"Delivered" and "in the inbox" are not the same thing, and the distance between them is bigger than most senders suspect. A receiving server can accept your message, report it delivered, and quietly file it in spam where nobody will ever open it. Across the messages we test at Unspam, 82% pass a full deliverability check, 14% draw warnings, and 4% fail outright, while the global primary-inbox rate sits around 59%. Somewhere in that gap, campaigns bleed revenue without anyone noticing.
What follows is the pre-send routine I run before anything important goes out. It matters more than it used to: Google and Yahoo have enforced sender requirements since February 2024, and Microsoft applied the same bar to Outlook in May 2025. Every step links to a free tool you can run in seconds, and each recommendation rests on what we actually measure across real sending domains rather than on folklore.
The email deliverability checklist at a glance
- Authenticate the domain: SPF, DKIM, and DMARC, all aligned
- Confirm the domain and sending IP are off blacklists
- Clean and verify the recipient list
- Warm up any new domain or IP
- Audit the content, formatting, and links
- Add a one-click List-Unsubscribe header
- Send on a consistent schedule and protect engagement
- Run a spam test and an inbox placement test before you send
The rest of the guide walks through each step, with the data and the provider rules behind it. Skim the list now, then go deeper wherever your own setup feels shaky.
What we see across the emails we test
Most deliverability advice recycles the same tips in a slightly different order, so let me start somewhere else: with what the emails running through Unspam actually show. These numbers describe where senders really stand, not where guides assume they do. Two patterns stand out, and neither one is visible in a blended "average deliverability rate."
Inbox placement is not one number
The same test message lands very differently depending on the mailbox provider:
| Mailbox provider | Primary-inbox rate |
|---|---|
| ProtonMail | 95% |
| Zoho | 93% |
| Gmail | 68% |
| Outlook | 48% |
| AOL | 42% |
| Yahoo | 40% |
Identical mail, a 55-point spread. A single blended average (about 59% to the primary inbox) papers over the awkward truth that Yahoo and Outlook quietly filter more than half of what Gmail lets through. So judge yourself per provider, never on one headline figure.
The authentication paradox
Across the domains we check:
- 90% pass SPF and 87% pass DKIM, so basic authentication is nearly universal.
- Only 58% publish DMARC, and DMARC is precisely the record the 2024 and 2025 provider rules enforce.
- 89% score in the safe SpamAssassin range (below 3.0), so raw content is rarely the primary problem.
- Only 30% pass our HTML best-practice checks, the lowest pass rate of anything we measure.
- Only 14% set a List-Unsubscribe header, despite it being a provider requirement for bulk mail.
- Just 0.28% of domains turn up on a domain blacklist, which is why a listing stands out so sharply when it happens.
Notice what this list is really saying. The fixes that move the needle are rarely the content tweaks people obsess over; they are DMARC alignment, engagement, and the unglamorous hygiene work below.
Authentication gets your mail accepted. Reputation and engagement decide whether it reaches the inbox.
What the mailbox providers require (and where they differ)
No blog decides what reaches the inbox; the mailbox providers do. Their published rules overlap heavily but do not perfectly agree, which is worth understanding before you take advice from either camp at face value.
The two enforcement regimes
These two rule sets cover most inboxes:
| Requirement | Google & Yahoo (since Feb 2024) | Microsoft Outlook (since May 2025) |
|---|---|---|
| Applies to | 5,000+ a day to Gmail or Yahoo | 5,000+ a day to Outlook, Hotmail, Live |
| SPF + DKIM + DMARC | All three required | All three required (DMARC at least p=none, aligned) |
| One-click unsubscribe | Required (RFC 8058) | Expected for bulk mail |
| Spam complaint rate | Below 0.3%, aim under 0.1% | Kept low and monitored |
| If you fail | Junk folder, then rejection | Rejected outright (550 5.7.15) |
The standards behind the rules
Two more authorities shape the baseline:
- Standards bodies. The technical baselines come from the RFCs (SPF in RFC 7208, DMARC in RFC 7489, one-click unsubscribe in RFC 8058), and M3AAWG, the industry anti-abuse working group, publishes the sending best practices most consultants follow on list hygiene, warmup, and complaint feedback loops.
