Email deliverability 101

What deliverability actually is

Deliverability is the technical and behavioral discipline of getting your email into the recipient's primary inbox rather than the spam folder, the promotions tab, or the void. It is not the same as "delivered" in your sending tool's dashboard. A sending tool reports a message as delivered the moment the receiving mail server accepts it, which happens before the mail server has decided what to do with the message. The message could be accepted and then routed straight to spam. From your sending tool's perspective, that is a successful delivery. From the buyer's perspective, that email does not exist.

Inbox placement is the metric that actually matters. The percentage of your sent messages that land in the recipient's primary inbox, observed empirically through seed inboxes and recipient feedback. Healthy B2B cold email programs land in the primary inbox 80 to 95 percent of the time. Programs that ignore deliverability run at 30 to 60 percent. The difference is roughly 2x in pipeline output, holding everything else equal.

The four levers that move inbox placement, in priority order:

1. Authentication. SPF, DKIM, DMARC. Without these, you are filtered automatically before any content check.
2. Sender reputation. Built up through warmup, sustained through engagement, lost through bounces and complaints.
3. Content quality. Spam-trigger words, link density, image-to-text ratio, attachments.
4. Engagement signals. Replies, not-spam clicks, forwarded messages. Increasingly, reply rate dominates over open rate.

The rest of this playbook walks through each lever.

Part 1: Sender reputation, how it works

Sender reputation is a score that inbox providers compute for every sending domain and every sending IP. It is not published. Google Postmaster Tools and Microsoft SNDS show you a slice of it. The full algorithm is opaque, but the inputs are well understood.

The inputs to reputation:

• Authentication pass rate. What percentage of your messages pass SPF, DKIM, and DMARC. Should be 100 percent. Anything less is a misconfiguration to fix immediately.
• Bounce rate. What percentage of recipients reject the message. Healthy is below 2 percent. Above 5 percent is a list-quality emergency.
• Spam complaint rate. What percentage of recipients click "report spam" or move the message to spam. Healthy is below 0.1 percent. Above 0.3 percent and Gmail will throttle you within days.
• Engagement. Replies, not-spam clicks, message forwards. High engagement raises reputation. Low engagement on a high-volume sender lowers it.
• Sending consistency. Steady volume builds trust. Bursts and gaps look suspicious.
• List quality signals. Sending to spam traps, deactivated addresses, or role-based mailboxes (info@, sales@) at scale all damage reputation.

Reputation is per-domain and per-IP. A bad domain on a shared IP affects everyone on that IP. This is one of the reasons most cold email tools use dedicated IPs or carefully managed shared pools.

Reputation builds slowly and dies fast. A new domain takes 14 to 21 days of warmup to reach a usable baseline. A domain that gets flagged can drop in 24 hours. Recovery from a drop takes 4 to 8 weeks of cooled-volume rebuilding, and some domains never fully recover.

Part 2: SPF, DKIM, DMARC in plain language

The three authentication standards. All three are required for B2B cold email in 2026. Setting up only two of three degrades deliverability over weeks. We see this misconfiguration on roughly half the domains we audit.

SPF (Sender Policy Framework)

SPF tells receiving mail servers which IP addresses or hostnames are allowed to send email on behalf of your domain. If a message arrives claiming to be from you, but it came from a server not listed in your SPF record, the receiving server should reject or quarantine the message.

SPF lives as a single DNS TXT record at the root of your domain.

Type:  TXT
Host:  @
Value: v=spf1 include:_spf.google.com -all

The structure:

• v=spf1: the version identifier.
• include:_spf.google.com: an include statement that imports Google's list of authorized servers. If you use Google Workspace, this is the right include.
• -all: the strict "fail" directive. Tells receivers to reject any mail not matching the listed servers.

Common variations:

• Microsoft 365: v=spf1 include:spf.protection.outlook.com -all
• Google Workspace plus SendGrid: v=spf1 include:_spf.google.com include:sendgrid.net -all
• Multiple senders: list every include before the -all.

Two failure modes to watch for:

• Multiple SPF records. You can only have one SPF TXT record at the root. Multiple records invalidate all of them.
• Exceeding 10 DNS lookups. Each include statement is a DNS lookup. SPF records that exceed 10 lookups fail. Use a tool like MXToolbox to verify count.

The "-all" hard fail is preferred over "~all" softfail. Hard fail is the modern standard. Soft fail is acceptable but weaker.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every outgoing message. Your sending provider gives you a public key. You publish it as a DNS TXT record. The receiving server uses the public key to verify the signature, which proves the message came from you and was not modified in transit.

