Email Deliverability Guide: How to Land in the Inbox Every Time

14 min read · Ecommerce Growth · Last updated July 2026

Quick answer: Email deliverability is determined by your technical authentication (SPF, DKIM, DMARC), sender reputation score, list hygiene, and engagement rates. Fix all four and you can expect 95%+ inbox placement within 60 days.

Introduction

Here is a number that should stop you cold: 21% of legitimate marketing emails never reach the inbox. They are silently filtered into spam, promotions tabs, or simply dropped — and most brands have no idea it is happening.

You can write the best subject line in the world. You can have a 40% open rate template. None of it matters if Gmail, Outlook, or Apple Mail never delivers the message.

Email remains the highest-ROI channel in ecommerce — $36 back for every $1 spent, according to Litmus’s 2025 State of Email report. But that ROI assumes inbox placement. Deliverability is the invisible lever that either multiplies or destroys your email revenue.

In this guide you will learn:
– How to set up SPF, DKIM, and DMARC correctly (and why each one matters)
– How ISPs score your sender reputation and what moves the needle
– The exact list hygiene process used by 8-figure ecommerce brands
– How to warm up a new domain without destroying it in the first week

Table of Contents

1. Why Deliverability Fails (The Real Reasons)
2. SPF: Stop Spoofing Before It Starts
3. DKIM: Prove Your Emails Are Authentic
4. DMARC: The Policy That Ties It All Together
5. Sender Reputation: How ISPs Score You
6. List Hygiene: The Practice That Separates Pros from Amateurs
7. Domain Warmup: The Right Way to Start Sending
8. Deliverability Monitoring Tools
9. Interactive: Email Deliverability Audit Checklist
10. Interactive: Sender Reputation Score Estimator
11. FAQ

1. Why Deliverability Fails (The Real Reasons)

Most brands blame spam filters for poor deliverability. The filters are not the problem — they are doing exactly what they are designed to do.

The real culprits are:

Low engagement rates. Gmail’s algorithm watches what recipients do with your emails. If 60% of your list never opens anything you send, Gmail interprets that as a signal you are sending unwanted mail — and starts filtering you to spam for everyone, including engaged subscribers.

Sending to invalid addresses. A bounce rate above 2% is a red flag for every major ISP. Sending to purchased lists, old lists, or uncleaned lists creates hard bounces that damage your reputation fast.

Spam complaints. A complaint rate above 0.1% (one complaint per 1,000 sends) will get you filtered. Above 0.3% and some ISPs will block you entirely. Gmail’s Postmaster Tools shows your complaint rate in real time.

Missing or broken authentication. Without SPF, DKIM, and DMARC, ISPs cannot verify you are who you say you are. Unauthenticated mail is far more likely to be filtered.

Sending inconsistent volumes. Going from 1,000 emails a week to 500,000 in a single day — common around Black Friday — is a major red flag. Volume spikes without warmup destroy reputation fast.

Key takeaway: Deliverability is a reputation game. Every email you send is a vote for or against your sender score.

2. SPF: Stop Spoofing Before It Starts

SPF (Sender Policy Framework) is a DNS record that tells receiving mail servers which IP addresses are authorised to send email on behalf of your domain.

Without SPF, anyone can send email claiming to be from your domain. ISPs know this, so they penalise domains without SPF records.

How to set up SPF:

1. Log in to your DNS provider (Cloudflare, GoDaddy, Namecheap, etc.)
2. Add a TXT record to your root domain (@)
3. The value specifies which servers can send

A typical SPF record for a Shopify store using Klaviyo looks like:

v=spf1 include:_spf.klaviyo.com include:servers.mcsv.net ~all

Breaking down the syntax:
– v=spf1 — declares this is an SPF record
– include:_spf.klaviyo.com — authorises Klaviyo’s sending IPs
– ~all — “softfail” — mail from other sources is suspect but not rejected
– -all — “hardfail” — mail from other sources is rejected (recommended once you are confident)

Critical rule: You can only have one SPF record per domain. If you have multiple email providers (Klaviyo, Postmark, G Suite), combine them into a single record. Two SPF records = SPF failure.

Verify your SPF with:

dig TXT yourdomain.com | grep spf

Or use MXToolbox’s free SPF checker at mxtoolbox.com/spf.aspx.

Key takeaway: SPF tells the world who is allowed to send email for you. One record, all providers, verify before you go live.

3. DKIM: Prove Your Emails Are Authentic

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. The receiving server uses your public key (published in DNS) to verify the signature matches. If it does, the email has not been tampered with in transit.

Why it matters: ISPs weight DKIM-signed emails more favourably. Gmail’s filtering algorithm explicitly rewards consistent DKIM alignment.

Setting up DKIM:

In Klaviyo:
1. Go to Account → Settings → Email Deliverability
2. Click “Add a Sending Domain”
3. Klaviyo generates two CNAME records
4. Add those CNAME records to your DNS
5. Return to Klaviyo and click “Verify DNS Records”

The process is near-identical in Mailchimp, Drip, and most other ESPs. Your ESP generates the keys and gives you the DNS records to paste in.