- SpamAssassin. The open-source filter behind many providers scores messages and flags them above 5.0 by default. In practice, aim well below that: a SpamAssassin score under 3.0 is the safe zone, and that is where 89% of the messages we test already sit.
They differ on thresholds and on what failure costs you: Outlook rejects outright, Gmail routes to junk first, and the exact complaint limits vary. On the core, though, they speak with one voice: authenticate everything, make leaving easy, keep complaints low. Every step below serves that shared standard.
1. Authenticate your domain with SPF, DKIM, and DMARC
Start here, because for bulk senders this stopped being optional: Google, Yahoo, and Microsoft all demand it now. Publish all three records, and, just as important, make sure each one aligns with your From domain rather than merely passing.
| Record | What it proves | Lives as |
|---|---|---|
| SPF | Which servers may send for your domain | one TXT record starting v=spf1 |
| DKIM | The message is signed by your domain and unaltered | TXT record at selector._domainkey |
| DMARC | What to do when SPF or DKIM fails, plus how to report it | TXT record at _dmarc |
- SPF: publish a single TXT record that starts with
v=spf1, names every service that sends on your behalf, and ends with-all(or~allwhile you are still testing). Keep it under the 10 DNS lookup limit. Confirm it with the free SPF checker. - DKIM: make sure your sending platform signs with your own domain in the
d=tag, not its shared domain. A mismatchedd=is the single most common reason "authenticated" mail still fails DMARC alignment. Verify it with the DKIM checker. - DMARC: publish a policy, starting at
p=nonewith anruareporting address, then tighten towardquarantineorrejectonce your reports run clean. Check it with the DMARC checker.
Only 58% of the senders we test publish DMARC, which makes this one record the most common gap between "my email passes SPF" and "my email meets the provider rules." If the acronyms are new to you, start with email authentication explained.
2. Check your domain and IP against blacklists
Blacklists are the silent failure in this list: a single listing can sink a campaign, and nobody sends you a letter when it happens. You find out by checking, or you find out from your open rates.
- Run your sending domain through the domain blacklist checker.
- Run your sending IP through the IP blacklist checker.
- Check your from-address reputation with the email blacklist checker.
- Cross-reference with Google Postmaster Tools and keep an eye on your sender score.
Domain-level listings are genuinely rare (about 0.28% of the domains we test carry one), and that rarity is exactly what makes them expensive: providers read an unusual signal as a loud one.
3. Clean and verify your list
Nothing burns a sending reputation faster than bounces and spam-trap hits, and the damage compounds quietly: a stale list drags engagement, poor engagement drags reputation, and reputation decides placement. Before a send:
- Remove invalid, role-based (info@, admin@), and long-inactive addresses.
- Verify anything you are unsure about with the free email verifier.
- Never send to purchased or scraped lists, which are the fastest route to a spam-trap hit.
- Keep your spam complaint rate under Gmail's 0.3% ceiling, and ideally under 0.1%.
Counterintuitive but consistently true: the smaller, engaged list beats the big stale one, because providers care how people react to your mail, not how much of it you send.
4. Warm up new domains and IPs
A fresh domain or dedicated IP arrives with no history at all, and to a mailbox provider, full volume from an unknown sender is indistinguishable from a spam run. M3AAWG's guidance, and every practitioner's, comes down to the same word: ramp.
- Start with your most engaged subscribers (recent openers and clickers).
- Increase volume steadily over two to four weeks.
- Watch complaints and bounces at each step, and slow down if either climbs.
Our guide on how to warm up a sending domain walks through a sample schedule. One caution that surprises people: a dedicated IP is not worth it at low volume, because thin volume on a cold dedicated IP performs worse than a healthy shared pool.
5. Audit your content and formatting
Content matters less than reputation, but it is the one lever entirely in your hands, and, oddly, it is where senders do worst: only 30% of the emails we check pass our HTML best-practice tests. Before you send:
- Scan the subject and body for spam trigger words with the free spam word checker, and treat any match as a prompt to rewrite, not a hard rule.
- Use tested, cross-client HTML. Broken rendering drives the low engagement that hurts placement, so it matters even though filters do not score "ugly" HTML directly.
