Deliverability is the share of your e-mail that reaches the inbox instead of the spam folder or nowhere at all. It depends on three things: proof that the mail really comes from you, a history of people wanting your mail, and sending habits that look like a trustworthy sender. Since 2024 the largest mailbox providers have turned much of this into firm rules.
SPF, DKIM and DMARC
These are three DNS records on your domain. Together they prove that a message using your domain really came from you.
- SPF (Sender Policy Framework) lists the servers allowed to send mail for your domain. Include every service that sends for you: your mailbox provider, your newsletter tool, your shop. You can only have one SPF record per domain, so combine them.
- DKIM (DomainKeys Identified Mail) adds a digital signature to each message. The receiving server checks it against a public key in your DNS, which shows the message was not changed on the way. Turn it on in every sending service and use 2048-bit keys where offered.
- DMARC ties the two to the address people see in the From line. It tells receivers what to do when a message fails, and sends you reports about who is sending mail with your domain.
Start DMARC with p=none and a reporting address. Read the reports for a few weeks to find any service you forgot. Once all your real mail passes, move to p=quarantine and then p=reject. That last step stops other people from sending fake mail in your name.
The mailbox provider rules
In February 2024 Google and Yahoo started enforcing new requirements for bulk senders. Microsoft followed for Outlook.com, Hotmail and Live addresses in May 2025, and rejects non-compliant mail from large senders. In November 2025 Gmail stepped up its own enforcement with temporary and permanent rejections.
| Rule | Gmail | Yahoo | Outlook.com |
|---|---|---|---|
| Who it applies to | 5,000 or more messages a day to Gmail | Senders of significant volume | More than 5,000 messages a day |
| SPF and DKIM | Both required | Both required | Both required |
| DMARC | At least p=none, aligned | At least p=none | At least p=none, aligned |
| One-click unsubscribe | Required for marketing mail | Required, honoured within 2 days | Clear unsubscribe expected |
| Spam complaints | Below 0.3%, aim for 0.1% | Below 0.3% | Not published as a number |
| Since | February 2024 | February 2024 | May 2025 |
Even if you send far fewer messages, follow the same rules. Every sender to Gmail needs SPF or DKIM, valid reverse DNS on the sending server and a low complaint rate, and the bulk-sender rules describe what good practice looks like anyway.
One-click unsubscribe
Marketing messages need two headers defined in a standard called RFC 8058: List-Unsubscribe and List-Unsubscribe-Post. Together they let Gmail, Yahoo and others show their own Unsubscribe button, and remove the person without them visiting a page or signing in. Keep a visible unsubscribe link in the message body as well, and process every request within two days. Most newsletter services add the headers for you; check that yours does.
Keep your list clean
- Only mail people who asked. Bought or scraped lists cause complaints and bounces fast.
- Confirm new sign-ups. A double opt-in keeps out typos and fake addresses.
- Remove hard bounces at once. An address that does not exist will never start working.
- Stop mailing the inactive. If someone has not opened or clicked in six to twelve months, send one last check-in, then remove them.
- Watch your complaint rate. Google Postmaster Tools shows how Gmail users react to your mail. Microsoft offers a similar service called SNDS.
Sending habits that help
Send from your own domain, never from a free webmail address. Keep the From name the same each time so people recognise you. Send at a steady rhythm; a sudden jump in volume from a new domain looks like spam. Write a subject line that matches the content, and keep a reasonable balance of text and images.
CC and BCC
When you write to a group, the field you choose matters.
Use BCC when the recipients do not know each other, such as customers or event guests, and put your own address in To. Sharing a list of customer addresses in CC can count as a personal data breach. For anything regular, use a newsletter service instead. It sends one message per person, handles unsubscribes and keeps your reputation in better shape.
Common questions
- Do these rules apply to a small business?
- The strictest ones apply above 5,000 messages a day. The basics, such as SPF or DKIM and a low complaint rate, apply to everyone, and following all of them protects your reputation.
- How do I check my records?
- Send a message to a Gmail address, open it, and choose Show original. It shows whether SPF, DKIM and DMARC passed.
- Why do my messages land in spam even with DMARC set up?
- Authentication proves who you are. Inbox placement also depends on whether people open, ignore or report your mail, so list quality matters as much as DNS.
- Is p=none enough?
- It meets the current minimum. Moving to quarantine or reject protects your domain from people sending fake mail in your name.
Good deliverability comes from honest lists and correct DNS, and both are a one-time setup with light upkeep. A professional on Internetivo can set up SPF, DKIM and DMARC and check your newsletter tool for you. Start a project here.