Email Deliverability Guide: How to Land in the Inbox, Not the Spam Folder

What Is Email Deliverability (and Why Should You Care?)

There’s a distinction worth making upfront, because most people confuse these two things. Email delivery is whether your email successfully reached the recipient’s mail server — it did not bounce. Email deliverability is whether your email ended up in the inbox. An email can be delivered and still never seen, because it landed in the spam folder.

Think of it like this: delivery is getting your letter to the right building. Deliverability is getting it into the right hands. You can have a 99% delivery rate and still have a campaign that nobody reads, if the spam filter intercepted it on the way in.

The journey of an email

When you click “Send” in Brixus365, your email does not teleport instantly into someone’s inbox. It travels through a gauntlet of automated checks, each one deciding whether your message deserves to be seen:

1. Your sending server transmits the email to the recipient’s mail server (Gmail, Outlook, or a corporate mail gateway).
2. The receiving server runs authentication checks — SPF, DKIM, and DMARC — to verify the email actually comes from who it claims to come from.
3. Reputation checks evaluate your sending IP address and domain against known spam databases, blacklists, and the receiving provider’s own historical data on your sending behaviour.
4. Content analysis looks at your subject line, body text, HTML structure, links, and images for signals associated with spam.
5. Engagement history — for the big providers like Gmail — factors in how recipients with similar profiles have treated your emails in the past. Did they open? Delete immediately? Mark as spam?
6. Finally, the email is placed in the inbox, spam folder, or promotions tab, or it is blocked entirely.

All of this happens in milliseconds, invisibly, before your subscriber ever sees a notification. That’s why deliverability deserves at least as much attention as your email design or copywriting.

Why it matters more than you might think

Global inbox placement rates average around 83% across all industries and providers, according to recent deliverability benchmarks. That means roughly one in six emails you send — even legitimate, well-crafted ones — never makes it to the inbox. For senders targeting corporate recipients using Microsoft 365 or Exchange, the picture is bleaker: some reports put corporate inbox placement below 51% when sender authentication and reputation are not carefully maintained.

The implications for your marketing are direct. A campaign that achieves 20% open rates for a well-deliverable sender might show 9% open rates for a sender with deliverability problems — not because the content changed, but because half the emails are going to spam. The good news is that deliverability is largely within your control, and the practices that improve it are learnable.

The Authentication Foundation: SPF, DKIM, and DMARC

Authentication is the single most important technical factor in email deliverability. It is not optional, and as of 2025 it is a hard requirement from every major inbox provider. Gmail, Yahoo Mail, and Microsoft 365 all now require bulk senders to have SPF, DKIM, and DMARC configured before they will accept email at scale.

1; SPF — authorised mail servers
2yourdomain.com TXT "v=spf1 include:_spf.youresp.com ~all"
3
4; DKIM — cryptographic signature
5bx._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3..."
6
7; DMARC — enforcement policy + reporting
8_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"

SPF — establishing who can send on your behalf

SPF stands for Sender Policy Framework. The way it works is straightforward: you publish a DNS TXT record on your domain that lists every mail server allowed to send email as your domain. When Gmail receives an email claiming to be from you, it looks up your SPF record and checks whether the sending server’s IP address is on the approved list. If it is, the check passes. If it is not — and this could happen because a phisher is impersonating you, or because you forgot to add a new sending service to your SPF record — the check fails.

Setting up SPF for Brixus365 is done at your DNS provider. Your SPF record will look something like this:

The ~all at the end is a “soft fail” — it marks unapproved senders as suspicious but does not outright reject them. Once you are confident your SPF record is complete, you can tighten this to -all (hard fail) to reject unauthenticated senders entirely.

DKIM — proving the message was not tampered with

DKIM stands for DomainKeys Identified Mail. While SPF verifies the sending server, DKIM verifies the message itself. When you send an email, your sending infrastructure adds a cryptographic signature to the email header using a private key that only you hold. The corresponding public key is published in your DNS. Receiving servers retrieve the public key and use it to verify that the signature is valid — which proves both that the email came from your domain and that its content has not been modified in transit.

