Email deliverability is whether your message lands in the inbox instead of spam after the recipient's mail server accepts it. To protect it, you need four things in order: authenticate your domain (SPF, DKIM, DMARC), send only to people who want your email, keep complaints and bounces low, and test before every campaign. This checklist walks through all four, then shows how to diagnose a problem when emails are already going to spam.
We built it for small and mid-sized business owners who run their own email program or oversee someone who does. Work through it top to bottom the first time. After that, use it as a pre-send routine.
TL;DR
- Set up SPF, DKIM and DMARC on the domain you send from, and make sure the From domain aligns with SPF or DKIM. Gmail, Yahoo and Outlook all require this of bulk senders.
- Keep spam complaints below 0.3% and make unsubscribing a single click. Remove bounced and inactive addresses before they drag your reputation down.
- Ramp volume up gradually on a new domain or mailbox, and never mail a purchased or stale list.
- Test each campaign before sending, then watch bounces, complaints and engagement by mailbox provider so you catch drops early.
Table of Contents
- What deliverability means and why emails go to spam
- Part 1: Authentication and technical setup
- Part 2: List quality and permission
- Part 3: Sender reputation and warm-up
- Part 4: Content and pre-send tests
- Part 5: Monitoring and diagnosis
- Emails going to spam: a fix order that works
- A note on disapproved Google Ads
- Our perspective: deliverability is a revenue problem, not a technical one
- Want help with the setup?
- A printable pre-send routine
- FAQ
- Sources
What deliverability means and why emails go to spam
Deliverability is not the same as delivery. An email can be accepted by the receiving server and still land in spam. According to Klaviyo's Help Center, good deliverability puts your message in the main inbox (tabbed inboxes count), and poor deliverability can put it in spam. The factors it names are recipient engagement, sending habits, content and sending infrastructure.
The simplest way to think about it is trust. Spamhaus, which publishes widely used anti-spam data, describes deliverability as the quality of your mail stream, judged by filters that use thousands of heuristics and trusted authentication data to make reputation decisions. Mailbox providers ask three questions about you:
- Can you prove you are who you say you are? (authentication)
- Do people want what you send? (engagement, complaints, list quality)
- Do you behave like a legitimate sender? (volume, consistency, content)
The checklist below follows those three questions, then adds testing and monitoring.
Part 1: Authentication and technical setup
This is where most small businesses lose the inbox without knowing it. A marketing platform, a CRM, a billing tool and a help desk may all send mail "from" your domain. Each one has to be authorized.
1. List every system that sends mail as your domain
Write down every tool that sends email using your domain: your email marketing platform, your website's contact forms, invoicing software, a help desk, a calendar scheduler. Anything you forget will fail authentication later, and those failures count against your domain.
2. Publish an SPF record
Google's sender guidelines explain the roles. SPF identifies the IP addresses authorized to send for your domain. You publish it as a DNS record, and you need only one SPF record per domain, so add each sending service to that single record rather than creating a second one.
3. Turn on DKIM signing
DKIM lets receiving servers verify that a message really came from your domain and was not altered. Your email platform gives you a key to publish in DNS. Do this for every system on your list from step 1, not just your main one.
4. Publish a DMARC policy
DMARC tells receiving servers what to do with mail that fails SPF or DKIM. Yahoo's sender requirements call for a DMARC policy of at least p=none for bulk senders. Starting with p=none is a sensible first move: it lets you collect reports and find unauthorized or forgotten senders before you tighten the policy.
5. Align your From domain
For mail sent directly, Google says the From domain should align with the SPF domain or the DKIM domain. Alignment is the step people miss. A message can pass SPF and DKIM for the vendor's domain while your own domain still fails DMARC.
6. Check reverse and forward DNS
Google's guidelines also list valid forward and reverse DNS records for sending servers. If you use a reputable email platform, they handle this. If you run your own mail server, you must.
