How to Land Your Emails in the Inbox, Not Spam: A Practical Deliverability Checklist

Why good emails end up in spam

Most spam-folder problems are not about your copy. They come from missing authentication, a poor sending reputation, or a mixed-up sending setup. Mailbox providers like Gmail, Outlook and Yahoo ask one question before anything else: can I trust that this message really comes from the domain it claims? If the answer is unclear, your email gets filtered.

Since Google and Yahoo tightened their sender requirements, authentication is no longer optional for anyone sending at volume. Here is what actually moves the needle, in the order you should tackle it.

1. Set up SPF

SPF is a DNS TXT record that lists the servers allowed to send mail for your domain.

v=spf1 include:_spf.mailflash.io ~all

Rules worth remembering:

• One SPF record per domain. Two records break SPF entirely.
• Stay under 10 DNS lookups. Every include: counts, and nested ones count too.
• Use ~all while testing, then move to -all once you are confident every legitimate sender is listed.

2. Sign your mail with DKIM

DKIM adds a cryptographic signature to each message. The receiving server checks it against a public key published in your DNS. If the signature validates, the message was not altered in transit and really came from your domain.

Publish the DKIM record your provider gives you, usually a CNAME or TXT on a selector like mf1._domainkey.yourdomain.com. Use 2048-bit keys where your DNS host allows it, and rotate keys once or twice a year.

3. Publish a DMARC policy

DMARC ties SPF and DKIM together and tells receivers what to do when checks fail. It also checks alignment: the domain in the visible From address must match the domain that passed SPF or DKIM.

Start in monitoring mode:

_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

Read the aggregate reports for a few weeks. Once every legitimate source passes, move to p=quarantine, then p=reject. Going straight to reject without looking at reports is how teams accidentally block their own invoices.

4. Separate transactional and marketing mail

Password resets and receipts have very high engagement. Newsletters and promotions get more complaints and more ignored messages. If both leave from the same domain and IP, the weaker traffic drags down the stronger.

Use a subdomain for each stream, for example mail.yourdomain.com for transactional and news.yourdomain.com for marketing. Reputation is tracked per domain and per IP, so a bad campaign will not delay someone's login code.

5. Warm up new domains and IPs

A brand new sender that suddenly pushes 50,000 messages looks like a spammer. Ramp up gradually:

• Day 1 to 3: a few hundred messages to your most engaged recipients
• Week 1: double the volume every day or two if bounce and complaint rates stay low
• Weeks 2 to 4: keep growing toward your normal volume

If you are on shared infrastructure, the provider has usually done much of this for you. On a dedicated IP, the warm-up is your job.

6. Keep your list clean

• Send only to people who asked for your email.
• Remove hard bounces immediately and never retry them.
• Keep spam complaints under 0.1%. Gmail treats 0.3% as a hard ceiling.
• Suppress addresses that have not opened anything in 6 to 12 months.
• Use double opt-in for marketing signups to avoid typos and spam traps.

Handle bounces and complaints automatically by listening to webhooks rather than checking dashboards by hand. A simple handler that adds hard-bounced addresses to a suppression list protects your reputation more than any copywriting trick.

7. Make unsubscribing easy

For bulk and marketing mail, include a visible unsubscribe link and the List-Unsubscribe and List-Unsubscribe-Post headers so Gmail and Yahoo can show their one-click unsubscribe button. People who cannot find the link hit the spam button instead, and that hurts you far more than an unsubscribe does.

8. Write like a person

Content still matters at the margins:

• Match the From name and address to something recipients recognize.
• Write a plain, honest subject line. Skip ALL CAPS, repeated exclamation marks and misleading "Re:" prefixes.
• Balance text and images. An email made of one big image looks suspicious.
• Link to your own domain and avoid URL shorteners.
• Always include a plain-text version alongside HTML.
• Include your physical business address in marketing mail.

9. Pick the right way to send

SMTP relay and REST API both work. A REST API is usually faster for high volume since you skip the SMTP handshake per message, and it returns clearer error responses. SMTP is fine for legacy apps and quick integrations. Whichever you choose, keep connections authenticated over TLS and respect rate limits so you do not trip throttling at receiving servers.

10. Monitor and test

• Send to a seed list of Gmail, Outlook and Yahoo accounts and check where each lands.
• Register with Google Postmaster Tools and Microsoft SNDS to see domain reputation and spam rates.
• Check your domain against major blocklists occasionally.
• Test messages with a header analyzer to confirm SPF, DKIM and DMARC all show pass.

Quick checklist

• SPF record published, one per domain
• DKIM signing enabled and passing
• DMARC at p=none, then tightened
• Transactional and marketing separated by subdomain
• New IP or domain warmed gradually
• Bounces and complaints handled via webhooks
• List-Unsubscribe headers on bulk mail
• Plain-text part included
• Postmaster Tools connected

Final thoughts

Inbox placement is earned over time. Authenticate properly, send what people want, remove addresses that do not engage, and watch your numbers. Do those four things consistently and spam-folder issues mostly disappear.