Email deliverability is the ability of your emails to reach the inbox rather than the spam folder or a rejection. It depends on three things: proving the mail is really from you (SPF, DKIM and DMARC), a sending reputation built on wanted mail and low complaints, and following mailbox provider rules such as one-click unsubscribe.
Since February 2024, Gmail and Yahoo have enforced stricter rules for bulk senders, and Microsoft followed for Outlook.com in 2025. This guide explains how inbox placement works, how to set up each record, what providers now require and how to fix problems.
Key takeaways
- Authenticate every sending domain with SPF, DKIM and DMARC, and make sure the From domain aligns with at least one of them.
- Gmail asks bulk senders to keep the spam rate below 0.3% and recommends staying below 0.1%; Yahoo also sets 0.3% as the ceiling.
- Marketing mail needs a one-click unsubscribe header (RFC 8058) plus a visible unsubscribe link, and opt-outs should be honoured quickly.
- Reputation comes from sending wanted mail: clean lists, gradual warm-up, engagement-based targeting and separate streams for transactional and marketing email.
- Monitor with free tools such as Google Postmaster Tools, Yahoo’s Complaint Feedback Loop and DMARC aggregate reports before tightening policy.
What does recent data and policy say about email deliverability?
The biggest change in recent years is that mailbox providers now publish hard rules. Google’s Gmail email sender guidelines say that from 1 February 2024 all senders must set up SPF or DKIM, use valid forward and reverse DNS, use TLS and keep the spam rate reported in Postmaster Tools below 0.3%. Senders of 5,000 or more messages a day to Gmail accounts must also set up SPF, DKIM and DMARC (p=none is acceptable), align the From domain and support one-click unsubscribe for marketing mail. Google recommends keeping the spam rate below 0.1% and never reaching 0.3%.
Yahoo’s Sender Hub best practices set similar bulk-sender rules from February 2024: SPF and DKIM, a passing DMARC policy of at least p=none, From-domain alignment, one-click unsubscribe, unsubscribes honoured within 2 days and complaints below 0.3%. Yahoo’s Sender Hub FAQ says List-Unsubscribe enforcement began in June 2024 and gives no fixed volume threshold for bulk senders.
Microsoft followed in 2025. Its Microsoft Defender for Office 365 Tech Community post on Outlook requirements for high-volume senders appeared in April 2025, and its support article on error 550 5.7.515 (published May 2025) says domains sending 5,000 or more messages to Microsoft consumer services such as Outlook.com must pass SPF and DKIM and publish a DMARC record that passes with From-domain alignment. Failing mail can be rejected with that error.
Maximum and recommended spam complaint rates for bulk senders
In practical terms, 0.3% means three spam complaints per 1,000 delivered emails. A list of 20,000 subscribers hits that ceiling at 60 complaints on a single campaign, which is why list quality matters more than send volume.
How does inbox placement actually work?
The receiving server runs a series of checks in milliseconds. Knowing the order shows where a problem sits.
- Connection checks. Blocklists, valid reverse DNS and TLS encryption.
- Authentication. SPF, DKIM and aligned DMARC.
- Reputation. How recipients have recently reacted to this domain and IP, including spam reports.
- Content and engagement signals. Whether the message and its links look trustworthy and consistent.
- Placement. Inbox, a Promotions tab, spam, deferral or rejection.
Authentication gets you through the door; reputation decides where you sit. Perfect records will not rescue a campaign to an old purchased list.
What is SPF and how do you stay within the 10-lookup limit?
Sender Policy Framework (SPF) is a DNS TXT record listing the servers allowed to send mail for your domain. It checks the envelope sender (Return-Path), not the visible From address, and a domain must have only one SPF record.
example.com. TXT "v=spf1 include:_spf.google.com include:spf.esp-example.net ~all"The detail most teams miss is the lookup limit. RFC 7208, the SPF specification, says implementations must limit DNS-querying terms (include, a, mx, ptr, exists and the redirect modifier) to 10 during evaluation, and exceeding the limit produces a permerror. It also says void lookups, which return no records, should be limited to two. Nested includes mean a domain using a workspace, CRM, helpdesk and email platform can quietly exceed 10.
