Deliverability: the plumbing nobody sees

It doesn't matter how good your list and message are if the email lands in spam. Deliverability decides whether anyone sees your work at all, and it fails quietly. Nothing bounces back to tell you most of your emails are going to junk. Treat it as infrastructure: set it up properly, monitor it, and follow the rules mailbox providers publish.

Why this is engineering#

Deliverability is DNS records, sending infrastructure, volumes, list quality and monitoring. It has the same properties as any other production system. It needs correct configuration, it degrades slowly then fails suddenly, and it is far easier to protect than to repair. A burned domain can take weeks to recover, or never does.

How inboxes decide#

Gmail, Outlook, Yahoo and corporate filters each decide where your email goes based on signals they keep about you: the reputation of your sending domain and IP address, whether your email is authenticated, how recipients react (opening, replying, deleting unread, marking as spam), how many messages bounce, and what the content looks like. Reputation builds slowly and drops fast.

The fastest way to ruin deliverability is to send more to a list you haven't verified.

Authentication: SPF, DKIM, DMARC#

Three DNS-based standards let a receiving server check that email claiming to be from your domain really is. All three are required by the major providers for anyone sending in volume.

getyourco.com.                       TXT  "v=spf1 include:_spf.google.com ~all"
selector1._domainkey.getyourco.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
_dmarc.getyourco.com.                TXT  "v=DMARC1; p=none; rua=mailto:dmarc@getyourco.com"

• Your email provider gives you the exact SPF and DKIM values; copy them precisely.
• Start DMARC with p=none and reporting turned on, then tighten to quarantine once the reports look clean.
• Check the records with a free DNS or mail-tester tool before sending anything.
• Each domain can have only one SPF record. Merge entries rather than adding a second.

Domains and mailboxes#

Cold outreach is riskier than normal email, so teams keep it away from the main company domain. Staff email, invoices and customer support stay on the main domain, and its reputation is protected. Outreach goes from a few similar secondary domains that redirect to the main website.

Mailbox maths

Sending limits per mailbox should be modest. Practitioners commonly keep cold sends to a few dozen per mailbox per day, and two or three mailboxes per domain. Use that to size the setup.

new prospects started per day   = 150
emails per prospect (sequence)  = 3
steady-state sends per day      = 150 × 3 = 450   (today's new starts plus earlier prospects' follow-ups)
sends per mailbox per day       = 30
mailboxes needed                = 450 / 30 = 15
mailboxes per domain            = 3   →  5 domains, plus one spare

The exact numbers vary by provider and change over time; the principle doesn't. Spread volume thin so no single mailbox or domain stands out, and add capacity before you need it, because new mailboxes need weeks of warm-up.

Warm-up and sending limits#

1. 1

   Start small

   A new mailbox begins with a handful of emails a day and grows over two to four weeks. Warm-up services exchange friendly emails that get opened and replied to, building a positive history.
2. 2

   Keep warming while sending

   Many teams keep a low level of warm-up running permanently alongside real outreach.
3. 3

   Send to verified addresses only

   Keep hard bounces under about 2%. A bounce rate above that is an early warning of a bad list.
4. 4

   Write like a person

   Plain text, few or no links, no images or attachments in a first email, no tracking pixels if you can avoid them.
5. 5

   Make it easy to opt out

   A clear way to say no keeps people from pressing the spam button instead.

Monitoring and the runbook#

Check these every week, and alert on the first two daily.

Write a short runbook: how to add a domain and mailbox, the DNS records, the warm-up schedule, daily limits, what to watch, and what to do when a mailbox or domain gets into trouble (pause it, investigate the list, resume slowly). Deliverability problems tend to arrive on Friday afternoons. A runbook means anyone can respond.

The rules of the big providers#

Since 2024, Google and Yahoo publish requirements for bulk senders. Google applies its strictest rules to anyone sending more than about 5,000 messages a day to personal Gmail accounts. They include: SPF and DKIM set up for your domain, and a DMARC record; the visible From domain aligned with SPF or DKIM; spam complaint rates kept below 0.3%, with Google recommending under 0.1%; and, for marketing and subscribed messages, one-click unsubscribe. Read the current versions linked below. They change, and they are the source of truth.

Laws apply too: the CAN-SPAM Act in the United States, and in the UK and EU, data-protection and electronic-marketing rules that treat business outreach differently from consumer outreach. Ask your legal team which apply to you.