One important advantage of DKIM over SPF: the DKIM signature travels with the email when it is forwarded. SPF breaks on forwarded messages because the forwarding server’s IP is not in your SPF record. DKIM survives forwarding intact, which is why both are needed rather than one or the other.

DMARC — the policy layer that ties it together

DMARC — Domain-based Message Authentication, Reporting, and Conformance — is the policy layer that sits on top of SPF and DKIM. It tells receiving servers what to do when one or both authentication checks fail. The three policy options are:

• p=none — Monitor only. Take no action on failures, but send reports. Use this when you are first setting up DMARC.
• p=quarantine — Move failing emails to the spam folder. A sensible middle ground once you are confident your authentication is stable.
• p=reject — Reject failing emails outright. Maximum protection against impersonation. Move here once you have monitored for several weeks and confirmed no legitimate emails are failing.

DMARC also provides reporting: receiving servers send you aggregate data about how your domain is being used, which lets you catch misconfigured services or active spoofing attempts. The rua tag in your DMARC record specifies where these reports go.

A note on DMARC rollout sequence

The right order for setting up authentication is SPF first, then DKIM, then DMARC. Start your DMARC record with p=none and an rua address so reports flow to you. After a few weeks of reviewing the aggregate reports and confirming all your legitimate sending sources are passing, move to p=quarantine. A few weeks after that, move to p=reject. Rushing to p=reject without monitoring first is how organisations accidentally break their own email.

Building and Protecting Your Sender Reputation

Authentication tells ISPs you are who you say you are. Reputation tells them whether you are the kind of sender they want to let through. These are separate scores — think of authentication as your ID card, and reputation as your credit score. Having the ID is necessary but not sufficient. You also need a good track record.

IP reputation versus domain reputation

ISPs track two distinct reputation signals. Your IP reputation is tied to the specific server addresses sending your email. Your domain reputation is tied to the domain in your From address. Gmail, in particular, weighs domain reputation heavily — which means changing your sending IP address does not give you a clean slate if your domain already has a poor history.

This is an important distinction because it affects how you recover from deliverability problems. If your IP reputation is the issue (say, you were on a shared IP that was abused by another sender), moving to a dedicated IP and warming it up properly can help significantly. If your domain reputation is the issue — because you have been sending to disengaged subscribers and generating complaints — you need to address the underlying list quality problem, not just switch IPs.

How ISPs score your reputation

Inbox providers do not publish their exact reputation scoring algorithms, but the signals they weight most heavily are well-understood from industry experience:

• Spam complaint rate — the most heavily weighted negative signal. Gmail considers anything above 0.1% a warning threshold, and above 0.3% risks your delivery being blocked entirely. Track this obsessively.
• Bounce rates — hard bounces (permanent failures) above 2% signal a poorly maintained list. Remove hard bounces immediately.
• Engagement signals — opens, clicks, and especially moves from spam back to inbox (when a user marks you as “Not spam”) all improve your reputation score.
• Sending consistency — irregular volume spikes look suspicious. ISPs trust senders who maintain a predictable cadence.
• Spam trap hits — hitting even one honeypot address can significantly damage your IP or domain reputation. These are real email addresses maintained by ISPs and blacklist operators specifically to catch senders using purchased or poorly managed lists.

How to monitor your reputation

Google Postmaster Tools (postmaster.google.com) is the most useful free tool available to email senders. Once you verify domain ownership, you get dashboards showing your domain reputation, spam rate, authentication pass rates, and delivery errors for Gmail specifically. Since Gmail handles a significant share of consumer inboxes, your Postmaster Tools data is a reliable proxy for overall deliverability health.

