Email deliverability: the complete guide to reaching the inbox
Why your mail lands in spam and how to fix it. A complete, plain-English guide to SPF, DKIM, DMARC, alignment, MTA-STS and the reputation factors that decide the inbox.
Deliverability is whether your mail reaches the inbox instead of spam — or gets rejected outright. It comes down to two things receivers check: authentication (can they prove the mail is really from you?) and reputation (do they trust your domain and sending IPs?). This guide covers the authentication trio you control via DNS, plus the reputation factors around them.
The authentication trio#
| Record | Answers the question | Fix guide |
|---|---|---|
| SPF | Which servers may send as my domain? | SPF |
| DKIM | Was the message signed by my domain and unmodified? | DKIM |
| DMARC | What should a receiver do if SPF/DKIM fail? | DMARC |
All three are DNS TXT records. SPF and DKIM prove authenticity; DMARC ties them to your visible From: domain (alignment) and tells receivers how to act on failures.
Alignment: the part people miss#
SPF and DKIM can pass on a hidden envelope domain that isn't your From: address — which does nothing for DMARC. DMARC only passes when SPF or DKIM authenticates a domain that aligns with the visible From: domain.
- For a sending service, that usually means setting up a custom return-path/CNAME and a DKIM key on your own domain, not the provider's.
- Use your provider's 'authenticate your domain' / 'custom domain' setup — it exists precisely to create alignment.
Beyond the trio#
- MTA-STS + TLS-RPT — enforce TLS on inbound mail and get reports. A trust/security signal.
- BIMI — show your logo next to authenticated mail in supporting clients (requires enforcing DMARC).
- Reverse DNS (PTR) on your sending IPs, matching the HELO hostname.
- List-Unsubscribe header (one-click) for bulk mail — now expected by Gmail/Yahoo.
Reputation and content#
- Warm up new domains/IPs gradually; a sudden volume spike looks like spam.
- Keep complaints low and lists clean — remove hard bounces and inactive addresses.
- Avoid spammy patterns: all-image emails, misleading subjects, link shorteners, mismatched sender names.
- Stay off blocklists — monitor your domain and IPs.
Check your setup#
Run the Email Deliverability Test for a single score across SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, with the exact fix for anything failing. To debug a specific message, paste its headers into the Email Header Analyzer.
Frequently asked questions
▸ ▾ Why does my email go to spam even with SPF, DKIM and DMARC?
Authentication gets you eligible for the inbox but doesn't guarantee it. Reputation (complaints, bounces, sending history), content, list hygiene and engagement all factor in. Check you're not on a blocklist and that your DMARC actually aligns.
▸ ▾ What's the minimum to meet Gmail/Yahoo bulk sender rules?
Valid SPF, DKIM and a DMARC record (at least p=none), one-click List-Unsubscribe on bulk mail, and a spam complaint rate under ~0.3%. Authenticate your sending domain so DMARC aligns.
▸ ▾ In what order should I set these up?
SPF first (single record, ends -all or ~all), then DKIM (enable signing at your provider), then DMARC (start at p=none with reporting, review, then tighten to quarantine and reject).
Do it with a free tool
Related guides
Published 2026-07-09 · Updated 2026-07-09 · By Crawlsonar.