Email Deliverability: Keep Your Emails Out of Spam

Most businesses find out they have a deliverability problem the same way: a campaign that used to bring replies goes quiet, and nobody is certain whether the emails were sent at all.

They were sent. They were simply not chosen. A mailbox provider decides in milliseconds whether a message earns a place in the inbox, and by the time your dashboard reports a successful send, the decision has already been made.

I have spent 13 years working on email and digital marketing for Australian businesses, and the pattern rarely changes. A campaign that fails is usually decided by a missing authentication record or a list nobody has cleaned in three years, well before anyone wrote a subject line. Deliverability is a plumbing problem before it is a writing problem.

Deliverability is not the same as delivery

What your sending dashboard actually measures

Your platform reports delivery, which means the receiving server accepted the message. Acceptance is not placement. A message that is accepted and then filtered into the spam folder still counts as delivered in almost every report I have seen.

Deliverability measures whether the message reached the inbox. That difference explains the campaign with a delivery rate above 99 per cent and an open rate near zero. Nothing in the sending platform is broken. The decision that mattered happened somewhere the report cannot see.

Why an accepted message can still miss the inbox

Once a message is accepted, the provider weighs three things: whether the sending domain can be verified, what the reputation of that domain and its sending IP looks like, and how recipients behaved towards previous messages from the same source. A provider that has watched thousands of people ignore your emails has formed an opinion about the next one before it opens it.

That is the part most businesses miss when they rewrite the email. The copy is usually the last variable in the chain, not the first.

What spam filters are really judging

Authentication, reputation and engagement

Authentication answers a simple question: can this server prove it is allowed to send on behalf of this domain. Where that proof is missing, filters have to guess, and guessing does not go your way. Google's sender requirements are explicit about the scale at which authentication becomes compulsory. Google's email sender guidelines state that "Starting February 1, 2024, email senders who send more than 5,000 messages per day to Gmail accounts must meet the requirements in this section." The threshold covers more businesses than most owners expect, because it counts anything close to it. As Google's sender guidelines FAQ explains, "A bulk sender is any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period."

Sending fewer messages does not put you outside the judgement, only outside the requirement. A small list that ignores you is still a small list that ignores you.

The complaint thresholds Gmail publishes

Reputation is partly about who you are and heavily about what recipients do. Google publishes the number it cares about. Its sender guidelines instruct senders to "Keep spam rates reported in Postmaster Tools below 0.30%." That figure is a user reported spam rate, not a bounce rate, and it is measured against the mail people complained about rather than the mail you sent.

The consequence of drifting past it is not a warning. It is a graduated penalty. Google's FAQ notes that "The user-reported spam rate's impact on delivery is graduated, and rates of 0.3% or higher have an even greater negative impact on email inbox delivery." Three complaints per thousand recipients is the line. Working under two per thousand leaves room for a bad day.

SPF, DKIM and DMARC in plain English

What each record does and who sets it up

SPF is a DNS record listing the servers allowed to send for your domain. DKIM adds a signature to each message so the receiving server can confirm the content was not altered in transit. DMARC is the policy that ties the two together, tells receivers what to do when a message fails both, and sends you reports on who is sending as your domain.

Your sending platform usually publishes the values and your DNS host applies them. Ask for the records themselves rather than a confirmation that someone added them. When I check a domain that is failing, the cause is nearly always a typo, a missing semicolon, or two SPF records on one domain, which is worse than having none.

Alignment, forwarding and why legit mail fails

Alignment is the detail that trips people up. It is not enough for a message to carry a valid signature. The domain in the signature has to match the domain the reader sees in the from address. A platform sending on your behalf with its own domain in the return path can pass SPF and DKIM and still fail alignment, and alignment is what DMARC actually assesses.

That is also why genuine mail fails. A subscriber forwards a newsletter to three colleagues, the signature breaks in transit, and the receiving provider sees unauthenticated mail claiming to be from your domain. Google is blunt about where that ends. Its guidelines state that "Messages that aren't authenticated with these methods might be marked as spam or rejected with a 5.7.26 error."

Why complaints hurt more than bounces

How user reported spam rates are measured

A bounce is a message that never arrived, and it is easy to act on: remove the address and move on. A complaint is a choice. Someone opened the email, looked at it, and pressed the button that says this is unwanted. Providers treat that as a judgement on the sender rather than on the individual message.

Complaints are counted as a share of delivered mail, which is why a small campaign moves the number faster than a large one. Fifty complaints from a list of ten thousand recipients is a worse signal than five hundred complaints from a million, because the ratio is what is being read.

What a spike does to your future sends

Reputation accumulates, and it recovers far more slowly than it degrades. Google states plainly that "If messages from your domain are frequently reported as spam, future messages from you are more likely to be marked as spam." The effect carries into transactional mail too, which is how a business finds out it has a problem when a password reset fails to arrive.

The uncomfortable part is that a complaint spike usually has a boring cause: sending to people who stopped engaging, or sending more often than your list expects. Both are fixable, and neither is fixed by changing the subject line.

List hygiene without deleting your list

Finding the unengaged end of a list

Nobody wants to delete a list they spent years building, and you do not have to. Split it rather than shred it. Start with the people who have received twelve or more messages and have never opened one. They are the group most likely to report you as spam instead of unsubscribing, and every complaint from that group affects delivery for everyone else on the list.

Move that segment aside and send one honest re-permission message asking whether they still want to hear from you. Anyone who does not respond comes off. The list gets smaller and far more accurate, and your complaint rate usually falls within a fortnight.

