Deliverability is not a setting but a chain: authenticate the domain, code a message readable everywhere, maintain a consented list. Each link can cancel out the other two. This guide sets out the full chain in the order it is built, and the thresholds providers actually measure.
The chain, in order
| Step | Question settled | Without it |
|---|---|---|
| 1. Authentication | Does this message really come from this domain? | The message is not admissible |
| 2. Reputation | Is this domain a respectable sender? | The message goes to junk |
| 3. Rendering | Is the message readable at the recipient’s end? | The message is ignored or deleted |
| 4. Consent | Did the recipient ask to receive it? | The three preceding steps degrade |
The costliest ordering mistake is working on the template before authentication. A beautiful message that is not delivered has no value.
Step 1 — Authenticate
Since 2024, Google and Yahoo have required bulk senders to authenticate fully and publish a DMARC record; Microsoft followed in 2025. Three mechanisms, three distinct questions: SPF declares the authorised servers, DKIM signs the message, DMARC dictates the behaviour on failure and supplies the reports.
none → quarantine → reject progression.Two traps dominate: the ~all terminator left in place indefinitely, and the silent breach of the ten-lookup limit, which makes SPF fail without any signal.
Step 2 — Build a reputation
Authentication opens the door, reputation decides the welcome. Providers measure three indicators, and their thresholds are not negotiable.
| Indicator | Accepted threshold |
|---|---|
| Complaint rate | Below 0.1% — alert from 0.3% |
| Invalid addresses | Below 2% |
| Spam traps | None tolerated |
A new domain has no reputation: warm-up must be progressive, starting with the most engaged contacts. Separating marketing from transactional sends across two subdomains protects the latter from a campaign that goes wrong.
A list of one thousand consented addresses delivers better than a list of ten thousand collected ones. That is not a moral position, it is reputation arithmetic.
Step 3 — Code a readable message
HTML email is not converging on web HTML, and betting on that convergence produces broken messages. Desktop versions of Outlook still rely on Word’s rendering engine: flex, grid and position are ignored there. Table structure remains the reference, styles are written inline, and dark mode must be handled explicitly or you get black text on a black background.
Step 4 — Maintain consent
Double opt-in costs subscriptions in the short term and gains them in the medium term: it eliminates typos and addresses entered by third parties. One-click unsubscription, compliant with RFC 8058, follows the same reasoning — easy unsubscription prevents a spam report, which itself degrades reputation lastingly.
Periodic cleaning of inactive contacts is a deliverability action, not an accounting one: continuing to write to contacts who no longer open degrades delivery for everyone else.
Diagnosis, when it stops getting through
- Read the DMARC reports — they reveal unauthenticated sends made in your name.
- Consult provider postmaster tools, which expose complaint rate and reputation.
- Check public blocklists for the domain and the IP address.
- Segment by provider: a problem limited to one operator points to reputation, a general problem to authentication or content.
Questions to settle before sending
- Is the sending domain the same as the site’s, or a dedicated subdomain?
- Do tracking links use an authenticated domain, or a third-party one?
- Is the plain-text version genuinely supplied?
- Does the unsubscribe link work — tested, not assumed?
Articles in this section
- SPF, DKIM and DMARC: the authentication baseline
- HTML email: what still works in mail clients
- The six causes of spam placement
This page is updated as articles are published in the Email & deliverability section.