Microsoft SNDS (Smart Network Data Services) provides similar data for Outlook and Hotmail recipients. If you send to a B2B audience, this is especially important given how many businesses run on Microsoft 365.

IP Warm-Up: The Patient Path to High Deliverability

If you are moving to a new dedicated sending IP — whether because you are a new sender, migrating from a shared IP, or expanding your infrastructure — you cannot simply start sending your full email volume from day one. ISPs are deeply suspicious of IP addresses that suddenly appear and immediately start sending thousands of messages. The remedy is a deliberate, gradual process called IP warm-up.

Why warm-up is necessary

When an ISP encounters an IP address it has no history with, it defaults to caution. It cannot yet tell whether this IP belongs to a legitimate marketer or to a spammer who just spun up a new server to evade their existing blacklisted IPs. The ISP’s response is to impose throttling — limiting how many messages per hour it will accept from the unknown IP — while it observes how recipients respond.

During warm-up, the ISP is watching closely. If your early sends generate high open rates and low complaints, its confidence in your IP grows quickly. If your early sends bounce heavily or generate spam reports, your reputation starts out negative — and it can take months to recover from a bad start. This is why the contacts you send to during warm-up matter enormously.

Who to send to during warm-up

The cardinal rule: send your most engaged subscribers first. In the first two weeks of warm-up, target only contacts who have opened or clicked within the past 30 days. These are the people most likely to engage positively, which sends strong reputation-building signals to ISPs. In weeks three and four, you can expand to contacts active in the past 60 days. Only after your reputation is established should you begin sending to older or less-engaged segments.

Send the same type of content you plan to send at full volume. Do not send generic “warm-up” emails that are different in character from your actual campaigns. ISPs are watching the content as well as the behaviour.

Common warm-up mistakes

• Sending to your whole list from day one. Most senders are eager to reach everyone immediately. Resist this. Start with your best contacts and expand methodically.
• Inconsistent sending frequency. Sending every day during warm-up is significantly better than sending in large weekly batches. Daily sending gives ISPs a steady, readable pattern.
• Not monitoring deliverability metrics during warm-up. Set up Google Postmaster Tools before you begin. Watch your spam rate daily. If it spikes above 0.1%, pause and reassess before continuing.
• Warming up without cleaning the list first. Hard bounces during warm-up are especially damaging. Run your list through an email verification service before starting.

Content That Passes the Spam Filter Test

Modern spam filters do not work by matching emails against a simple list of forbidden words. They use machine learning models that look at hundreds of signals simultaneously — sender reputation, authentication, engagement history, and content signals together. That said, content still matters, particularly for senders with a relatively new or untested reputation.

Subject line best practices

Your subject line faces more scrutiny than any other part of your email, because it is the first thing both spam filters and humans evaluate. A few principles that consistently hold up:

• Keep it under 60 characters. Subject lines beyond 60 characters are truncated on most mobile clients, which account for over half of email opens. What is cut off might be the part that made it interesting.
• Use sentence case, not title case or all caps. “Your August statement is ready” reads like a person wrote it. “YOUR AUGUST STATEMENT IS READY” reads like a shouting robot.
• Avoid leading with the recipient’s name. Subject lines that open with “John, don’t miss this” feel manipulative and often correlate with lower engagement in A/B tests.
• Be specific and accurate. The subject line should describe what is actually inside the email. Misleading subject lines that overpromise to boost open rates increase spam complaints — because frustrated recipients mark you as spam when the content does not deliver what the subject promised.
• Skip the question mark fishing. “Did you see this?” and “Can I ask you something?” are overused subject line patterns that spam filters now actively flag.

Text-to-image ratio

A common mistake among email designers is building emails that are primarily images with very little text. This causes problems for two reasons: first, many email clients block images by default, so your message is invisible without them. Second, spam filters are suspicious of image-heavy emails because spammers have historically embedded their content in images to evade text-based filters.

