How Do You Improve Email Deliverability and Stay Out of the Spam Folder?

To improve email deliverability, authenticate your domain with SPF, DKIM and DMARC, mail only people who asked to hear from you, and keep spam complaints below 0.1% of what you send. Then grow your sending volume slowly, remove bounces and inactive contacts, and check Google Postmaster Tools every week so you see a problem before Gmail, Yahoo or Outlook act on it.

Most deliverability problems stay hidden. Your email platform reports a campaign as delivered, the open rate drifts down a little each month, and nobody notices that a growing share of the list now sees you in the spam folder. Delivered only means the receiving server accepted the message. It tells you nothing about which folder the message landed in.

The rules have also tightened. Gmail and Yahoo started enforcing new sender requirements in February 2024, and Microsoft followed for Outlook.com in May 2025. Since November 2025, Gmail has been ramping up enforcement, with temporary and permanent rejections for mail that fails its requirements. A setup that worked in 2023 can now fail quietly.

SPF, DKIM and DMARC in plain language

SPF, DKIM and DMARC are three DNS records that prove your email comes from you. SPF lists the servers allowed to send for your domain, DKIM signs each message so any tampering shows, and DMARC tells inbox providers what to do when a message fails those checks and sends you reports about it. Without them, your mail looks the same as a forgery.

SPF is your approved sender list. It is a TXT record that names every server and service allowed to send email as your domain: your newsletter platform, your CRM, your helpdesk, your office mail server. Two rules in the SPF standard are easy to break by accident. A domain must have only one SPF record, and one SPF check may trigger no more than 10 DNS lookups. Break either rule and the check fails with a permanent error. Each tool you add with an include entry counts towards that limit, which is how a domain that passed last year starts failing after a few new software subscriptions.

DKIM works like a tamper seal. Your sending platform signs every message with a private key, and you publish the matching public key in DNS. The receiving server checks the signature: if the message changed on the way, or the key does not match, DKIM fails. Most email platforms give you the DKIM records to copy into your DNS. Sign with your own domain rather than the platform's shared one, because DMARC alignment depends on it.

DMARC ties the two together. It checks that the domain in the From address, the one your reader sees, matches a domain that passed SPF or DKIM. That match is called alignment. Your DMARC record then tells receivers how to treat mail that fails: p=none means monitor and report, p=quarantine asks them to treat it as suspicious, and p=reject asks them to refuse it. The reports matter more than the policy at the start. They list every source sending mail with your domain on it, including the tools nobody remembered to add to SPF.

Consider a clinic that sends appointment reminders from its booking software and a monthly newsletter from a separate platform. Both services need to sit inside one SPF record, both need DKIM signing with the clinic's domain, and one DMARC record covers them all. Miss the booking tool and its reminders fail DMARC, even though the newsletter passes.

The Gmail, Yahoo and Outlook sender rules you have to meet

Gmail and Yahoo set two levels of rules. Every sender must pass SPF or DKIM and keep spam complaints below 0.3%. Bulk senders, which Gmail defines as anyone sending close to 5,000 or more messages a day to personal Gmail accounts, carry extra duties around DMARC and unsubscribing, and Microsoft now applies similar rules to Outlook.com.

Gmail's email sender guidelines and Yahoo's sender best practices line up closely. Every sender needs:

• SPF or DKIM passing for the sending domain.
• A spam complaint rate below 0.3%.
• Valid forward and reverse DNS records, also called PTR records, for the domains or IPs you send from.
• Messages formatted to the internet message standard, RFC 5322. Gmail also asks for a TLS connection when mail is transmitted.

Bulk senders add these on top:

• Both SPF and DKIM, not one or the other.
• A DMARC record. A policy of p=none is enough to comply, and Yahoo states that DMARC must pass.
• Alignment, meaning the domain in your From address matches the SPF or DKIM domain.
• One-click unsubscribe in the message header for marketing and subscribed mail, plus a clearly visible unsubscribe link in the body.
• Unsubscribes honoured within two days. Yahoo makes this a requirement, and Google recommends 48 hours.

