Pressing "send" does not put an email in anyone's inbox. It hands the message to the recipient's mailbox provider, which then decides what to do with it. That decision is based less on what the email says than on who you are and how your previous mail was received.
Marketers tend to think about subject lines. Mailbox providers think about trust. This note covers how that trust is established, and what the large providers now require of anyone sending in volume.
Three records that prove you are you
Email was designed in an era when nobody checked the sender's identity. Three standards were added later to fix that. Each is a small text record published in your domain's DNS settings.
| Standard | What it says | Everyday analogy |
|---|---|---|
| SPF | These servers are permitted to send mail for my domain. | The list of approved couriers. |
| DKIM | This message carries my cryptographic signature and has not been altered. | The wax seal on the envelope. |
| DMARC | If SPF or DKIM fails, or does not match my visible "from" address, here is what to do, and where to send a report. | The instructions to the mailroom. |
The detail that catches people out is alignment. It is not enough for SPF and DKIM to pass. The domain they pass for has to match the domain your reader sees in the "from" line. Many senders using a third-party email platform pass both checks on the platform's domain and still fail DMARC on their own.
What the big providers require
In February 2024, Google and Yahoo began enforcing a common set of rules for bulk senders, which Google defines as those sending around 5,000 or more messages a day to personal Gmail accounts. Microsoft introduced similar requirements for Outlook.com in 2025. In summary:
- Authenticate. Both SPF and DKIM, plus a published DMARC policy, with the "from" domain aligned.
- Make leaving easy. Marketing messages must support one-click unsubscribe, and requests must be honoured within two days.
- Stay wanted. Keep the rate at which recipients report your mail as spam below 0.3%. Google advises aiming for under 0.1%.
Three reports in a thousand is not much room. A single badly targeted campaign to an old list can exceed it.
You do not have a deliverability problem. You have a "people did not want this" problem that shows up as deliverability.
Reputation is behaviour over time
Authentication gets you through the door. What happens next depends on how recipients treat your mail. Providers watch whether people open, reply, move messages out of spam, delete without reading, or hit the report button. Those signals attach to your sending domain and IP address and follow you.
This is why practices that seem harmless do damage:
- Old lists. Addresses that have not engaged in a year include abandoned accounts, some of which have been converted into spam traps.
- Sudden volume. A new domain sending a large campaign on day one looks exactly like a spammer. Volume needs to be built up gradually.
- Bought lists. People who never asked to hear from you complain at far higher rates than people who did.
- Hiding the exit. If unsubscribing is hard, the spam button becomes the unsubscribe link.
A short maintenance routine
- Check that SPF, DKIM and DMARC all pass and align. Free header analysers will show you in seconds.
- Register for the postmaster tools the major providers offer and look at your complaint rate monthly.
- Send more to people who engage and less to people who do not. Stop sending to the long-silent.
- Confirm new subscribers, and keep a record of how and when each one opted in.
- Read your DMARC reports. They show who else is sending mail in your name.
None of this is glamorous. All of it is cheaper than discovering in the middle of your biggest sale that half your list never saw the announcement. If you suspect a problem, a deliverability audit is where we would start.