Email Deliverability: How to Get Your Emails Into the Inbox
Email deliverability is the share of your sent email that reaches the recipient's inbox rather than the spam folder or a rejection — and it's decided by receiving mailbox providers like Gmail, Outlook and Yahoo, not by the tool you send from. You influence it through four things: authentication, reputation, engagement and content. This guide walks through each pillar, the decisions inside it, and the actions that actually move inbox placement.
What email deliverability actually means
Deliverability is an outcome, not a setting. It measures how much of your mail lands where the recipient will see it. That's different from delivery rate, which only counts messages the receiving server accepted. A message can be accepted with a 250 response and still be filed to spam — the server took it, then decided where it belongs. If you track only delivery rate, you'll see 99% and assume everything is fine while your campaigns quietly underperform. The distinction is worth understanding properly; it's covered in more depth in Email Delivery vs Deliverability.
Why it matters in business terms: a password reset that lands in spam becomes a support ticket. A receipt that never arrives becomes a chargeback. A launch campaign that reaches 40% of the list wastes the other 60% of the work you put into it. And because mailbox providers filter per recipient, the same message can land in one person's inbox and another's spam folder — so "it worked for me" proves nothing.
No platform, including Mailerflow, can guarantee inbox placement. What a platform can do is make the technical requirements easy to satisfy and give you the data to see problems early.
For a wider view of the market, our ranking of the Best Email Marketing Platforms shows what each service really costs for your number of contacts.
The four pillars of inbox placement
Filtering decisions are made by algorithms you can't read, but the inputs are consistent enough to organize around four pillars:
- Authentication — proving the message genuinely came from your domain, using SPF, DKIM and DMARC.
- Reputation — what mailbox providers have learned about your sending history: volume patterns, bounces, complaints, blocklist appearances.
- Engagement — how recipients react: opens, clicks, replies, marking as not spam, or ignoring you entirely.
- Content — what the message looks like and says, including headers, links and structure.
The rest of this article takes them one at a time, with the actions that matter most in each.
Pillar 1: Authentication — SPF, DKIM and DMARC
Authentication is the foundation. Without it, everything else is guesswork for the receiving server.
SPF is a DNS TXT record listing the servers allowed to send mail for your domain. It looks like this:
v=spf1 include:spf.yourprovider.com include:spf.youresp.com ~all
The ~all means "anything not listed here is probably not us." Keep the record under the 10-DNS-lookup limit; every include: counts, and nested includes count too. A broken SPF record fails silently — mail still sends, it just fails authentication.
DKIM adds a cryptographic signature to each message. You publish a public key in DNS, your sending platform signs with the private key, and the receiver verifies the message wasn't altered in transit. The practical detail that trips people up: the DKIM signing domain should align with the domain in your From address. If you send as you@mail.example.com but the signature is on the platform's domain, you get a pass on DKIM but no alignment — which weakens DMARC.
DMARC ties SPF and DKIM together. It tells the receiver what to do when both fail, and it sends you aggregate reports showing who is sending as your domain. A starting record:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; adkim=s; aspf=s
Roll DMARC out in stages. Start at p=none and read the reports for a few weeks — you'll often discover third-party services sending on your behalf that you forgot about. Then move to p=quarantine, then p=reject. Jumping straight to reject is how you break your own transactional email.
Two decisions worth making early:
- Subdomain or root domain? Sending marketing mail from a subdomain like
mail.example.comisolates its reputation from your root domain, which protects transactional mail sent fromexample.com. The trade-off is that a subdomain starts with no reputation at all. - Strict or relaxed alignment? Strict alignment (
adkim=s; aspf=s) is cleaner but requires your records to match exactly. Relaxed is more forgiving during migration.
BIMI — the logo that appears next to your brand in some inboxes — is a later step. It requires DMARC enforcement and a verified logo, so treat it as something to reach after the basics are stable.
Mailerflow supports own-domain sending with guided DKIM, SPF and DMARC setup and automatic verification, so you can confirm the records are correct rather than guessing from a DNS panel.
Pillar 2: Reputation — what mailbox providers remember about you
Reputation is a running average of your behavior. It's built from volume patterns, bounce rates, spam complaint rates, blocklist appearances and how recipients engage. It's slow to build and fast to damage.
IP reputation vs domain reputation. Modern filtering leans heavily on domain reputation, which is good news: it means you're not permanently tied to a shared IP's history. But IP reputation still matters, especially for high-volume senders.
