Email Deliverability Guide: How to Keep Your Emails Out of Spam

You can write the best email in the world, but if it lands in the spam folder, it doesn't exist. Email deliverability is the invisible layer that decides whether your outreach, your newsletters, your invoices, and your transactional emails actually reach a human inbox. This is the complete 2026 guide — SPF, DKIM, DMARC, domain warmup, reputation, inbox placement, and the mistakes that quietly kill campaigns.

What email deliverability actually means

Email deliverability is the probability that your email reaches the recipient's inbox — not the spam folder, not the promotions tab, not silently dropped. It's different from "delivery rate", which just measures whether a server accepted the message. A 99% delivery rate with 40% inbox placement means 60% of your emails are landing in spam, invisible to you and to the recipient.

The three thresholds every sender should care about:

• Delivered — accepted by the receiving server
• Inboxed — placed in the primary inbox
• Read — the recipient actually opened and engaged

Deliverability work is about pulling the inbox number as close to the delivered number as possible.

Why deliverability is harder in 2026

Google, Microsoft, and Yahoo now enforce sender authentication requirements that would have been considered enterprise-grade three years ago. Since early 2024, bulk senders must publish valid SPF, DKIM, and DMARC records, keep spam complaint rates below 0.3%, and honor one-click unsubscribe. In 2026, those rules are strictly enforced — miss any of them and your mail silently disappears into spam.

The good news: the rules are clear, and if you follow them, your deliverability will beat 90% of senders instantly.

The authentication trio: SPF, DKIM, DMARC

Sender authentication tells the receiving server "this email really came from who it claims to be from". Without it, you're indistinguishable from a scammer spoofing your domain. All three records live in your DNS, take an hour to set up, and are non-negotiable.

SPF — Sender Policy Framework

SPF is a DNS TXT record that lists every server allowed to send email on behalf of your domain. When a receiving server gets a message claiming to be from you, it checks your SPF record to see if the sending IP is authorized.

A typical SPF record for a business using Google Workspace and one sending platform looks like:

• v=spf1 — declares SPF version 1
• include:_spf.google.com — authorizes Google's servers
• include:sendinguctx.com — authorizes your sending platform
• ~all — soft-fail everything else (use ~all in production, not -all initially)

Rules that trip people up:

• Only one SPF record per domain — combine sources with include: statements
• Maximum 10 DNS lookups — chain too many includes and everything breaks silently
• Every third-party sending your mail (Mailchimp, HubSpot, Postmark, SES, cold-email tools) must be included

DKIM — DomainKeys Identified Mail

DKIM signs every outgoing email with a cryptographic signature. The receiving server checks the signature against a public key in your DNS. If it matches, the message provably came from you and wasn't altered in transit.

Setup:

• Your email provider generates a public/private key pair
• You publish the public key as a DNS TXT record at a specific selector (e.g. 'google._domainkey.yourdomain.com')
• The provider signs every outbound message with the private key
• Recipients verify automatically

Every sending platform should have its own DKIM key. Never share keys across tools.

DMARC — Domain-based Message Authentication, Reporting and Conformance

DMARC is the policy layer that tells receiving servers what to do when SPF or DKIM fails. It also sends you reports on who's sending mail from your domain — including bad actors trying to spoof you.

A safe starting DMARC record:

• v=DMARC1
• p=none — monitor only, don't reject yet
• rua=mailto:dmarc@yourdomain.com — where aggregate reports go
• fo=1 — send failure reports on any auth failure

Once your reports show clean traffic for two to four weeks, move to p=quarantine (spam folder for failures), and eventually p=reject (bounce failures). Jumping to reject on day one blackholes legitimate mail from tools you forgot to authorize.

BIMI (optional, high-signal)

If you've moved DMARC to quarantine or reject, adding a BIMI record puts your verified brand logo next to your emails in Gmail, Yahoo, and Apple Mail. It's a strong trust signal and improves open rates by 5–10%.

Domain warmup — the step everyone skips

A brand-new domain sending 500 cold emails on day one is a spam-filter red flag every time. Every sending domain needs a warmup period where volume ramps gradually and engagement builds a positive reputation.

The warmup fundamentals

• Send from a domain that's been registered and used (even lightly) for at least 30 days
• Start at 10–20 emails per day for the first week
• Ramp by 10–20% per day thereafter until you hit your target volume
• Never exceed 300–500 cold emails per inbox per day — even fully warmed
• Split large sending across multiple secondary domains (never your primary business domain)

Automated warmup tools

Tools like Instantly, Smartlead, Warmup Inbox, Mailreach, and Lemwarm run a pod of connected inboxes that email each other, open, reply, and mark messages as important. The receiving servers see engaged behavior and build reputation for your domain.

