DNS and authentication
Start here, because nothing below matters if this is wrong. A receiving server decides whether to accept your mail before it looks at a word of it, and the first thing it checks is whether the domain in the From line authorised the send. Get these records right once and they keep working; get them wrong and every other improvement is applied to mail nobody reads.
- SPF published once, ending in -all or ~all, under 10 DNS lookups.
- DKIM signing with a 2048-bit key, aligned to your From domain.
- DMARC at p=none or stricter, with a rua address you actually read.
- Send from a subdomain (mail.yourdomain.com) so your company mail's reputation is separate.
List hygiene
Sending to addresses that do not exist is the fastest way to lose a reputation. Receiving servers read a high bounce rate as a sign you either bought the list or are not paying attention, and both get treated the same. The fix is unglamorous: stop sending to addresses that have already failed.
- Suppress hard bounces immediately - never retry an address that doesn't exist.
- Suppress spam complaints immediately and permanently.
- Keep the complaint rate below 0.3%; Gmail's guidance is below 0.1%.
- Never buy or scrape lists; confirm sign-ups with a verification email.
Message content
Content matters less than most advice suggests, and in a narrower way. Filters are not grading your prose - they are looking for the shape of mail that recipients have previously complained about. A transactional message with a clear purpose, a real reply-to and a link to a domain that matches the sender rarely has a content problem.
- Include a plain-text part alongside HTML.
- A From name and address people recognise, and a Reply-To that reaches a person.
- Subjects that describe the email - not all caps, not misleading.
- One-click List-Unsubscribe on marketing mail (required by Gmail and Yahoo for bulk senders).
Monitoring
Deliverability is not a setting you get right once. Reputation moves with what you send and how people react to it, so the useful question is not whether you are set up correctly but whether something changed this week.
- Watch bounce and complaint rates in your delivery logs.
- Read DMARC aggregate reports to spot services sending as you without authentication.
Sendpository handles several of these by default: suppression on bounces and complaints, 2048-bit aligned DKIM, one-click unsubscribe headers, and daily DNS re-checks.