Est. reading time: 8 minutes

Deliverability isn’t “did the email send?” anymore. It’s “did it land where a real human will actually see it?”, primary inbox, Promotions, spam, or the void. Mailbox providers keep getting better at separating wanted mail from technically valid mail, and the big shift is settled now: domain reputation is the star of the show, engagement is the scorecard, and authentication is assumed rather than optional. With Apple Mail Privacy Protection still making opens a messy signal, inbox placement leans on what people actually do, clicks, replies, forwards, deletes, complaints, bounces, and overall list quality. Deliverability isn’t a switch. It’s a relationship, and mailbox providers are the kind of friends who notice when you only reach out when you need something.

Authentication and alignment: the price of admission

At any meaningful volume, providers expect SPF, DKIM, and DMARC, aligned. Done right looks like this:

• One SPF record per domain, kept under 10 DNS lookups
• All mail signed with 2048-bit DKIM, keys rotated annually, unique selectors per sending platform
• DMARC published with alignment, starting at p=none to collect aggregate reports, then staged toward quarantine and reject
• Alignment between the visible From domain, the DKIM signing domain, and the MAIL FROM domain

The boring infrastructure underneath matters more than most teams want to believe: valid PTR records mapping IPs to hostnames, consistent HELO/EHLO, and TLS enabled for transport. And if you run multiple ESPs, don’t let each vendor freelance with your identity. Centralize DNS and policy on your main domain and require vendors to sign with your keys, so alignment, and the reputation attached to it, stays consistent.

Unsubscribes and complaint control

One-click unsubscribe stopped being a UX nicety and became a compliance and reputation requirement. Implement List-Unsubscribe headers in both mailto and HTTPS forms, support RFC 8058 one-click, and process opt-outs within two business days or faster. Complaint rates should hold well below 0.1 percent of delivered volume, and drifting toward 0.3 percent is testing how far your sender reputation bends before it snaps.

Keeping complaints down is mostly honesty engineering. A From name people instantly recognize, subject lines that don’t play games, an unsubscribe link easy enough to find that nobody reaches for the spam button instead, a preference center so “less email” is an option rather than “goodbye forever,” and high-risk segments watched and throttled when complaints trend up. Every complaint you prevent by making leaving easy is reputation you keep.

Domains, IPs, and warm-up

Send from a dedicated subdomain (mail.example.com) rather than your apex domain, which gives cleaner reporting and shields the main domain if marketing mail takes a hit. Split traffic by purpose, marketing, lifecycle, transactional, usually on separate subdomains and often separate IP pools, so a promotional stumble never drags down password resets. Dedicated IPs give control at scale; shared IPs work when the ESP manages reputation tightly, though your domain still carries its share of the trust either way. Avoid domain sprawl, every new domain has to earn reputation and needs steady volume to keep it, hold reverse DNS consistent, and don’t rotate IPs unless you enjoy rebuilding trust from scratch.

New domains and IPs start at zero and earn credibility one send at a time. The warm-up that works: begin with your most engaged, recently active subscribers, ramp volume in stages, often doubling every few days, only while metrics stay clean, go slower with Gmail and Microsoft early, and lead with simple, recognizable content, lifecycle and transactional first, promotions later. Watch unknown-user rates, since a burst of invalid addresses early gets you blocked fast, and if sending pauses for weeks, re-warm instead of jumping back at full volume. Document the plan, because “we accidentally blasted the whole list” remains a remarkably common way to ruin a new domain.

Consent, hygiene, and sunsetting

Permission is still the biggest lever, and nothing else comes close. Build lists through explicit consent on owned properties, skip co-registration and purchased lists entirely, they’re deliverability sandbags, and use double opt-in for higher-risk sources with single opt-in plus real-time validation for lower-risk ones. Set expectations up front about what you’ll send and how often, store consent proof, timestamp, IP, source, keep footers compliant with CAN-SPAM, GDPR, CASL, and whatever acronym governs your region, and don’t surprise-pivot the list, someone who signed up for a newsletter didn’t opt into daily promotions. B2B senders should be extra careful with role accounts and distribution lists, which trigger gateway filtering and complaints at higher rates.

Hygiene then protects what consent built. Suppress hard bounces immediately, apply backoff logic with capped retries to soft bounces, and sunset inactive subscribers, commonly at 90 to 180 days for marketing mail, routing them through re-permission flows before removal, the process we detailed in the list cleaning process that revives deliverability. Segment by recency and engagement, defined on clicks and purchases rather than MPP-fogged opens, sending more to active cohorts and lightly to fading ones, and exclude role accounts and disposable domains from promotions. The strategy layer above all this mechanics, why lists decay and how content trains disengagement, is its own post: your email list is dying and your emails are the reason.