DKIM selector: Each sending domain has a “selector” — a prefix that lets you have multiple DKIM keys. Klaviyo typically uses klaviyo1._domainkey and klaviyo2._domainkey.

Check DKIM alignment: In Gmail, open any email you sent, click the three-dot menu, and select “Show original.” You will see a line like dkim=pass or dkim=fail. This is the fastest way to verify DKIM is working.

Key takeaway: DKIM signs your emails cryptographically. Without it, ISPs have no way to verify your emails have not been forged or altered.

4. DMARC: The Policy That Ties It All Together

DMARC (Domain-based Message Authentication, Reporting, and Conformance) sits on top of SPF and DKIM. It tells ISPs what to do when an email fails authentication checks, and crucially, it sends you reports on what is happening.

DMARC policy levels:

Recommended rollout:

Start with p=none to collect data for 2-4 weeks. Review the reports. Once you are confident all legitimate sending sources are covered by SPF and DKIM, move to p=quarantine, then p=reject.

Example DMARC record:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc-forensics@yourdomain.com; pct=100; adkim=s; aspf=s

• rua — where aggregate reports are sent (daily digest from each ISP)
• ruf — where forensic reports are sent (per-failure detail)
• pct=100 — apply policy to 100% of failing emails
• adkim=s — strict DKIM alignment (the From domain must match the DKIM d= domain exactly)
• aspf=s — strict SPF alignment

DMARC reporting tools: Postmark’s DMARC Digests (free), Dmarcian, Valimail, and EasyDMARC all parse the XML aggregate reports into readable dashboards.

Key takeaway: DMARC is the enforcement layer. Without it, having SPF and DKIM provides protection but no instruction to ISPs about what to do when they fail.

5. Sender Reputation: How ISPs Score You

Your sender reputation is a score maintained by each major ISP. It is based on dozens of signals, but these are the ones that move the needle most.

Engagement rate. The single most important factor for Gmail and Yahoo. Positive engagement — opens, clicks, replies, moving emails out of spam — boosts your score. Negative engagement — deleting without opening, marking as spam — damages it.

Complaint rate. Track this at Gmail Postmaster Tools (postmaster.google.com). Green = below 0.1%. Yellow = 0.1-0.3%. Red = above 0.3% and you are being actively filtered.

Bounce rate. Keep hard bounces below 2% per send. Most ESPs automatically suppress hard bounces, but you need to make sure that suppression is working. A single send to a rented list can spike your bounce rate enough to trigger filtering for weeks.

Spam trap hits. Spam traps are email addresses used by ISPs and blacklist operators to identify senders with poor list hygiene. They come in two types:
– Pristine traps: addresses that have never opted in to anything. Hitting these means you bought or scraped a list.
– Recycled traps: addresses that were once real but are now reactivated as traps. Hitting these means your list is old and uncleaned.

Volume consistency. Erratic sending patterns — silence for two months then a massive blast — damage reputation. A regular sending cadence signals you are a legitimate operation.

Domain age and sending history. New domains have zero reputation. This is why warmup is required.

Check your reputation:
– Gmail Postmaster Tools — see your Gmail reputation directly
– Microsoft SNDS (Smart Network Data Services) — for Outlook/Hotmail reputation
– Barracuda Reputation System lookup — barracudacentral.org/lookups
– MXToolbox Blacklist Check — checks 100+ blacklists simultaneously

Key takeaway: Sender reputation is built over months and destroyed in days. Protect it like a credit score.

6. List Hygiene: The Practice That Separates Pros from Amateurs

Suppress unengaged subscribers. Define “unengaged” as: no opens or clicks in the last 90-180 days. Create a sunset flow in Klaviyo that sends a re-engagement sequence (3 emails over 2 weeks). Anyone who does not engage goes into a suppressed segment and stops receiving campaigns.

Do not delete them — suppress them. If they visit your site and purchase, you can re-activate them.

Validate emails at point of capture. Use a real-time email validation API (ZeroBounce, NeverBounce, BriteVerify) on your signup forms. This prevents disposable emails, typos, and known spam traps from entering your list in the first place.

Remove role-based addresses. Addresses like info@, admin@, support@, sales@, webmaster@ are shared inboxes or forwarding addresses. They often generate complaints because multiple people see the email. Most ESPs let you filter these automatically.

Run a quarterly list audit. Every 90 days:
1. Export your full list
2. Run it through ZeroBounce or NeverBounce
3. Remove “invalid,” “catch-all” (when scored as risky), “disposable,” and “spam trap” categories
4. Suppress or remove the flagged addresses before your next major send

Double opt-in for new acquisition channels. Whenever you add a new traffic source or lead magnet, use confirmed opt-in. The extra step reduces list size but dramatically improves quality. Klaviyo supports double opt-in flows natively.

Key takeaway: A list of 10,000 engaged subscribers will outperform a list of 100,000 unengaged ones — in revenue and deliverability.