Two details catch small businesses out. Gmail's bulk sender status has no expiry date, so a domain that crossed the line during one big holiday campaign stays classified as a bulk sender afterwards. And 0.3% is a ceiling rather than a target: Google asks senders to keep their spam rate below 0.1%, and since June 2024 bulk senders above 0.3% have been ineligible for mitigation help.

Put numbers on it. A campaign to 20,000 people that collects 60 spam reports sits at 0.3%. At 0.1%, your limit is 20 reports. Gmail calculates its rate on mail delivered to the inbox, so treat this as a rough guide, but the scale is right: a few dozen irritated readers can move you from safe to at risk.

For Outlook, the rules arrived on 5 May 2025. Domains sending 5,000 or more messages a day to outlook.com, hotmail.com and live.com addresses must pass SPF and DKIM and publish DMARC at p=none or stricter, aligned with SPF or DKIM. Microsoft rejects mail that fails with error 550 5.7.515 rather than moving it to junk. If that code shows up in your bounce logs, the problem is authentication, not your content.

List hygiene that protects your sender reputation

Old, bought and unconfirmed addresses can undo everything authentication does for you. List hygiene means mailing only people who asked for your email and still want it. That keeps your complaint and bounce rates low, and inbox providers look at both when they decide where your mail goes.

Google's guidelines are direct about this: do not buy addresses from other companies, confirm each recipient's email address before subscribing them, and consider unsubscribing people who do not open or read your messages. Remove hard bounces after the first failure, and set a sunset rule, such as no opens or clicks in six months, for everyone else. Blocklist operators and mailbox providers also run spam traps, addresses whose only job is to catch senders with poor list practices.

Spamhaus describes three kinds:

• Typo traps sit on lookalike domains such as yaaho.com or homail.com. They get onto lists when sign-up forms accept misspelled addresses without checking them.
• Recycled traps are old addresses that a provider switched off, rejected mail for, and then quietly turned back on. Hitting one means you kept mailing long after the person left.
• Pristine traps were never given to a real person, so the only way to reach one is through scraped or bought data.

Spamhaus recommends confirmed opt-in at the point of collection to keep traps off your list. You lose a few sign-ups who never click the confirmation link, and those are the addresses you least want.

Picture a retailer that merges a trade-show badge scan and a three-year-old customer spreadsheet into its newsletter list, 8,000 new addresses in one go. Some have been switched off and recycled as traps, a few are typos, and most belong to people who never agreed to the newsletter. One send to that list can undo a year of careful mailing. Check old data before you import it, and send those contacts a separate permission email first, not the full campaign.

How much to send, and how fast to grow it

Steady, predictable volume builds trust with inbox providers, and sudden jumps erode it. Google tells senders to start with a low volume to engaged users and increase it slowly, without sudden spikes if there is no history of sending large volumes. If messages start bouncing or getting deferred, it says to cut volume until the error rate falls.

Volume control counts most when something changes: a new domain, a new email platform, a new dedicated IP, or a list that has grown fast. Each of those resets or weakens the sending history providers judge you on. The fix is a warm-up. Send first to the subscribers who opened or clicked recently, then widen the audience in stages while bounces and complaints stay flat.

A business moving 30,000 subscribers to a new platform should not send to all 30,000 on day one. Start with the few thousand most engaged readers, watch the next day's bounces and Postmaster Tools data, and add more of the list with each send over the following weeks. Slow feels wasteful in week one. It costs far less than rebuilding a damaged reputation.

A list that hears from you every week, as it expects, is easier to keep healthy than one that gets five campaigns in the fortnight before a sale after three silent months.

Keep different types of mail apart, too. Google advises against mixing content types, such as promotions inside sales receipts, and recommends one From address per category of mail. Send invoices, password resets and order confirmations from a separate address, or better, a separate subdomain, from your newsletters. A weak campaign then has less chance of dragging down the mail your customers are waiting for.

Content habits that stop emails going to spam

Content decides how readers react, and reader reactions feed your reputation. Google's own content rules are about transparency, and they contain no list of banned words: links in the message body should be visible and easy to understand, HTML should follow HTML standards, and nothing should be hidden with HTML or CSS.

