Is your email reaching the inbox? A neutral guide to email deliverability

What’s the difference between delivery and deliverability?

The single most useful distinction in email is the one most people never learn. Email delivery only confirms that the receiving server accepted your message; deliverability is whether that message actually reached the inbox rather than the spam folder (Mailtrap, 2026). The two diverge more than you’d expect — you can run a 99% delivery rate and a 60% inbox placement rate at the same time, and the performance loss lives entirely in that gap, because a delivered email sitting in spam is, for practical purposes, not delivered (Loops, 2026).

The scale of the leak is concrete. Validity’s 2025 benchmark put the global average inbox placement rate at around 83.5%, meaning roughly one in six legitimate marketing emails never reaches the inbox, and placement varies sharply by provider — Gmail averages about 87% for compliant senders while Microsoft mailboxes run hardest at around 75.6% (Loops, 2026; MessageFlow, 2026). If you send to a list of any size and measure only “delivered,” you are almost certainly overstating how many people actually saw your email. Track inbox placement, not merely delivery.

The three things that decide inbox placement

Everything about deliverability reduces to three factors working together, and understanding them is the whole map. The first is authentication — the DNS records that prove an email genuinely comes from your domain, so a receiving server can trust it isn’t a spoof. The second is sender reputation — the behavioural profile mailbox providers build from your entire sending history. The third is engagement and list quality — whether the people you mail actually want and open your email.

The order matters because they gate each other. Authentication is now table stakes: without it, the 2024 rules mean your mail may be rejected outright before reputation even enters the picture. But authentication only grants entry — it does not guarantee inbox placement, and once your records are clean, reputation and engagement decide everything downstream (niche­advertiser, 2026). This is the same shape as the rest of how a good site works: a foundation that has to be correct before anything else can help, and a set of behaviours that compound over time. The rest of this guide takes the three in turn.

Authentication: SPF, DKIM, DMARC and BIMI

Authentication is a stack of DNS records that together tell a receiving server your mail is really from you. SPF (Sender Policy Framework) is a record listing which servers may send on your domain’s behalf; DKIM (DomainKeys Identified Mail) adds a cryptographic signature confirming the specific message was authorised by you and wasn’t altered in transit; and DMARC (Domain-based Message Authentication, Reporting and Conformance) uses SPF and DKIM as inputs, then applies a policy you control and sends you reports of who is sending in your name (EmailVerify, 2026). SPF confirms the server, DKIM confirms the message, and DMARC ties them together with a rule for what happens on failure.

A fourth standard sits on top. BIMI (Brand Indicators for Message Identification) lets a verified sender display its logo next to the sender name in the inbox, but only once DMARC is enforced at quarantine or reject — it’s effectively a reward for getting the rest right, and senders using it report meaningfully higher open rates (MessageFlow, 2026), though it’s a trust-and-display feature rather than a deliverability fix. Our guide on BIMI covers the certificate tiers and what it’s actually worth. Two newer standards, MTA-STS and TLS-RPT, handle in-transit encryption and are becoming expected for serious senders (EmailVerify, 2026). The detailed setup of each is its own guide — this pillar’s job is to show why they exist and how they fit together. Our deep-dive on how SPF, DKIM and DMARC work covers the setup, the alignment subtlety, and the staged rollout to p=reject.

The 2024–2026 rules that changed everything

For most of email’s history, authentication was strongly recommended but optional. That ended. Gmail and Yahoo began enforcing bulk-sender requirements in February 2024, Microsoft joined the enforcement wave in 2025, and since November 2025 Gmail permanently rejects non-compliant bulk mail with hard 5xx errors rather than merely filtering it to spam (MessageFlow, 2026). The window to coast on legacy setup is closed. Getting a domain from monitoring to enforcement is its own operational project, which our guide on rolling out DMARC to p=reject walks through report by report.