Type:  TXT
Host:  google._domainkey
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBi[...long key...]QAB

The host name uses a "selector," which is the prefix before _domainkey. Different providers use different selectors:

• Google Workspace: google._domainkey
• Microsoft 365: selector1._domainkey and selector2._domainkey (publishes two)
• SendGrid: s1._domainkey and s2._domainkey
• Mailgun: k1._domainkey

You will have multiple DKIM records if you send through multiple providers. Each one needs its own selector and its own published public key. The selectors do not conflict.

Get the public key from your sending provider's admin console. For Google Workspace: Admin Console > Apps > Google Workspace > Gmail > Authenticate Email. For Microsoft 365: Defender > Email & collaboration > DKIM.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC tells receiving servers what to do when SPF or DKIM fail. Without DMARC, receivers have to guess. With DMARC, you set the policy.

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourco-outreach.io; pct=100

The fields:

• v=DMARC1: version.
• p=quarantine: policy. Three options: none (monitor only), quarantine (route to spam), reject (block). Use quarantine for cold sending domains. Reject is too aggressive; legitimate forwarded mail can fail SPF and you want quarantine, not block, on those cases. None is too permissive for production.
• rua=mailto:dmarc@...: reporting endpoint. Receivers will send daily aggregate reports here. Useful for catching misconfigurations early.
• pct=100: apply the policy to 100 percent of mail. Start at 100 for cold email; ramped policies (pct=50, pct=25) are for slow migration scenarios.

Common DMARC mistakes:

• Setting p=none and never moving past it. None is monitor-only and provides no protection.
• Setting p=reject too aggressively, blocking legitimate forwarded mail.
• Skipping the rua reporting address, so you never see when SPF or DKIM are failing.

After all three records are published, verify with MXToolbox or a similar checker. All three should return green before you start warmup.

Part 3: Domain warmup, week by week

A new domain has no sender reputation. Sending 50 messages on day one is the digital equivalent of a stranger walking into your kitchen and starting to cook. Inbox providers do not know who you are. They assume the worst. The standard outcome is a spam flag within the first week, followed by 4 to 8 weeks of recovery work that rarely fully succeeds.

Warmup is the process of building reputation gradually by sending small volumes that look like normal human email. Most cold email platforms include automated warmup networks that exchange messages with thousands of other domains in the network, marking them as read, replying to them, and moving them out of spam folders. This builds reputation without requiring real recipients.

The ramp schedule that works:

Several rules during warmup:

• Do not send live cold messages. Day 1 through day 14 is warmup network only. Live cold sends before day 14 frequently undo the warming.
• Vary the content. The warmup network handles this automatically. If you are warming manually, mix subject lines and body content.
• Send from a real-looking inbox. firstname.lastname@yourdomain.com. Set the profile picture, the signature, the display name. Inbox providers grade on these too.
• Spread sends across the day. Bursts look like spam. The warmup network does this for you; if you are sending manually, randomize.
• Keep warmup running after live sending starts. The warmup network's continued message exchange maintains reputation. Turning it off is a common cause of slow reputation decay.

Skipping warmup is the single most common cause of new-domain spam flags. We see this on roughly a third of the domains brought to us for emergency recovery. The fix in those cases is to retire the flagged domain and warm a new one, which costs 14 days at a minimum.

Part 4: Sending limits that protect reputation

Even after warmup, hard limits protect deliverability. These limits feel low because they are. The math works because you scale horizontally (more domains, more inboxes), not vertically (more sends per inbox).

• Per inbox per day: 40 to 50 emails maximum after warmup. Above this, you trigger volumetric spam filters at Gmail and Outlook.
• Per domain per day: Roughly 150 to 250 emails (3 to 5 inboxes per domain). To scale beyond, add domains.
• Per minute: Spread sends. Bursts of 50 emails in 5 minutes look like spam. The same 50 across 6 hours looks like a human.
• Per recipient per week: One message per recipient per week is the ceiling. More frequent contact triggers complaint rates.
• Per sequence: 3 to 5 messages over 14 to 21 days. Sequences longer than 6 messages show diminishing returns and rising complaint rates.

The horizontal scaling pattern:

• 2 secondary domains, 3 inboxes per domain, 40 emails per inbox per day = 240 emails per day total.
• 5 secondary domains, 4 inboxes per domain, 40 emails per inbox per day = 800 emails per day total.
• 10 secondary domains, 5 inboxes per domain, 40 emails per inbox per day = 2,000 emails per day total.

