Avoiding Email Delivery Issues

/

Email deliverability stopped being optional homework in 2024, when the three largest mailbox providers on earth started bouncing mail that fails authentication.

Google and Yahoo began enforcing bulk sender requirements in February 2024, and Microsoft followed on May 5, 2025, rejecting non-compliant bulk mail to Outlook, Hotmail and Live addresses with a permanent 550 5.7.515 error rather than quietly junking it. If your password resets, invoices or newsletters are landing in spam, the cause is almost always one of the layers below, and every one of them is fixable. This covers the full stack: DNS authentication with setup steps, the From/Reply-To mistakes that trip filters, compliance rules, domain and IP reputation, blocklist monitoring, and the testing tools that actually tell you where you stand.

The Authentication Trio: SPF, DKIM, DMARC

These three DNS records are the price of admission now. Gmail and Yahoo require all three for anyone sending 5,000+ messages a day, Microsoft requires them for bulk senders, and even low-volume senders get scored on them.

SPF: Who May Send for Your Domain

SPF is a TXT record on your domain listing every server authorized to send mail claiming to be you. One record, every sender included:

Type:  TXT
Host:  @
Value: v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.25 -all

Setup steps: inventory every service that sends as your domain (Google Workspace, your ESP, your CRM, the web server sending form notifications), add each one’s include, then end with -all (hard fail) or ~all (soft fail). The two mistakes that break SPF: publishing more than one SPF record (the spec allows exactly one; merge them) and exceeding the 10 DNS lookup limit, which silently invalidates the whole record. Every include: costs lookups, so audit with a checker and drop services you no longer use, or use a flattening service if you genuinely need more than ten.

DKIM: Cryptographic Proof the Message Wasn’t Altered

DKIM signs each outgoing message with a private key; receivers verify it against a public key you publish in DNS under a selector:

Type:  TXT
Host:  s1._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

Setup steps: you don’t write this record by hand. Every legitimate sender (Google Workspace, SendGrid, Mailgun, Postmark, SES, your SMTP relay) generates the key pair and hands you the record or a CNAME to publish; you paste it in DNS and click verify. Use 2048-bit keys, publish a selector per sending service so one compromised key doesn’t take everything down, and rotate keys yearly. The common failure is a service left half-configured and signing with its own domain instead of yours, which brings us to alignment.

DMARC: The Policy That Makes the Other Two Matter

DMARC tells receivers what to do when SPF or DKIM fail, and critically, it requires alignment: the domain in the From header your reader sees must match the domain that passed SPF or DKIM. Without DMARC, a spammer can pass SPF on their own domain while displaying yours in the From line.

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r

Setup steps, in order: publish at p=none first, which enforces nothing but makes every major receiver email you aggregate reports showing exactly which services are sending as your domain and which are failing alignment. Read those reports for two to four weeks (a free parser like DMARC analyzers from EasyDMARC or Postmark’s DMARC digests makes them human-readable), fix every legitimate sender that’s failing, then tighten to p=quarantine and finally p=reject. Microsoft’s minimum is p=none, but none provides zero spoofing protection and does nothing for your reputation; reject is the destination. Once you’re at enforcement, BIMI lets you publish your logo next to messages in Gmail and Yahoo, which is cosmetic but signals exactly the kind of sender filters trust.

From, Reply-To, and the Formatting Mistakes That Trip Filters

Authentication gets you to the door; the message itself still has to not look like spam.

  • From domain mismatch – Sending “from” yourdomain.com through an ESP that signs as esp-mail.com fails DMARC alignment. Always complete the custom domain authentication step in your ESP.
  • Reply-To pointing somewhere unrelated – A From at yourdomain.com with a Reply-To at a random Gmail address is a classic phishing pattern. Keep Reply-To on the same domain, or at minimum a recognizably related one, and make it a real monitored mailbox.
  • noreply@ addresses – Filters increasingly score on engagement, and an address that invites zero replies earns zero positive engagement. Replies are the strongest positive signal a mailbox provider sees; accept them.
  • HTML with no plain-text part – Multipart messages with a real text/plain alternative score better than HTML-only. Most ESPs generate it; broken custom senders often skip it.
  • Link text that doesn’t match the href – Displaying one URL while linking another is the single most phishing-correlated content pattern. Related: raw link shorteners (bit.ly) in email bodies, which spammers burned long ago.
  • Image-heavy, text-light bodies – One big image with ten words of text is spammer camouflage. Keep a sensible text-to-image ratio.
  • Sloppy HTML – Unclosed tags, pasted-from-Word markup, and $0 font tricks all correlate with junk. Templates from any mainstream ESP are fine; hand-rolled HTML deserves a lint.
  • Tracking domains that aren’t yours – Open and click tracking rewrites links through your ESP’s shared tracking domain, whose reputation you share with every other customer. Set up a custom tracking CNAME (track.yourdomain.com) so clicks resolve through your own name.

Compliance: Unsubscribe and the Law

This is both a legal requirement and a filtering input, because providers measure how you handle people who want out.

  • One-click unsubscribe headers (RFC 8058) – Gmail, Yahoo and Microsoft all require bulk mail to carry List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click headers, and to honor them within two days. This is the header-level unsubscribe button in Gmail’s UI, separate from the link in your footer. Any real ESP adds it; verify yours does.
  • CAN-SPAM (US) – Working unsubscribe honored within 10 business days, a valid physical postal address in every commercial message, and no deceptive subject lines or headers. Penalties are per message.
  • GDPR (EU) and CASL (Canada) – Consent-based rather than opt-out-based: you need provable opt-in before sending marketing at all. CASL fines are severe.
  • Spam-rate ceiling – Gmail’s enforced threshold is a 0.3% user-reported spam rate, with under 0.1% as the stated target. Making unsubscribe hard doesn’t retain subscribers; it converts them into spam complaints that poison delivery to everyone else on your list.

