Email Deliverability Deep Dive
Deliverability is a reputation system, not a feature
Deliverability is not binary — a message doesn't simply arrive or fail. It lands in one of three places: primary inbox, a secondary tab (Promotions, Updates), or the spam folder, and that placement is decided per-recipient, per-send, by mailbox providers evaluating a sender's historical behavior in real time. The unit they score is sender reputation, tracked mainly at the sending domain and the sending IP, built from the aggregate behavior of everyone sending through that infrastructure, not just your own messages.
This is why deliverability problems often feel mysterious: a campaign that converted fine last quarter starts landing in spam with no content change, because the reputation signal underneath it degraded gradually from rising complaint rates, falling engagement, or a shared IP neighbor's bad behavior.
SPF, DKIM, DMARC — alignment is where most setups silently fail
Most senders configure SPF and DKIM and assume they're done, but inbox providers (especially Gmail and Yahoo post-2024) increasingly gate on DMARC alignment, not just raw pass/fail. Alignment means the domain in the visible From: header must match (exactly, for strict mode, or at the organizational level for relaxed mode) the domain that SPF or DKIM actually authenticated. A common failure: an ESP signs DKIM with its own domain (sendgrid.net) while your From: header shows yourdomain.com — DKIM technically 'passes' but doesn't align, so DMARC evaluates it as a fail unless SPF alignment covers it instead.
DMARC policy also needs a staged rollout. Jumping straight to p=reject before confirming every legitimate sending source (ESP, transactional provider, internal tools, CRM) passes alignment will silently drop real customer emails with no visible error to you — only the bounce never arrives, because rejected mail doesn't bounce back to the sender, it just vanishes at the receiving server.
From: marketing@yourdomain.com
; SPF check - does the sending IP match a domain's SPF record?
Return-Path: bounce@mail.yourdomain.com -> SPF authenticates mail.yourdomain.com
; DKIM check - does the signature's "d=" domain verify?
DKIM-Signature: d=yourdomain.com; s=selector1; -> DKIM authenticates yourdomain.com
; DMARC alignment logic (relaxed mode, default):
; PASS if organizational domain of From: header matches
; the organizational domain of EITHER the SPF-authenticated
; domain OR the DKIM d= domain. Only one needs to align.
; Common break: ESP signs DKIM as d=esp-platform.com and your
; SPF record doesn't cover the sending IP for yourdomain.com
; -> both checks fail alignment -> DMARC fail -> policy appliesRejected mail fails silently
What actually drives inbox placement beyond authentication
Authentication is table stakes, not a placement guarantee. Once a message passes SPF/DKIM/DMARC, mailbox providers score it on signals including: complaint rate (recipients clicking 'report spam' — even 0.1% sustained is considered high), engagement rate (opens, clicks, time-in-inbox before deletion), spam trap hits (sending to addresses that exist only to catch senders with stale, non-consented, or purchased lists), sending consistency (sudden volume spikes from a previously low-volume sender look like a compromised account), and content/link reputation (URLs or redirect domains with a history of abuse get flagged independent of your own sending history).
Gmail's Postmaster Tools and Microsoft's Smart Network Data Services (SNDS) expose some of these signals directly — spam rate, IP reputation tier, domain reputation tier — and are the closest thing to ground truth a sender gets outside of their own ESP's blended metrics.
Deliverability signals: what each one tells you
| Signal | What degrades it | Where to monitor it | Recovery timeline |
|---|---|---|---|
| Sender reputation (domain) | Rising complaints, spam traps, erratic volume | Google Postmaster Tools, Microsoft SNDS | Weeks to months |
| Sender reputation (IP) | Shared IP neighbor abuse, new/cold IP ramp-up | ESP dashboard, blocklist checkers | Days to weeks |
| Authentication (SPF/DKIM/DMARC) | Misconfigured records, unaligned signing domain | DMARC aggregate reports (rua) | Immediate once fixed |
| Engagement rate | Mailing unengaged segments, irrelevant content | ESP open/click reports | 1-3 send cycles |
| Spam trap hits | Purchased lists, very old unconfirmed addresses | Blocklist/reputation monitoring tools | Months — traps are sticky |
IP warming still matters even on shared pools
Diagnosing a deliverability drop
When inbox placement drops, work the signals in order of what's cheapest to rule out: (1) check DMARC aggregate reports for new alignment failures first — a platform migration or new sending tool is a frequent silent cause; (2) check Postmaster Tools/SNDS for a reputation tier downgrade; (3) check recent list growth sources — a new signup form, co-registration partner, or imported list is the most common source of spam traps and invalid addresses; (4) check whether send volume or frequency changed abruptly. Content and subject line wording are usually blamed first and are rarely the actual cause once authentication and list quality are healthy.
What's next
Deliverability and list quality are inseparable — a technically perfect authentication setup still degrades reputation if the underlying list is full of disengaged or invalid addresses.
Next: Email List Hygiene →
I build these systems professionally.
Whether it's a RAG pipeline, analytics migration, or AI workflow — let's talk.