Programs sending more than 500 emails per day need at least 2 to 3 sending domains. Programs above 1,000 per day need 4 or more. The cost is small ($15 to $50 per domain per year plus mailbox provider fees) and the deliverability benefit is large.

Part 5: Inbox vs spam diagnostics

The hardest part of deliverability is that you cannot directly see where your messages land. The recipient sees the inbox or the spam folder. You see "delivered" in your sending tool. The gap between these two views is what diagnostics fills.

Seed inbox testing

The most reliable diagnostic: maintain a panel of test inboxes across Gmail, Outlook, Yahoo, Apple iCloud, and a few corporate domains. Send a test campaign to the panel and observe where each message lands. Vendors like GlockApps, MailReach, and MailGenius automate this with networks of seed addresses.

A healthy program shows 80 percent+ primary inbox placement on Gmail, 75 percent+ on Outlook, 70 percent+ on Yahoo. Lower numbers point to specific issues:

• Gmail spam: usually content or reputation. Check Postmaster Tools.
• Outlook spam: usually IP reputation. Check Microsoft SNDS.
• Yahoo spam: usually authentication. Verify SPF, DKIM, DMARC.
• Gmail promotions tab: usually too HTML-heavy, too many links, or commercial content cues.

Google Postmaster Tools

Free, run by Google. Add your sending domain, verify ownership with a DNS record, wait 7 to 14 days for data. It then shows:

• Domain reputation (low, medium, high).
• IP reputation.
• Spam complaint rate.
• Authentication pass rate (SPF, DKIM, DMARC).
• Encryption pass rate (TLS).

Check weekly. Any drop in reputation or rise in spam rate is a signal to investigate. Postmaster Tools is the single most useful free deliverability monitoring tool for Gmail.

Microsoft SNDS

Smart Network Data Services. Microsoft's equivalent for Outlook deliverability. Less detailed than Postmaster Tools but tracks the right signals. Register your sending IPs, monitor weekly.

Bounce rate and complaint rate

Both are in your sending tool. Set thresholds:

• Bounce rate under 2 percent: healthy.
• 2 to 5 percent bounce rate: list quality issue. Pause new campaigns, scrub the list.
• Above 5 percent bounce rate: stop sending immediately. Diagnose before resuming.
• Complaint rate under 0.1 percent: healthy.
• 0.1 to 0.3 percent complaints: message or targeting issue. Investigate.
• Above 0.3 percent complaints: Gmail will throttle. Stop sending and fix.

Bounce rate is the cleanest health signal for list quality. Complaint rate is the cleanest signal for message-market fit.

Part 6: Secondary sending domains in detail

Never send cold email from your primary domain. The two-domain rule:

• Primary domain (yourco.com): all internal email, all customer communication, all critical operational mail. Never used for cold outreach.
• Secondary sending domains (yourco-outreach.io, get-yourco.com): all cold email. Multiple secondaries let you split volume across domains.

If you violate this rule and your primary domain gets flagged, you damage the deliverability of every customer-facing email your company sends. The cost of recovery on the primary is catastrophic. The cost of secondary domains ($15 to $50 per year per domain plus mailbox fees) is trivial.

Naming conventions that work

• yourco-outreach.io
• get-yourco.com
• hello-yourco.com
• yourco-team.com
• talk-to-yourco.com
• yourco-app.io

Patterns to avoid

• Anything with "deal," "free," "save," "discount" in the name.
• Numbers in the domain (yourco2024.com reads as spam to filters).
• Lookalike TLDs (.email, .biz, .info) are down-weighted by most inbox providers.
• Hyphens stacked too aggressively (yourco-out-reach.com).
• Anything with "noreply" baked into the domain name.

How many secondary domains

The math is volume-driven:

• Under 250 emails per day: 1 secondary domain, 2 to 3 inboxes.
• 250 to 500 per day: 2 secondary domains, 3 to 4 inboxes each.
• 500 to 1,000 per day: 3 secondary domains, 4 inboxes each.
• 1,000 to 2,000 per day: 5 to 6 secondary domains.
• Above 2,000 per day: scale linearly. One domain per 250 to 400 sends per day.

Each domain needs its own full setup: SPF, DKIM, DMARC, warmup, monitoring. Provisioning a new domain takes 14 days minimum from purchase to first live send because warmup cannot be rushed.

Part 7: The February 2024 changes (Gmail, Yahoo, and Outlook)

The most consequential change in cold email deliverability in the last five years. Any program running in 2026 needs to be compliant with these requirements.

