Email deliverability: how to make sure your emails reach the inbox in 2026

What email deliverability actually means

Email deliverability is not the same as sending email. Sending email is trivial. Getting it to land in the inbox, reliably, for the people who want to receive it, is where most senders run into trouble.

Deliverability refers to the rate at which your emails reach the primary inbox of your recipients rather than being filtered into spam, held in quarantine, or silently dropped by a mail server. It is expressed as inbox placement rate, and a strong programme targets 95% or above.

Several factors determine where your email ends up. Internet service providers (ISPs) and mailbox providers such as Google, Microsoft, and Apple score every email against a set of signals before deciding where to place it. Those signals include your sender reputation, your technical authentication setup, your list quality, and the engagement patterns of your recipients. Fail on too many of those signals and your email never reaches anyone.

The challenge is that inbox placement is not visible in most email platforms by default. Your delivery rate, which platforms report, only tells you how many emails were accepted by receiving servers, not where those servers put them. An email accepted into the spam folder counts as delivered. Inbox placement tools, which we cover later in this guide, give you the fuller picture.

Understanding deliverability starts with understanding what mailbox providers are actually trying to do. They exist to serve their users, not senders. If a mailbox provider lets through too much unwanted email, users abandon the platform. So every signal they evaluate comes back to one question: does this sender send email that recipients want to receive? Build your programme around answering yes to that question and most deliverability problems either never appear or become straightforward to fix.

How email authentication works (SPF, DKIM, DMARC)

Authentication is the technical foundation of deliverability. Before a mailbox provider evaluates whether your email is wanted, it needs to verify that your email is genuine. Three DNS-based protocols handle this: SPF, DKIM, and DMARC.

SPF (Sender Policy Framework) is a DNS record that lists which IP addresses and mail servers are authorised to send email on behalf of your domain. When a receiving server gets an email claiming to be from your domain, it checks your SPF record to confirm the sending IP is on your authorised list. If it is not, the email fails the SPF check.

Setting up SPF requires adding a TXT record to your domain's DNS settings. Most email platforms provide the exact SPF record you need during onboarding. The record looks something like: v=spf1 include:_spf.yourplatform.com ~all. The ~all at the end is a soft fail, meaning emails that fail SPF are not automatically rejected but may be treated with more suspicion. A -all (hard fail) rejects them outright.

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The signature is created using a private key held by your sending platform and verified against a public key published in your DNS. Receiving servers check that the signature matches and that the email has not been modified in transit. DKIM is the stronger of the two inbound authentication signals because it is tied to content integrity, not just sending IP.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) builds on SPF and DKIM by telling receiving servers what to do when emails fail authentication. A DMARC policy at p=none monitors failures without taking action. At p=quarantine it sends failing emails to spam. At p=reject it blocks failing emails entirely. DMARC also sends aggregate reports to an email address you specify, so you can see who is attempting to send email using your domain.

Starting at p=none and graduating to p=reject over several weeks is the safest path for most senders. Moving straight to reject without monitoring first can accidentally block legitimate sending sources you had not identified, such as a third-party tool that sends transactional receipts on your behalf.

All three records work together. DMARC alignment requires that either SPF or DKIM passes and that the relevant domain aligns with the From address domain. Publishing all three, monitoring the DMARC reports, and maintaining alignment is the authentication baseline every sender should reach before worrying about anything else.

Tools like Mailchimp and HubSpot walk you through SPF and DKIM setup during account configuration, and both platforms generate the exact DNS records you need to add to your domain registrar.

Why emails go to spam and how to fix it

Spam filtering has become significantly more sophisticated. Modern filters do not just scan for keywords. They evaluate sender reputation, recipient engagement, content structure, link patterns, and authentication status simultaneously. Understanding which signals are triggering filters gives you the clearest path to fixing them.

