MCP

Deliverability in a nutshell

Last verified: 2026-08-05

TL;DR

  • Placement is decided by reputation — your domain's and mailbox's track record of sending mail people want — not by word choice. Nothing in the copy rescues a bad reputation.
  • Authenticate, keep volume modest and steady, and watch two numbers: bounces and spam complaints. The mailbox providers publish the thresholds; treat them as the floor, not the target.
  • Your sending platform owns the machinery. You own the two decisions that actually move the numbers: how much you send, and who you send it to.

The physics, in one page

Mailbox providers decide placement from the reputation of the domain and mailbox doing the sending, built from how recipients react over time — replies on one side, deletions, complaints and dead addresses on the other. It is slow to build, fast to lose, and it is why two identical emails from two different domains land in different folders. Three mechanics carry most of the weight.

Authentication proves the mail is really from your domain. SPF and DKIM are the two signing mechanisms; DMARC ties them to the address a human sees in the From: line and tells providers what to do when they disagree. Since February 2024 Google has required SPF or DKIM from every sender, and SPF and DKIM plus an aligned DMARC record from anyone sending more than 5,000 messages a day to Gmail [1]. Microsoft matched it for Outlook and Hotmail in May 2025, rejecting non-conforming high-volume mail outright [2]. Enforcement has tightened since: from November 2025 Gmail warns that non-compliant traffic will meet "temporary and permanent rejections" rather than merely poorer placement [3]. Yahoo's rules mirror Google's, and the industry baseline is public [4, 5]. Setting authentication up is DNS work your sending platform documents; the standards themselves are open [6, 7, 8].

Volume discipline. New domains and new mailboxes have no reputation, so they get no benefit of the doubt. The universal advice is to start small, rise gradually, and hold a steady daily figure rather than sending in bursts — see Volume limits and ramp for the numbers different sources use.

Complaints and bounces. Google asks senders to stay under a 0.30% spam-complaint rate and to run nearer 0.10% for headroom [1]. That is a very small number: three complaints in a thousand is already the ceiling. Bounces matter for the same reason — a list full of dead addresses tells a provider you did not check who you were writing to, which is why verification belongs upstream, in Email finding and verification.

What the platform handles, and what stays yours

Sending platforms handle authentication setup, mailbox rotation, pacing, warmup and the dashboards that show bounce and complaint rates. What no platform can do is choose a smaller, better-qualified list, or resist raising daily volume when the pipeline looks thin — and those two judgment calls decide most deliverability outcomes.

Warmup: practice versus policy

Automated warmup — software exchanging mail between mailboxes to manufacture positive engagement before a campaign starts — is close to universal practice, and most sending platforms build it in; a typical published regime ramps to about 40 messages a day and waits for a deliverability score above 90 before any campaign launches (vendor guidance, 2026) [9]. It is also, on the mailbox providers' own terms, artificial engagement, and Spamhaus names warmup networks explicitly among the practices that make a sender a blocklisting candidate (2025) [10]. Both statements are true at once, and the library does not resolve them for you: warmup is standard practice that the parties who run the inboxes have not blessed.

The honest counterweight

Read the blocklist operator's position directly rather than through a vendor's summary. Spamhaus applies the industry definition of spam — unsolicited and bulk — and concludes that cold email as commonly practiced meets it, whatever a given jurisdiction permits (June 2025) [10]. Their listing criteria name purchased and scraped lists, email appending, warmup tools, LLM-generated content variations, faked engagement, and fleets of throwaway lookalike domains. Deliverability consultants make a quieter version of the same argument: placement follows permission and reputation [11, 12].

You can disagree with where they draw the line and still use that list as a map of which practices carry the most risk. They are the ones that get sending domains burned.

References

  1. Google — Email sender guidelines (support page, requirements in force since Feb 2024)
  2. Microsoft — Strengthening the email ecosystem: Outlook's new requirements for high-volume senders (official blog, 2025)
  3. Google — Email sender guidelines FAQ (support page, enforcement escalation from Nov 2025)
  4. Yahoo — Sender Hub best practices (official, current)
  5. M3AAWG — Senders Best Common Practices v3 (industry BCP, n.d.)
  6. IETF — RFC 9989: DMARC (standard, May 2026; obsoletes RFC 7489)
  7. IETF — RFC 7208: Sender Policy Framework (standard, 2014)
  8. IETF — RFC 6376: DomainKeys Identified Mail (standard, 2011)
  9. lemlist — Email warmup (vendor guide, 2026)
  10. Spamhaus — Spamhaus's take on cold emailing, aka spam (resource hub, June 2025)
  11. Laura Atkins — Word to the Wise (blog, active 2025)
  12. Al Iverson — Spam Resource (blog, active 2025)