Email deliverability checklist for small teams

Deliverability is the share of your mail that reaches the inbox, not the spam folder and not a bounce. It depends on three things receivers check: whether the message is authenticated, whether your domain and IP have a good reputation, and whether recipients want it. Most problems at small companies come from the first, and most of the rest from sending to people who did not ask.

The checklist below is grouped the way you would work through it. Tick the items as you go; the ticks are kept on this page only.

Gmail, Yahoo and Outlook.com all start here. Every sender needs SPF or DKIM; anyone sending around 5,000 messages a day to their users needs SPF, DKIM and a DMARC record, aligned with the From address. Meeting the higher bar costs a small team nothing, so do it from day one.

example.com.                3600 IN TXT   "v=spf1 include:spf.provider.example ~all"
s1._domainkey.example.com.  3600 IN CNAME s1.dkim.provider.example.
_dmarc.example.com.         3600 IN TXT   "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

• SPF: one record, every sending service in it, at most 10 DNS lookups.
• DKIM: each service signs with d=example.com, your domain, not its own. 2048-bit keys.
• DMARC: start at p=none with a report address; tighten later.
• Reverse DNS and TLS: your provider’s sending IPs need PTR records that match, and mail should travel over TLS. Gmail rejects mail from IPs without PTR (code 5.7.25).

Each record explained, with alignment and the 2026 DMARC changes: SPF, DKIM and DMARC explained.

Receivers judge you mostly by how recipients react. Mail that people open, reply to and move out of spam builds reputation; mail they report as spam or that bounces destroys it. You cannot fix that with DNS.

• Only people who expect your mail. No bought or scraped lists. One campaign to a cold list can undo months of good sending.
• Hard bounces out at once. A 550 5.1.1 (no such user) means the address is dead. Sending to it again tells receivers you do not clean your lists.
• Soft bounces watched. 4xx codes and a full mailbox (5.2.2) are temporary; drop the address after repeated failures over several days.
• One-click unsubscribe on marketing. Add both headers (RFC 8058) and a visible link, and process requests within 2 days.
• Pause the inactive. Contacts who have not engaged in six months or more drag your engagement down.

List-Unsubscribe: <https://example.com/u/8f2c1a>, <mailto:unsubscribe@example.com?subject=8f2c1a>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Do not add unsubscribe headers to person-to-person mail. They mark a message as bulk, which is not what a reply to a customer is.

• A real From and Reply-To. An address someone reads. no-reply addresses on mail that invites an answer frustrate people and lose replies.
• Valid format. One From header, a Date, a unique Message-ID, a plain-text part alongside the HTML (RFC 5322). Good tools do this for you; hand-built scripts often do not.
• Links on your domain. Shorteners and unrelated tracking domains look like phishing. Keep link domains aligned with yours.
• Marketing on its own stream. Send campaigns from a subdomain (news.example.com) or a separate service, so complaints about a newsletter do not land on the domain your team replies from.
• Ramp up slowly. A new domain or a new service that suddenly sends thousands of messages looks like a spammer. Start with the people most likely to answer and grow over a few weeks.

Spam-filter folklore (avoid the word “free”, never use red text) matters far less than it used to. Filters read authentication, reputation and how people react. Write like a person writing to a person.

• Google Postmaster Tools. Free, verified with a DNS record. It shows your spam rate as Gmail users report it, and whether you meet the sender requirements. Google asks senders to stay below 0.1% and never reach 0.3%.
• DMARC aggregate reports. Daily XML from each large receiver, listing every IP that sent as your domain and whether it passed. A report reader turns them into a table.
• Bounces in your own mailbox. Read them. The code says whether the problem is the address, your authentication or your reputation.
• Blocklists after a spike. If bounces suddenly mention a blocklist, check that list for your IP or domain and follow its removal process.

Bounce codes worth knowing

A rule that saves time: codes starting with 5.1 are about the address, codes starting with 5.7 are about you. Never delete an address because of a 5.7.

Work through these in order; the first ones explain most cases.

• Open a message you sent to Gmail, choose Show original and read SPF, DKIM and DMARC. Anything other than PASS is the first fix.
• Check that the From domain matches the DKIM domain (d=). A service signing as itself passes DKIM but fails DMARC for you.
• Look at Postmaster Tools for a rising spam rate or a falling domain reputation.
• Ask what changed: a new tool sending as your domain, a list import, a campaign to old contacts, a sudden jump in volume.
• If it is one recipient’s company only, their filter may be strict; ask them to add you as a safe sender while you check the rest.

The large providers’ formal rules, with dates and thresholds: Gmail, Yahoo and Outlook sender requirements.

Most of what a small team sends is person-to-person: quotes, replies, follow-ups. That mail has the best deliverability there is, as long as it gets sent. Skein is built for that part: its agent drafts the follow-up in your tone and, by default, asks before it sends. See it in the demo.