Poor sender reputation is the most common cause of spam filtering. Reputation is domain-level and IP-level, and it accumulates over time based on recipient behaviour. High spam complaint rates, high unsubscribe rates, low open rates, and sending to inactive addresses all degrade reputation. Gmail and Yahoo moved the acceptable complaint rate threshold to 0.1% in early 2024. Above 0.3%, sending is likely to be heavily filtered or blocked.

Sending to unengaged or invalid addresses is the fastest way to damage reputation. If you send to people who have not opened your emails in six or twelve months and never re-engage them or remove them, mailbox providers interpret the lack of engagement as a signal that recipients do not want your email.

Spam trigger content has less influence than it used to, but it still matters at the margins. All-caps subject lines, excessive use of currency symbols, misleading subject lines, and overly image-heavy emails with little text can all contribute to spam scoring. The bigger risk today is engagement: an email with a slightly spammy subject line sent to a highly engaged list will likely land in the inbox. The same email sent to a disengaged list probably will not.

Missing or failed authentication remains an immediate filter trigger. Mailbox providers have substantially tightened requirements for bulk senders in recent years. Google and Yahoo both require SPF, DKIM, and DMARC for senders sending more than 5,000 emails per day. Even below that volume, missing authentication increases spam filtering risk significantly.

Sudden volume spikes trigger filters because they look like compromised account behaviour. If you normally send 2,000 emails per week and suddenly send 50,000, ISPs will flag the spike. Volume changes should be gradual, which leads directly to the question of domain warming.

If your emails are landing in spam, the fix follows a sequence: verify authentication is correct, check your complaint rate in the tools your platform provides, clean your list of invalid and long-inactive addresses, reduce send volume temporarily, and focus the next several sends on your most engaged segment to rebuild engagement signals.

List hygiene and its effect on deliverability

Your list is your most direct control over deliverability. A clean, permission-based list of engaged subscribers will outperform a large, unclean list on every metric that matters to mailbox providers.

List hygiene covers several distinct processes. The first is removing invalid addresses. Every email sent to an address that no longer exists generates a hard bounce. Hard bounces tell ISPs you are not maintaining your list, and a hard bounce rate above 2% can trigger filtering or sending suspensions. Mailchimp and Klaviyo both automatically suppress hard bounces after the first occurrence, but the underlying list problem, collecting invalid addresses in the first place, needs addressing at the source.

The second process is managing soft bounces. Soft bounces are temporary delivery failures caused by a full inbox, a temporarily unavailable server, or a message size rejection. Most platforms retry soft bounces automatically over 24 to 72 hours. Addresses that soft-bounce repeatedly across multiple campaigns should be suppressed, since persistent soft bounces can indicate an address that is now inactive.

The third process is re-engagement and removal of inactive subscribers. Inactive subscribers are typically defined as those who have not opened or clicked any email in the past 90, 180, or 365 days depending on your list size and industry. Sending to large numbers of inactive subscribers suppresses your open rate, which in turn signals low engagement to mailbox providers.

A re-engagement sequence sends two or three targeted emails to inactive subscribers with a clear message: here is what you have been missing, do you still want to hear from us? Give recipients a clear reason to confirm they want to stay subscribed. Those who click stay on the list. Those who do not can be moved to a suppression list or removed entirely.

The fourth process is removing known spam traps. Spam traps are email addresses used by ISPs and anti-spam organisations to identify senders with poor list practices. They come in two types: pristine traps (addresses that have never been used by a real person) and recycled traps (previously valid addresses that ISPs have converted into traps). Sending to spam traps does not affect a small percentage of your list, it damages your domain reputation at the ISP level and can result in blacklisting.

Spam traps enter lists through data purchases, scraping, or collecting addresses from old sources without confirmation. The cleanest way to avoid them is to use double opt-in for every new subscriber, which we address in the compliance section below. Good list hygiene habits, combined with the spam prevention practices covered in the cluster, form the core of a healthy sending programme.

For senders concerned about large-scale list quality, dedicated email validation services can check addresses in bulk before sending. These services flag invalid format addresses, catch-all domains, disposable addresses, and known spam traps before they damage your reputation. Running a validation pass on any list that has not been sent to in six months or longer is standard practice before resuming contact.

