Your first mailing can reach inboxes or vanish into junk. This starter guide explains what receiving servers look for and how to set up your domain the right way.
TL;DR
- Deliverability means your mail reaching the inbox, not just being sent; spam placement is the failure most small businesses never notice.
- SPF, DKIM and DMARC records prove your identity to receiving servers; set up all three, starting DMARC in monitor-only mode.
- Since February 1, 2024, Gmail requires SPF or DKIM, valid DNS records and a TLS connection from all senders, plus DMARC for those sending 5,000 or more messages a day.
- Keep your reported spam rate below 0.3 percent for Gmail, and aim under 0.1 percent.
- Send only to people who opted in, include one-click unsubscribe, and grow volume gradually from a new domain.
You put together a short list of customers, wrote your first newsletter, and pressed send. A few days later, some recipients say nothing arrived, and others found your message sitting next to ads for miracle supplements. That is a deliverability problem, and it is one of the most fixable problems in small business email.
What Does Deliverability Actually Mean?
Deliverability is the measure of whether your email reaches the inbox, the spam folder, or nowhere at all. Sending is not the same as arriving. Your server can accept a message and pass it along, and the receiving server can still decide it belongs in junk.
Three outcomes are possible for every message. Delivery means the receiving server accepted it. Inbox placement means it landed where people actually look. Blocking or bouncing means it was refused, and bounced mail comes back to you with an error. Spam placement is quieter: the message arrives, but nobody sees it.
Deliverability is judged per sender, per message, and per mailbox provider. Gmail, Outlook, and Yahoo each run their own filters with their own thresholds, so the same mailing can reach one provider’s inboxes and miss another’s.
How Do Mail Servers Decide You Are Trustworthy?
Receiving servers look at three things: who you appear to be, whether you can prove it, and how recipients have treated your past mail.
First comes identity. Mailbox providers anchor reputation to authenticated identities, which is why they push senders toward the standards described below. A domain with no history gets cautious treatment, and a domain that behaves erratically gets treated worse.
Second comes proof. Filters check that the server sending on your behalf is authorized, that the message carries a valid signature, and that the visible From address lines up with the authenticated domain. Fail any of those checks and the message starts with a strike against it.
Third comes behavior. Providers watch how recipients respond. Opens, replies, and deletions all register, and spam complaints count heavily. High bounce rates suggest a stale list, and high complaint rates suggest unwanted mail. Both drag down the trust score tied to your domain, which is why a big send to a cold list does lasting damage.
There is a security angle too. The FBI’s 2025 Internet Crime Report recorded $3 billion in reported business email compromise losses, much of it involving attackers posing as trusted business contacts. Filters that verify sender identity exist partly to make that kind of impersonation harder.
Which Sender Records Should You Set Up First?
Three DNS records do most of the work: SPF, DKIM, and DMARC. DNS, the Domain Name System, is the directory that stores settings for your domain. You edit these records where you manage your domain, usually with the company you bought it from.
| Record | What it does | What it tells the receiving server |
|---|---|---|
| SPF | Lists the servers allowed to send for your domain | “This server is on the approved list” |
| DKIM | Signs each message with a cryptographic key | “The message is intact and came from us” |
| DMARC | Combines SPF and DKIM results against the visible From address | “Here is what to do if the checks fail” |
SPF, or Sender Policy Framework, is a single TXT record that starts with v=spf1 and lists every service allowed to send as your domain. Two rules trip up newcomers. You can only have one SPF record per domain; if you use several email services, merge them into a single record, because multiple SPF records cause all SPF checks to fail. And SPF allows a maximum of 10 DNS lookups, with each include statement counting as at least one.
DKIM, or DomainKeys Identified Mail, adds a signature your mail provider generates. You publish the public key in DNS, the provider signs outgoing mail with a matching private key, and receiving systems verify the pair. Google’s setup guidance recommends 2048-bit keys where your provider supports them.
DMARC ties the first two together. It lives at _dmarc.yourdomain.com and tells receiving servers what to do when authentication fails. Start with a policy of p=none, which means monitor only, and leave it there for two to four weeks while you review the reports. Fix any legitimate sender that fails, then move to quarantine and finally reject. CISA recommends putting all three methods in place together, because none of them works well in isolation.
One practical choice: some businesses send marketing mail from a subdomain such as mail.yourcompany.com. That keeps campaign records separate from your main business email and avoids SPF conflicts.
Tip
Since February 1, 2024, anyone sending to personal Gmail accounts must have SPF or DKIM set up, valid forward and reverse DNS records, and a TLS connection. Senders of 5,000 or more messages per day to Gmail must also set up DMARC, though its policy can start at none.
What Does a Good First Mailing Look Like?
Small, expected, and easy to leave. That is the shape of a first mailing that lands well.
