Email Deliverability: SPF, DKIM, DMARC, and Why Your Emails
Email deliverability is the probability that a message you send actually reaches the recipient's inbox rather than spam, quarantine, or the void.
Email Deliverability: The Invisible Tax on Every Product Email You Send
Email deliverability is the technical and reputational discipline of getting emails you send into recipient inboxes rather than spam folders, quarantines, or nowhere. It matters for every category of email your product sends — transactional (receipts, password resets, verification), lifecycle (onboarding, dormant re-engagement), and marketing (newsletters, promotions). Deliverability problems are usually silent: emails don't bounce, they just don't show up, and users assume the feature is broken rather than reporting a missing email.
The three DNS records that must exist
(1) SPF — a TXT record listing which servers are authorized to send email from your domain. Gets you past the first check but is fragile across forwards. (2) DKIM — a public key in DNS that your sending provider uses to sign each message; recipients verify the signature to confirm the message wasn't altered and came from an authorized signer. (3) DMARC — a policy record telling recipients what to do when SPF or DKIM fails (none/quarantine/reject) and where to send failure reports. All three are non-optional in 2024+; Gmail and Yahoo will actively reject unauthenticated bulk email. Set them up before sending your first user-facing email, not when deliverability starts hurting.
Separate transactional from marketing
Use different sending domains or at minimum different subdomains for transactional (mail.acme.com or acme.com) and marketing (news.acme.com) email. Reputation is per-domain: one bad marketing campaign that generates spam complaints can destroy deliverability of your password reset emails. Segregating traffic isolates the blast radius. Most sending providers (SendGrid, Postmark, Resend, Mailgun) support easy subdomain setup; use it.
Warming up a new domain
A brand-new sending domain has no reputation and will land in spam by default at high volumes. Warm-up: start with low daily volume (50-500 sends) to your most engaged recipients (existing customers who reply), grow 2-4x per week over 4-8 weeks to your steady-state volume. Sending 100K messages from a cold domain on day one is a reliable way to get flagged as spam permanently. Providers like Postmark and Resend have warmup guidance built in.
Content and engagement factors
Modern spam filters are ML-based and care about engagement more than keywords. Signals that hurt: high complaint rate (>0.1% is a red flag), low open rate (<15% for lifecycle emails), high bounce rate (>2%), images-only emails with no text, misleading subject lines, no plaintext part. Signals that help: consistent sending schedule, replies from recipients, unsubscribe links respected instantly, list hygiene (removing inactive addresses after 6-12 months). Sending more to fewer engaged recipients beats sending more to a large stale list.
Monitoring what actually happens
Set up: Postmaster Tools (Google) and Sender Score (Validity) for reputation monitoring; DMARC reports (via a service like Postmark or Dmarcian) to see who's actually sending as you; provider-side webhooks for bounces, complaints, and delivery events; a synthetic test that sends a message to a Gmail, Outlook, and Yahoo test account and checks inbox placement. Discovering deliverability problems six weeks after they started, from user support tickets, is much worse than seeing them in a dashboard the day they emerge.
Frequently asked questions
Which sending provider should we use?
Postmark for transactional (single-purpose, excellent deliverability). Resend for developer-friendly transactional with modern APIs. SendGrid or Mailgun for scale and marketing volume. Amazon SES for lowest cost with more setup complexity. Whatever you pick, set up SPF/DKIM/DMARC correctly on day one.
Can we send from our founders' Gmail addresses?
For 1:1 outreach at very low volume, yes — that's just normal email. For anything programmatic or bulk, no; Gmail explicitly forbids using consumer accounts for automated sending, and doing it anyway will get the account suspended eventually.
How important is DMARC 'reject' policy?
Very. p=none monitors without action; p=quarantine sends failures to spam; p=reject blocks them entirely. Reject is the goal state and protects your domain from being spoofed in phishing attacks. Get there by first deploying p=none for 2-4 weeks to inspect reports, then p=quarantine, then p=reject.