Making unsubscribe easy on purpose

Every obstacle in front of the unsubscribe link pushes people towards the spam button instead, and a complaint costs more than a lost subscriber ever does. Google's guidance is direct: "Always give recipients an easy way to unsubscribe from your messages." Its Postmaster Tools guidance goes further and suggests pruning the quiet end of the list at the source: "Consider unsubscribing recipients who don't open or read your messages."

Plenty of businesses still hide the link in six point grey text at the bottom of the footer. Open your last campaign on a phone and try to find it in three seconds. If you cannot, nobody else can either.

If the list has not been reviewed since it was built, the work is worth doing next to a wider look at what is actually driving enquiries, which is what a marketing audit that checks your email setup end to end is designed to cover.

Reading Postmaster Tools like an operator

The four dashboards worth a monthly look

Postmaster Tools is free, and in my experience almost nobody has set it up. Add your sending domain, verify it with a DNS record, and give it a few days to populate. Four panels do the work: the user reported spam rate, domain and IP reputation, delivery errors, and the feedback loop.

Check them on the same day each month so you are comparing like with like. Resist refreshing daily. Spam rates move in small increments, and daily readings will have you chasing noise instead of a trend.

What to do when the numbers move

A rising spam rate usually means one of three things happened: you sent to a quiet segment, a seasonal promotion landed badly, or the list picked up addresses that never asked for anything. A reputation drop with a flat spam rate points somewhere else, most often at authentication or at a shared sending IP.

Write down what you changed before you changed it. Half the diagnostic work is knowing which variable moved first, and the other half is knowing when it moved.

Diagnosing a sudden deliverability drop

Working backwards from the date it changed

Find the date the numbers turned, then list everything that changed in the fortnight before it: a new sending platform, a migrated domain, a new signup source, a larger campaign, a new template, a changed from address. Deliverability problems follow changes, and the cause is usually one of the changes you assumed was unrelated.

Look at the complaint rate and the bounce rate separately. A spike in bounces points to a list or infrastructure problem. A spike in complaints points to relevance or frequency, and the two need different responses.

The three usual suspects and how to tell them apart

Authentication failure, a reputation hit and an engagement collapse account for nearly every case I have worked on. Authentication failure shows up as SPF, DKIM or DMARC failures in the headers of a test send, and it usually follows a DNS change or a platform migration. A reputation hit shows as a panel turning amber or red while your own send behaviour looks unchanged. An engagement collapse looks like nothing at all until you compare open rates across segments and find one that has been dead for months.

Send a test to a fresh address you control, including a Gmail address, and read the headers. That single step separates the first suspect from the other two in about five minutes.

The fix order that works when time is short

Free fixes first

Publish or correct SPF, DKIM and DMARC. Remove hard bounces. Make sure the unsubscribe link works in every template and test it on a phone. Suppress the segment with no opens over the past year. Each of those costs nothing but an hour, and together they resolve most cases on their own.

Do them in that order. Fixing authentication before pruning the list means the first re-permission send goes out from a domain that can be verified, which is the difference between a repair and another complaint spike.

What to change in your sending platform

Once the free work is done, look at separating your sending streams. Marketing mail and transactional mail should not share a reputation. Send campaigns from a subdomain, keep order confirmations and password resets on the main domain, and give the marketing stream room to fail without taking the rest of your email with it.

Then reduce sending to your most engaged segment and add names back only while the numbers hold. Reputation is rebuilt from recipient behaviour over weeks rather than switched back on, so the pattern that works is slow and deliberate.

The longer term work is a program people have a reason to open, which is what email marketing that actually reaches the inbox is built around, and content that gives people a reason to open feeds it. If you would rather have someone read the records and the reported spam rate directly, you can ask about an email deliverability review and bring access to your sending platform's settings so the review starts from real data.

Email deliverability questions I get asked most

Why do my emails go to spam when people signed up for them?

Usually one of three things. The sending domain is not properly authenticated with SPF, DKIM and DMARC. The domain or IP has a poor reputation because of past complaints. Or most recipients have stopped opening, so the mailbox provider treats new sends as unwanted. Check authentication first because it is the fastest to verify and the fastest to fix.

Do I need DMARC if I only send a few hundred emails a month?

Gmail's published bulk requirements start at 5,000 messages a day, so a small sender is not obliged to publish DMARC. It is still worth doing. DMARC tells receiving servers what to do with mail that fails authentication, and it gives you reports showing who is sending as your domain. Treat it as protection for your domain's name rather than a box to tick.

How much of my list should I clean out?

There is no fixed percentage and anyone who quotes one is guessing. Start with the subscribers who have received a dozen or more messages and never opened one, because they are the group most likely to mark you as spam rather than unsubscribe. Move them into a re-permission send, and remove the ones who do not respond.

Will shortening my emails and dropping images help deliverability?

Occasionally, but it is rarely the real cause. Filters weigh sender authentication, reputation and recipient behaviour far more heavily than image count. Fix the plumbing first. If your emails are image-only with almost no text, adding a plain text version and a clear reason to reply can help, but treat that as a small improvement rather than a cure.

How do I know if a problem is my sending platform or my domain?

Send a test to a fresh address you control, including a Gmail address, and check the message headers for SPF, DKIM and DMARC results. Then look at your Postmaster Tools dashboards for the sending domain. If the platform's other customers are fine and your domain is not, the reputation problem sits with your domain or list rather than the platform.

How long does it take to recover from a spam problem?

Reputation recovers slowly, because it is built from recipient behaviour over time rather than switched back on. Expect weeks rather than days. The pattern that works is to fix authentication, reduce sending to your most engaged segment, keep complaints close to zero, and increase the send again only while the numbers hold.