7. Use a dedicated sending address for marketing
Many businesses send newsletters from the same mailbox employees use for one-to-one conversations. A separate sending subdomain or address keeps a marketing problem from damaging the mail your team needs to reach customers. Keep the From name and address consistent and recognizable, because unfamiliar senders are more likely to be ignored or reported, as the pre-send guidance from MailGenius points out.
What the big mailbox providers require
The rules got stricter in 2024 and 2025. Here is what each provider has published for bulk senders.
| Provider | Authentication | Unsubscribe | Spam complaints | Threshold |
|---|---|---|---|---|
| Gmail | SPF, DKIM and DMARC, with From-domain alignment | One-click for marketing and subscribed mail | Below 0.30% | More than 5,000 messages a day to Gmail accounts |
| Yahoo | SPF and DKIM, DMARC at least p=none | One-click for marketing and subscribed mail | Below 0.3% | Bulk senders, from February 2024 |
| Outlook.com | SPF, DKIM and DMARC | Not covered here | Not covered here | Over 5,000 emails a day, enforced from May 5, 2025 |
Sources: Gmail, Yahoo, Outlook.com Postmaster. Outlook says non-compliant messages go to junk first, with rejection to follow.
You may think 5,000 a day is far above your volume. Two cautions. Gmail's baseline for all senders already includes SPF or DKIM, valid DNS records and a spam rate below 0.3% in Postmaster Tools. And the authentication steps above are what filters read as trust signals at any volume, so do them regardless.
Part 2: List quality and permission
Authentication proves who you are. Your list determines whether people welcome you.
8. Email only people who asked
Send only to people who requested your messages. Purchased, rented or scraped lists produce complaints and bounces, and complaints are the metric providers watch most closely. Our piece on why cold outreach doesn't work covers how to approach prospects without burning your sending domain.
9. Verify addresses at sign-up
Catch typos and fake addresses when they enter your list. Emailit's documentation recommends verifying at sign-up and removing invalid, bounced or inactive recipients. If a sudden wave of sign-ups produces bounces, AWS suggests investigating the source, including possible fake sign-ups, and considering confirmed opt-in.
10. Remove hard bounces and complainers immediately
AWS treats hard bounces and complaints as list-quality signals: remove the affected addresses and look at where they were acquired. Never re-mail them "just in case."
11. Suppress dormant subscribers
Klaviyo's troubleshooting guidance warns that repeatedly sending to dormant subscribers can lower your sender reputation. Pick a window that fits your sales cycle (for a monthly newsletter, perhaps six months without an open or click), run one re-engagement message, then suppress those who stay silent. Our step-by-step email list cleaning guide shows how.
12. Make unsubscribing painless
There are two layers here. Gmail and Yahoo require one-click unsubscribe for marketing and subscribed mail from bulk senders. Separately, the FTC's CAN-SPAM guide requires an easy way to opt out, and you must honor requests within 10 business days. Do it faster. A visible unsubscribe link costs you a subscriber. A hidden one costs you a spam complaint, which is far worse.
13. Meet the CAN-SPAM basics
The FTC says CAN-SPAM applies to all commercial messages. It requires accurate header information, non-deceptive subject lines, clear identification of ads and a valid physical postal address. These are legal requirements in the US, and they also happen to be what a legitimate sender looks like to a filter.
14. Grow the list the right way
A healthy list starts with good acquisition. If you need ideas that bring in people who actually want your email, see how to grow your email list with offers that earn clicks.
Part 3: Sender reputation and warm-up
15. Warm up new domains and mailboxes
Sudden volume spikes raise red flags with inbox providers. MailGenius notes that gradually warming a domain helps establish trust and reduces the risk of throttling. A practical approach: start with your most engaged contacts (recent buyers, recent openers), send small batches, and raise volume over several weeks only while bounces and complaints stay low.
16. Keep volume and frequency steady
Big jumps from one send to the next look like a compromised account or a bought list. If you have a seasonal peak, such as a holiday promotion, build toward it with regular sends in the weeks before rather than going from quiet to full blast.
