Email deliverability — the practitioner's guide

You hit send on a campaign that looks fine, the dashboard reports 99% delivered, and your open rate quietly tanks anyway. Half the audience never saw it — the message landed in the spam folder, in Gmail's Promotions tab, or got accepted and silently filtered. That gap between "delivered" and "actually seen" is what deliverability lives in.

Getting mail into the inbox — not just to the recipient's server, but to the part of their mailbox they'll actually open — isn't one setting you can flip. It's four distinct systems running at the same time, each watching from a different angle, each punishing different sins. Break one and the damage usually shows up as something else entirely: low opens, slow throughput, complaint spikes nobody can trace.

The four pillars, in order of where damage starts:

Authenticationis the plumbing — three DNS records that prove to mailbox providers (Gmail, Yahoo, Outlook) that you're allowed to send from your domain. Miss any of them and the big providers reject bulk senders at the door.Source · GoogleEmail sender requirementsGoogle's sender requirements updated in 2024 mandating SPF, DKIM, DMARC, and one-click unsubscribe for bulk senders.support.google.com/a/answer/81126

Reputation is a trust score that mailbox providers keep on your IPs and domains, based on how you've behaved over weeks and months. Earned slowly. Drained fast. One bad week can erase a half-year of clean sending.

Engagement is the forward-looking pillar. Opens, clicks, replies, adds-to-contacts, moves-out-of-spam — providers treat all of those as signals that your mail is worth inboxing tomorrow.

List hygiene is the boring, continuous discipline of removing dead weight. A clean list lifts engagement; engagement protects reputation; reputation delivers the mail. The whole stack compounds — in both directions.

Before a mailbox provider decides whether to inbox you, it asks a more basic question: is this sender even who they say they are? Spammers spoof from-addresses for a living. Authentication is how you prove you're not one of them. Three records, all three needed, all configured at the DNS level on your sending domain.

SPF (Sender Policy Framework) is a public list of which servers are allowed to send mail on your behalf. Published as a DNS TXT record. When Gmail receives a message claiming to be from yourbrand.com, it checks the SPF record, sees if the sending server is on the approved list, and waves it through if so.

DKIM (DomainKeys Identified Mail) goes a step further. It cryptographically signs every message, so the recipient can verify the body wasn't tampered with in transit. SPF says "this server is allowed to send." DKIM says "and this is the exact message they sent, untouched."

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer on top. It tells the recipient what to do when SPF or DKIM fails — ignore, quarantine, or reject — and emails you a daily report of what's passing and what isn't. The reports are how you discover the half-configured forwarding service nobody remembered to fix.

All three, configured correctly, no exceptions. Gmail and Yahoo hardened the requirement for bulk senders in 2024; Microsoft has equivalent policy for Outlook.com. When something is misconfigured, the damage is the worst kind — slow, silent, and hard to debug because every other dashboard still looks fine.

If you're on Braze or any bulk ESP (email service provider — the platform you actually send from), use a dedicated sending subdomain like mail.yourbrand.com, not the root domain. That isolates marketing reputation from corporate transactional mail and makes authentication easier to debug. Launch DMARC in monitoring mode (p=none) first, read the reports for two to four weeks, then promote to quarantine or reject once you're sure nothing legitimate is failing.

Mailbox providers score you the same way a credit bureau scores a borrower. Same sender, same volume band, same content character, same kind of engaged recipients — that pattern, sustained, builds trust. The reputation score itself is invisible to you. What you see are its consequences: inbox placement, throughput limits, the spam folder.

The score is tracked per IP (the server address mail leaves from) and per sending domain, independently. Earning it means being predictable. Spinning up a fresh IP requires a disciplined ramp before hitting full volume — the IP warm-up playbook has the schedule.

Three things trash a sender score fastest. Sudden volume spikes top the list. Hard-bounce rates above 2% come next — a hard bounce is a permanent delivery failure, usually a dead mailbox or invalid address, and a high rate means your list is full of zombies. Complaint rate is the third and the loudest: a complaint is when a recipient hits "mark as spam," and providers treat 0.1% as the watch line, 0.3% as the damage line. The biggest driver of climbing complaint rate is mailing dormant users who've forgotten they ever subscribed — which is less a mystery than a policy failure.

