sending high volume = instant spam filtering
How: 6-week progressive warmup: 50→500→2000→10000 emails/day
Reverse DNS (PTR) records
HighWhy: ISPs verify IP matches claimed sending domain
How: PTR record: mail.yourdomain.com points to sending IP
Monitor IP blacklists
CriticalWhy: Blacklisted IPs have 90%+ spam placement rate
How: Daily monitoring: MXToolbox, Spamhaus, SURBL checks
Sending Patterns
Consistent daily sending schedule
HighWhy: Erratic patterns (silent for days, then spike) trigger filters
How: Send same time daily, maintain consistent volume ±20%
Gradual volume increases
HighWhy: Sudden volume spikes indicate compromised account or spam
How: Increase volume max 20-30% per week
Time zone appropriate sending
MediumWhy: Sending at 3 AM recipient time looks automated and spammy
How: Send 8 AM - 6 PM recipient's local time
Rate limiting per recipient domain
MediumWhy: Too many emails to same company = spam to that company's filters
How: Max 3-5 emails/hour to single recipient domain
- Using your main company domain for cold outreach (protects reputation with subdomain)
- Sending from brand new domain without warmup (6-week warmup is mandatory)
- Shared IP for high volume >50k/month (get dedicated IP for control)
- Inconsistent sending schedule (erratic patterns trigger spam filters)
- Overloading single domain with >2000 emails/day (split across multiple domains)
- No reverse DNS setup (ISPs check PTR records, missing = major red flag)
The most common infrastructure mistake is trying to scale too fast on too few domains. Plan for 1 sending domain per 1,000-1,500 emails/day target volume. If you want to send 5,000 emails/day, you need 4-5 warmed domains. This distributes risk and maintains deliverability at scale.
Initial Setup (Week 1)
- Purchase and configure dedicated sending domain(s)
- Set up SPF, DKIM, DMARC records correctly
- Configure reverse DNS (PTR) for sending IPs
- Implement email verification service
- Set up Google Postmaster Tools and Microsoft SNDS
Warmup Period (Weeks 2-7)
- Start with 50-100 emails/day to engaged contacts
- Gradually increase volume 20-30% weekly
- Monitor inbox placement rate daily
- Track authentication pass rates
- Maintain <0.1% spam complaint rate
Production Launch (Week 8+)
- Scale to target volume (1000-2000/day per domain)
- A/B test email content for engagement
- Monitor deliverability metrics 3x weekly minimum
- Check blacklists weekly
- Review and optimize based on engagement data
Ongoing Maintenance
- Weekly deliverability metrics review
- Monthly deep dive into DMARC reports
- Quarterly list cleaning and verification
- Regular content spam score testing
- Continuous monitoring of ISP reputation scores
Monitoring and recovery: fixing deliverability problems fast
Even with perfect setup, deliverability problems happen. The key is catching them early and knowing how to recover quickly. Here's how to monitor effectively and troubleshoot common issues:
Essential deliverability tools
Testing & Monitoring
Mail-tester.com
Pre-send spam score testing
Key features: Spam score, authentication check, content analysis
GlockApps
Inbox placement testing
Key features: Real inbox testing, spam folder tracking, ISP-specific results
Google Postmaster Tools
Gmail reputation monitoring
Key features: Domain reputation score, spam rate, authentication status
Microsoft SNDS
Outlook.com deliverability data
Key features: IP reputation, spam trap hits, complaint rates
Email Verification
FindyMail
Email validation and enrichment
Key features: Real-time verification, catch-all detection, deliverability scoring
ZeroBounce
Email list cleaning
Key features: Spam trap detection, abuse email detection, bounce prediction
NeverBounce
Bulk email verification
Key features: Real-time API, bulk verification, auto-bounce removal
Clearout
Email validation with deliverability focus
Key features: Catch-all detection, greylisting check, MTA validation
Domain & IP Management
MXToolbox
DNS and blacklist monitoring
Key features: Blacklist monitoring, DNS lookup, SMTP diagnostics
Warmup Inbox
Automated domain warmup
Key features: Gradual volume increase, engagement simulation, reputation building
MailReach
Deliverability monitoring + warmup
Key features: Inbox placement tracking, warmup automation, spam folder monitoring
Folderly
Email deliverability platform
Key features: Template spam check, domain reputation, deliverability fixes
Authentication & Security
DMARC Analyzer
DMARC monitoring and reporting
Key features: DMARC report aggregation, SPF/DKIM alignment tracking
Postmark DMARC Digests
DMARC report parsing
Key features: Weekly digest emails, authentication failure alerts
EasyDMARC
Complete DMARC management
Key features: DMARC record generator, SPF flattening, monitoring
PowerDMARC
Enterprise DMARC solution
Key features: Threat intelligence, BIMI support, forensic reports
Catch deliverability problems before they become critical:
- Daily: Bounce rate, spam complaints, inbox placement rate (during warmup and first 3 months)
- 3x per week: Open rates, authentication pass rates, engagement metrics (after warmup)
- Weekly: Blacklist checks (MXToolbox), Google Postmaster reputation score, DMARC reports
- Monthly: Deep dive into deliverability trends, list cleaning, domain reputation review
- Quarterly: Full infrastructure audit, email verification of entire database, update processes
Common deliverability problems and recovery plans
Sudden drop in inbox placement
Symptoms you'll see:
- Open rates dropped >50%
- Emails appearing in spam folders
- Bounce rate increased
How to diagnose:
- 1Check spam complaints - did you hit a spam trap?