17. Register for Google Postmaster Tools
Google's guidelines base the 0.3% threshold on the spam rate reported in Postmaster Tools. If a meaningful share of your list uses Gmail, add and verify your sending domain there. It is the closest thing to a direct view of how Gmail sees you.
Part 4: Content and pre-send tests
Content matters less than authentication and list quality, but it is the part you control on every send.
18. Include a plain text version
MailGenius notes that some spam filters may penalize emails with no plain text version. Most platforms generate one automatically. Confirm that yours does.
19. Balance images and text
Emailit advises balancing images and text and using consistent sender details. An email that is a single large image, with little real text, gives filters nothing to read and gives subscribers with images blocked nothing to see.
20. Write honest subject lines
CAN-SPAM prohibits deceptive subject lines, and a misleading one produces complaints even when it technically gets through. If your open rates are the concern, our guide to raising email open rates covers subject lines and timing.
21. Run a pre-send test
MailGenius recommends running spam filter tests, checking inbox placement across providers and confirming the unsubscribe link works. Before each campaign, also send a test to your own accounts at Gmail, Yahoo and Outlook, open it on your phone, and click every link. If you draft campaigns with AI help, a reusable AI prompt for promotional emails can speed up the first draft, but a human should still review the final copy, links and unsubscribe before it goes out.
22. Check your design and sending rhythm
Campaigns built on tested templates are easier to keep consistent. If you are planning seasonal promotions, these tips for designing better emails are a good complement to the technical steps here.
Part 5: Monitoring and diagnosis
Deliverability is a trend to watch, not a setting you configure once. Klaviyo frames it as monitoring engagement, bounce, unsubscribe and complaint metrics together so you can spot deterioration early.
23. Know the symptoms
According to Klaviyo's monitoring guide, the main signs of a deliverability problem are:
- Falling opens or clicks
- Rising unsubscribes, spam complaints or bounces
- Falling revenue or conversions
- Recipients telling you your messages did not arrive or landed in spam
That same page defines the rates you should track. Bounce rate is bounced email divided by sent email. Unsubscribe rate and spam-complaint rate are each divided by delivered email.
24. Compare by mailbox provider
A single blended open rate hides problems. Acoustic suggests comparing open and click rates across domains to find anomalies at specific providers. If Gmail recipients engage normally but Outlook recipients fall off a cliff, the problem is provider-specific, and your fix is different.
25. Locate the problem before changing anything
Suped's practitioner guidance is to identify the affected provider, campaign, sending domain and the first time it failed before editing DNS or content. It also notes that accepted mail does not prove inbox placement, so pair reputation data with a fresh placement test.
Emails going to spam: a fix order that works
If your emails are already landing in spam, work in this order. It moves from the cheapest, most likely cause to the least likely.
- Confirm authentication. Check that SPF and DKIM pass and that DMARC aligns for every sending system. A new tool added last month is a common culprit.
- Check complaints and bounces. Look at your platform's reports and Postmaster Tools. Anything near 0.3% complaints is an emergency.
- Look at who you sent to. A recent import, a re-activated old list or a big new segment often explains a sudden drop. Pause those segments.
- Review the last few sends. Did volume jump? Did the content change? Were links or images different?
- Check blocklists. The Litmus audit guidance says diagnosis should cover the sending domain, authentication, IP and sender reputation, blocklists and spam performance, not one campaign metric alone.
- Send only to engaged contacts for a while. Rebuild with recent openers and clickers, then widen slowly.
AWS also recommends monitoring bounces, complaints and delivery delays as they happen. If you send through Amazon SES, it offers event publishing for real-time bounce, complaint and delay events.
A note on disapproved Google Ads
Some people searching this topic land here because they also have a "disapproved" status in Google Ads. That is a separate system. Email deliverability concerns inbox placement; ad disapproval concerns Google's advertising policies. In Google's help page on fixing a disapproved ad, the path is to open Ads or Ad groups, hover over the Disapproved status in the Status column, and select Read the policy. You can also add a Policy details column for more information. Google says a disapproved ad can't run until the violation is fixed and the ad is reviewed again.
