# Email Deliverability: SPF, DKIM, DMARC, and Inbox Placement

> Email deliverability explained: SPF, DKIM, DMARC, sender reputation, and list hygiene, plus how to warm a new domain and diagnose inbox placement.

By Justin Cooperman (Founder, Tented). Published May 11, 2026. Updated June 23, 2026. Filed under Email Marketing.

Human page: https://tented.ai/blog/email-deliverability. All posts: https://tented.ai/blog.md.

Your platform says the campaign was delivered. Revenue says nobody saw it. Both can be true, because delivered only means a server accepted the message, not that a human ever laid eyes on it.

Deliverability is the craft of landing in the inbox instead of the spam folder, and it rests on three things mailbox providers evaluate constantly: whether you can prove who you are, how your mail has behaved historically, and whether recipients seem to want it.

This guide covers delivery versus deliverability, how mailbox providers decide, SPF, DKIM, and DMARC in plain English, what bulk senders are now expected to do, hygiene and suppression, warming a new domain, and how to diagnose placement problems.

## Delivery vs deliverability

Delivery is binary: the receiving server accepted your message or bounced it. Platforms can measure it precisely, which is why every dashboard reports a delivery rate.

Deliverability is where the accepted message actually lands: primary inbox, a secondary tab, or spam. Nobody reports it precisely, because only the mailbox provider knows, and the answer varies per recipient.

That gap explains the classic mystery of a 99 percent delivery rate paired with cratering engagement. The mail arrived; it just arrived somewhere nobody looks.

## How mailbox providers decide

Every large mailbox provider runs the same rough evaluation on your mail, each weighting it their own way.

- **Authentication.** Can the message be tied to a domain that takes responsibility for it? Unauthenticated mail starts the race with a penalty, and increasingly does not start at all.
- **Reputation.** What is the track record of the sending domain and IP: complaint rates, bounce rates, spam-trap hits, volume consistency, and how long that record stretches back.
- **Engagement.** Do recipients open, reply, and rescue your mail from spam, or delete it unread and flag it? Filtering is increasingly personal, so the same campaign can inbox for an engaged subscriber and junk for a silent one.

Notice what is missing from that list: how the email looks. Deliverability is mostly earned before the send button is pressed.

## SPF, DKIM, and DMARC in plain English

The three authentication protocols intimidate mostly through their acronyms. Each answers one question a receiving server asks about your message.

| Protocol | What it proves | What breaks without it |
| --- | --- | --- |
| SPF | The server that sent the message is on your domain's approved sender list | Spoofing your domain gets easier, and strict receivers distrust or reject your mail |
| DKIM | The message was signed by your domain and was not altered in transit | You have no durable identity for providers to attach reputation to |
| DMARC | The From address readers see aligns with SPF or DKIM, and you have declared a policy for failures | Anyone can put your exact From address on spam, and bulk senders without a policy fail modern requirements |

### SPF, the guest list

SPF is a DNS record listing the servers allowed to send mail for your domain. The receiving server checks the actual sender against that list. Simple, but fragile: ordinary forwarding can break it, which is why SPF alone was never enough.

### DKIM, the tamper-proof seal

DKIM adds a cryptographic signature to each message using a private key only your sender holds, with the matching public key published in DNS. When the signature verifies, the receiver knows the mail is genuinely yours and arrived unmodified. This is the identity your reputation accrues to.

### DMARC, the policy and the paper trail

DMARC ties the other two to the From address a human actually sees, requiring at least one of them to align with it. It also declares what receivers should do on failure, from monitor only, to quarantine, to reject, and it sends you reports about who is sending as your domain. Start at the monitoring level, read the reports, then tighten.

## What mailbox providers expect from bulk senders

The major mailbox providers have converged on published expectations for anyone sending in volume, and the themes are consistent even as the details evolve.

- Authenticate fully: SPF, DKIM, and a DMARC policy on your sending domain.
- Make leaving easy: a working one-click unsubscribe, honored promptly rather than buried or delayed.
- Keep spam complaints very low. The tolerated rate is a small fraction of one percent, which in practice means permission-based lists and relevant sends.
- Send from a domain with valid DNS records, and never impersonate another sender.

None of this is optional for volume senders anymore; miss the bar and providers throttle or junk your mail regardless of content quality. If your exit experience needs work, fixing it costs less than the complaints it prevents, as covered in [how to reduce your unsubscribe rate](/blog/reduce-unsubscribe-rate).

Try this on Tented: describe the campaign you want to run and the AI generates the on-brand pages and emails, ready to send. Free plan: https://app.tented.ai/signup.

## List hygiene, bounces, and suppression

Reputation is mostly a record of who you mail, which makes hygiene a core deliverability practice rather than housekeeping.

