Email deliverability guide 2026: SPF, DKIM, DMARC and warm-up

Email deliverability is the ability of your messages to reach the inbox rather than the spam folder. In 2026 it rests on three pillars: technical authentication (SPF, DKIM, DMARC), sender reputation built through warm-up and consistent engagement, and sending behaviour — volume, list quality and complaint rates. Miss any pillar and even legitimate email disappears into spam.

Why deliverability decides whether outbound works at all

Every metric in an outbound programme sits downstream of deliverability. If half your emails land in spam, your real reply rate is invisible: you will conclude that your messaging fails when the truth is that nobody saw it.

Since February 2024, Google and Yahoo enforce explicit requirements for bulk senders — according to Google's bulk-sender guidelines, senders above certain volumes to Gmail addresses must authenticate email with SPF, DKIM and DMARC, offer one-click unsubscribe, and keep spam complaint rates low. Yahoo published equivalent requirements. What used to be best practice is now an entry condition, and other providers have followed the same direction.

What are SPF, DKIM and DMARC?

The three records answer one question for receiving servers: is this sender really who they claim to be?

SPF: who is allowed to send for your domain

SPF (Sender Policy Framework) is a DNS record listing the servers authorised to send email on behalf of your domain. When your message arrives, the receiving server checks whether the sending server appears in that list.

Practical points:

• Keep one SPF record per domain — multiple records cause validation failures.
• SPF allows a maximum of 10 DNS lookups; exceeding it invalidates the record. Audit your includes when you add new tools.
• SPF breaks on forwarding, which is one reason it is never enough on its own.

DKIM: proof the message was not tampered with

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing message. The receiving server verifies the signature against a public key published in your DNS. A valid signature proves the message came from your domain and was not modified in transit.

Your email provider generates the keys; you publish the public key as a DNS record. Use 2048-bit keys where supported and rotate them periodically.

DMARC: the policy that ties it together

DMARC tells receiving servers what to do when a message fails SPF or DKIM alignment: do nothing (p=none), send it to spam (p=quarantine) or block it (p=reject). It also sends you aggregate reports showing who is sending email under your domain's name.

Roll it out progressively:

1. Publish p=none and collect reports for a few weeks.
2. Fix any legitimate source failing alignment (marketing tools, CRM, invoicing software).
3. Move to p=quarantine, then p=reject.

A domain without DMARC is trivially spoofable, and mailbox providers treat unauthenticated mail with growing suspicion.

How does warm-up actually work?

Authentication proves identity; reputation proves behaviour. A brand-new domain has no reputation, and mailbox providers are deliberately cautious with unknown senders that suddenly send at volume.

Mailbox warm-up is the process of building that reputation gradually:

• Start with very low daily volume from each new mailbox.
• Increase progressively over several weeks, watching bounce and spam-placement signals.
• Prioritise engaged recipients early — replies and reads are the strongest positive signals.
• Keep warm-up activity running at a lower level even after campaigns start, to maintain reputation.

Two warnings. First, automated warm-up networks (tools that exchange fake positive engagement between mailboxes) sit in a grey zone: providers actively detect them, and Google's guidelines prohibit artificially generated engagement. Use them cautiously, if at all, and never as a substitute for genuinely well-targeted sending. Second, warm-up cannot rescue a bad list — if you send warmed mailboxes at purchased data full of dead addresses, reputation collapses anyway. We explain why in why buying lead lists hurts your domain.

Protect your main domain with secondary domains

Cold outreach always carries some deliverability risk, however well you run it. That risk should never touch the domain your company uses for contracts, support and billing.

The standard architecture uses secondary domains: close variations of your brand, each with its own SPF, DKIM and DMARC, its own warm-up and a small number of mailboxes. If one domain's reputation degrades, you retire it and the rest of the operation — and your main domain — remains intact.

What sending behaviour keeps you in the inbox?

With authentication and warm-up in place, day-to-day behaviour determines where you land:

• List quality: verify every address before sending. High bounce rates are an immediate red flag to providers.
• Volume discipline: keep per-mailbox daily volume conservative and ramp changes gradually. Spikes look like spam because spam behaves in spikes.
• Relevance: complaint rate is the metric providers weight most heavily. Google's bulk-sender guidance requires keeping spam complaints below very low thresholds — and the only sustainable way to do that is sending relevant messages to a precise ICP.
• Easy opt-out: honour unsubscribe and "not interested" requests immediately, across all your sending domains.
• Consistent cadence: steady sending patterns build reputation; stop-start patterns erode it.

How do you monitor deliverability?

Do not wait for reply rates to collapse. Monitor continuously:

• DMARC aggregate reports show authentication failures and spoofing attempts.
• Google Postmaster Tools exposes your domain reputation and spam complaint rate for Gmail traffic.
• Inbox placement tests (seed lists) sample where your emails actually land across providers.
• Bounce and reply trends per mailbox — a mailbox whose replies suddenly drop to zero has usually lost inbox placement.

Treat a deliverability drop as an incident: pause the affected mailboxes, diagnose, fix, and re-warm before resuming.

Deliverability is infrastructure, not a checklist

Authentication records are configured once, but reputation is earned continuously through targeting, volume discipline and list hygiene. That is why we treat deliverability as a core layer of every system we install as part of the AI Outbound Engine — not a task to tick off before launch.

If you suspect your current setup is leaking into spam, the outbound maturity diagnostic will flag the weak points in minutes, or you can book a strategy call and we will look at your sending architecture together.