The Email Deliverability Checklist: Beyond SPF, DKIM, and DMARC

Setting up SPF, DKIM, and DMARC is the part of email deliverability everyone knows about, and most domains have at least partially done it. It is also where most people stop, which is why mail from a "correctly configured" domain can still land in spam. The records are necessary but not sufficient; beyond them sits a second layer of reputation, volume, content, and ongoing monitoring that decides whether a mailbox provider trusts the next message you send.

Authentication: the baseline, done properly

SPF authorizes sending IPs, DKIM signs message content with a private key, and DMARC ties the two together and tells receivers what to do when alignment fails. The records are the price of entry, and they have to be correct, not merely present.

• SPF should end in a hard fail once you are confident every legitimate sender is listed. A record ending in soft fail, or worse, an explicit "allow all," is a weak signal receivers discount.
• DKIM should sign with at least a 1024-bit key, ideally 2048, and the signing domain should align with the visible From domain for DMARC to pass.
• SPF has a hard limit of 10 DNS lookups. Count every include:, a, mx, and exists: mechanism; exceed 10 and SPF evaluation fails entirely, for everyone, including legitimate mail.

You can verify all three records against a live domain in seconds. The SPF lookup, DKIM lookup, and DMARC lookup tools each pull the relevant DNS records directly.

DMARC: from monitoring to enforcement

A DMARC record set to a monitoring policy is a monitor, not an enforcement policy. It tells receivers to keep doing whatever they were doing and send you reports, which is useful for the first few weeks but does nothing to stop spoofing. Enforcement begins at quarantine and gets serious at reject.

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; ruf=mailto:forensics@example.com; pct=100; adkim=s; aspf=s"

The fields worth knowing: p is the policy for the organizational domain, pct is the percentage of mail the policy applies to, rua is where aggregate reports go, ruf is where forensic samples go, and adkim and aspf set alignment to strict. A sensible rollout is to start with p=none and pct=100, read the aggregate reports for a few weeks to confirm nothing legitimate is failing authentication, move to p=quarantine at a low percentage, then raise the percentage, then switch to p=reject.

The aggregate reports are the part most people skip and should not. They arrive as gzipped XML attachments and list every sender, by IP, SPF result, and DKIM result, that claimed to be your domain. Reading them is how you discover the marketing tool you forgot to add to SPF, or the legacy server still sending from an IP you decommissioned.

Try it: DMARC Lookup

Look up and analyze a domain's DMARC policy and reporting configuration.

Reputation, volume, and warm-up

Authentication proves the message is genuinely from you. Reputation is whether the receiver wants mail from you at all. Reputation is built on the recent history of your sending domain and IP, and it moves slowly.

• Volume should ramp gradually. A brand-new IP that suddenly sends fifty thousand messages looks like a spammer; the same IP that warms up over a few weeks looks like a legitimate sender.
• Complaints, the "this is spam" button, hurt more than almost anything else. Keep them well under one in a thousand messages.
• Bounces should be handled. Remove hard bounces immediately and retry soft bounces on a sane schedule. Sending repeatedly to an address that already returned a hard bounce is a strong negative signal.
• Engagement matters at the large providers. Mail that gets opened and read is treated better than mail that gets ignored, which is why list quality beats list size.

If your sending infrastructure is shared, a marketing platform with many customers on one IP, you are affected by your neighbors. A dedicated IP costs more but removes that variable entirely.

Content and list hygiene

Filters read the message body too. The fastest way to land in spam after authentication is to send to a list you bought. Purchased and scraped lists produce high bounce and complaint rates that destroy reputation in a single send, and they are the most common cause of a sudden deliverability collapse.

The durable rules are not novel, which is the point: only send to people who asked, make unsubscribe one click and honor it immediately, keep the text-to-image ratio reasonable (an image-only email looks like spam to a filter), avoid spam-trigger phrases in the subject line, and set up List-Unsubscribe headers so the inbox's native unsubscribe works. Deliverability rewards the boring fundamentals done consistently across every send, not a clever trick applied once.