The traditional rule of thumb is a 60:40 text-to-image ratio — 60% text content, 40% images maximum. More practically, make sure every meaningful piece of information in your email also exists as readable text, not just as an image. Your email should be intelligible even with images disabled.

Link practices

• Do not use link shorteners (bit.ly, tinyurl, etc.) Shortened URLs obscure the destination and are heavily used by spammers. Many spam filters automatically flag emails containing them. Use full, direct URLs.
• Limit the number of links. Emails with dozens of links look like link farms. Three to five well-chosen calls to action are more effective and less suspicious than fifteen.
• Ensure linked domains have a clean reputation. If you link to a domain that is on a blacklist — even inadvertently — that hurts your email. Check linked domains periodically.
• Match the link text to the destination. “Click here” linking to a product page is vague and scored poorly. “View the Spring Collection” is descriptive and credible.

Legal requirements: unsubscribe and physical address

These are not just best practices — they are legal obligations in most jurisdictions. Under CAN-SPAM (US), CASL (Canada), and GDPR (EU), commercial emails must include:

• A visible, functioning unsubscribe link that processes opt-out requests within 10 business days (CAN-SPAM) or immediately upon click (best practice and a reputation-building behaviour with ISPs).
• Your physical mailing address — typically shown in the email footer. This is a CAN-SPAM requirement and cannot be a P.O. box alone.
• Clear sender identification — your email must clearly identify who is sending it and the From address must be accurate.

Beyond the legal obligation, ISPs actively monitor your unsubscribe processing. Senders who make unsubscribing difficult — or worse, continue sending to people who have unsubscribed — generate spam complaints and see their reputation suffer accordingly. Make unsubscribing as easy as clicking a link and confirm immediately.

List Hygiene: Your Secret Deliverability Weapon

There is a myth in email marketing that the biggest list wins. The truth is that a smaller, engaged, well-maintained list consistently outperforms a large, stale one — not just on open rates and conversions, but on deliverability itself. The quality of the addresses you send to has a direct, measurable impact on your sender reputation.

Hard bounces versus soft bounces

When an email cannot be delivered, the receiving server sends back a bounce notification. The two types have very different implications for your list management strategy:

Hard bounces are permanent failures. The email address does not exist, the domain does not exist, or the receiving server has permanently blocked your messages. Hard bounces must be removed from your list immediately and never mailed again. They signal to ISPs that your list is of poor quality. Most sending platforms — including Brixus365 — automatically suppress hard bounces, but you should monitor them actively rather than just trusting the automation.

Soft bounces are temporary failures. The recipient’s mailbox is full, the server is temporarily unavailable, or the message was too large. Soft bounces may resolve on their own. Most platforms will retry soft-bounced emails automatically for 72 hours. However, if a contact consistently generates soft bounces over multiple sends, treat them as a hard bounce and suppress them. Continued sending to persistently bouncing addresses is wasteful at best and reputation-damaging at worst.

Industry benchmarks for 2025 put acceptable hard bounce rates below 0.21% and soft bounces below 0.70%. If you are above 2% overall bounce rate, your list needs immediate attention before you send another campaign.

Spam traps: the hidden list quality test

Spam traps are email addresses maintained by ISPs and blacklist operators that exist solely to catch senders who are using poor data practices. There are two types:

• Pristine traps — addresses that have never been used by a real person and have never opted into anything. If you email one, you bought or scraped a list, because there is no legitimate way to have obtained that address.
• Recycled traps — old email addresses that were once real but have been decommissioned, left dormant for a period, and then reactivated as traps. Hitting these means your list is stale and you have not been doing regular re-engagement or suppression.

Hitting even a small number of spam traps can result in your IP or domain being added to a blacklist. The only defences are good data collection practices, regular list cleaning, and suppressing contacts who have not engaged in 12 to 18 months.