Sender reputation: how to build and protect it

Sender reputation exists at two levels: domain reputation and IP reputation. Both matter, but domain reputation has become the dominant signal as shared IP infrastructure has become more common and mailbox providers have shifted their scoring accordingly.

Domain reputation is tied to your sending domain. It accumulates based on recipient engagement, complaint rates, bounce rates, and authentication compliance over time. A new domain has no reputation at all, which is itself a risk signal. A domain with years of clean sending history and strong engagement has built substantial trust with mailbox providers.

IP reputation matters most for senders on dedicated IP addresses. Senders on shared IP pools, which is the default with most email platforms, inherit some of the reputation of the pool. This is usually fine because platforms manage pool quality, but it means your deliverability can occasionally be affected by the behaviour of other senders on the same pool. Moving to a dedicated IP is worth considering once you consistently send more than 50,000 to 100,000 emails per month, as the volume is sufficient to build strong domain-level reputation independently.

Protecting your sender reputation means maintaining engagement quality over time. That requires a few consistent habits. Send to your most engaged segments first, particularly when trying a new subject line approach or content format. Set clear send expectations at sign-up so subscribers know how often they will hear from you. Make unsubscribing easy, since a quick unsubscribe is far less damaging than a spam complaint. Monitor your complaint rate using Google Postmaster Tools, which provides domain-level data on how Gmail recipients interact with your emails.

Engagement metrics that build reputation include opens, clicks, replies, forwards, and the act of moving an email from spam to the inbox. Negative signals include spam complaints, deletes without reading, and moving emails from the inbox to spam. Your goal is to maximise the former and minimise the latter by only sending email that recipients genuinely want to receive.

If your reputation has been damaged by a period of poor practices, recovery is possible but slow. Cleaning the list, reducing volume, improving content quality, and focusing sends on your most engaged 10% to 20% of subscribers for several weeks will gradually rebuild positive engagement signals. There is no shortcut. Reputation recovery takes the time it takes.

How to warm up a new sending domain

Domain warming is the process of gradually building sending volume from a new domain to establish reputation with mailbox providers. Sending a large volume from a domain that has never sent email before triggers immediate filtering because the domain has no history.

The principle of warming is simple: start with small volumes to your most engaged subscribers, let engagement signals accumulate, and increase volume gradually over four to eight weeks. Mailbox providers observe the engagement rate of early sends and use it to calibrate how they treat future volume from that domain.

A typical warming schedule for a new domain might look like this. In week one, send to a maximum of 200 to 500 recipients per day, selecting your most recently acquired and most engaged subscribers. In week two, increase to 1,000 to 2,000 per day. By week four, many senders reach 10,000 to 20,000 per day if engagement rates are strong. By week eight, most senders can reach their full intended volume if the warming process has been clean.

The single most important factor in successful warming is list quality. If you warm a new domain against a list full of old, unengaged, or invalid addresses, you will build negative reputation from the start. Warming requires your best subscribers, not a random slice of the full list.

Several email platforms handle warming automatically for dedicated IP addresses. Klaviyo, for example, has built-in IP warming tools that manage the ramp schedule on your behalf. For domain warming specifically, the discipline falls on the sender: you need to control which segments receive email during the warming period and monitor engagement carefully throughout.

If you are migrating from one sending platform to another, treat the migration as a warming exercise even if you have been sending from the same domain for years. The new sending infrastructure has no established relationship with mailbox providers under your domain, and a sudden shift in sending IP patterns can temporarily affect placement rates.

Deliverability tools and monitoring

Most email platforms give you delivery rates and bounce tracking by default, but inbox placement, the number that tells you whether accepted emails landed in the inbox or in spam, requires dedicated monitoring tools.