The specific bar is worth memorising. Any sender dispatching 5,000 or more messages a day to personal accounts must have SPF, DKIM and DMARC configured, implement one-click unsubscribe (the RFC 8058 List-Unsubscribe header), and keep spam complaint rates below 0.3% (MessageFlow, 2026). Google Postmaster Tools replaced subjective reputation scores with binary compliance checks, so you can now see exactly whether you pass (MessageFlow, 2026). Sensible senders treat all of this as the baseline regardless of volume, because the direction of travel is one way: stricter every year. Beyond the mailbox-provider rules, cold outreach also has to satisfy anti-spam law — CAN-SPAM, GDPR and CASL — which our guide on cold email and the law covers, and which demands much the same discipline.

Sender reputation: earned slowly, lost in one send

Once you’re authenticated, reputation takes over, and it behaves unlike most business metrics. Sender reputation is the running score mailbox providers maintain on every sending domain and IP, built from complaint rates, bounce rates, engagement, blocklist appearances and authentication completeness (EmailVerify, 2026). A strong reputation typically produces around 92% inbox placement; a weak one produces filtering regardless of how good your content is.

The critical property is that reputation has asymmetric kinetics: a clean sender builds it steadily over months, but can lose it in a single bad campaign (EmailVerify, 2026). One send to an unverified imported list, a campaign with a complaint rate above 0.5%, hitting spam traps, or a sudden 10x volume spike can each undo a long stretch of good history. And trends matter more than any single number — a programme running at 0.12% complaints is healthy, but the same rate climbing 10% month over month is heading for trouble, so the discipline is to watch the slope, not only the threshold (Digital Applied, 2026). Reputation persists, too: decisions made in 2024 still shape placement in 2026. How reputation is scored, monitored now that Google has retired its grades, and recovered when damaged is the subject of our guide on email sender reputation.

Transactional versus marketing: why you separate the streams

Not all email is the same kind of thing, and conflating the two kinds is a common, expensive mistake. Transactional email is sent one-to-one in response to a user action — a password reset, a one-time code, a receipt, an order confirmation — and it’s infrastructure, not marketing: a payment confirmation in spam or an OTP that never arrives is a broken product, not a missed campaign (Maestra, 2026). Marketing email is sent in bulk to a list, and it carries a different risk profile, because promotional volume attracts more complaints.

The practical consequence is stream separation. Keeping transactional traffic distinct from bulk sends — ideally on separate streams or IPs — is a genuine deliverability safeguard, not a cosmetic one, because it stops a marketing complaint spike from dragging down the password resets your users actually need (Mailtrap, 2026; Maestra, 2026). The same logic explains why mixing cold outreach with transactional mail on one domain is dangerous: the riskiest traffic contaminates the most important. This is a decision worth its own detailed treatment, which our guide on transactional versus marketing email gives it.

Do you need an ESP, a self-hosted server, or neither?

Here is the question every vendor answers in its own favour, so here is the neutral version. The landscape has a few distinct categories: mailbox providers (Gmail, Outlook — where recipients read), managed SMTP relays and email service providers (which accept your mail and handle delivery at scale), transactional specialists, marketing ESPs with campaign tools, and self-hosted mail servers you run yourself (DirectInbox, 2026). The right category depends on two variables: your monthly volume and your technical capability.

The honest thresholds look like this. A personal Gmail account is not production email infrastructure — it has restrictive limits and weak sender controls, fit only for staging (DuoCircle, 2026). Below roughly 25,000 emails a month, or without technical staff, a managed provider almost always wins, because the maintenance time of self-hosting exceeds the cost savings (Mailflow Authority, 2026). Self-hosting becomes cost-effective somewhere around 50,000 to 100,000 emails a month and can save $800–5,000 a year at scale, but only if you have the Linux skills to own IP reputation, DNS, blocklist remediation and security patches — an unpatched mail server is an open relay waiting to happen (Mailflow Authority, 2026). And many of the most capable operations are hybrids, running a transactional specialist for the mail that must arrive alongside cheaper bulk sending for campaigns. There is no single right answer, which is exactly why a source that will tell you when the answer isn’t itself is worth reading. The full decision — self-hosted, managed, dedicated or shared, and where warming fits — is our guide on choosing your email infrastructure.

