Email deliverability is not a single setting you get right once. It is a combination of authentication configuration, list quality, content signals, sending infrastructure, and ongoing monitoring - each of which degrades independently if left unattended. These 30 rules cover every dimension. Most senders violate at least 5 of them. Each one costs deliverability in a measurable way.
v=spf1 include:[your-provider] ~all. Use -all only after confirming all sources. A missing SPF record is an immediate deliverability penalty.
Generate DKIM in your email provider and publish the TXT/CNAME record. 1024-bit keys are deprecated. 2048 is the standard in 2026.
Start with p=none and rua=mailto:[email protected]. Move to p=quarantine after 30 days of clean reports. p=reject gives maximum protection once you’re confident all legitimate sources are authenticated.
Send cold email from send.yourdomain.com or outbound.yourdomain.com, not yourdomain.com. A deliverability incident on the subdomain doesn’t affect your main domain’s reputation.
DMARC alignment requires that the From: domain in your email matches the domain in your SPF or DKIM record. Misalignment causes DMARC failures even with SPF and DKIM passing.
BIMI (Brand Indicators for Message Identification) displays your logo in Gmail inbox for authenticated senders. Requires DMARC at p=quarantine or p=reject. Improves open rates by 10-20% in supporting clients.
This is the single highest-impact practice. Run every list through BounceZero within 72 hours of campaign launch. B2B data decays 2-3% per month.
Gmail and Outlook begin throttling at 2% hard bounce rate. Above 5% triggers immediate reputation damage. If you hit 2%, pause, investigate the list source, and re-verify.
A hard bounce (550 User Unknown) means the address doesn’t exist. Remove it from every list. Never retry a hard bounce.
A soft bounce (452 Mailbox Full, 421 Temporary Failure) means the server rejected temporarily. After 3 consecutive soft bounces from the same address over 7+ days, suppress it.
On B2B lists, 20-40% of addresses are on catch-all domains. Don’t exclude all of them (you lose good leads) and don’t include all of them (you accept bounce risk). Use BounceZero’s 0-100 catch-all score - send to high-scorers, exclude low-scorers.
Addresses like info@, support@, sales@, admin@ are monitored by multiple people and have high spam complaint rates. Never include them in cold email campaigns.
Any address that marks your email as spam must be suppressed across all your lists immediately. One complaint per 1,000 emails (0.1%) starts damaging Gmail reputation. The FBL (Feedback Loop) from ISPs surfaces these.
Links in the first email are a significant spam signal. They also reduce reply rates. Add Calendly or website links only in follow-up emails.
Open tracking pixels (tiny 1×1 images from a 3rd-party domain) are flagged by spam filters. For cold email, disable open tracking entirely or use reply-based tracking.
Longer cold emails have lower reply rates and higher spam scores. Get to the point. One problem, one benefit, one ask.
Attachments in unsolicited email are a critical spam signal. Attachments are for existing relationships. Never attach files to a first cold email.
ALL CAPS, excessive exclamation marks!!!, FREE!!!, GUARANTEED, ACT NOW, LIMITED TIME OFFER - each phrase adds to your spam score. Run every template through Mail-Tester before sending.
Mail-Tester.com gives a 10/10 score breakdown. Aim for 8/10+. Send the exact email (with real personalization filled in) to the test address, not a generic version.
Send from Google Workspace, Microsoft 365, or a dedicated SMTP provider. Gmail personal accounts have sending limits (500/day) and reputation that affects your personal account.
New domains have no sender reputation. Starting cold email before warmup results in immediate spam folder placement. Use Instantly Warmup, Lemwarm, or Mailreach to build reputation gradually.
For new-to-medium aged domains (under 6 months), cap at 30-50 sends per inbox per day. Spread volume across multiple inboxes and domains rather than pushing one domain to its limit.
Use 3-5 sending domains per 100 emails/day of target volume. Domain rotation limits the impact of any single domain getting flagged.
If you control your own SMTP server, ensure forward-confirmed reverse DNS (the PTR record for your IP matches the EHLO hostname). FCrDNS failure causes immediate rejection at many ISPs.
Run your sending IP through MXToolbox Blacklist Check before every major send. A single SBL or CBL listing drops deliverability to near zero on major ISPs.
Free and takes 10 minutes. Postmaster shows domain reputation (High/Medium/Low), IP reputation, spam rate, and delivery errors. Check it weekly. Any drop to Medium triggers investigation.
Set an alert in your sequencer at 2% bounce rate. Stop the campaign automatically. Investigate the list source before continuing. Do not push through a high bounce rate.
Your rua= address receives XML reports showing which IPs are sending email from your domain and whether they pass authentication. This catches spoofing attempts and misconfigured legitimate sources.
Postmaster shows your spam complaint rate as reported by Gmail users. Above 0.1%, Gmail begins throttling. Above 0.3%, Gmail starts rejecting. This is separate from and more sensitive than your sequencer’s bounce rate.
Even for lists you’re actively sending to, re-verify the full list every quarter. Addresses go invalid without generating bounces in every case - some just stop delivering silently.
List hygiene is the single highest-impact practice. Sending to invalid email addresses raises your bounce rate, which triggers spam filters and damages sender reputation. Keep bounce rate under 2% and verify your list before every campaign with a tool like BounceZero.
SPF: publish a TXT record that includes only your sending provider, use ~all initially then tighten to -all. DKIM: generate a 2048-bit key through your email provider and publish it. DMARC: start with p=none + rua=mailto:[email protected], move to p=quarantine after 30 clean days, then p=reject for maximum protection.
For cold email: verify before every campaign. For newsletters: re-verify every 90 days and suppress hard bounces and complaints immediately. B2B email data decays at 2-3% per month.
Authentication, content, and infrastructure work better when you’re not dragging down reputation with invalid addresses. Verify your list with BounceZero before every campaign. 100 free credits, no card required.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Deep-dive guides on how email verification and inbox placement work
272,446-domain census: DMARC gap, provider divide, catch-all rates
10.2M verifications: 12.3% of addresses are dead, and where they hide
826K re-verifications: only 19% of valid addresses survive 90 days
True catch-all is 1.4% - most of what looks catch-all is unprobeable providers
info@ bounces 4.5x more than personal addresses - measured, not guessed
The 3x invalid-rate gap that vanishes when you control for domain size
Explore other topics