Warmup should never fully stop. Even at scale, keep 10–20% of daily volume flowing through warmup tools to maintain reputation.

The secondary-domain playbook

For cold outreach, never send from your primary business domain ('yourcompany.com'). Instead:

• Register lookalike domains ('try-yourcompany.com', 'yourcompany.io', 'get-yourcompany.com')
• Warm each one for 3–4 weeks
• Route all cold sending through the secondaries
• Keep the primary domain clean for transactional and executive email

If a secondary domain gets burned, you rotate to a fresh one without touching your business email.

Bounce reduction — cutting the biggest deliverability killer

Bounces destroy sender reputation faster than any other signal. Two types matter:

• Hard bounces — the address doesn't exist. Every hard bounce is a mark against your domain.
• Soft bounces — temporary failures (mailbox full, server down). Some are tolerable; a spike is a warning.

The 2% rule

Keep bounce rate under 2% on every send. Above 5% and Google, Microsoft, and Yahoo will begin filtering your mail into spam within days. Above 10% and you'll be hard-blocked by major providers.

How to actually get there

• Verify every list before sending — layered SMTP + syntax + MX + catch-all detection
• Re-verify old contacts — 20% of B2B email addresses go stale each year
• Suppress bounces immediately — one hard bounce → remove from all future sends
• Watch soft-bounce spikes — sudden increase usually means the receiving server flagged you
• Skip role accounts — info@, sales@, admin@ often reject or accept-and-discard
• Match volume to reputation — a cold domain sending 500/day will bounce far more than the same list at 50/day

Domain reputation — the score you don't see

Every domain and every sending IP carries a reputation score at Google (Postmaster Tools), Microsoft (SNDS), and every major spam filter. You can't see the raw numbers — but the outputs are visible.

Signals that build good reputation

• Low bounce rate (under 2%)
• Low spam complaint rate (under 0.1% is elite, under 0.3% is required)
• High engagement (opens, replies, marks as important)
• Consistent sending volume
• Proper SPF/DKIM/DMARC alignment
• Recipients moving your mail out of spam / into primary

Signals that destroy reputation

• Bounce spikes
• Sending to purchased lists
• Spam trap hits (dead addresses that spam filters seed into leaked databases)
• Users hitting "report spam"
• Massive volume from a cold domain
• Sending identical content to thousands of recipients
• Broken unsubscribe

The tools worth watching

• Google Postmaster Tools — free, essential, checks daily
• Microsoft SNDS — free, for Outlook/Hotmail visibility
• GlockApps or Mail-Tester — inbox-placement testing across major providers
• MXToolbox — check for blacklist listings

Check these weekly. If reputation drops, you have three days to fix it before it hurts campaigns.

Inbox placement — landing in Primary, not Promotions

Even a "delivered" email in Gmail's Promotions tab is functionally invisible for cold outreach. Landing in the Primary inbox comes down to what your email looks and behaves like.

The primary-tab checklist

• Plain text only, or text-heavy HTML — heavy images, tracking pixels, and marketing HTML scream "promotions"
• One or two links maximum — every link is a signal
• No unsubscribe footer on 1:1 style outbound — required for bulk, avoided for personal
• No image attachments in cold outreach
• Personalization tokens filled in cleanly — {{first_name}} showing raw is instant spam
• Realistic sender name — first name last name, not "Sales Team"
• Match the subject line to the body content — clickbait subjects trigger filters

Behavioral signals that help

• Recipients replying (biggest positive signal)
• Recipients marking as important
• Recipients starring or moving to a folder
• Recipients adding you to contacts

This is why warmup tools work — they simulate these behaviors at scale.

Deliverability best practices for 2026

The habits that separate 90%+ inbox rates from 40% inbox rates.

Segment aggressively

Never send the same message to everyone. Break lists into micro-segments by persona, industry, and behavior. Higher relevance = higher engagement = better reputation.

Send at consistent volumes

Wild volume swings look like spam campaigns. If you normally send 200/day, don't jump to 2,000 for one big blast — spread it across a week.

Match sending times to recipient timezones

Sending at 3am recipient time creates lower engagement, which pulls reputation down. Most sequencers handle timezone sending natively.

Use one-click unsubscribe

Google and Yahoo now require one-click unsubscribe (RFC 8058) for bulk senders. Not having it is an instant filter hit.

Monitor and respond to feedback loops

Register with Microsoft SNDS, Yahoo, and Apple's feedback loops so complaints route back to you. Remove complainers immediately.

