Email Deliverability Guide: How to Land in the Inbox

What Is Email Deliverability?

Email deliverability is the measure of whether your emails actually reach the inbox — not just whether they're sent. It's the difference between "delivered" (the server accepted the message) and "inbox placement" (the recipient sees it in their primary inbox rather than spam or promotions).

Here's the uncomfortable truth: even if your ESP shows a 98% delivery rate, your actual inbox placement could be 70% or lower. The 28% gap? Those emails were "delivered" to the spam folder, where they'll never be opened.

Deliverability isn't a single setting you toggle on. It's the outcome of dozens of technical, behavioral, and reputation signals that mailbox providers evaluate for every email you send. This guide covers all of them.

The Four Pillars of Email Deliverability

Every inbox placement decision comes down to four factors. Neglect any one of them and the other three can't compensate.

1. Authentication

Are you who you say you are? Mailbox providers use DNS-based authentication protocols to verify that an email actually came from the domain it claims to come from.

2. Sender Reputation

What's your track record? ISPs and mailbox providers maintain reputation scores for your sending IPs and domains, based on historical bounce rates, complaint rates, and engagement patterns.

3. Content Quality

Does your email look like something people want? Content analysis includes everything from subject lines to HTML structure to the ratio of text vs. images.

4. List Quality

Who are you sending to? A perfectly authenticated email with great content still lands in spam if you're sending to invalid addresses, spam traps, or people who don't want your mail.

Let's go deep on each one.

Email Authentication: SPF, DKIM, and DMARC

Authentication is the foundation. Without it, everything else is irrelevant — Gmail and Microsoft will reject or spam-folder your emails outright.

SPF (Sender Policy Framework)

SPF tells the world which mail servers are authorized to send email on behalf of your domain. It's a DNS TXT record that lists allowed IP addresses and services.

v=spf1 include:_spf.google.com include:sendgrid.net ~all

This record says: "Google and SendGrid are authorized to send mail for this domain. Soft-fail anything else."

Common SPF mistakes:

Too many DNS lookups. SPF allows a maximum of 10 DNS lookups. If you use multiple ESPs, CRMs, and tools that all need SPF includes, you can hit this limit. Use SPF flattening tools to consolidate.
Using +all instead of ~all or -all. The +all mechanism authorizes everyone to send as your domain — it's essentially turning SPF off.
Forgetting to include your transactional email service. If your marketing emails go through Mailchimp but your receipts go through SendGrid, both need to be in your SPF record.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email you send. The receiving server verifies this signature against a public key published in your DNS. If the signature matches, the email hasn't been tampered with in transit.

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...

DKIM doesn't prevent anyone from sending as your domain (that's SPF's job). It proves that an email claiming to be from your domain was actually sent by someone with access to your private key — and that the content wasn't modified after sending.

DKIM best practices:

Use 2048-bit keys (1024-bit keys are increasingly considered weak)
Rotate keys annually
Sign with a subdomain (selector._domainkey.yourdomain.com) to keep your main domain's DNS clean
Ensure your ESP generates unique DKIM signatures per customer, not shared ones

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. It also provides reporting so you can see who's sending email as your domain.

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100

The three DMARC policies:

p=none — Monitor only. Emails that fail authentication are delivered normally, but you get reports. Start here.
p=quarantine — Failed emails go to spam. A middle ground while you verify your authentication is complete.
p=reject — Failed emails are blocked entirely. The goal state — but only after you've confirmed all legitimate sending sources are authenticated.

The DMARC rollout path:

Publish p=none and collect reports for 2-4 weeks
Analyze reports to identify all legitimate senders
Fix SPF and DKIM for any unauthenticated legitimate sources
Move to p=quarantine for 2-4 weeks
Confirm no legitimate mail is being quarantined
Move to p=reject

Rushing to p=reject without the monitoring phase will block your own legitimate emails. Take the time.

