Chrome Extension
Login
Get a demo
Sign up for free

Explore AI Summary

ChatGPT
Google AI
Perplexity
Grok
Claude

Email deliverability best practices, starting with your list

Email deliverability best practices thumbnail: deliverability starts with a verified list, then SPF, DKIM and DMARC, then sending

Contents

Email deliverability is decided before you write a word: first by the addresses on your list, then by your domain’s authentication, then by how you send. This guide starts with the list, because dead addresses, catch-alls and spam traps will sink a perfectly configured domain.

Then it covers SPF, DKIM and DMARC, the exact Gmail, Yahoo and Microsoft sender thresholds, warm-up, content, tracking and a pre-send checklist.

What is email deliverability?

Email deliverability is the share of your emails that land in the recipient’s inbox, rather than in spam or bouncing back. Delivery only means the receiving server accepted the message; deliverability is where it ended up. Mailbox providers decide it from three things: who you send to, whether your domain proves it is you, and how recipients react.

The margin is thin even for mail people asked for. Validity’s 2025 benchmark found that “one in six legitimate marketing emails fails to reach the inbox” (83.5% inbox placement in 2024), with Microsoft the hardest major provider at 75.6%. Cold email starts with less trust than opt-in mail, so each step below matters more.

How to improve email deliverability, starting with your list

Improving email deliverability starts with the list because every bad address counts against your domain before anyone reads your email: a hard bounce, a spam-trap hit, a complaint from someone who never belonged on the list.

Email deliverability list funnel: drop guessed and Not found contacts, dead addresses and spam-trap signals, set Risky aside, send Valid from the main domain
Only the bottom of the funnel should ever touch your main sending domain.

1. Verify every address right before it enters a sequence

Verification asks each domain’s mail server whether the mailbox exists, without sending an email. It catches typos, dead domains and people who left the company. Run it right before you load a sequence, not months earlier when the list was built. Here is how to verify an email address without sending, check by check.

2. Keep catch-all emails out of your main campaign

A catch-all domain accepts mail for every address, so no verifier can confirm the mailbox, and some messages bounce days later. In ZeroBounce’s 2025 data, more than 9% of the addresses its customers submitted were catch-all. Give them a separate, smaller campaign: see our guide to catch-all emails.

3. Keep spam traps out by fixing the source

A spam trap is an address that exists to expose senders who add people to lists without permission. Spamhaus describes several kinds, including pristine traps no person ever used, typo traps at misspelled domains, and dead addresses that hard-bounced for a long time (often 12 months or more) before being turned back on as traps.

Traps look like real inboxes, so verification cannot catch them all. The fix is sourcing: never mail an old or bought list, and drop contacts who have never engaged. Spamhaus asks senders to treat traps “as proof of a data collection or hygiene issue”.

4. Re-verify data that has gone stale

Contact data decays because people change jobs. About 1 in 5 US workers had been with their employer for a year or less in January 2026 (BLS). ZeroBounce reports that at least 23% of email lists degrade within a year, based on 11 billion addresses it checked in 2025.

If a list has sat in your CRM since its last campaign, check it again. More on how fast B2B data decays.

5. Remove hard bounces the same day

A hard bounce is a permanent failure: the mailbox or the domain does not exist. Remove it from every list and sequence the day it arrives. Read the code first, because a 5.7.x code is a block against you, not a dead address (hard bounce vs soft bounce).

For scale: Hunter’s data from 31 million emails sent by its users in 2025 puts the average cold email bounce rate at 3.6%, and Instantly’s 2026 benchmark report advises staying under 2%. Track yours per campaign with our email bounce rate guide.

What to do with Valid, Risky and Not found emails

Scalelist labels every email it returns Valid or Risky, and marks a contact Not found when no address turns up. Each status has one job.