To stay within it, remove unused includes, avoid ptr, move high-volume platforms to a subdomain with its own SPF record, and run a free SPF checker after each change.
How does DKIM work, and what key length and selectors should you use?
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to each message. The sending platform signs with a private key, and the receiver checks it against the public key published in your DNS.
Each key is published under a selector, which lets you run several keys at once, for example one for Google Workspace and one for your marketing platform. Google Workspace DKIM set-up help recommends 2048-bit keys where your DNS host supports them, uses google as the default selector, and publishes the key as a TXT record at the selector name followed by ._domainkey. Google’s sender guidelines require at least 1024-bit keys for mail to personal Gmail accounts.
google._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...(public key)"
s1._domainkey.example.com. CNAME s1.domainkey.esp-example.net.Many platforms use CNAME records so they can rotate keys for you. Remove old selectors when you stop using a tool.
What is DMARC, and how do you move from p=none to p=reject?
DMARC ties SPF and DKIM to the visible From address and tells receivers what to do when mail fails. RFC 7489 (2015) defined the policies none (no action requested), quarantine (treat failing mail as suspicious) and reject, the rua tag for aggregate reports, and relaxed alignment by default. In May 2026 the IETF published RFC 9989, a standards-track version that obsoletes RFC 7489 and keeps the same three policies.
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r"Alignment is the concept that causes most confusion. DMARC passes only if SPF or DKIM passes for a domain matching the From domain. Relaxed alignment allows a subdomain match; strict needs an exact match. If your platform signs with its own domain, DKIM passes but DMARC fails.
| Policy | What receivers do with failing mail | When to use it |
|---|---|---|
| p=none | Deliver as normal; send reports | Starting point: discover every service sending as your domain |
| p=quarantine | Treat as suspicious, usually spam folder | After reports show all legitimate sources pass and align |
| p=reject | Refuse the message | Once quarantine has run cleanly; strongest protection against spoofing |
A safe path: publish p=none with a rua address, read aggregate reports for several weeks, fix every legitimate source, then move to quarantine and reject. Free report viewers are enough to start.
BIMI (Brand Indicators for Message Identification) can show your logo next to authenticated mail. According to Google Workspace BIMI help, Gmail needs DMARC at quarantine or reject (not none), an SVG Tiny PS logo and a Verified Mark Certificate or Common Mark Certificate. It is a finishing touch, not a fix.
What do Gmail, Yahoo and Microsoft require from bulk senders?
| Requirement | Gmail (5,000+/day) | Yahoo (bulk senders) | Outlook.com (5,000+) |
|---|---|---|---|
| SPF and DKIM | Both required | Both required | Both must pass |
| DMARC | Required; p=none acceptable | Required; at least p=none, must pass | Record required; must pass with alignment |
| From-domain alignment | With SPF or DKIM | With SPF or DKIM | With SPF or DKIM |
| One-click unsubscribe | Required for marketing mail | Required; RFC 8058 POST highly recommended | Not specified in the support article |
| Spam rate | Below 0.3%; aim for below 0.1% | Below 0.3% | Not specified in the support article |
| Source | Yahoo Sender Hub | Microsoft support |
For one-click unsubscribe, RFC 8058 (January 2017) specifies two headers: a List-Unsubscribe header containing an HTTPS address, and List-Unsubscribe-Post with the value List-Unsubscribe=One-Click. Both headers must be covered by a valid DKIM signature. Most platforms add them automatically; check a test message’s raw headers.
List-Unsubscribe: <https://example.com/unsub?u=abc123>, <mailto:unsub@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-ClickHow do you build and protect sender reputation?
1. Keep lists clean
What: Remove hard bounces, suppress long-inactive contacts and never buy lists. Why: Invalid addresses and uninterested recipients drive bounces and spam reports. How: Use double opt-in on risky forms and a sunset policy with a re-permission email. Our guide to lead magnets covers capturing addresses people actually want to use.
2. Warm up new domains and IPs
What: Increase volume gradually on a new domain or IP. Why: Providers distrust sudden volume from senders with no history. How: Start with engaged recipients and scale over several weeks, checking bounces at each step.