Gmail and Yahoo (February 2024)

For senders pushing more than 5,000 messages per day to Gmail or Yahoo:

• Authenticate all email. SPF and DKIM required.
• DMARC policy of at least p=none. Strict alignment required.
• One-click unsubscribe header. List-Unsubscribe and List-Unsubscribe-Post headers must be present and functional.
• Spam complaint rate under 0.3 percent. Sustained complaints above this trigger throttling.
• Valid forward and reverse DNS. The sending IP must have matching forward and reverse lookups.

The 5,000-message threshold is per recipient domain. A B2B sender hitting 200 unique companies a day is unlikely to hit 5,000 to a single domain, but the requirements still apply because Gmail and Yahoo enforce them for any high-engagement senders. Practically, you should comply regardless of volume.

Outlook (late 2024)

Microsoft followed Gmail and Yahoo with similar requirements. The notable additions:

• Domain authentication enforced more aggressively than before. SPF and DKIM failures route to spam by default for cold senders.
• List-Unsubscribe header expected on all bulk-style mail.
• Higher penalty for sending to invalid or stale addresses. List hygiene matters more than it did pre-2024.

Apple Mail Privacy (rolled out 2021, now structural)

Apple Mail Privacy Protection automatically opens every email and downloads tracking pixels, regardless of whether the user actually read the message. This made open rate structurally unreliable for any audience with significant Apple Mail usage, which in B2B is now 30 to 45 percent of recipients.

Practical consequence: open rate is dead as a primary metric. Reply rate is the meaningful signal. The shift is uncomfortable for teams trained to optimize for opens, but the data forces the change.

Part 8: Engagement signals that actually matter

Open rate is dead. Click rate is unreliable for cold (most cold first emails should have zero links). The signals that move reputation in 2026:

• Reply rate. The single most important engagement signal. Healthy cold B2B reply rate is 5 to 12 percent. Below 3 percent is broken. Reply rate is the cleanest signal of message-market fit.
• Not-spam clicks. When a recipient manually moves a message out of spam, the receiving server learns. Cumulative not-spam signals raise reputation faster than almost anything else.
• Forwards. A forwarded message is high-engagement. Forwards are harder to measure (your tool may not capture them) but the receiving server sees and weights them.
• Time in inbox before action. Messages that sit in the inbox for hours before being read or replied to score higher than messages immediately archived.
• Reply length. A two-word "not interested" reply still counts, but multi-sentence replies score higher.

What this means for your sending strategy: optimize for replies. The list, the message, the targeting should all be tuned against reply rate, not open rate.

Part 9: List hygiene and bounce management

Bad lists kill deliverability faster than bad content. Two principles:

Validate before sending

Run every list through a verification service before the first send. Common services: ZeroBounce, NeverBounce, Hunter Verify, Kickbox, MillionVerifier. They check each address against the receiving server in real time and return:

• Valid: safe to send.
• Invalid: the mailbox does not exist. Remove from the list.
• Catch-all: the server accepts all mail but the specific mailbox may not exist. Use cautiously.
• Risky: role-based addresses, disposable addresses, or addresses with low engagement history. Often remove.
• Unknown: the server timed out or did not respond. Re-verify or skip.

A healthy validated list is 85 percent+ valid addresses. After validation, your bounce rate on first send should land under 2 percent.

Monitor bounces continuously

Bounces fall into two categories:

• Hard bounces: the mailbox does not exist or the domain is invalid. Immediately suppress these from future sends. Hard bounces directly damage sender reputation if you keep sending to the same address.
• Soft bounces: temporary issues (mailbox full, server unavailable). One soft bounce is fine. Three or more soft bounces from the same address: treat as a hard bounce and suppress.

Most cold email tools handle suppression automatically. Verify yours does. A non-suppressing tool will repeatedly send to bounced addresses, which kills reputation in days.

Part 10: The deliverability tooling stack

A working setup uses Postmaster Tools and SNDS (free, mandatory), MXToolbox (free tier is fine for most), a seed-testing tool (GlockApps or MailReach), and one list-validation service. Total monthly cost: $100 to $300. Real cost-benefit: avoid one flagged domain per year and the tools have paid for themselves five times over.

Part 11: Recovery when a domain gets flagged

Domains do get flagged sometimes, even with everything set up correctly. The recovery process:

Step 1: Stop sending immediately. Continued sending after a flag deepens the damage and shortens the recovery odds.

Step 2: Diagnose.