The habits below are our advice, built on the same principle: give filters and readers nothing that looks like a disguise.

• Use a From name your subscribers would recognise in their inbox, and keep it the same from send to send.
• Write subject lines that describe the email. A subject that promises a discount the body does not deliver earns spam reports.
• Skip link shorteners. They hide the destination, which is the opposite of a visible, easy-to-understand link.
• Balance images with real text and include a plain-text version, since an email that is one large image shows a blank box to anyone who blocks images.
• Use a reply-to address that a person reads.
• Put the unsubscribe link where people can find it without hunting. A reader who cannot find it presses "Report spam" instead, and that report counts against you.

A software company that sends a product update with the subject line "Your account needs attention" will get its opens. It will also get spam reports from every customer who feels tricked, and those reports outlast the open rate.

How to check your sender reputation

Check your sender reputation with the tools the inbox providers publish themselves. Google Postmaster Tools shows your Gmail spam rate, compliance status, authentication results and delivery errors. Microsoft SNDS shows how Outlook.com sees your sending IPs. Your DMARC reports show who is sending as your domain, and your email platform's bounce and complaint figures fill in the rest.

Start with Postmaster Tools. Verify your domain, then read these Postmaster Tools dashboards first:

• Compliance status tells you whether your mail meets Gmail's sender requirements. Google says the data is usually updated within 24 hours, so a fix made this morning may not show until tomorrow.
• Spam rate is the share of your DKIM-authenticated mail that reached the inbox and was then marked as spam. This is the number to hold below 0.1%.
• Authentication shows what percentage of your mail passes SPF, DKIM and DMARC.
• Delivery errors show how much of your authenticated mail Gmail rejected or temporarily failed.

Do not build your reporting around the domain and IP reputation dashboards. Google has said both will be retired, so the spam rate and compliance dashboards are the safer habit. On low-volume days Google may leave data out to protect user privacy, which is why small senders should read trends across weeks rather than single days.

For Outlook.com, register with Microsoft's Smart Network Data Services (SNDS). You sign in with a Microsoft account and request access to the IP addresses you are responsible for, and SNDS then shows data about each of them. It is most useful if you send from dedicated IPs. On a shared IP, your email platform is the one responsible for that address, so ask your provider for its numbers.

Then set a weekly routine. Every Monday, check the Gmail spam rate, the authentication pass rate, the bounce rate on last week's campaigns, and any new sources in your DMARC reports. A business that spots its spam rate creeping from 0.05% to 0.12% has time to find the cause before it reaches 0.3%. A business that finds out because the sales team asks why nobody replies is weeks behind.

A 30-day plan to improve email deliverability

Fix authentication first, then the list, then monitoring, and move DMARC towards enforcement last. The order is deliberate: a clean list and good content cannot help mail that inbox providers cannot confirm is yours.

1. Week 1: list every tool that sends email as your domain. Publish one SPF record that covers all of them within the 10-lookup limit, turn on DKIM with your own domain in each tool, and publish a DMARC record at p=none with an address for reports.
2. Week 2: remove hard bounces, suppress contacts with no opens or clicks in six months, add confirmed opt-in to your sign-up forms, and test that one-click unsubscribe and the body unsubscribe link both work.
3. Week 3: verify your domain in Postmaster Tools, register any dedicated IPs with SNDS, and read your first DMARC reports. Add any legitimate sender you missed to SPF and DKIM.
4. Week 4: move receipts and account emails onto their own address or subdomain, start the Monday check, and plan your next DMARC step.

On DMARC enforcement, an honest caveat. Gmail, Yahoo and Microsoft all accept p=none today, so p=quarantine and p=reject are not needed to comply. They do protect your domain from people sending fake mail in your name, which is worth having. Move to them only when your reports show every legitimate sender passing, because a forgotten invoicing tool under p=reject means your own invoices get refused.

None of this is a one-time setup. Teams add tools, lists age, and inbox providers keep updating their rules, so the checks have to keep running after the first month. Inbox placement is earned send by send.

If you would rather have a team set this up and keep watching it, our email marketing services cover email delivery and planned campaigns, and a note to info@technomantraa.com gets you a custom quote.