Where the two overlap is the landing page. If your ads send people to a form that feeds your email list, make sure that page is accurate and working. Google Ads management is something we handle for clients through our advertising services.
Our perspective: deliverability is a revenue problem, not a technical one
We look at every channel from an ROI perspective, and email is no exception. When a small business tells us email "stopped working," the cause is rarely the offer. It is usually a combination of an unauthenticated sending tool, an old list that has not been cleaned in a year, and a team that watches open rates but never complaint rates.
The fix is not clever. Authenticate the domain properly, clean the list on a schedule, send less to people who ignore you and more to people who respond, and review the numbers every month. Each of those steps costs little. A campaign that lands in spam costs the entire send: the design time, the offer, and the sales that never happen.
We also see email as one part of a visibility system. The same customer who ignores a cold email may find you through a local search, an AI recommendation or a review. Email works best when it follows up on interest you have already earned, which is why we pair it with email automation that nurtures leads and a solid list-building plan, and why we put list health ahead of send volume.
— Diane O'Brien
Want help with the setup?
If you would rather not edit DNS records and audit lists yourself, our team handles email marketing campaigns that convert leads into sales as part of our full-service digital marketing work, alongside paid ads, local SEO and reputation management. See what is included on our services page, or start from our home page to tell us what you are trying to achieve.
A printable pre-send routine
Once the setup is done, this is the short version to run before each campaign:
- All sending systems authenticate (SPF, DKIM) and DMARC aligns.
- The list was cleaned recently: no hard bounces, no complainers, dormant contacts suppressed.
- Volume is in line with recent sends, or you are ramping on purpose.
- The email has a plain text version, honest subject line, physical address and a working one-click unsubscribe.
- You have tested placement at Gmail, Yahoo and Outlook and clicked every link.
- After sending, you check bounces and complaints within a day and compare engagement by provider within a week.
For the broader picture, our best practices for effective email marketing and email marketing basics guides cover strategy beyond the inbox.
FAQ
Do small businesses really need SPF, DKIM and DMARC?
Yes. Google, Yahoo and Microsoft's Outlook.com require all three for senders above their bulk thresholds, and the checks are what providers use to confirm you are who you claim to be. Even below 5,000 messages a day, Gmail expects SPF or DKIM, and unauthenticated mail is easier to spoof and easier to filter.
What spam complaint rate is too high?
Gmail and Yahoo both say to keep it below 0.3%. Gmail measures it through Postmaster Tools. Treat that number as a ceiling, not a target: the closer you get, the more likely it is that inbox placement is already suffering.
How long does it take to fix emails going to spam?
It depends on the cause. A missing DKIM record can be fixed in a day. A damaged reputation from complaints or bounces takes longer, because you need to stop sending to the wrong people and then rebuild with engaged contacts at gradually increasing volume. Expect weeks, and track the numbers in the meantime.
Are disapproved Google Ads related to email deliverability?
No. They are separate systems with separate rules. For a disapproved ad, check the reason in the Status column, read the policy and fix the ad, then request a review or appeal if you believe the decision was wrong, as Google's help page explains.
Sources
- Email sender guidelines, Gmail Help
- Sender Best Practices, Yahoo Sender Hub
- Outlook.com Postmaster
- CAN-SPAM Act: A Compliance Guide for Business, FTC
- A guide to improving and maintaining email deliverability, Spamhaus
- Optimizing Email Deliverability, AWS Messaging and Targeting Blog
- Understanding email deliverability, Klaviyo Help Center
- Troubleshooting why emails go to spam, Klaviyo Help Center
- Getting started with email deliverability monitoring, Klaviyo Help Center
- Email deliverability best practices, Emailit Docs
- Complete Deliverability Pre-Send Checklist, MailGenius
- The essential email deliverability checklist, Acoustic
- Email Deliverability Audit, Litmus
- Email deliverability tools and monitoring practices, Suped
- Fix a disapproved ad or appeal a policy decision, Google Advertising Policies Help