Updated · 12 min read
Email deliverability — the practitioner's guide
Deliverability problems don't arrive. They accumulate. Every send to a dormant user, every half-configured DNS record, every month you skip list hygiene — each is a small negative signal, and reputation is the sum of them all. Here's the operator's view of the four pillars: what to set up, what to watch, and what to do when something breaks.
By Justin Williames
Founder, Orbit · 10+ years in lifecycle marketing
Four pillars, all load-bearing
Deliverability is the cumulative result of every send decision made over the lifetime of a domain. Protect it accordingly.
Deliverability isn't a single setting. It's four distinct systems running at the same time, each watching you from a different angle, each punishing you for different sins. Break one and the damage usually shows up as something else entirely — low opens, slow throughput, complaint spikes you can't trace.
1. Authentication.SPF, DKIM, DMARC. DNS-level plumbing that proves to mailbox providers you're allowed to send from your domain. Miss any of the three and Gmail, Yahoo, and Microsoft will reject bulk senders at the door.Source · GoogleEmail sender requirementsGoogle's sender requirements updated in 2024 mandating SPF, DKIM, DMARC, and one-click unsubscribe for bulk senders.support.google.com/a/answer/81126
2. Reputation.Providers score your IPs and domains based on how you've behaved over weeks and months. Reputation is earned slowly and drained fast — one bad week can erase a half-year of clean sending.
3. Engagement. The forward-looking one. Opens, clicks, replies, adds-to-contacts, moves-out-of-spam — providers treat them as the strongest signal of whether your mail is worth inboxing tomorrow.
4. List hygiene. The boring, continuous discipline of removing dead weight. Clean list drives engagement. Engagement protects reputation. Reputation delivers the mail. It compounds — in both directions.
Authentication — the hard floor
SPF (Sender Policy Framework) publishes which servers are allowed to send on your behalf, via a DNS TXT record. DKIM (DomainKeys Identified Mail) cryptographically signs every message so recipients can verify it hasn't been tampered with. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells recipients what to do when SPF or DKIM fails, and sends you reports on what's passing and what isn't.
All three, configured correctly, no exceptions. Gmail and Yahoo hardened the requirement for bulk senders in 2024; Microsoft has equivalent policy for Outlook.com. When it's misconfigured, the deliverability damage is the worst kind — slow, silent, and hard to debug because every other dashboard still looks fine.
If you're on Braze or any bulk ESP, use a dedicated sending subdomain — mail.yourbrand.com, not the root domain. Isolates marketing reputation from your corporate transactional mail and makes authentication easier to debug. Launch DMARC in monitoring mode (p=none) first, read the reports for two to four weeks, then promote to quarantine or reject once you're sure nothing legitimate is failing.
Short version: SPF says who can send. DKIM proves the message wasn't altered. DMARC tells the receiver what to do when one of the first two fails and emails you a report about it. Skip any one and Gmail treats you like a stranger.
Reputation — earned, not configured
< 2%
Healthy hard-bounce rate. 2–5% is a warning; above 5% gets you rate-limited.
< 0.1%
Healthy complaint rate. 0.3%+ actively damages reputation.
3–6wks
Typical time to recover reputation after a serious incident.
Reputation is tracked per IP and per sending domain, independently. You earn it by being boring: same sender, same volume band, same content character, same kind of engaged recipients, week after week. For a fresh IP that means a disciplined ramp before you hit full volume — the IP warm-up playbook has the schedule.
Three things trash reputation fastest. Sudden volume spikes. Bounce rates over 2%. Complaint rates over 0.1% for watch, over 0.3% for damage. Healthy numbers: under 2% hard bounces, under 0.1% complaints. Anything above those and the mailbox providers are already adjusting how they treat you. The biggest driver of climbing complaint rate is mailing dormant users who've forgotten they ever subscribed — which is less a mystery than a policy failure.
Watch it with Google Postmaster Tools (free, covers Gmail) and Microsoft SNDS (free, covers Outlook.com and Hotmail). Beyond those, Validity and Mailgun's deliverability product give cross-ISP views if you want them.Source · GooglePostmaster ToolsGoogle's free service for monitoring Gmail sender reputation, spam complaint rates, authentication results, and delivery errors.postmaster.google.comCheck weekly at minimum. A reputation drop usually leads delivery failure by three to five days — catching it early means pausing, diagnosing, and recovering before the inbox placement craters.
Engagement — the thing that protects everything else
Engagement is what separates a sender whose reputation survives a bad week from one that doesn't. Providers weight engaged recipients heavily. If your active base opens, clicks, and replies at healthy rates, you get treated as a legitimate sender even when a specific send misses. If it doesn't, one sloppy campaign can tip the whole domain.
Protect engagement actively, not passively. Suppress dormant users from marketing sends. Segment so every campaign ships to an audience with above-baseline engagement probability. Run re-engagement programs early — before the 90-day cliff — because a 30-day-dormant user comes back roughly twice as often as a 180-day-dormant one, in my experience across consumer programs.
The Orbit Braze Deliverability Health Check skill pulls bounce and complaint data directly from Braze and flags segments where engagement is eroding faster than average — so you see the issue before it becomes a reputation problem.
List hygiene — the discipline most teams skip
List hygiene isn't cleanup. It's a standing policy, applied to every send, every day. Three rules do most of the work:
Hard-bounce once, remove forever. An address that hard-bounces is dead or disabled. Mailing it again is a loud negative signal to every provider watching.
Soft-bounce three times, suppress. Soft bounces are recoverable in theory — full mailbox, server hiccup — but three in a row almost always means the address is abandoned. Suppress until the user re-engages through some other signal.