BIMI (Brand Indicators for Message Identification)

BIMI is the newest authentication layer. It displays your brand logo next to your emails in supported inboxes (Gmail, Yahoo, Apple Mail). It requires a DMARC policy of p=quarantine or p=reject and a Verified Mark Certificate (VMC).

BIMI doesn't directly affect deliverability, but it increases open rates by 10-30% because recipients recognize and trust branded emails.

Sender Reputation: Your Email Credit Score

Mailbox providers maintain reputation scores for every sending IP address and domain. This reputation is the single biggest factor in inbox placement decisions.

IP Reputation vs. Domain Reputation

IP reputation is tied to the specific IP address (or range) your emails are sent from. If you use a shared IP from your ESP, your reputation is pooled with other senders on that IP. If you use a dedicated IP, your reputation is entirely yours.

Domain reputation is tied to your sending domain. Even if you change IPs, your domain reputation follows you. Google in particular weighs domain reputation heavily — switching IPs won't help if your domain has a poor track record.

What Builds Good Reputation

Low bounce rate — Below 0.3% (Google's threshold for bulk senders)
Low complaint rate — Below 0.1% (one complaint per 1,000 emails sent)
Consistent volume — Sending 10,000 emails every week is better than sending 100,000 once a month
High engagement — Opens, clicks, replies, and forwards all signal that recipients want your mail
Clean list — Sending only to verified, opted-in addresses

What Destroys Reputation

Spam trap hits — Even one pristine spam trap hit can devastate your reputation. These are addresses maintained by ISPs and anti-spam organizations specifically to catch bad senders.
High bounce rates — Bouncing above 2% consistently will trigger throttling. Above 5% and you're looking at blocks.
Complaint spikes — A single campaign that generates a complaint rate above 0.3% can land your domain on a watchlist.
Inconsistent sending patterns — Going from 1,000 emails/week to 50,000 overnight looks like a compromised account. ISPs will throttle you.
Sending to purchased lists — These lists are riddled with spam traps and unengaged contacts. The reputation damage is almost always permanent.

How to Monitor Your Reputation

Google Postmaster Tools — Free, essential. Shows your domain and IP reputation with Google, spam rate, authentication success rate, and encryption metrics. Every sender should have this set up.

Microsoft SNDS — Smart Network Data Services provides similar data for Outlook, Hotmail, and Live.com addresses.

Blacklist monitoring — Check if your sending IP or domain appears on major blacklists (Spamhaus, Barracuda, SORBS, SpamCop). Being listed on even one major blacklist can tank deliverability across all providers.

SendSure's deliverability testing tool checks your domain against major blacklists, validates your SPF/DKIM/DMARC configuration, and provides an A-F deliverability grade — all in a single API call.

List Quality: The Deliverability Factor Most People Ignore

You can have perfect authentication, excellent reputation, and compelling content — and still land in spam if your list is dirty.

How Bad Addresses Hurt Deliverability

Every email you send to a bad address generates a signal:

Hard bounce — "This address doesn't exist." Direct reputation damage.
Spam trap hit — "You're sending to an address that only bad senders have." Severe reputation damage.
Soft bounce (repeated) — "This mailbox is full/unavailable." Signals you're not maintaining your list.
Zero engagement — Sending to addresses that never open or click tells ISPs your content isn't wanted.

ISPs aggregate these signals across your entire sending volume. A 3% bounce rate doesn't just waste 3% of your sends — it degrades deliverability for the other 97%.

The Verification-Deliverability Connection

This is where email verification directly impacts deliverability. A verification engine like SendSure's identifies and removes the addresses that generate negative signals before you send.

Here's the measurable impact:

| Metric | Before Verification | After Verification | |--------|--------------------|--------------------| | Bounce rate | 4.2% | 0.3% | | Spam complaint rate | 0.18% | 0.04% | | Inbox placement | 72% | 94% | | Open rate | 18% | 26% |

These numbers are from actual SendSure customers cleaning lists for the first time. The improvement is immediate — usually visible within 1-2 campaigns after cleaning.

