August 20, 2026
Email Deliverability: How to Keep Your Business Email Out of the Spam Folder
You can write the best email your business has ever sent — the right offer, the right list, the right timing — and still lose the sale, because the message quietly landed in a spam folder nobody opens. That gap between “sent” and “seen” is email deliverability, and it’s one of the few marketing problems that is really an I.T. problem wearing a marketing costume. The fix isn’t better subject lines. It’s DNS records, sending hygiene, and a bit of discipline about who you email and how often.
We’ve seen businesses spend months building a list and thousands of dollars on campaign design, only to discover their invoices, quotes, and password resets were also getting filtered — because the same domain reputation governs both marketing blasts and everyday transactional mail. The good news: most deliverability problems have concrete, fixable causes. This guide walks through what actually determines whether your email reaches the inbox, how to set up authentication correctly, and what to do when your sending reputation is already damaged.
What Email Deliverability Actually Means
There’s an important distinction hiding here. Delivery means the receiving mail server accepted your message. Deliverability means it landed in the inbox rather than the spam folder. A campaign can report 99% “delivered” and still have terrible deliverability — the messages arrived, they just arrived somewhere nobody looks.
Mailbox providers like Gmail, Outlook, and Yahoo make that inbox-or-spam decision in milliseconds, using signals that fall into three buckets:
- Identity — can they cryptographically verify that you are who you claim to be? This is authentication: SPF, DKIM, and DMARC.
- Reputation — how have recipients historically reacted to mail from your domain and your sending IP? Opens and replies help; spam complaints, deletes-without-reading, and bounces hurt.
- Content and behavior — does this message look like the mail people asked for, and does your sending pattern look human and consistent?
Identity is the part you control completely and can fix this week. Reputation is earned slowly and lost quickly. Content is where most people start, and it matters least.
Deliverability is not a spam-filter trick. It’s a trust score, and you build it the same way you build trust with a customer — by being consistently who you say you are.
The Three Records That Prove You’re You
Email was designed in an era when nobody expected anyone to lie about the “From” address. Anyone can still claim to be sending as your domain. Authentication is the layer bolted on top to prove otherwise, and it lives in your DNS. Getting these three records right is the single highest-leverage email deliverability project most small businesses can do.
SPF: Who Is Allowed to Send for You
A Sender Policy Framework record is a list, published in DNS, of the mail servers authorized to send on behalf of your domain. When a receiving server gets a message claiming to be from you, it checks whether the sending server appears on that list.
The common failure mode is sprawl. Over the years a business accumulates senders: Microsoft 365 or Google Workspace for staff mail, a marketing platform, a CRM, an invoicing tool, a helpdesk, a website contact form, a scheduling app. Each one needs to be represented in a single SPF record — and SPF has a hard limit of ten DNS lookups. Blow past it and the record fails entirely, which is worse than having a mediocre one.
DKIM: A Signature That Travels With the Message
DomainKeys Identified Mail attaches a cryptographic signature to each outgoing message. The receiver fetches your public key from DNS and verifies the signature, confirming both that the message came from an authorized system and that key parts of it weren’t altered in transit.
Unlike SPF, DKIM survives forwarding, which is why it carries more weight with most providers. Every platform that sends mail as your domain should have its own DKIM key published — and this is exactly the step most often skipped when a new tool gets added to the stack.
DMARC: The Policy That Ties It Together
DMARC is the instruction manual you publish for receivers: if a message claims to be from my domain but fails authentication, here’s what to do with it, and here’s where to send me reports. Policies escalate through three levels:
p=none— monitor only. Nothing gets blocked; you just collect reports. This is where every business should start.p=quarantine— failing mail goes to spam.p=reject— failing mail is refused outright. This is the destination.
The reports are the underrated part. DMARC aggregate reports tell you every source sending mail as your domain — including the marketing tool a department signed up for without telling anyone, and any outright spoofing attempts. It’s one of the cheapest visibility wins in small business I.T., and it overlaps directly with the fundamentals we cover in our guide to small business cybersecurity.
Critically, the major mailbox providers stopped treating this as optional. Google and Yahoo’s bulk sender requirements, in effect since early 2024, expect authenticated mail, one-click unsubscribe on marketing messages, and spam complaint rates kept well under a fraction of a percent. Microsoft has moved in the same direction for high-volume senders. If you’re sending meaningful volume without DMARC, you’re not being cautious — you’re behind.