Sunset inactive users.Anyone who hasn't opened mail in 90 to 180 days — the threshold depends on your product's natural cadence — comes off marketing sends. Keep transactional, invite them back through a re-engagement flow, and if they don't come back, let them go. A list that never shrinks is a list slowly poisoning the domain it sits on.
When it breaks — the recovery playbook
Diagnose before you treat. A sudden deliverability drop has three usual suspects, and the fix depends on which one bit you.
Reputation collapse. Usually follows a volume spike or a high-complaint send. Postmaster Tools and SNDS will show you the crash. Scale back volume, suppress dormant users, send only to the most-engaged segment for two to three weeks. Watch reputation recover before you open up volume again.
Authentication failure. Symptom: delivery drops overnight with no volume change, often paired with a recent DNS change or ESP config update. DMARC reports will name the failure mode. Fix the record, redeploy, and reputation recovers within days once mail authenticates cleanly again.
Blacklisting.Spamhaus or SORBS has listed your IP or domain. Symptom: hard delivery failures with bounce strings that name the blacklist. Work out why you got listed — usually a volume spike, a compromised account, or a complaint surge — fix the cause, then request delisting through the blacklist's official channel. Repeat listings compound; don't assume one delisting buys you forever.
Recovery is always slower than the breakage. Budget three to six weeks for full reputation repair after a serious incident. Prevention is cheaper every time.
Frequently asked questions
- What is email deliverability?
- Email deliverability is the ability of an email to reach the recipient's inbox — specifically the Primary inbox rather than Promotions, spam, or outright blocked. It's determined by sender reputation (per-IP and per-domain), authentication alignment (SPF, DKIM, DMARC), content signals, and the recipient's historical engagement with the sender. The deliverability rate most operators see in ESP dashboards measures accepted (didn't bounce) — it does NOT measure inbox placement, which requires seed testing to measure accurately.
- Why are my emails going to spam?
- Four usual suspects, in order of frequency: (1) low sender reputation — recent complaint rate above 0.1%, bounce rate above 2%, or engagement trending down tells mailbox providers you're a less-trusted sender. (2) Authentication issues — SPF/DKIM/DMARC misaligned with the From domain. (3) Content signals — spam-trigger words, excessive image-to-text ratio, broken HTML, link-heavy body. (4) Recipient history — if users in your list have previously marked you as spam, their mailbox provider weights that heavily. Fix in the order listed; content fixes rarely recover a reputation problem.
- What's a good email deliverability rate?
- 98%+ accepted delivery (bounces below 2%). 92-98% inbox placement (measured via seed tests, NOT ESP dashboard metrics). Spam rate below 0.1% (0.3% is the operator red line — Gmail specifically cracks down above that). Hard bounce rate below 1%. Unsubscribe rate below 0.5% per campaign (some campaigns naturally run higher — promotional sends to broad audiences vs transactional or welcome sends).
- How long does it take to fix a deliverability problem?
- Weeks, not days. Sender reputation is a trailing signal — mailbox providers evaluate your last 30-60 days of sending behaviour before adjusting trust. A program in reputation recovery typically needs 4-8 weeks of clean sending (reduced volume, highly-engaged audience only, no complaint spikes) before inbox placement returns. Operators who try to solve deliverability by tweaking content in a week are treating the symptom; the disease is sender behaviour over the medium term.
- Should I use a dedicated IP or shared IP?
- Shared IPs are the right default for programs under 100K sends/month. Dedicated IPs only make sense when volume is high enough that your own behaviour drives stable reputation signals — typically 100K+/month per mailbox provider. Below that threshold, a dedicated IP's reputation is driven by too-small a sample size and produces volatile inbox placement. The Orbit IP warmup guide covers the full decision matrix.
This guide is backed by an Orbit skill
Related guides
Browse allList hygiene: the six-rule policy
List hygiene isn't cleanup; it's a continuous policy that runs automatically. Here's the six-rule policy every lifecycle program should have written down, each tied to a specific deliverability outcome.
IP warm-up in Braze — the playbook that actually holds
A fresh dedicated IP has zero reputation on day one. Most warm-up guides fixate on ramp speed and ignore the harder question — which users get the send each day. Here's the schedule, the Random Bucket Number trick, and the day-10 mistake that ruins most of them.
The unsubscribe page is the most important page in your lifecycle program
The page every lifecycle team ignores is the one quietly deciding sender reputation, suppression-list quality, and the fate of next quarter's deliverability. A short defence of why it deserves the ten-minute rebuild.
Reputation recovery: the 90-day playbook for dropping from High to Low
Domain reputation at Low or Bad isn't a problem you fix this week. It's a 6–12 week project of disciplined sending to engaged users only, while the reputation signals slowly reset. Here's the plan.
The deliverability mental model: one picture for authentication, reputation, content, and monitoring
Every deliverability guide covers one piece — SPF, DKIM, DMARC, BIMI, reputation, warmup. What's missing is the systems-level picture that ties them together. This is the one diagram a senior operator needs: how mailbox providers decide whether your email reaches the inbox, and where each piece of the stack plugs in.
SPF, DKIM, and DMARC explained for lifecycle marketers
Three DNS records decide whether your marketing email is trusted or binned. Gmail and Yahoo made all three mandatory for bulk senders in 2024, and the grace period is over. This is the practitioner's explainer: what each one does, how they interact, and the setup order that won't block your own mail.
Found this useful? Share it with your team.
Use this in Claude
Run this methodology inside your Claude sessions.
Orbit turns every guide on this site into an executable Claude skill — 54 lifecycle methodologies, 55 MCP tools, native Braze integration. Pay what it's worth.