3. Send based on engagement
What: Target people who recently opened, clicked or bought. Why: Engagement improves placement; fewer sends to cold contacts cut complaints. How: Segment by recency and offer a preference centre. The lifecycle marketing guide shows how to match messages to customer stage.
4. Monitor complaints and reputation
What: Track spam rate and reputation weekly. Why: Early problems are easier to fix. How: Google Postmaster Tools offers dashboards for compliance status, spam rate, reputation, feedback loop, authentication, encryption and delivery errors. Yahoo’s Complaint Feedback Loop reports each spam complaint once your DKIM domain is enrolled. Both are free.
5. Separate transactional and marketing streams
What: Send receipts and OTPs from a different subdomain and stream than promotions. Why: A promotion’s complaint spike should never delay an order confirmation. How: Use, for example, mail.example.com and news.example.com, each with its own DKIM selector. Ecommerce teams will find more on this in the eCommerce email and WhatsApp guide.
How do you authenticate your domain in HubSpot, Zoho Campaigns, Brevo and Mailchimp?
Each platform generates your exact records; copy them rather than typing values from a guide.
| Platform | Records requested | Where to find it | Notes |
|---|---|---|---|
| HubSpot | Two DKIM CNAMEs, SPF include, DMARC TXT | Settings > Content > Domains & URLs > Email Sending | Starter plans and above |
| Zoho Campaigns | SPF TXT and DKIM TXT | Settings > Domain Authentication | Admin only; regional SPF values |
| Brevo | Brevo code TXT, DKIM (two CNAMEs or one TXT), DMARC TXT | Settings > Senders, Domains, IPs > Domains | Automatic or manual |
| Mailchimp | Two DKIM CNAMEs and a DMARC TXT | Account > Domains > Start authentication | Verify the domain first |
HubSpot, Brevo and Mailchimp all note that DNS changes can take up to 48 hours to propagate. If you use HubSpot for CRM and campaigns, connecting your sending domain is a one-off settings task; see the HubSpot CRM guide. Add each include to your existing SPF record, never a second one.
How should you audit your email deliverability?
Six checks, in order, before you change content or volume
List every tool that sends as your domain: workspace, CRM, email platform, helpdesk, billing, website forms.
One SPF record within 10 lookups, DKIM per platform, DMARC with a rua address, valid reverse DNS.
Find sources that fail or do not align; fix them before tightening policy.
Postmaster Tools spam rate and compliance status, Yahoo feedback reports, bounce codes.
Bounce handling, sunset rules, opt-in records, unsubscribe headers and processing time.
Move DMARC towards quarantine and reject, split streams and set a weekly review.
What are common deliverability problems and how do you fix them?
| Symptom | Likely cause | Fix |
|---|---|---|
| SPF permerror in headers or reports | More than 10 DNS lookups, or two SPF records | Merge into one record, remove unused includes, move a platform to a subdomain |
| DKIM pass but DMARC fail | Platform signs with its own domain, so DKIM does not align | Complete custom domain authentication in the platform |
| Outlook.com bounces with 550 5.7.515 | High-volume sender missing SPF, DKIM or DMARC | Publish and verify all three for the From domain |
| Gmail 4.7.28 deferrals | Rate limiting after unusual volume or reputation drop | Pause, then resume gradually, as Google advises |
| Sudden move to spam after a campaign | Complaint spike from an old or cold segment | Stop sending to that segment, check Postmaster Tools, re-permission or suppress |
| Unsubscribe link missing in Gmail | Headers missing or not DKIM-signed | Enable one-click unsubscribe in the platform and check raw headers |
What does a deliverability fix look like in practice?
A hypothetical example: an Indian B2B software firm’s newsletter opens have fallen and Outlook.com contacts report bounces. The audit finds two SPF records, a platform signing DKIM with its own domain, no DMARC and an old imported event list.
The fixes: merge SPF into one record, complete domain authentication so DKIM aligns, publish DMARC at p=none, suppress the event list, re-permission inactive contacts and move notifications to a subdomain. After clean reports, DMARC moves to quarantine. This example is illustrative; it does not describe a real client or outcome.
What should Indian businesses consider about consent and email?