- 2Review recent email content - new spam triggers?
- 3Verify authentication - SPF/DKIM/DMARC still passing?
- 4Check blacklists - domain or IP listed?
Recovery steps:
- 1Pause campaigns immediately to prevent further damage
- 2Run email through spam checkers (Mail-tester, GlockApps)
- 3Request blacklist removal if listed (usually 24-72 hours)
- 4Reduce sending volume by 50% and slowly rebuild
- 5Switch to highly engaged segments only for 1-2 weeks
Typical recovery time: 2-4 weeks typically
High bounce rate (>5%)
Symptoms you'll see:
- Many invalid email addresses
- Hard bounces increasing
- Soft bounces not resolving
How to diagnose:
- 1List quality issue - purchased list or old data?
- 2Email verification not done or failed
- 3Catch-all addresses marked as valid
- 4Company domains changed or defunct
Recovery steps:
- 1Stop sending immediately - high bounces kill reputation fast
- 2Re-verify entire list through validation service
- 3Remove all bounced addresses permanently
- 4Implement real-time email verification
- 5Set up bounce handling automation
Typical recovery time: Immediate stop, 1 week to clean list
Authentication failures
Symptoms you'll see:
- DMARC failing
- SPF softfail or fail
- DKIM signature invalid
How to diagnose:
- 1DNS records not propagated (can take 24-48 hours)
- 2SPF record exceeds 10 DNS lookup limit
- 3DKIM keys rotated but not updated
- 4Sending service not included in SPF
Recovery steps:
- 1Use DNS checker to verify record propagation
- 2Flatten SPF record to reduce lookups
- 3Regenerate and publish new DKIM keys
- 4Update SPF to include all sending sources
- 5Test with mail-tester.com before resuming
Typical recovery time: 1-3 days for DNS propagation
Low engagement (opens/clicks)
Symptoms you'll see:
- <15% open rate
- Minimal clicks
- No replies
- But emails reach inbox
How to diagnose:
- 1Content not relevant to recipients
- 2Subject lines not compelling
- 3Targeting wrong ICP or personas
- 4Sending at wrong times
Recovery steps:
- 1This is not a deliverability issue - emails reaching inbox
- 2A/B test subject lines extensively
- 3Improve personalization and relevance
- 4Segment list by persona and customize messaging
- 5Review ICP targeting criteria
Typical recovery time: Ongoing optimization, 2-3 weeks for noticeable improvement
The key to deliverability success isn't avoiding problems entirely (they'll happen) - it's catching them early through consistent monitoring and having recovery playbooks ready. Most major deliverability disasters happen because teams didn't notice problems for weeks, allowing damage to compound. Daily monitoring during warmup and 3x weekly after launch prevents this.
Frequently asked questions
At Outreaches, we manage complete email deliverability setup: domain acquisition and warmup, SPF/DKIM/DMARC configuration, IP reputation management, inbox placement monitoring, and ongoing optimization. Our clients usually achieve 95%+ inbox placement and maintain it long-term.
Schedule deliverability auditReady to achieve 95%+ inbox placement?
Email Outreach Services
Complete email deliverability management: domain warmup, SPF/DKIM/DMARC setup, inbox monitoring, and ongoing optimization for maximum inbox placement.
Multichannel Outreach
Combine email, LinkedIn, and WhatsApp for better engagement while maintaining perfect deliverability across all channels.
SDR as a Service
Full-service outreach with dedicated deliverability team managing infrastructure, monitoring, and optimization for you.
Ready to implement these strategies?
Let's build your systematic outreach process from scratch. From signal-driven data to booked meetings.