Shared vs dedicated IP. A shared IP pools reputation with other senders — usually fine, and the right default for most senders. A dedicated IP makes sense when you send high, steady volume and want full control of your reputation. If you get one, you must warm it up: start with your most engaged segment, send small volumes, and increase gradually over weeks. A dedicated IP that suddenly blasts 100,000 messages to a cold list will perform worse than a shared one.
Concrete actions that protect reputation:
- Suppress hard bounces immediately and never retry them. A hard bounce means the address doesn't exist. Retrying it is pure reputation damage.
- Keep complaints low. Make unsubscribe visible, one-click where possible, and honor it instantly. A complaint is worse than an unsubscribe because it tells the provider your mail is unwanted.
- Send consistently. Predictable volume beats spikes. Going silent for three weeks and then sending 200,000 messages in a day looks exactly like a compromised account.
- Check blocklists. If you appear on one, find out why before requesting removal — otherwise you'll be back.
Mailerflow handles part of this mechanically: automatic suppression of bounces and complaints, reputation monitoring, and warm-up limits that pace sending so you don't blow past what your domain can sustain.
Pillar 3: Engagement — the signal you can influence most
Engagement is where the reader has the most leverage. Opens, clicks, replies and "not spam" actions all feed back into filtering, and providers increasingly weigh engagement per recipient — meaning a contact who never opens your mail can drag down delivery for contacts who do.
Practical actions:
Segment by engagement and send less to inactive contacts. Split your list into engaged (opened or clicked in the last 90 days), lapsed (90–180 days) and dormant (180+ days). Send your best content to the engaged group, run a re-engagement series for the lapsed, and stop mailing the dormant unless they re-engage.
Run a documented re-engagement series before removing anyone. Three emails over two to three weeks, each with a clear reason to respond: a genuine question, a preference update, a final notice. Anyone who doesn't respond gets suppressed. This is a deliberate trade — you lose list size and gain inbox placement for everyone else.
Ask for replies. A short, plain-text-style message that ends with a real question ("Which of these two topics would help more?") generates a signal that's hard to fake and easy for providers to read.
Offer a preference center. Let people choose frequency or topics instead of forcing a binary choice between staying and unsubscribing. A downgrade is better than a complaint.
One caveat on measurement: open tracking is approximate. Image blocking and privacy features like Apple Mail Privacy Protection mean opens are inflated or unreliable in some segments. Treat clicks, replies and conversions as stronger signals, and use opens for trend direction rather than precision. Mailerflow's analytics label opens as approximate for exactly this reason.
Pillar 4: Content — what gets filtered and what gets read
Content filters read the whole message: subject line, From name, headers, body, links and structure. A legitimate message can be filtered simply because it resembles a common phishing pattern.
What reliably causes problems:
- Spammy subject lines, ALL CAPS, excessive punctuation and "RE:" on a first contact.
- A From name that doesn't match the domain or the brand the recipient signed up for.
- Image-only emails with no text. Filters can't read images, and neither can a recipient with images off.
- Link shorteners and links pointing to domains unrelated to your From domain.
- Attachments in bulk mail — a strong phishing signal.
- Hidden text, white-on-white text, or invisible link padding.
What works:
- A healthy text-to-image ratio. A rough guide: enough real text that the message makes sense with images blocked.
- Your own domain for links, ideally the same domain you send from.
- Subject lines that match the body. Mismatch reads as bait.
- Testing rendering across major clients before you send, especially if you use custom HTML.
If you'd rather not hand-code HTML, Mailerflow's AI email builder takes a description of the email you want and produces a complete responsive design, subject lines and preview text — which tends to produce consistent, well-structured markup rather than the table-heavy output that hand-built templates often accumulate.
A worked example: a new domain's first 30 days
This is an illustrative scenario, not a customer story.
A company decides to move marketing sending from a shared platform domain to mail.example.com.
Days 1–3. Publish SPF, DKIM and DMARC at p=none. Verify each record. Set up a mailbox to receive DMARC aggregate reports. Don't send yet.
Days 4–7. Send only to the most engaged segment — people who opened in the last 30 days. Keep volume low and content simple: text-forward, one link, no heavy imagery. The goal is a clean first impression, not a big campaign.
Week 2. Increase volume gradually, maybe 50% week over week. Watch bounce and complaint rates daily. Read the DMARC reports and note every source sending as your domain.
Week 3. Add the next engagement tier. Launch a re-engagement series for 90-day non-openers. If bounce rates climb, stop adding volume and investigate — usually it's an old list segment or a form that isn't validating addresses.