7. Domain Warmup: The Right Way to Start Sending

Warming up a domain means gradually increasing your email volume over 4-8 weeks so ISPs can observe your sending patterns and build a positive reputation file for you before you send at full scale.

Never skip warmup. Sending 50,000 emails on day one from a new domain will get you blacklisted. ISPs see a brand-new domain sending mass email as a major red flag.

Warmup schedule (recommended):

Send to your best subscribers first. During warmup, send only to people who have opened or clicked in the last 30 days. High engagement during warmup teaches ISPs your list is healthy.

Monitor closely during warmup. Check Gmail Postmaster Tools daily. If reputation starts dropping or you start seeing complaints, slow down and investigate before continuing.

Dedicated sending domain vs. root domain. Many email-mature brands use a subdomain for marketing sends (e.g., news.yourbrand.com) so that spam complaints do not affect transactional email deliverability on the root domain. Shopify and Klaviyo both support custom sending domains.

Key takeaway: Warmup is not optional. Think of it as earning the trust of every ISP before you ask them to deliver your mail at scale.

8. Deliverability Monitoring Tools

Gmail Postmaster Tools (free) — The gold standard for Gmail deliverability insight. Shows domain reputation, IP reputation, spam rate, authentication rates, and delivery errors. Connect it using your Google Workspace account.

MXToolbox (free + paid) — Blacklist monitoring, DNS record verification, SMTP diagnostics. The free blacklist check covers 100+ lists and should be run weekly.

GlockApps (paid) — Sends test emails through your ESP and shows where they land (inbox, spam, promotions) across 70+ mailbox providers. Invaluable for pre-send testing.

Mail-Tester.com (free, 3 tests/day) — Paste a test email address, send an email to it, and get a deliverability score out of 10 with detailed diagnostics. Great for quick audits.

ZeroBounce / NeverBounce — Email verification and list cleaning. Integrate via API for real-time validation on signup forms.

Klaviyo’s Deliverability Hub — If you are on Klaviyo, their deliverability hub shows bounce rates, complaint rates, and unsubscribe rates segmented by flow and campaign.

9. Interactive Tool: Email Deliverability Audit Checklist

10. Interactive Tool: Inbox Placement Revenue Calculator

FAQ

Q: How long does it take to recover from a bad sender reputation?
Recovery typically takes 4-12 weeks, depending on how severe the damage is. Start by stopping all sends to unengaged subscribers, fixing authentication, and sending only to your most engaged 10-20% of the list. Rebuild slowly.

Q: Does inbox placement vary by email client?
Yes, significantly. Gmail, Yahoo, Outlook, and Apple Mail all have different filtering algorithms. A message that lands in Gmail’s inbox may go to Outlook’s spam. Use GlockApps or Litmus to test across all major clients before major sends.

Q: Should I use a dedicated IP address?
Dedicated IPs are generally only worth it if you send more than 100,000-200,000 emails per month. Below that threshold, the shared IP pools used by Klaviyo, Mailchimp, and other major ESPs are well-maintained and actually have stronger reputations than a brand-new dedicated IP.

Q: One-click unsubscribe — what is this and is it mandatory?
Since February 2024, Gmail and Yahoo require bulk senders (5,000+ emails/day) to support RFC 8058 one-click unsubscribe. This is a header in the email (not just a link in the body) that lets email clients show an “Unsubscribe” button. Klaviyo and most modern ESPs add this header automatically.

Q: My open rates dropped after the Apple MPP update. Does this affect deliverability?
Apple Mail Privacy Protection (MPP) inflates open rates by pre-fetching images. This means you can no longer use open rate alone as an engagement signal. Switch to click rate as your primary engagement metric for segmentation and sunset flows.

Q: How often should I clean my list?
Run a full verification quarterly. Run a soft purge of non-openers monthly (move to a suppression segment, not delete). Monitor bounce rates after every send.

Q: What is a spam trap and how do I avoid them?
Spam traps are email addresses used by ISPs and anti-spam organisations to identify senders with poor list hygiene. Avoid them by never buying lists, using double opt-in, validating emails at signup, and cleaning your list regularly. If you hit spam traps, your sending reputation will drop fast.

Conclusion

Email deliverability is not a technical problem you solve once — it is an ongoing discipline. The brands that consistently drive 30-40% of their ecommerce revenue from email have built deliverability into their weekly operations: monitoring Postmaster Tools, running sunset flows, validating new signups, and warming new domains properly.

The framework is straightforward: authenticate with SPF, DKIM, and DMARC; protect your reputation by suppressing unengaged subscribers and monitoring complaint rates; verify your list quarterly; and never send a major volume spike without a warmup.

Ready to fix your email deliverability and start recovering revenue from every send? The Ignited Nepal team has helped ecommerce brands across Australia, UK, UAE, and Nepal rebuild their sender reputation and achieve 95%+ inbox placement rates.

Work with Ignited Nepal →

Written by the Ignited Nepal team. ignitednepal.com