Google Postmaster Tools is free and provides domain-level data for your Gmail sending performance. It tracks domain reputation, IP reputation, spam rate, authentication pass rates, and delivery errors. If you send any meaningful volume to Gmail addresses, Postmaster Tools should be running from day one. The data is available only for your own domain after you verify ownership, and it updates daily.

Postmaster Tools data has limits. It covers Gmail only, and it is only statistically significant when you send enough volume to Gmail recipients for Google to generate meaningful signals. For senders with smaller lists or heavily B2B audiences where Outlook dominates, supplementary monitoring tools give broader coverage.

Seed list testing is the standard method for checking inbox placement across multiple providers simultaneously. Services that offer seed list testing send your email to a set of test addresses at providers including Gmail, Outlook, Yahoo, and Apple Mail, then report back where each copy landed. This gives you a cross-provider inbox placement rate before you send to your actual list. Running a seed test on major campaigns before they go out catches placement problems while you can still address them.

HubSpot includes deliverability reporting in its Marketing Hub plans, with visibility into engagement rates, unsubscribes, and bounces segmented by list and campaign. For senders running more complex segmentation, this reporting helps identify which audience segments are causing reputation drag.

Blacklist monitoring is another component of deliverability health. Major blacklists maintained by organisations like Spamhaus, SURBL, and Barracuda are checked by many receiving servers. If your domain or sending IP appears on a significant blacklist, some recipients will never see your email regardless of its content. Blacklist monitoring services check your domain and IP against dozens of lists on a scheduled basis and alert you to new listings.

Building trust with subscribers also contributes to deliverability in ways that are harder to measure directly. Platforms like Trustpilot help businesses gather authentic reviews and signals of legitimacy, which supports the broader credibility that underpins a strong email programme. When subscribers recognise your brand as trustworthy, they are more likely to open, click, and mark your emails as safe rather than as spam.

AI-assisted tools can support ongoing deliverability by helping you write better subject lines and email copy that improves engagement rates. ChatGPT and Claude are both used by email marketers to draft subject line variants and test different content angles, which ultimately feeds back into the engagement signals that underpin inbox placement.

Compliance requirements that affect deliverability

Email compliance and email deliverability are closely connected. The legal frameworks that govern commercial email exist to protect recipients from unwanted messages. Mailbox providers largely share that goal, which means compliance failures and deliverability failures often have the same root cause: sending email to people who did not ask for it or who no longer want it.

Two frameworks matter most for UK and international senders: GDPR and the CAN-SPAM Act. GDPR governs email marketing to recipients in the UK and European Union and requires a clear lawful basis for sending, explicit opt-in consent for marketing email, and straightforward processes for unsubscribing and requesting data deletion. The GDPR and email marketing guide covers the specific consent and documentation requirements in detail.

The CAN-SPAM Act governs commercial email in the United States. It requires honest subject lines, a physical mailing address in every commercial email, a clear unsubscribe mechanism, and honour of unsubscribe requests within ten business days. CAN-SPAM does not require opt-in, but its unsubscribe requirements align closely with good deliverability practice: senders who ignore unsubscribe requests see complaint rates climb, and climbing complaint rates trigger spam filters regardless of legal status.

List hygiene practices intersect with compliance in two specific areas. First, consent documentation. Under GDPR you need to be able to demonstrate when and how each subscriber gave consent. This is not just a legal requirement; it is also evidence that your list is permission-based, which is the foundation of good deliverability. Second, suppression lists. Unsubscribed addresses must be suppressed permanently in your sending platform, not just removed from an active list. Most platforms handle this automatically, but if you import contacts from multiple sources or merge lists, verifying that suppressions carry over is essential.

Sending from a professional business email address on a custom domain is both a compliance signal and a deliverability factor. Sending from a free email domain such as Gmail or Yahoo for commercial volume email is increasingly treated as a spam signal by mailbox providers, particularly since Google and Yahoo added domain alignment requirements in 2024. A custom domain email address also helps recipients recognise your brand and decide to open rather than delete.