Re-engagement before sunsetting

Before you remove contacts who have not engaged in a long time, give them one final chance. A well-executed re-engagement campaign — a simple, direct email asking whether they still want to hear from you — will either win them back or confirm they should be suppressed. Those who do not respond to your re-engagement campaign after one or two attempts should be moved to a suppression list. They are hurting your deliverability by depressing your engagement rates, and they may eventually become spam traps.

Handling unsubscribes

When someone unsubscribes, remove them immediately. Do not wait for a batch processing cycle. Do not send one more “last email” to confirm the unsubscribe. The fastest way to turn an unsubscriber into a spam complaint is to keep sending to them after they have asked to stop. Brixus365 processes unsubscribes automatically at the point of click, so this is handled for you — but make sure your campaigns use the platform’s built-in unsubscribe link rather than a custom solution that might process more slowly.

Monitoring and Troubleshooting Deliverability

The best time to notice a deliverability problem is before it becomes a crisis. Setting up proper monitoring so you can catch early warning signs — a slight uptick in spam complaints, a slow drop in open rates, a new bounce pattern — lets you intervene when the problem is still recoverable.

Key metrics to watch

• Spam complaint rate: Check this after every campaign in Google Postmaster Tools. Your target is below 0.1%. Consistent readings above 0.08% are a signal to investigate what is generating complaints — is it the content, the unsubscribe experience, or list quality?
• Bounce rate: Review per-campaign and as a cumulative trend. A sudden spike in hard bounces often indicates a data quality issue — a new acquisition source with invalid addresses, or a purchased segment that has been added to your list.
• Open rate trends: A decline in open rates over time can indicate deliverability degradation even when everything else looks normal. If your emails are going to spam, the subscribers who would have opened them cannot — so open rates fall. This is one of the earliest indicators of a developing deliverability problem.
• Inbox placement rate: Some email platforms and third-party tools (Litmus, EmailOnAcid, GlockApps) offer seed list testing that shows you exactly which inbox providers are placing you in the inbox versus spam. Run these tests before major campaigns.

Monitoring tools

Google Postmaster Tools is free, authoritative, and essential. It shows domain reputation, IP reputation, spam rate, delivery errors, authentication results, and encryption status — all for Gmail recipients. Set it up, check it weekly at a minimum, and daily around major sends.

Microsoft SNDS (Smart Network Data Services) provides the equivalent data for Outlook and Hotmail recipients. Register your sending IPs and review the complaint rates and sending data Microsoft tracks for your addresses.

What to do when you land in spam

Discovering that your emails are going to the spam folder is not a crisis — provided you act methodically rather than frantically. Here is a structured approach:

1. Verify your authentication. Use MXToolbox or similar tools to confirm your SPF, DKIM, and DMARC records are configured correctly and passing. Authentication failures are often the root cause and the easiest fix.
2. Check blacklists. Use a multi-blacklist checker to see if your sending IP or domain appears on any known spam blacklists. Most blacklists have a delisting process; follow it.
3. Review your recent complaint rate. Pull your spam rate from Google Postmaster Tools for the past 30 days. A spike will point to a specific campaign or acquisition source that generated complaints.
4. Audit your list quality. Run your list through an email verification service to identify invalid, risky, or trap-like addresses and remove them.
5. Reduce volume temporarily. Sending less while you diagnose and fix the issue prevents further reputation damage. Resume full volume gradually once your metrics have stabilised.
6. Contact your ESP’s deliverability team. Brixus365’s deliverability team has visibility into patterns that individual senders cannot see from their own dashboards. If you are experiencing persistent problems, reach out.

When to consider a new IP or domain

If your IP reputation is severely damaged and your delisting efforts are not succeeding, moving to a new dedicated IP — and warming it up properly — may be the right path. But a new IP does not solve a domain reputation problem. If your domain has a poor reputation with Gmail specifically, the only real remedy is sustained improvement in engagement and complaint rates over time. This is why prevention is so much easier than recovery: once a domain’s reputation is damaged, it takes months of careful sending to restore it.

Frequently Asked Questions