All guides

Email that reaches the inbox

Marketing6 min read

On 1 February 2024, Gmail and Yahoo began enforcing requirements that had been optional for twenty years. Anyone sending more than 5,000 messages a day to personal Gmail accounts now has to authenticate properly or watch delivery degrade.

Two years on we still audit businesses whose newsletter open rates fell off in early 2024 and who assumed the content had gone stale. The content was fine. The DNS records were missing.

The three records

SPF lists which servers are allowed to send mail for your domain. It is a DNS TXT record, and the common failure is having several of them, which is invalid, or exceeding the ten-lookup limit by chaining too many third-party includes.

DKIM signs each message cryptographically so the receiving server can verify it was not altered and genuinely came from your domain. Your email platform generates the key and you publish it in DNS.

DMARC tells receivers what to do when SPF or DKIM fails, and it is the one most often missing entirely. Google requires bulk senders to have a DMARC record published. The policy can be set to p=none, which enforces nothing and only collects reports, and that still satisfies the requirement while you work out what your actual mail flows look like.

Start at p=none and read the aggregate reports for a few weeks. You will almost certainly discover systems sending as your domain that nobody remembered: an old invoicing tool, a recruitment platform, a form plugin on a site somebody built in 2019. Move to p=quarantine and then p=reject once those are either authenticated or shut off. Jumping straight to reject is how companies accidentally stop their own invoices from arriving.

The spam rate threshold

Google publishes a hard number here and it is stricter than most people expect. Bulk senders must keep their spam complaint rate below 0.30% as measured in Postmaster Tools, and Google recommends staying under 0.10%.

Three complaints per thousand messages is the ceiling. That is not many. A single badly targeted campaign to a stale list can breach it, and reputation recovers slowly.

Register for Google Postmaster Tools if you send any real volume. It is free, it shows your actual complaint rate and domain reputation as Google sees them, and it turns deliverability from guesswork into a number you can watch.

The rest of the checklist

Bulk senders also need valid forward and reverse DNS records for the sending IP, TLS for transmission, and one-click unsubscribe in marketing messages via the List-Unsubscribe header. Sender domain alignment matters too, meaning the domain in your visible From address has to line up with the domain authenticated by SPF or DKIM.

That alignment requirement catches a lot of people. Sending from hello@yourcompany.com through a platform that authenticates as mail.someplatform.com fails DMARC alignment even when SPF and DKIM both pass individually. The fix is configuring a custom sending domain in your email platform, which every serious platform supports.

List hygiene does more than any of it

Authentication gets you eligible for the inbox. Engagement decides whether you land there.

Mailbox providers watch what recipients do. Opens, replies, deletions without opening, moves to spam. A list where 8% of people open is treated very differently from one where 40% do, regardless of how perfect your DNS is.

So stop mailing people who have not opened anything in a year. It feels like throwing away audience and it is the single most reliable way to improve delivery to everyone still listening. Suppress hard bounces immediately. Never buy a list, and never import one from a previous employer or an acquired company without permission that actually covers you.

Confirmed opt-in costs you signups and buys you a list that performs. That is a real trade and worth making deliberately rather than by default.

Transactional mail is where the money is

Most businesses fret about the newsletter and ignore the automated messages, which is backwards. Password resets, order confirmations, quote follow-ups and enquiry acknowledgements have open rates several times higher than any campaign, and they arrive when the recipient is actively thinking about you.

Send those from a subdomain kept separate from marketing mail. mail.yourcompany.com for campaigns and notify.yourcompany.com for transactional keeps a bad marketing month from taking your password resets down with it.

The acknowledgement email that goes out when someone submits an enquiry form belongs in that category. It does a lot of quiet work. We covered why in speed to lead.

Check yours in ten minutes

Look up your own domain’s SPF, DKIM and DMARC records. Send a message to a Gmail address, open the original, and confirm SPF, DKIM and DMARC all show as PASS. Sign into Postmaster Tools and read your complaint rate. Then check whether your transactional mail shares a domain with your marketing mail.

Four checks. Most businesses fail at least one, and the fix is usually a DNS record rather than a project.

Email sits inside how we handle marketing, usually alongside the CRM work that decides what gets sent and when. Get in touch if your delivery has been drifting.

References