Deliverability for transactional and automated emails

Transactional emails, including order confirmations, password resets, receipts, and shipping notifications, have different deliverability dynamics from marketing campaigns. Recipients expect them and typically open them immediately, which produces engagement signals that benefit your sending domain's reputation. However, transactional emails sent through the same infrastructure as marketing campaigns can be affected if your marketing sending degrades your domain or IP reputation.

The standard practice for senders with significant transactional volume is to separate sending infrastructure. Marketing emails and transactional emails are sent from different subdomains, different IP addresses, or different sending accounts within the same platform. This ensures that a deliverability problem with marketing emails does not affect the delivery of time-critical transactional messages that customers rely on. Klaviyo supports subdomain separation for this purpose, as does HubSpot at higher plan tiers.

Automated email sequences, including welcome flows, abandoned cart series, and post-purchase sequences, sit between transactional and marketing email in terms of recipient expectation. Recipients who recently subscribed or took an action that triggers an automation are more likely to engage than recipients of a cold broadcast. This makes well-timed automations a positive contributor to sender reputation, provided the trigger logic is accurate and the content is relevant to the action that fired it.

The deliverability risk with automated sequences is staleness. A welcome sequence built and activated two years ago may contain links to pages that no longer exist, offers that have expired, or product references that are outdated. Broken links in automated emails generate bounces and error signals that affect deliverability. A quarterly audit of all active automation sequences to verify link integrity and content accuracy is the minimum maintenance standard for any programme sending automation at volume.

For sequences that trigger based on purchase or browsing behaviour, the accuracy of the data connection between your ecommerce platform and your email platform directly affects both the relevance of the email and its deliverability profile. A browse abandonment email that triggers for the wrong product, or a post-purchase sequence that fires for a product the customer did not actually buy, produces the kind of confusing experience that increases delete-without-reading rates and, over time, spam complaints. The guide to email automation covers the sequence setup and maintenance practices that keep automated flows performing reliably, and the guide to email marketing strategy covers how transactional and marketing email fit together in a unified programme design.

What this means for your inbox placement

Deliverability is one of the few areas of email marketing where technical setup, list quality, content, and compliance all connect directly to commercial outcomes. An email that does not reach the inbox earns nothing, regardless of how good the offer, the subject line, or the design happens to be.

The practical path to strong inbox placement follows a clear sequence. Set up SPF, DKIM, and DMARC before sending anything, and use a DMARC policy that escalates gradually from monitoring to enforcement over eight to twelve weeks. Use double opt-in for all new sign-ups so your list starts clean. Run a re-engagement campaign on any segment that has been inactive for more than six months and remove non-responders. Monitor your complaint rate using Google Postmaster Tools, and treat a rate above 0.1% as an immediate signal to investigate list quality and send relevance.

For senders building a programme from scratch or migrating to a new domain, domain warming is not optional. The four to eight weeks of controlled low-volume sending feels slow, but skipping it consistently leads to the much slower process of reputation recovery after a filtering event.

The content and compliance fundamentals covered across this cluster, reducing spam triggers, managing bounce rates, maintaining legal compliance under CAN-SPAM and GDPR, and sending from a professional business email domain, all feed into the same outcome: a sender that mailbox providers trust and recipients recognise.

Strong deliverability is not a one-time setup task. It is an ongoing practice of list maintenance, engagement monitoring, and authentication hygiene. Senders who treat it as a background technical concern and review it once a year tend to find deliverability problems at the worst possible time, during a major campaign launch or a critical sales period. Senders who monitor it monthly and act on early warning signals maintain consistently strong performance across the programme.

The best foundation for long-term deliverability is also the simplest: send the right email to the right people at the right time, and make it easy for them to stop receiving it when they want to. Everything else in this guide is in service of that principle. For a broader perspective on how deliverability fits into overall programme design, the email marketing strategy guide covers the strategic context, the email list building guide covers permission-based acquisition, and the email marketing tips guide covers the ongoing optimisation habits that keep engagement high.