Email deliverability in plain English (SPF, DKIM, DMARC)

“Deliverability” just means: does your email land in the inbox, or in spam — or nowhere at all? Email providers like Gmail and Outlook decide that in a split second, based on two things: can they trust that the email really comes from you, and do people seem to want your emails.

Part 1: Proving it's really you

Anyone can write any sender address on an email, a bit like writing any return address on an envelope. SPF, DKIM and DMARC are three small settings on your domain that let receiving servers check that an email claiming to come from you actually does.

SPF — the guest list

SPF is a list of the services that are allowed to send email for your domain — for example your email provider and your newsletter tool. If an email comes from somewhere not on the list, it looks suspicious. It's one line in your domain's DNS, something like:

v=spf1 include:_spf.google.com include:yournewslettertool.com ~all

The exact contents depend on which services you use — they'll tell you what to add. You should only have one SPF record; add services to it rather than creating a second.

DKIM — the wax seal

DKIM adds an invisible digital signature to every email. The receiving server checks it against a public key in your DNS. If the signature matches, the email hasn't been tampered with and really was sent with your permission. Your email service generates the key; you just paste it into your DNS.

DMARC — the instructions for the doorman

DMARC tells receiving servers what to do if an email fails the SPF and DKIM checks: let it through, put it in spam, or reject it — and where to send reports. A gentle way to start is “just report, don't block”:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Once you're confident all your real emails pass, you can tighten it to p=quarantine or p=reject, which makes it much harder for anyone to pretend to be you.

Part 2: Showing people want your emails

Even a perfectly authenticated email lands in spam if recipients don't seem to want it.

• Email people who expect you. Subscribers who signed up, customers, or — for cold email — businesses where you're genuinely relevant.
• Warm up new addresses. A brand-new address or domain that suddenly sends hundreds of emails looks like a spammer. Start small and increase gradually over a few weeks.
• Make leaving easy. A clear unsubscribe link is better than people clicking “Report spam”.
• Clean your list. Remove addresses that bounce and people who haven't opened anything in a long time.
• Write like a person. No shouting subject lines, no walls of images, no misleading “Re:” tricks.

A simple checklist

1. Send from your own domain, not a free Gmail or Hotmail address.
2. Add SPF, DKIM and DMARC (start DMARC at p=none).
3. Only email people who have a reason to hear from you.
4. Include an unsubscribe or opt-out in every marketing email.
5. Increase volume slowly on new addresses.
6. Watch bounces, complaints and replies — and act on them.