Content, rendering, and cadence

Filters care more about behavior than keywords, but messy content still drags. Build mobile-first, accessible templates with a balanced text-to-image ratio, real alt text, and a clean plain-text version. Avoid URL shorteners, use branded tracking domains aligned with your sending domain, keep HTML clean, inline CSS, no heavy scripting, and test dark mode. Lead with recognizable branding, never send image-only emails or random attachments, and keep promotions modest inside transactional mail, since transactional trust is hard to earn and easy to wreck.

Cadence is the behavioral half of the same trust. Consistency builds it, random bursts build suspicion, so choose a sustainable frequency your audience recognizes and hold it, with send-time optimization fine as long as it doesn’t create spikes that look like gaming. Respect SMTP signals, back off on 4xx deferrals, retry with exponential delays, never hammer servers asking you to slow down, batch large campaigns across time zones, and prioritize transactional queues so receipts don’t sit behind the sale announcement. Sudden cadence increases are among the most common lead-ups to complaints and blocks.

Monitoring you can’t skip

The minimum stack: Gmail Postmaster Tools for domain and IP reputation and spam rate, Microsoft SNDS, the Yahoo complaint feedback loop where supported, DMARC aggregate reports for alignment and unauthorized senders, and TLS-RPT for encryption failures. Seed tests help but don’t reflect engagement-based filtering, so pair them with real audience behavior. Track the major blocklists, Spamhaus being the usual suspect, alert on bounce-code shifts, and break performance down by provider, because filtering problems are almost always provider-specific before they’re general.

Advanced protections, and the B2B difference

Once DMARC is enforced, BIMI can put your logo in the inbox, with some providers requiring a Verified Mark Certificate. ARC preserves authentication across forwarding chains, useful for newsletters and listserv-heavy environments, and MTA-STS with TLS-RPT hardens transport. Moving toward p=reject, tighten alignment, apply subdomain policies, and audit vendor access to signing credentials regularly.

B2C and B2B are the same game with different referees. Consumer inboxes reward engagement velocity and consistent identity, while corporate gateways, Microsoft Defender, Proofpoint, Mimecast, prioritize authentication, reputation, and link integrity, penalizing mismatched branding and aggressive tracking. Keep DKIM stable, links transparent, and plain-text clean, expect greylisting and higher deferrals from smaller corporate domains, build patient retry logic, and for mission-critical mail, allowlisting guidance helps where policy permits.

When things go sideways

First diagnose the problem type, content, volume, or reputation, because the remedies differ. Then: pause sending to the affected provider, cut volume to only recent, engaged users, fix authentication failures immediately since DKIM alignment and SPF breakage are frequent culprits, remove risky segments and stale addresses, and resume slowly, letting lifecycle and transactional traffic rebuild trust before promotions return. If you’re blocklisted, follow the remediation steps and be ready to show evidence of consent and hygiene, and if you’re seeing spam-folder placement specifically, the recovery walkthrough covers the sequence in detail. Recovery is behavior over time, not a magic form you submit.

The metrics that actually matter

Optimize for delivered clicks, replies, conversions, and complaint rate, tracked by cohort recency and acquisition source so low-quality growth shows up early. Tie deliverability outcomes to specific changes, template updates, domain shifts, new acquisition channels, using controlled rollouts, and build an inbox health dashboard covering acceptance, deferrals, spam estimates, DMARC pass rates, and provider-level breakdowns. Then share a short weekly deliverability narrative internally, because reputation is far easier to protect when everyone understands what “small changes” can trigger.

The practical setup checklist

• One SPF record per domain, under 10 lookups
• 2048-bit DKIM on all mail, keys rotated yearly
• DMARC with RUA reporting and staged enforcement, none to quarantine to reject
• TLS, PTR records, HELO consistency, and stable IP pools
• Separate subdomains for marketing, lifecycle, and transactional
• List-Unsubscribe with one-click support, opt-outs processed fast
• Hard bounces suppressed immediately, soft retries capped
• Domains warmed on engaged users only, ramped deliberately
• Postmaster Tools, SNDS, DMARC, TLS-RPT, and blocklists monitored weekly

Looking forward, providers will keep tightening alignment expectations, penalizing opaque tracking, and raising the bar on provable consent, with filtering weighting human signals, replies, foldering, deletes, ever more heavily. Identity signals, consistent From names, branded links, DMARC enforcement, BIMI, are becoming baseline trust indicators rather than differentiators. Deliverability was never really a checklist. It’s the byproduct of sending email people actually want, and that’s how you keep landing where it counts: the primary inbox.