• Spike in bounces? List quality problem. Re-validate the list.
• Spike in spam complaints? Message problem (too pushy, off-target, or sent to a wrong audience segment).
• Drop in reputation score without other symptoms? Often a provider algorithm change. Wait it out.
• Sudden blocklist landing? Check MXToolbox for which list. Submit removal request if appropriate.

Step 3: Cool the domain. Reduce sending volume to warmup levels (5 to 15 emails per day) for 14 to 21 days. The domain rebuilds reputation slowly.

Step 4: Fix the underlying cause. List validation, message rewrite, audience re-segmentation. Without fixing the cause, the flag recurs the moment you ramp volume back up.

Step 5: Ramp back up. Once the domain has held at low volume for 2 to 3 weeks without further issues, increase by 50 percent per week until you reach the previous sending rate.

If the domain does not recover after 4 to 6 weeks of cooling, retire it and warm a new one. Some domains never fully rebuild and starting fresh is faster than continuing to fight.

Part 12: The 14-day deliverability setup checklist

To deploy a working deliverability stack from scratch:

1. Day 1: Buy 2 secondary domains. Same registrar as your primary for convenience.
2. Day 1: Set up Google Workspace or Microsoft 365 on each domain. 2 to 3 inboxes per domain. Use firstname.lastname format. Add profile photo and signature.
3. Day 1: Configure SPF, DKIM, DMARC. Verify each in MXToolbox before proceeding.
4. Day 2: Verify the unsubscribe header (List-Unsubscribe and List-Unsubscribe-Post) is configured by your cold email tool. Send a test email to yourself and inspect raw headers.
5. Day 2: Connect each inbox to your cold email tool via OAuth.
6. Day 2: Enable the warmup network on every inbox. Start warmup.
7. Day 3: Register the domain with Google Postmaster Tools. Add sending IPs to Microsoft SNDS.
8. Day 3: Set up MXToolbox blocklist monitoring with email alerts.
9. Days 4 to 13: Let warmup run. Do not send live cold messages.
10. Day 14: Verify Postmaster Tools shows authentication passing at 100 percent. Run a seed inbox test.
11. Day 14: Validate your prospect list with ZeroBounce or NeverBounce. Suppress invalids.
12. Day 15: First live send. Start at 30 to 40 emails per inbox per day. Monitor the first 4 hours closely.

End-to-end: 14 days of warmup, 4 to 6 hours of setup work. After this, you can send sustainably for years on the same domains.

Part 13: How ReachIQ Email Health automates this

Deliverability is operational hygiene, not optimization, but the operational overhead is real. Configuring SPF/DKIM/DMARC correctly across 4 secondary domains, running warmup networks, monitoring Postmaster Tools and SNDS, parsing DMARC reports, validating lists, suppressing bounces: all of it is mechanical work that can be automated.

The ReachIQ Email Health module handles:

• Automated domain authentication setup with DNS-record templates per registrar.
• Built-in warmup network across all connected inboxes.
• Continuous monitoring of sender reputation, spam rate, and authentication pass rate.
• Automated bounce suppression and complaint suppression.
• Daily seed inbox testing across Gmail, Outlook, Yahoo, and corporate domains.
• Alerts when reputation drops or any monitored metric crosses a threshold.
• One-click recovery playbook when a domain gets flagged.

The point is to remove the operational burden so the team can focus on message and targeting. For teams running their own stack, the checklist in Part 12 covers the same work manually. Either approach works; the work just has to get done.

Part 14: Common deliverability mistakes

Mistake 1: Sending cold from the primary domain. Even briefly. Damages the email reputation of the entire company. Always use secondaries.

Mistake 2: Skipping DMARC. SPF and DKIM without DMARC degrades deliverability over weeks. All three are required.

Mistake 3: Skipping warmup. A new domain at 50 sends per day on day one has a 30 to 60 percent chance of being flagged within a week.

Mistake 4: Sending bursts. 50 emails in 5 minutes looks like spam. Spread across 6 hours.

Mistake 5: Ignoring open rate decay. Open rate stopped being reliable in 2021 and is now structurally noisy. Optimize for reply rate.

Mistake 6: Not validating the list. Bounce rate above 5 percent on first send is almost always preventable with $50 worth of list validation.

Mistake 7: No monitoring. A reputation drop that goes unnoticed for 4 weeks becomes a domain death sentence. Check Postmaster Tools weekly.

Mistake 8: Vertical scaling. Sending 200 emails per inbox per day "to save on domains" is the fastest path to a flag. Scale horizontally with more inboxes and more domains.

FAQ