Indian businesses should also prepare for the Digital Personal Data Protection framework. The Ministry of Electronics and IT data protection framework page sets out the Act and Rules, which are being phased in. Practically: collect clear consent, record when and how each contact opted in, make withdrawal easy and keep only the data you need. Take legal advice. People who knowingly signed up also rarely complain.
If you also message customers on WhatsApp, the same consent thinking applies; the WhatsApp Business automation guide covers opt-in requirements. B2B teams should read the B2B demand generation guide so email volume follows demand.
What is a practical 30/60/90-day deliverability plan?
| Phase | Focus | Actions |
|---|---|---|
| Days 1–30 | Visibility and authentication | Inventory senders; fix SPF, DKIM and alignment; DMARC p=none; Postmaster Tools and Yahoo CFL |
| Days 31–60 | List and reputation | Clean bounces; sunset policy; engagement segments; separate streams |
| Days 61–90 | Enforcement and routine | DMARC to quarantine, then reject; document DNS ownership |
Deliverability works best as part of a wider automation system rather than a one-off fix. The marketing automation guide shows how sending rules, segments and data hygiene fit together, and Bargaon’s marketing automation service can help you plan that system around authenticated, consent-based email.
Which mistakes hurt deliverability most?
- Publishing a second SPF record when adding a new tool, instead of editing the existing one.
- Jumping straight to p=reject without reading reports, which blocks your own legitimate mail.
- Hiding the unsubscribe link, which pushes people to the spam button instead.
Which related guides should you read next?
- Marketing automation for the system that segments, triggers and sends your email.
- Lifecycle marketing to match email frequency and content to customer stage.
- eCommerce email and WhatsApp for transactional and promotional flows in online stores.
- WhatsApp Business automation for opt-in and messaging rules on WhatsApp.
- HubSpot CRM for setting up contacts, campaigns and reporting in HubSpot.
Frequently asked questions
Do I need SPF, DKIM and DMARC if I send fewer than 5,000 emails a day?
Gmail requires the full set only from senders of 5,000 or more a day, but all three are low effort and protect your domain from spoofing.
Can I start with DMARC p=reject?
It is risky: any legitimate tool that fails alignment will have its mail rejected. Start at p=none and tighten after reading reports.
Why does my SPF record fail when it looks correct?
The most common causes are more than 10 DNS lookups across nested includes, which produces a permerror under RFC 7208, or having two separate SPF records.
Is a dedicated IP better for deliverability?
Not always. It needs steady volume and warm-up; smaller senders often do better on a well-managed shared IP.
Do transactional emails need one-click unsubscribe?
Gmail and Yahoo apply the one-click unsubscribe requirement to marketing and subscribed messages. Keep transactional mail on a separate stream and free of promotions.
Which free tools help monitor deliverability?
Google Postmaster Tools, Yahoo’s Complaint Feedback Loop and DMARC aggregate reports read with a free viewer.
Sources and further reading
- Google: Gmail email sender guidelines
- Google: Postmaster Tools dashboards
- Google Workspace: Set up DKIM
- Google Workspace: Set up BIMI
- Yahoo Sender Hub: Sender best practices
- Yahoo Sender Hub: FAQs (Complaint Feedback Loop)
- Microsoft Tech Community: Outlook’s new requirements for high-volume senders (April 2025)
- Microsoft Support: Fix NDR error 550 5.7.515 in Outlook.com
- IETF: RFC 7208, Sender Policy Framework
- IETF: RFC 7489, DMARC (2015)
- IETF: RFC 9989, DMARC (May 2026)
- RFC Editor: RFC 8058, one-click unsubscribe
- HubSpot Knowledge Base: Connect your email sending domain
- Zoho Campaigns Help: Authenticate email domain
- Brevo Help: Authenticate your domain with Brevo
- Mailchimp Help: Set up email domain authentication
- MeitY: Data protection framework
- Editorial note: the deliverability audit sequence, the 30/60/90-day plan and the worked example are Bargaon’s editorial models and hypothetical illustrations, not research data or client results.
Want email that reaches the inbox? Bargaon’s marketing automation service helps you plan authenticated sending, consent-based lists and clean segments as part of one automation system.