Shared versus dedicated IP, and the warmup

One more infrastructure choice shapes deliverability: whether your mail goes out over a shared IP address pooled with other senders, or a dedicated IP that carries only your reputation. Shared IPs amortise reputation across many senders, which helps a low-volume sender but exposes you to other senders’ mistakes; dedicated IPs give you full control of your own reputation and, in tested comparisons, deliver measurably higher inbox placement (Maestra, 2026). The rule of thumb is to move to a dedicated IP once you consistently send more than about 50,000 emails a month, or when deliverability suffers on a shared pool despite good practices, which usually signals shared-IP contamination.

Whichever you choose, a new IP or domain has no reputation, so you cannot start at full volume. The warmup period — ramping send volume gradually, starting with your most engaged recipients — is what teaches mailbox providers your mail is wanted before you scale up, and skipping it is a reliable way to earn early filtering (Mailflow Authority, 2026). Cutting over to new infrastructure cold, without warmup, is one of the most common self-inflicted deliverability wounds. The day-by-day ramp, the engagement gates, and whether you even need a dedicated IP are covered in our guide on IP warming.

List hygiene: the unglamorous half

The half of deliverability that has nothing to do with technology is list quality, and it’s where authenticated senders most often still fail. The foundations are dull and decisive: use double opt-in so people confirm they want your email before they count as subscribers, which filters out typos, bots and spam traps before they touch your reputation (Loops, 2026). Remove hard bounces immediately, suppress anyone who marks you as spam, and keep your complaint rate below 0.1% — well under Gmail’s 0.3% ceiling.

Then there’s the discipline of letting go. A sunset policy stops mailing contacts who haven’t engaged within a defined window, commonly 90 to 180 days, so chronic non-openers stop dragging down your sender score (Loops, 2026). Once you’re authenticated and mailing a clean list, engagement is what providers watch: opens, clicks, replies and move-to-inbox actions teach Gmail your mail is wanted, while deletes-without-reading and mark-as-spam teach the opposite. Relevance beats volume every time, which is why segmentation and list verification do more for deliverability than any clever subject line. The full discipline — preventing bad data at the form, handling bounces and spam traps, and running a sunset policy — is our guide on email list hygiene.

Why we tell you the truth about this — even when it isn’t us

Read enough about email deliverability and you’ll notice something: almost every guide is published by a company selling a sending service, and it recommends its own product. One widely-cited provider comparison openly notes that it “ranks its own product” alongside the competitors it tested (Mailtrap, 2026); the pattern is the norm, not the exception. That’s not a scandal, but it does mean the advice comes with a thumb on the scale.

We take a different position because our incentives are different. Web Involved resells no third party’s mail transfer agent, email service provider or sending platform for a commission, so nobody else’s margin is steering our advice. We do run our own reliable email infrastructure and hosting, and we’ll still recommend a managed provider, a self-hosted setup, a transactional specialist, or none of the above — including when the honest answer is not to use us — based on your volume and skills. What keeps that honest is the guarantee we make everywhere: whatever you choose, your site and its data stay yours and portable, so we earn your stay rather than trap it. It’s the same posture that runs through the rest of what we publish, and it’s grounded in how we build: self-hosting the pieces that should be self-hosted, recommending the setup that fits rather than the one that pays us most. If you want the practical thread of how that philosophy shows up elsewhere, our guide on what a website really costs applies the same total-cost-of-ownership honesty to the build.

How email deliverability connects to everything else

Step back and email deliverability rhymes with every other discipline on this site. Like performance, it’s decided by a foundation you can’t fake and behaviours that compound over time. Like accessibility, it’s mostly invisible until it fails, and cheapest when built in rather than bolted on. Like being readable by AI, it depends on being legible to a machine — here the mailbox provider’s filter rather than the answer engine’s crawler — that judges you on structure and signals before any human is involved.

And like the rest, the failure mode is the same: treating it as a content problem when it’s an infrastructure-and-discipline problem. A beautiful email to an unauthenticated domain and a stale list is the exact analogue of a beautiful website a crawler can’t read or a fast page served from a slow server. The work that makes email reach the inbox — clean authentication, earned reputation, an engaged list, the right infrastructure for your scale — is the same shape of work that makes a site fast, accessible, findable and owned: done once, correctly, at the foundation, it pays off quietly for years. The spokes branching from this guide take each piece of that foundation in turn — and if you run a small business and want the plain-language starting point, begin with email authentication for small business.