Decision tree for verified emails: Valid goes to the main sequence, Risky catch-all emails to a separate batch or a call, Not found contacts get a call, never a guessed address
The mistake that hurts domains most is not Risky emails: it is sending them, or guesses, from the main domain.
  • Valid: the mail server confirmed the mailbox. Load it into your main sequence, on your main domain.
  • Risky: found, but the domain is catch-all, so the mailbox cannot be confirmed. Scalelist’s help center estimates that about 20 to 30% of Risky emails are deliverable and recommends sending them from a secondary domain. Send small batches, check for late bounces, and call the contacts that matter most.
  • Not found: no email turned up. Do not fill the gap with a guessed first.last@ address: an unverified guess is exactly how hard bounces get in. Call the person instead, or leave them out.

Keep the status in its own CRM field so nobody merges Risky contacts back in. Full definitions: email verification statuses explained.

Authenticate your domain: SPF, DKIM, DMARC and one-click unsubscribe

Email authentication proves to the receiving server that your domain sent the message and that nobody changed it on the way. Gmail requires every sender to use SPF or DKIM, and senders of more than 5,000 messages a day to use SPF, DKIM and DMARC.

SPF, DKIM and DMARC authentication flow: SPF checks the sending server, DKIM checks the signature, DMARC checks From alignment and applies the policy
SPF and DKIM prove who sent the email; DMARC ties them to the From address your recipient actually sees.

SPF: which servers may send for you

SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send mail for your domain. Publish one SPF record per domain, and watch the lookup limit: RFC 7208 caps DNS-querying terms such as include: at 10, and a record over the limit fails with a permanent error.

DKIM: a signature that proves nothing changed

DKIM (DomainKeys Identified Mail, RFC 6376) adds a cryptographic signature to each message. The receiving server checks it against a public key published in your DNS. Turn it on in every tool that sends as your domain: your mailbox provider and your sequencer.

DMARC: the policy that ties them together

DMARC passes when SPF or DKIM passes for a domain aligned with the visible From address. Its policy (p=) tells receivers what to do when a message fails: none, quarantine or reject. Gmail and Yahoo accept p=none from bulk senders, so start there, read the reports, then tighten. DMARC is now defined in RFC 9989 (May 2026), which replaced RFC 7489.

DNS records for a domain that sends from Google Workspace (example)
SPF, a TXT record at northwindfab.com:
v=spf1 include:_spf.google.com ~all

DKIM, a TXT record at <selector>._domainkey.northwindfab.com:
v=DKIM1; k=rsa; p=<public key from your provider>

DMARC, a TXT record at _dmarc.northwindfab.com:
v=DMARC1; p=none; rua=mailto:dmarc@northwindfab.com

The SPF line is Google’s record for domains that send only through Google Workspace. Each other tool that sends as you adds an include:, so count your lookups.

To see these records the way a receiving server does, MailSenpai’s free email DNS checker reads your SPF, DKIM and DMARC records and reports what Gmail and Outlook see.

One-click unsubscribe

Gmail requires one-click unsubscribe on marketing and subscribed messages from bulk senders, and Yahoo requires it from bulk senders. It works through two headers from RFC 8058: List-Unsubscribe with a URL, and List-Unsubscribe-Post: List-Unsubscribe=One-Click, both covered by your DKIM signature. If your sequencer supports it, turn it on and check the raw headers of a test email.

US law adds its own floor. The CAN-SPAM Act makes no exception for B2B email: commercial messages need a clear opt-out honored within 10 business days and a valid physical postal address (FTC). This is not legal advice.

Gmail, Yahoo and Microsoft sender rules

Gmail, Yahoo and Microsoft Outlook.com all require authentication from high-volume senders, and Gmail and Yahoo add spam-rate and unsubscribe rules. Here are the thresholds as each provider publishes them.

