Email Deliverability: Mastering SPF, DKIM, DMARC and Reputation

The landscape of email marketing changed significantly in February 2024. Google and Yahoo introduced mandatory requirements for anyone sending more than 5,000 messages per day to their users. These rules were established to reduce the volume of unwanted or fraudulent emails that clutter user accounts. If a sender fails to meet these technical standards, their messages are often rejected immediately or flagged as suspicious by the receiving server.

These updates are not merely suggestions; they are hard technical requirements. A common pattern in high-volume accounts is a sudden drop in open rates when these settings are misconfigured. In a typical account, the primary focus is now on three specific authentication protocols: SPF, DKIM, and DMARC. Without these, the likelihood of reaching the inbox for a Gmail or Yahoo user is extremely low. Mailbox providers use these records to verify that the sender is who they claim to be.

Sender Policy Framework (SPF) is a DNS record that specifies which mail servers are authorized to send email on behalf of your domain. Think of it as a guest list for a party; if a server is not on the list, the security guard at the inbox will likely turn the email away. A standard SPF record is a TXT entry in your DNS settings. It usually starts with v=spf1 and includes the IP addresses or hostnames of your email service provider, such as Mailchimp, Klaviyo, or Microsoft 365.

DKIM, or DomainKeys Identified Mail, adds a layer of security by attaching a digital signature to every email you send. This signature is verified using a public key located in your DNS records. When the receiving server gets the email, it uses that key to check if the message was tampered with during transit. If the signature matches the content, the server knows the email is authentic. In a typical setup for a Shopify store, for example, setting up DKIM involves copying two or three CNAME records provided by the email marketing platform into the domain registrar’s panel.

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It acts as an instruction manual for mailbox providers on what to do if an email fails SPF or DKIM checks. Before DMARC, a server might not know whether to deliver or block a failing email. Now, you can set a policy that tells the server to do nothing (p=none), put the email in quarantine (p=quarantine), or reject it entirely (p=reject).

Starting with a ‘none’ policy allows you to receive reports about who is sending mail using your domain without affecting delivery. This is helpful for identifying legitimate third-party services you might have forgotten to authorize. Once you are confident that all your valid mail sources are authenticated, moving to a ‘quarantine’ or ‘reject’ policy provides the best protection against spoofing. This helps maintain a clean reputation because it prevents bad actors from using your domain name for phishing attacks.

Reputation is divided into two categories: IP reputation and domain reputation. Mailbox providers track how users interact with your emails over time. If users frequently open your messages and click links, your reputation improves. Conversely, if users ignore your emails or mark them as spam, your reputation suffers. This is why list hygiene is a fundamental part of a successful strategy.

Domain reputation is increasingly more important than IP reputation. This means that even if you change your email service provider or move to a new IP address, your history follows your domain name. In a typical scenario, a brand that sends relevant content to an engaged audience will maintain a high reputation score. Platforms like Google Postmaster Tools provide a dashboard where you can see your reputation graded from ‘Bad’ to ‘High’. Aiming for a ‘High’ rating is necessary for consistent delivery to the primary tab.

The 0.3% threshold is a specific limit set by Gmail. If more than three out of every 1,000 recipients mark your email as spam, your deliverability will likely suffer. Ideally, you should aim for a spam rate below 0.1%. When the rate climbs, filters become more aggressive, and even your most loyal subscribers might start finding your newsletters in their junk folders. This metric is a direct reflection of how much your audience values your content.

Monitoring this rate requires using tools provided by the mailbox providers. Since Gmail does not send traditional feedback loops for spam complaints to most ESPs, you must check Google Postmaster Tools manually or via API. Additionally, high spam rates often stem from poor acquisition practices, such as buying lists or failing to use a double opt-in process. A clean list of people who actually want to hear from you is the best defense against high complaint rates.

To evaluate your current standing, start by sending a test email to a service that analyzes your headers. These tools can tell you if your SPF, DKIM, and DMARC records are passing verification. You should also check if your sending IP is on any major blacklists. While being on a minor blacklist might not stop all mail, being on a major list like Spamhaus will cause significant delivery failures.

Another step is to look at your bounce logs. Hard bounces occur when an email address is invalid or does not exist. These should be removed immediately. Soft bounces happen due to temporary issues, like a full inbox or a temporary server problem. If an address soft bounces multiple times, it is usually best to treat it as a hard bounce and stop sending to it. Maintaining a low bounce rate is a signal to providers that you are a responsible sender who manages their data carefully.