Watch the score with Google Postmaster Tools (free, covers Gmail) and Microsoft SNDS (Smart Network Data Services — free, covers Outlook.com and Hotmail). Beyond those, Validity and Mailgun's deliverability product give cross-ISP views if you want them.Source · GooglePostmaster ToolsGoogle's free service for monitoring Gmail sender reputation, spam complaint rates, authentication results, and delivery errors.postmaster.google.comCheck weekly at minimum. A reputation drop usually leads delivery failure by three to five days — catching it early means pausing, diagnosing, and recovering before the inbox placement craters.

Eventually you will ship a bad campaign. Wrong segment, broken merge tag, subject line that misfires. Engagement is what decides whether one bad campaign costs a few opens or tanks the whole domain. Providers weight engaged recipients heavily — if your active base opens, clicks, and replies at healthy rates, you get treated as a legitimate sender even when a specific send misses. Without that cushion, one sloppy campaign can tip the whole domain.

Protect engagement actively, not passively. Suppress dormant users from marketing sends. Segment so every campaign ships to an audience with above-baseline engagement probability. Run re-engagement programs early — before the 90-day cliff — because a 30-day-dormant user comes back roughly twice as often as a 180-day-dormant one, in my experience across consumer programs.

The Orbit Braze Deliverability Health Check skill pulls bounce and complaint data directly from Braze and flags segments where engagement is eroding faster than average — so the issue surfaces before it becomes a reputation problem.

The instinct, when you've spent years acquiring email addresses, is to keep them. Bigger list = more reach, surely. It's the wrong instinct. A list full of dead addresses doesn't expand reach; it slowly poisons every send to the addresses that are still alive. List hygiene is the standing policy that keeps the list working — applied to every send, every day, not as a once-a-quarter cleanup.

Three rules do most of the work. First: hard-bounce once, remove forever. A hard-bouncing address is dead or disabled, and mailing it again is a loud negative signal to every provider watching.

Second: soft-bounce three times, suppress. A soft bounce is a temporary failure — full mailbox, server hiccup. Recoverable in theory. But three soft bounces in a row almost always means the address is abandoned. Suppress until the user re-engages through some other signal.

Third: sunset inactive users. Anyone who hasn't opened mail in 90 to 180 days — the threshold depends on your product's natural cadence — comes off marketing sends. Keep transactional, invite them back through a re-engagement flow, and if they don't come back, let them go. A list that never shrinks is a list slowly poisoning the domain it sits on.

Sooner or later something will go wrong. The dashboard will show a delivery cliff, opens will halve overnight, or a bounce string from Spamhaus will arrive that you've never seen before. Resist the urge to fix the symptom — diagnose first, because a sudden deliverability drop has three usual suspects, and the fix depends on which one bit you.

Reputation collapse. Usually follows a volume spike or a high-complaint send. Postmaster Tools and SNDS will show the crash. Scale back volume, suppress dormant users, send only to the most-engaged segment for two to three weeks. Watch the score recover before opening up volume again.

Authentication failure. Symptom: delivery drops overnight with no volume change, often paired with a recent DNS change or ESP config update. DMARC reports will name the failure mode. Fix the record, redeploy, and trust returns within days once mail authenticates cleanly again.

Blacklisting.A blacklist (Spamhaus, SORBS, and others) is a third-party registry of IPs and domains known to send spam, which the big mailbox providers consult. Symptom: hard delivery failures with bounce strings that explicitly name the blacklist. Work out why the listing happened — usually a volume spike, a compromised account, or a complaint surge — fix the cause, then request delisting through the blacklist's official channel. Repeat listings compound; one delisting doesn't buy you forever.

Recovery is always slower than the breakage. Budget three to six weeks for full reputation repair after a serious incident. Prevention is cheaper every time.