Types of Dangerous Addresses

Pristine spam traps — Email addresses created by ISPs that have never been used by a real person. If you're sending to one, you got the address from a purchased list or a scrape. There's no legitimate way to have this address.

Recycled spam traps — Real email addresses that were abandoned and repurposed as traps. The original owner left, the address bounced for 6-12 months, and then the ISP reactivated it as a trap. If you're still sending to it, you're not cleaning your list.

Honeypots — Addresses planted on websites specifically to catch scrapers and bots. They're hidden in page source code where humans wouldn't find them but automated tools would.

Role-based addresses — Addresses like info@, admin@, support@ that are managed by teams. Higher complaint rates because the recipient didn't personally opt in.

How Often Should You Verify?

Every 90 days for your full list. This catches addresses that have decayed since your last check.
Before every major campaign. If you're sending a promotional blast to your entire list, verify first.
In real-time for new signups. Never let an unverified address enter your database.
After any period of inactivity. If you haven't emailed a segment in 6+ months, verify before re-engaging.

Engagement Metrics That Drive Inbox Placement

Authentication gets your email past the front door. Reputation keeps you in good standing. But engagement is what tells ISPs your emails belong in the primary inbox.

Positive Engagement Signals

Opens — The recipient opened your email (tracked via pixel or proxy)
Clicks — They clicked a link in the email
Replies — They replied directly (strongest positive signal)
Forwarding — They forwarded it to someone else
Moving to primary — They moved your email from Promotions or spam to Primary (Gmail tracks this)
Adding to contacts — They added your sending address to their address book

Negative Engagement Signals

Marking as spam — The single most damaging action. One complaint outweighs hundreds of opens.
Deleting without reading — Consistently deleting your emails signals low interest
Ignoring — Emails that are never opened over multiple sends suggest the recipient isn't engaged
Unsubscribing — Better than a spam complaint, but still signals your content isn't meeting expectations

How to Improve Engagement

Segment aggressively. Don't send the same email to everyone. Segment by behavior (recent purchasers vs. browsers), by engagement (active openers vs. dormant), and by interest (product categories, content topics).

Sunset inactive subscribers. If someone hasn't opened an email in 90 days, move them to a re-engagement segment. Send 2-3 targeted "we miss you" emails. If they still don't engage, suppress them. It's counterintuitive, but removing unengaged subscribers improves deliverability for everyone who remains.

Send at optimal times. Test different send times for your audience. An email sent when the recipient is active is more likely to be opened immediately, which is a stronger signal than one opened 3 days later.

Nail the subject line. It's the single biggest factor in open rates. Be specific, create urgency without being clickbait, and keep it under 50 characters for mobile.

Make unsubscribing easy. A visible, one-click unsubscribe link reduces spam complaints. Every spam complaint is 10x more damaging than an unsubscribe.

Monitoring and Testing Your Deliverability

You can't improve what you don't measure. Here's what to monitor and how.

Key Metrics to Track

Inbox placement rate — The percentage of delivered emails that land in the primary inbox (not spam or promotions). This is different from delivery rate. Tools like SendSure's deliverability testing or seed-list testing services can measure this.

Bounce rate — Track per campaign and per segment. A sudden spike indicates a list quality issue.

Spam complaint rate — Available from Google Postmaster Tools and your ESP. Keep this below 0.1%.

Blacklist status — Check your sending IPs and domain against major blacklists weekly. Automated monitoring is better — manual checks miss fast-moving listings.

Authentication pass rate — What percentage of your emails pass SPF, DKIM, and DMARC? Should be 99%+. Anything lower means misconfiguration.

Tools for Deliverability Monitoring

Google Postmaster Tools — Free. Shows domain reputation, spam rate, and authentication metrics for Gmail. Setup takes 5 minutes — verify your domain and start collecting data.