- Keep a sensible text-to-image balance, make sure every link resolves and check how your tracking links route, and cover the email accessibility basics like alt text and contrast, since the same fixes protect you with images off.
- Stay under Gmail's roughly 102KB clipping point so your unsubscribe link is never hidden.
- Aim for a SpamAssassin score below 3.0, the range where 89% of tested messages comfortably sit.
6. Add a one-click unsubscribe (List-Unsubscribe)
Google, Yahoo, and Microsoft all require bulk senders to support one-click unsubscribe through the List-Unsubscribe header, yet only about 14% of the senders we test actually set it. I keep waiting for that number to improve; it barely moves. One of the easiest compliance wins available is sitting untouched in most sending stacks.
- Add both
List-UnsubscribeandList-Unsubscribe-Postheaders (RFC 8058) so the unsubscribe works in one click. - Keep the visible unsubscribe link in the body as well.
- Honor requests within two days, which is the window the provider rules specify.
An easy exit lowers complaints, because recipients who cannot find the unsubscribe use the spam button instead. See the List-Unsubscribe header guide for the exact headers.
7. Send consistently and protect your reputation
Providers reward mail that people expect and open, sent on a rhythm they can model. Reputation remains the single biggest lever on placement, bigger than any wording choice you will ever make, so guard it:
- Send on a steady cadence rather than in erratic bursts.
- Honor unsubscribes quickly and make them easy.
- Sunset subscribers who have not engaged in 90 to 180 days so dead weight stops dragging your numbers down.
- Segment by engagement so your most active recipients see your mail first, which lifts the aggregate signals providers watch.
Read more in our guide to sender reputation.
8. Run a spam test and an inbox placement test before you send
Everything above is preparation; this is the proof. It is also, in my experience, the step most senders skip, usually right before the campaign that teaches them not to.
- A free spam test scores your message against the same engines mailbox providers use and flags authentication, blacklist, and content problems in about 30 seconds.
- An inbox placement test delivers to real seed inboxes and shows where the email actually lands per provider, which matters because, as the table above shows, placement swings from 40% at Yahoo to 95% at ProtonMail on identical mail.
- Preview how the message renders on real devices before it goes out, across 50+ real email clients in light and dark mode.
- Re-test after any fix to confirm it moved placement, not just delivery.
Deliverability thresholds worth memorizing
Keep these numbers on hand; they are the lines the providers and filters actually draw:
- Spam complaint rate: under 0.1% good, 0.3% is the danger line (Google, Yahoo, Microsoft).
- Bulk-sender threshold: 5,000 messages a day triggers the strict authentication rules.
- SpamAssassin score: below 3.0 is safe, above 5.0 is likely spam.
- SPF: one record, maximum 10 DNS lookups.
- Gmail clipping: messages over about 102KB get truncated.
- Warmup: two to four weeks for a new domain or IP.
- List hygiene: sunset unengaged contacts after 90 to 180 days.
The mistakes we see most often
After enough audits the surprises stop. The same handful of errors keeps turning up across the domains we test, month after month:
- Sending from the ESP's shared domain, so DKIM signs the wrong
d=and DMARC alignment fails silently. - Publishing SPF and DKIM but not DMARC, which leaves you out of compliance with the very rules being enforced (only 58% publish it).
- Going full volume from a cold domain instead of warming up.
- Mailing purchased or long-dead lists, which drives complaints and spam-trap hits.
- Shipping image-heavy or untested HTML that breaks in Outlook and Gmail.
- Skipping the final test, then discovering the spam problem from falling revenue instead of a report.
The pre-send checklist (copy this)
- SPF, DKIM, and DMARC published and aligned
- Domain and sending IP clear of blacklists
- List cleaned and verified, complaint rate under 0.1%
- New domain or IP warmed up gradually
- Content checked for spam words, tested HTML, and working links
- One-click List-Unsubscribe header in place
- Consistent schedule and an engaged list
- Spam test and inbox placement test passed
There is no single big fix hiding anywhere in deliverability. There is only this small set of habits, repeated before every send until it stops feeling like a checklist. When your next campaign is ready, run it through a free spam test and an inbox placement test first, no signup required.