Small, because a fresh domain that suddenly sends thousands of messages looks like a spam run. If your domain is new, build sending history gradually first; our guide to warming up a new email domain covers how.
Expected, because every address should have opted in to hearing from that address. Google’s guidance says recipients should explicitly opt in to getting messages from you, particularly if they have never received email from you before.
Easy to leave, because commercial messages need one-click unsubscribe support and a visible unsubscribe link in the body. Honoring opt-outs promptly is also a legal requirement under the CAN-SPAM Act.
Content-wise, keep the subject line honest, use a real name in the From field, and send from your own domain rather than a generic address. Send a test to yourself first, then mail a small slice of the list, check the results, and grow only when opens look healthy and complaints stay at zero.
How Do You Tell If Your Mail Is Landing in Spam?
Bounces are the easy part; they come back to you with an error code, and our article on why email bounces explains how to read them. Silent spam placement takes more digging.
Start with direct signals. Ask a few customers on different providers whether the message arrived. Send tests to accounts you control at Gmail and Outlook and see where they land.
Then use the tools. Google’s Postmaster Tools gives verified domain owners dashboards covering spam rates, authentication, delivery errors, and domain reputation. Two caveats apply. The data is not real time, and very low sending volume may not produce data at all, because Gmail suppresses dashboards for low-volume domains to protect user privacy. Google asks senders to keep reported spam rates below 0.3 percent, and its own troubleshooting page suggests aiming under 0.1 percent.
Watch indirect signals too. A sudden drop in opens after an otherwise normal send often means mail went to junk. So do replies from people asking why they never got your earlier messages.
What Should You Check Before Sending to a New List?
New lists are where reputations are lost, because carelessly assembled lists can contain spam traps. Spam traps are addresses used to catch senders with poor list practices, and hitting one can mark your domain as a spam source. Our article on how spam traps work explains the types and how to steer clear of them.
Run through this checklist before the first send to any new list:
- Permission. Can you show where and when each address opted in?
- Accuracy. Typos and dead addresses produce bounces. An email verification service can catch obvious problems before you send.
- Expectation. Does the message remind people who you are and why they are getting it?
- A way out. Is the unsubscribe link visible and working?
If your list is thin or built from business cards and old invoices, rebuild it rather than send to it. Building an email list customers actually want covers collection methods that keep deliverability healthy from the start.
How Do You Keep Your Sender Reputation Healthy Over Time?
Reputation is cumulative, so your habits matter more than any single send.
Send on a steady rhythm. Predictable volume looks normal to receiving servers; bursts and spikes look like attacks.
Prune the list. Remove addresses that hard bounce, and set aside people who never open. A smaller, engaged list beats a big, dead one every time.
Keep authentication current. Whenever you add a tool that sends as your domain, update your SPF record and add DKIM for it. Skim your DMARC reports occasionally for senders you forgot about.
Watch the free early-warning systems. Postmaster Tools spam rates and DMARC aggregate reports cost nothing and flag trouble before customers complain.
Guard against impersonation. Google specifically warns against using Gmail From headers you do not own, and moving DMARC to enforcement protects your domain from spoofers. The stakes are real: someone spoofing your address can trick your customers into paying fake invoices, which is how business email compromise reaches losses measured in billions of dollars.
Tighten gradually. Once DMARC reports show that all your legitimate mail passes consistently, move from p=none to quarantine, then to reject. That staged approach keeps real customer mail flowing while shutting out impostors.
None of this requires a big budget or a specialist. It requires an afternoon with your DNS settings, a short list of people who asked to hear from you, and a little patience.
If you have not sent anything yet, open your domain provider’s DNS settings and set up your SPF record. It is the single record most likely to decide whether your first mailing gets read.
Quick answers
Q: Do I need all three records if I only send a few hundred emails a month?
A: Gmail’s baseline rules ask all senders for SPF or DKIM, valid forward and reverse DNS records, and a TLS connection. CISA recommends all three authentication methods together, and they protect you from spoofing at any volume.
Q: What happens if I have two SPF records?
A: Multiple SPF records cause all SPF checks to fail. Merge every sending service into a single record and stay within the 10 DNS lookup limit.
Q: How long should I wait before tightening my DMARC policy?
A: Start at p=none and leave it there for two to four weeks while you review the aggregate reports. Move to quarantine, then reject, once all your legitimate mail passes consistently.
Q: How do I know if my mail went to spam?
A: Send tests to accounts you control at different providers and check Google Postmaster Tools, which shows spam rates and authentication for verified domains. Very low-volume senders may not get Postmaster data, so watch for sudden drops in opens as well.
Email services change their settings and menus often. This guide is general information, not legal or professional security advice; check your provider’s help pages and official sources such as FTC.gov and CISA.gov.