MXToolbox — Free tier available. DNS lookup, blacklist check, SMTP diagnostics. Good for quick spot-checks.

SendSure Deliverability Testing — Tests your domain's full authentication stack (SPF, DKIM, DMARC), checks 50+ blacklists, and provides an A-F grade with specific recommendations. Available via API or dashboard:

curl -X POST https://api.sendsure.ai/v1/deliverability \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "yourdomain.com"}'

Response includes:

{
  "domain": "yourdomain.com",
  "grade": "B+",
  "score": 82,
  "spf": { "status": "pass", "record": "v=spf1 include:..." },
  "dkim": { "status": "pass", "selector": "google" },
  "dmarc": { "status": "pass", "policy": "quarantine" },
  "blacklists": { "listed": 0, "checked": 54 },
  "recommendations": [
    "Upgrade DMARC policy from quarantine to reject",
    "Add BIMI record for brand visibility"
  ]
}

Seed List Testing

Seed list testing sends your actual email to test addresses at major ISPs (Gmail, Outlook, Yahoo, AOL) and checks where it lands. It's the most direct measurement of inbox placement.

Create test accounts at each major provider, add them to your list, and check placement after every campaign. Or use a service that maintains seed lists across dozens of providers.

Action Plan: Improving Deliverability Step by Step

Here's a practical, ordered checklist. Work through it top to bottom — each step builds on the previous one.

Week 1: Authentication Audit

Check your SPF record. Use dig TXT yourdomain.com or an online tool. Verify all legitimate sending sources are included.
Verify DKIM signing. Send a test email and check the headers for a valid DKIM signature. Most ESPs handle DKIM setup automatically, but verify it's working.
Publish a DMARC record if you don't have one. Start with p=none and an rua reporting address.
Sign up for Google Postmaster Tools and verify your domain.

Week 2: List Hygiene

Export your full email list from your ESP or CRM.
Run it through SendSure's bulk verification. Upload the file and let the 27-stage engine classify every address.
Immediately remove all invalid, disposable, and critical-risk addresses.
Segment catch-all and high-risk addresses into a separate list.
Suppress any address that hasn't engaged (opened or clicked) in the last 180 days.

Week 3: Engagement Optimization

Create segments based on engagement recency: active (30 days), warm (30-90 days), cooling (90-180 days), cold (180+ days).
Send a re-engagement campaign to the "cooling" segment. Simple subject line: "Still interested in hearing from us?"
Anyone who doesn't engage within 14 days moves to suppression.
Review your unsubscribe process. It should be one click, prominently placed in every email.

Week 4: Infrastructure

If you're on a shared sending IP, evaluate whether a dedicated IP makes sense for your volume. Generally worth it above 50,000 emails/month.
If you move to a dedicated IP, warm it up gradually: start with 500 sends/day to your most engaged segment and increase by 25-50% daily over 2-3 weeks.
Set up DKIM key rotation on an annual schedule.
Move your DMARC policy from p=none to p=quarantine if your reports show no legitimate failures.

Ongoing: Monthly Maintenance

Monitor Google Postmaster Tools weekly for reputation changes
Check blacklists weekly (or use automated monitoring)
Verify new signups in real-time using API verification
Clean your full list every 90 days with bulk verification
Review bounce and complaint rates after every campaign
Sunset unengaged subscribers after 90 days of inactivity
Test inbox placement with seed lists before major campaigns

The Bottom Line

Email deliverability isn't a one-time fix. It's an ongoing practice built on authentication, reputation, content quality, and list hygiene. The good news is that the steps are straightforward, the tools exist, and the results are measurable.

The single highest-impact action you can take today is cleaning your email list. Bad addresses are the most common — and most fixable — cause of deliverability problems. Every other optimization works better when your list is clean.

SendSure gives you 100 free credits to start. Verify a sample of your list, see where you stand, and build from there. Sign up at sendsure.ai — no credit card required.