A Practical Setup Sequence
Order matters here, because turning on enforcement before you’ve inventoried your senders is how legitimate invoices start disappearing.
- Inventory every system that sends mail as your domain. Ask each department. Check billing statements for SaaS tools. Look at your website’s form handler and your e-commerce platform.
- Publish one clean SPF record covering all of them, staying under the lookup limit.
- Enable DKIM signing in every platform and publish each key.
- Publish DMARC at
p=nonewith a reporting address, and let it run for two to four weeks. - Read the reports. Fix or remove any legitimate source that’s failing. Investigate anything you don’t recognize.
- Move to
p=quarantine, watch for a couple of weeks, then escalate top=reject.
| Record | What it proves | Survives forwarding? | Where it lives |
|---|---|---|---|
| SPF | The sending server is authorized | No | DNS TXT record |
| DKIM | The message is signed and unaltered | Yes | DNS TXT record (per selector) |
| DMARC | What to do when the others fail | N/A | DNS TXT at _dmarc |
Reputation: The Part Authentication Won’t Save
Authentication gets you considered. Reputation gets you delivered. Once your records are in order, email deliverability comes down to sending behavior — and this is where marketing habits do real damage.
List Quality Beats List Size
Purchased lists, scraped addresses, and years-old contacts who’ve never opened anything are the fastest route to a damaged domain. Old lists are full of dead addresses, and hard bounces are a strong negative signal. Worse, dormant addresses at some providers get recycled into spam traps.
Send to people who asked to hear from you, use confirmed opt-in where you can, and clean the list regularly. If you’re building from scratch, our guide on how to grow an email list that actually converts covers the acquisition side in depth.
Suppress the Unengaged
Engagement is a primary inbox-placement signal at Gmail in particular. A subscriber who hasn’t opened anything in a year isn’t just neutral — they actively drag your reputation down. Segment by engagement, run a short win-back sequence for the quiet ones, and then stop mailing the people who don’t respond. Most businesses see placement improve after cutting volume, which feels backwards until you understand what’s being measured.
Make Unsubscribing Easy
Every unsubscribe you make difficult becomes a spam complaint instead, and complaints are far more expensive. Put a visible unsubscribe link in the template, honor it immediately, and support one-click unsubscribe headers on marketing mail.
Separate Your Mail Streams
Transactional mail — receipts, password resets, appointment confirmations — should not share a sending reputation with promotional campaigns. Use a subdomain for marketing (something like news.yourdomain.com) so a rough campaign can’t take your invoices down with it. If you’re moving to a new domain or platform, warm it up gradually rather than sending your full list on day one.
The most common deliverability emergency we get called into isn’t a spam filter mystery. It’s a business that changed platforms, sent 40,000 emails from a cold domain on a Tuesday, and torched a reputation it took years to build.
Diagnosing a Problem You Already Have
If mail is already landing in spam, work through this in order:
- Check authentication first. Send a test message to an account at a major provider and inspect the headers for SPF, DKIM, and DMARC pass results. One failing record explains a surprising number of cases.
- Check whether it’s provider-specific. Landing in spam at Gmail but fine at Outlook points to engagement and reputation, not configuration.
- Check blocklists for your sending IP and domain, and follow the delisting process where one exists.
- Check your complaint and bounce rates in your sending platform. Rising complaints almost always trace back to a list or frequency change.
- Check what changed. New platform, new template, new list import, new sending volume — deliverability drops are rarely spontaneous.
Recovery is slower than damage. Expect to spend weeks sending smaller volumes to your most engaged contacts before placement fully returns.
Where This Fits in Your Stack
The reason email deliverability falls through the cracks is ownership. Marketing owns the campaigns, I.T. owns DNS, and neither owns the outcome. Somebody needs to hold both halves — the DNS records and the sending habits — and review them whenever a new tool joins the stack. That’s precisely the seam where our I.T. services and communications work meets our marketing services, and it’s why we treat authentication as table stakes on every email program we run.
If your email is landing in spam, your DMARC policy is still at p=none after a year, or you’re not sure how many systems are sending as your domain, we’d be glad to take a look. Frozen Crow offers a free, no-obligation consultation — get in touch at frozencrow.com and we’ll tell you plainly what’s wrong and what it takes to fix it.