### Hard versus soft bounces

A hard bounce is permanent: the address does not exist or the domain is dead. Remove it immediately, because repeatedly mailing dead addresses is a signature spam-sender behavior. A soft bounce is temporary: a full mailbox, a size limit, a server hiccup. Retrying is fine, but treat an address that soft-bounces repeatedly as hard.

### Suppression is protection

Your suppression list holds everyone you must not mail again: unsubscribes, complainers, and hard bounces. It is not lost audience; it is armor. Every send it blocks is a complaint or bounce that never lands on your record.

### Sunset the silent

Subscribers who have ignored you for months hurt you slowly. Give them a fair chance with a [win-back campaign](/blog/win-back-email-campaigns), then suppress the non-responders. And never import purchased addresses, which stack every risk in this section at once; grow through real opt-ins instead, as covered in [email list building](/blog/email-list-building).

## Warming a new sending domain

A brand-new domain has no reputation, and providers treat no history as suspicious history. Blast your full list from it on day one and you will start life in the spam folder.

Warming is reputation building on a schedule.

1. Start with your most engaged recipients, the people nearly certain to open and click.
2. Send small volumes consistently, then increase gradually over several weeks.
3. Hold content and cadence steady while volume ramps, so the only variable is scale.
4. Watch bounces and complaints at every step, and slow the ramp the moment they twitch.

The exact numbers matter less than the shape: small, consistent, engaged-first, and patient. Rushing a warmup creates the exact reputation problem it was meant to prevent.

## Diagnosing inbox placement problems

When engagement drops and you suspect placement, work the list in order instead of guessing.

1. Verify authentication on real received messages, not just in your DNS dashboard. A broken DKIM key or a new sending tool missing from your SPF record is a classic silent failure.
2. Split your metrics by mailbox provider. A collapse isolated to one provider points at your reputation there, not at your content.
3. Use the postmaster and sender tools the large providers offer to check domain reputation and complaint trends.
4. Reconstruct what changed: a list import, a new template, a vendor switch, a volume spike. Placement problems usually have a birthday.
5. Rebuild by mailing only your most engaged segment, let the metrics recover, then widen gradually. It is domain warming, repeated.

Placement recovers the way it was lost: through sustained behavior, not through a support ticket.

## Where your platform should carry the load

Much of this discipline can be structural instead of remembered. Suppression should apply to every send automatically, unsubscribes should be one click and honored instantly, and your templates should render cleanly so engagement signals stay strong.

That is how Tented approaches it: unsubscribe handling and suppression are built into [email sending](/platform/email-marketing), authenticated branded sending domains are supported on paid plans, and the [AI Email Studio](/platform/email) produces clean, client-proof HTML so your mail behaves predictably wherever it lands.

The parts that remain yours are the ones no platform can do for you: permission, relevance, and restraint.

## Final thoughts

Deliverability is not a switch you flip after a bad campaign. It is the accumulated record of your authentication, your hygiene, and how wanted your mail is, and it moves at the speed of sender behavior.

Authenticate everything, mail people who asked, remove the dead and the silent, and warm anything new. Do that consistently, with a platform like Tented handling the mechanical layer, and the inbox mostly takes care of itself.

## Frequently asked questions

### What is the difference between email delivery and deliverability?

Delivery means the receiving server accepted your message instead of bouncing it. Deliverability means the message reached the inbox rather than the spam folder. Platforms measure delivery precisely; deliverability can only be inferred from engagement, provider tools, and seed tests.

### Do I really need SPF, DKIM, and DMARC?

Yes, all three, if you send any meaningful volume. Major mailbox providers now expect full authentication from bulk senders, and each protocol covers a gap the others leave: SPF approves servers, DKIM proves integrity and identity, and DMARC ties both to the visible From address.

### How long does it take to warm up a new email domain?

Typically several weeks, depending on your target volume. Start with small sends to your most engaged recipients and increase gradually, holding content and cadence steady. Watch bounces and complaints at each step and slow down whenever they rise.

### What is a spam trap?

An email address maintained to catch senders who mail without permission or without hygiene, such as addresses that were never signed up or old addresses recycled after long dormancy. Hitting traps damages your reputation, and they arrive mainly through purchased lists and stale data.

### Why do my emails go to spam even though authentication passes?

Authentication is necessary but not sufficient. Placement also depends on your domain reputation and on engagement, so high complaints, mailing unengaged subscribers, bounced-out data, or a sudden volume spike can junk fully authenticated mail. Split metrics by provider to find where the problem lives.

### What is an acceptable spam complaint rate?

Directionally, a small fraction of one percent. Mailbox providers tolerate very little, and a sustained rise degrades placement for your whole list. Keep it low with permission-based acquisition, relevant segmented sends, and an unsubscribe that is easier to find than the spam button.

## Learn more

- All blog posts: https://tented.ai/blog.md
- The Tented platform: https://tented.ai/platform.md
- Pricing: https://tented.ai/pricing.md
- Sign up free: https://app.tented.ai/signup