Rotate content

Sending the exact same email body 5,000 times is a spam signature. Vary opening lines, spin subjects, and use personalization to make each message unique enough to look human.

Keep sending domains focused

One domain, one purpose. Cold outreach domains do only cold outreach. Transactional domains do only transactional. Newsletter domains do only newsletters. Cross-contamination burns everything.

Test inbox placement before every campaign

Run a seed test through GlockApps or similar before any campaign over 500 sends. If your placement is under 80% inbox on Google and Outlook, fix before sending.

Common mistakes that land you in spam

We've audited hundreds of deliverability disasters. The same handful of mistakes cause 90% of them.

Sending cold outreach from your primary business domain

Burns your billing, contract, and support mail alongside outreach.

Skipping DMARC entirely

Gmail and Yahoo are now silently downranking senders without valid DMARC.

Blasting a purchased list on day one

The fastest documented way to land on a blacklist.

Ignoring the warmup

New domains sending real volume without warmup have inbox rates around 20%.

Not honoring unsubscribes within 48 hours

Legally required in most regions and a fast track to complaints.

Using URL shorteners in cold email

bit.ly, tinyurl, and even branded shorteners trigger filters. Use full URLs on your own domain.

Attaching PDFs to cold outreach

Attachments spike spam scores instantly. Link to a hosted version instead.

Emoji in cold outreach subject lines

Fine for consumer marketing. Death for B2B cold.

Chasing open rates instead of reply rates

Open tracking is broken and misleading. Optimize for replies — the only metric that matters.

Not monitoring blacklists

Getting listed on Spamhaus or SORBS silently blocks 30%+ of your mail. Check weekly.

Frequently asked questions

How long does it take to warm a new sending domain?

Two to four weeks for cold outreach, longer for high-volume marketing. Faster warmup timelines almost always trade off against inbox placement.

Should I set DMARC to p=reject immediately?

No. Start at p=none for two to four weeks, review reports for legitimate senders you forgot to authorize, then move to p=quarantine, and finally p=reject. Skipping the ramp will blackhole real mail.

Can I send cold email from my main business domain?

Only if you accept the risk of burning it. Best practice is to buy secondary lookalike domains, warm them separately, and route all cold outreach through them.

What's a good spam complaint rate?

Under 0.1% is elite, under 0.3% is required by Gmail and Yahoo, and above 0.5% will get you filtered site-wide.

Why do my emails land in Gmail's Promotions tab?

Too many images, too much HTML, too many links, or a "marketing" sender name (like "Team Acme" instead of "Jane Smith"). Strip down to a personal-looking plain-text email and it usually moves.

Do open trackers hurt deliverability?

Yes, at scale. Every tracking pixel is a small negative signal, especially in cold outreach. For high-deliverability sending, disable open tracking and rely on reply tracking.

Should I use a dedicated IP or shared IP?

Dedicated IP if you're sending over 100,000 emails a month and can maintain the reputation. Shared IP if you're smaller — a good ESP's shared pool will outperform a poorly-warmed dedicated IP every time.

How often should I check deliverability?

Weekly at minimum. Google Postmaster Tools daily, seed tests before every campaign, and blacklist checks once a week.

What tools do I actually need?

At minimum: a proper ESP (Google Workspace or Microsoft 365 for business email, a cold email tool like Instantly or Smartlead for outbound), a verification tool (NeverBounce, Reoon, ZeroBounce), a warmup tool (Instantly, Warmup Inbox, Mailreach), and monitoring (Google Postmaster, GlockApps).

Do you handle deliverability setup for clients?

Yes — it's foundational to what we do. GetLeadExpo configures SPF/DKIM/DMARC, secondary domains, warmup infrastructure, and monitoring so your emails actually reach the inbox. See our [cold email setup](/services/cold-email-setup) and [email verification](/services/email-verification) services or [book a call](/contact).

Conclusion — deliverability is the compounding advantage

Every sender is fighting the same filters. The ones who win are the ones who treat deliverability as infrastructure, not an afterthought — authenticated domains, disciplined warmup, verified lists, clean content, and weekly monitoring. Do that, and average copy books more meetings than brilliant copy from a burned domain ever will.

If you'd rather not manage the SPF, DKIM, DMARC, warmup, and secondary-domain stack yourself, that's exactly what GetLeadExpo sets up and operates for our clients. [Book a free deliverability audit](/contact) or explore our [cold email setup](/services/cold-email-setup), [email verification](/services/email-verification), and [B2B lead generation](/services/b2b-lead-generation) services — and start landing in the inbox instead of the spam folder.