Week 4. Review blocklists and any postmaster-style feedback available to you. If authentication is passing cleanly and complaints are under control, move DMARC to p=quarantine.
If something goes wrong mid-ramp — a spike in bounces, a complaint surge — pause the ramp, drop back to the previous volume, and fix the source before continuing. Slowing down for a week costs far less than a reputation hit that takes months to undo.
Common mistakes that quietly hurt deliverability
Buying or scraping lists. One-line fix: don't. Purchased addresses have no relationship with you and generate complaints at rates that damage domains quickly.
Sending to a purchased list "just to test." One-line fix: there is no safe test size. The damage is proportional to complaints, not volume.
Ignoring hard bounces. One-line fix: suppress them automatically and never retry.
No DMARC record, or leaving it at p=none forever. One-line fix: monitor for a few weeks, then move to quarantine and reject.
Sending everything from a no-reply address. One-line fix: use a monitored reply path, even if it's an auto-acknowledged inbox.
Inconsistent volume. One-line fix: schedule sends so weekly volume stays within a predictable band.
URL shorteners in bulk mail. One-line fix: use your own domain for links.
One giant campaign to the whole database. One-line fix: segment by engagement and send in tiers.
Treating unsubscribes as failure. One-line fix: reframe them as the cheap alternative to complaints.
Not monitoring complaints. One-line fix: check complaint rates after every campaign, not once a quarter.
Deliverability checklist
Authentication
- [ ] SPF published, under 10 DNS lookups, includes every sending service
- [ ] DKIM published and aligned with the From domain
- [ ] DMARC published, reports going to a monitored mailbox
- [ ] DMARC moved past
p=noneonce reports are clean
Reputation
- [ ] Hard bounces suppressed automatically
- [ ] Complaint rate reviewed after each campaign
- [ ] Sending volume consistent week to week
- [ ] Blocklists checked monthly
Engagement
- [ ] List segmented by activity (engaged / lapsed / dormant)
- [ ] Re-engagement series live for lapsed contacts
- [ ] Preference center available
- [ ] Dormant contacts suppressed after a final notice
Content
- [ ] Text-to-image ratio healthy; message readable with images off
- [ ] Links use your own domain
- [ ] Subject line matches the body
- [ ] Rendering tested across major clients
Review the whole list monthly, and again after any change to sending infrastructure — a new ESP, a new subdomain or a new IP all reset part of the picture.
FAQ
Why do my emails go to spam even though people signed up? Consent gets you past the legal bar, not the filtering bar. If authentication is missing or misaligned, or if a large share of your list hasn't opened anything in months, providers will filter based on those signals regardless of how people joined. Start by checking SPF, DKIM and DMARC alignment, then look at engagement by segment.
How long does it take to improve email deliverability? Authentication fixes take effect within days once records propagate. Reputation and engagement improvements are slower — think weeks to a few months of consistent, well-targeted sending. A new domain or IP needs a warm-up period before it performs at full strength.
Do I need a separate IP address? Usually not. Shared IPs are the right default for most senders. A dedicated IP makes sense when you send high, steady volume and want direct control over reputation — but it requires warm-up and consistent volume, or it will underperform a shared one.
Does using an email marketing platform hurt deliverability? Not inherently. Platforms handle authentication infrastructure and suppression mechanics that are hard to build yourself. What hurts deliverability is what you send and to whom — list quality, engagement and content — and those are yours regardless of the platform. Gmail and Yahoo's sender requirements apply to bulk senders either way; the details are worth reading in Gmail and Yahoo Sender Requirements Explained.
What is the difference between a bounce and a complaint? A bounce means the message couldn't be delivered — the address doesn't exist (hard) or the mailbox was temporarily unavailable (soft). A complaint means the message was delivered and the recipient marked it as spam. Complaints are the more serious signal because they reflect a human judgment about your mail.
Where Mailerflow fits
Mailerflow covers the mechanical parts of deliverability so you can focus on the judgment calls. Own-domain sending comes with guided DKIM, SPF and DMARC setup and automatic verification. Bounces and complaints are suppressed automatically, reputation is monitored, and warm-up limits pace your sending. Analytics report delivery, bounces, complaints, clicks and approximate opens per campaign and overall. Signup forms support double opt-in with consent records, and CSV import checks for duplicates and invalid addresses.
None of that guarantees inbox placement — the four pillars above are still your responsibility. This article is the pillar piece of the Deliverability Basics cluster, and supporting articles will be linked here as they publish.
Set up your sending domain in Mailerflow with guided DKIM, SPF and DMARC and automatic verification.