Sending Domain Authority and Content Relevance

Mailbox providers keep a reputation score on your domain the same way Google keeps one for search, and it’s built on history: how long the domain has sent mail, how consistently, and how recipients react.

  • Never send cold from a fresh domain. A domain registered last week blasting 10,000 messages is the textbook spam signature. Age the domain, send low volumes to engaged recipients first, and ramp over weeks (warmup).
  • Use subdomains to isolate reputation. The standard architecture is transactional mail from one subdomain (mail.yourdomain.com), marketing from another (news.yourdomain.com), corporate one-to-one from the root. A newsletter mistake then can’t drag your receipts into spam.
  • Send from a domain with real, related content. Filters and the humans reviewing mitigation requests both check whether the sending domain resolves to a live site whose content matches the mail. A newsletter about WordPress sent from a domain hosting a WordPress consultancy is coherent; mail from a bare parked domain, or content mismatched with the site, reads as a snowshoe spam setup. Keep the root domain’s site alive, relevant and linked from your messages.
  • Keep volume consistent. Reputation systems model your normal. Sending nothing for two months and then a 50,000-message burst looks like a compromised account even when it’s just your holiday campaign; ramp into spikes.

Sending IP Reputation

Below the domain sits the IP, and the right answer depends on volume.

  • Under roughly 100K messages/month: use your ESP’s shared pools. A good provider polices its pools, and a shared IP with constant healthy traffic beats a dedicated IP you can’t keep warm.
  • High volume: dedicated IP, warmed properly. Two to six weeks of gradually increasing sends to your most engaged recipients before full volume, and never let it go cold.
  • Never send bulk from your web server’s IP. Your WordPress box has no sending reputation, shares a neighborhood with whoever your host put next to you, and PHP mail() from it is the fastest route to the junk folder. Route everything through authenticated SMTP or an API-based provider; I covered the small-scale version of this in my Google SMTP post.

Checking Blocklists and Monitoring Reputation

Do this on a schedule, not after the complaints start:

  • Blocklist sweep – MXToolbox’s blacklist check runs your domain and IP against 100+ lists in one shot. The ones that matter: Spamhaus (SBL/XBL/DBL), Barracuda, SpamCop, SURBL. Most lists have self-service delisting once you’ve fixed the cause; Spamhaus listings mean a real problem to resolve first.
  • Google Postmaster Tools – Free, and the only first-party view of how Gmail scores you: domain and IP reputation tiers, spam-rate trend, authentication success rates. Mandatory for anyone sending volume to Gmail.
  • Microsoft SNDS and JMRP – The Outlook equivalents: SNDS shows your IP’s traffic and complaint view, JMRP feeds you the actual complaints so you can suppress those recipients.
  • DMARC aggregate reports – Your ongoing radar for both spoofing attempts and legitimate services drifting out of alignment.

Testing Deliverability: What to Actually Use

Two tools cover 95% of needs:

  • Mail-Tester (free) for the quick check. Send one message to the address it generates and get a 10-point score with every deduction itemized: SPF/DKIM/DMARC results, blocklist hits, content flags, broken headers. It’s the right first stop every time you change DNS, templates or providers. Don’t chase 10/10 religiously; chase the specific deductions.
  • GlockApps for real inbox placement. My recommendation when it matters: it sends your actual campaign to a seed list of ~70 real mailboxes across Gmail, Outlook, Yahoo and others and shows you where it landed (inbox, promotions, spam, missing) per provider, plus blocklist and DMARC monitoring. Plans run $59 to $129 a month, and one month of it diagnosing a placement problem pays for itself. The honest caveat with any seed test: seed inboxes have no engagement history with you, so results approximate real-world placement rather than guarantee it, which is why Postmaster Tools stays in the loop as ground truth.

For DNS-layer verification specifically, learndmarc.com visualizes a live SPF/DKIM/DMARC evaluation of a real message, and EasyDMARC or dmarcian make the ongoing report monitoring painless.

Common Patterns That Get Flagged

The shortlist of behaviors that reliably trigger filters, independent of everything above:

  • Purchased or scraped lists, which are salted with spam traps: addresses that never opted into anything and exist purely to catch you. One trap hit craters a reputation.
  • No list hygiene: hard bounces left on the list signal scraping, and Microsoft’s 2025 rules explicitly require bounce management. Suppress hard bounces immediately and prune recipients who haven’t engaged in 6-12 months.
  • Sudden volume spikes from a quiet domain or IP.
  • Mismatched or deceptive subject lines (“Re:” on a first contact, fake forward prefixes).
  • Sending everything to everyone instead of segmenting by engagement; low open rates across a whole list drag the domain down for your best recipients too.
  • Rotating domains or IPs to outrun a bad reputation, which is literally the definition of snowshoe spam and is pattern-matched aggressively.

The Order of Operations

If you’re starting from spam-folder purgatory, fix things in this sequence: authenticate (SPF, DKIM, DMARC at p=none), read a Mail-Tester result and clear every deduction, fix alignment and move DMARC to reject over a month, add the one-click unsubscribe headers, set up Postmaster Tools and SNDS, sweep blocklists and delist, then run a GlockApps placement test to confirm. Deliverability is not one setting; it’s the accumulation of a sender that authenticates cleanly, mails people who asked for it, and makes leaving painless. Mailbox providers measure all three, and they’re measuring whether you’re worth delivering.