Table of Gmail, Yahoo and Outlook.com sender requirements: 5,000 a day thresholds, SPF, DKIM, DMARC, one-click unsubscribe, spam rate below 0.10% or 0.3%
All three demand SPF, DKIM and DMARC from high-volume senders; only Gmail and Yahoo publish a spam-rate line.
  • Gmail: the extra rules apply above 5,000 messages a day to personal Gmail accounts. All mail from the same primary domain counts toward that number, subdomains included, and once you cross it you are a bulk sender permanently. Since November 2025, Gmail has been ramping up enforcement, with temporary and permanent rejections for non-compliant mail.
  • Yahoo: every sender must keep spam rates below 0.3% and use SPF or DKIM. Yahoo does not publish a volume threshold for bulk senders.
  • Microsoft: since May 5, 2025, Outlook.com rejects mail from domains sending more than 5,000 emails a day that do not pass SPF and DKIM and publish DMARC, with the code 550 5.7.515.

These rules cover personal inboxes. Google’s FAQ says its guidelines do not apply to messages sent to Google Workspace accounts, and Microsoft’s cover consumer Outlook.com, not Microsoft 365 business tenants. Company inboxes still pass through each provider’s spam protection, so treat the rules as your minimum.

Sending volume and domain warm-up

Mailbox providers trust senders whose volume grows slowly and stays steady. Google’s guidance is to “send email at a consistent rate” and to “start with a low sending volume to engaged users, and slowly increase the volume over time”. If messages start bouncing or being deferred, Google says to reduce volume until errors drop, then increase slowly again.

  • Warm up new domains. Instantly’s 2026 benchmark report recommends starting new domains at 5 to 10 emails a day and warming them over 4 to 6 weeks. That is a vendor recommendation, not a measured result.
  • Spread sends across the day. Set daily caps and sending windows per mailbox in your sequencer (how sales engagement platforms compare).
  • Use a separate domain for Risky emails. A secondary registered domain keeps catch-all sends off your main one. A subdomain is different: Google counts its mail toward the primary domain’s 5,000-a-day total.
  • Know your IP. Google notes that on a shared IP, “the activity of any senders” affects the reputation of all of them.

Email content that stays out of spam

Content matters less than the list and the domain, but it can still push a message into spam. Google’s guidelines cover the basics: links should be “visible and easy to understand”, HTML should follow standards, and hidden content “might cause messages to be marked as spam”.

  • Write short, plain emails. Instantly’s 2026 report says its elite senders keep first-touch emails under 80 words.
  • One visible link, no attachments. Our rule for a first email: link to a page on your own domain, never a shortened URL, and share files later.
  • Send from your company domain. In Hunter’s 2025 data, emails from custom domains got a 5.2% reply rate versus 2.5% from free webmail.
  • Question open tracking. Hunter also found 7.4% replies on campaigns without open tracking versus 4.4% with it. That is a correlation in one vendor’s data, not proof of cause.

Relevance does the rest, because replies tell mailbox providers your email is wanted. Start from our sales email templates and personalize at scale with real account facts.

For ecommerce brands on Shopify, improving email deliverability also means aligning your sending setup with your store’s post-purchase flows, because a misconfigured transactional sequence can spike complaint rates fast.

How to track email deliverability

Track deliverability with the mailbox-provider tools that apply to you, plus your own campaign numbers, the only view that covers company inboxes.

Four places to track email deliverability: Google Postmaster Tools, Microsoft SNDS and JMRP, Yahoo Complaint Feedback Loop, and your own campaign numbers
Provider tools cover personal inboxes; for B2B lists, your own bounce and reply data by list source matters most.
  • Google Postmaster Tools shows compliance status, spam rate, authentication, encryption and delivery errors for mail sent to personal Gmail accounts, once you verify your domain. Google is retiring the Domain and IP Reputation dashboards in the new version, and data can be missing on low-volume days.
  • Microsoft SNDS gives data on IP addresses you are responsible for, and its Junk Mail Reporting Program sends a report when Outlook.com users mark your email as junk. It helps only if you control your sending IPs.
  • Yahoo’s Complaint Feedback Loop sends a report each time a Yahoo user marks your email as spam, so you can suppress that person. It is domain-based and requires DKIM signing.
  • Your own numbers: hard bounces, replies and unsubscribes per campaign and per list source. A spike in one segment points to its source list.

Example: a pre-send check on 500 contacts

Maya Torres, SDR lead at Brightline HVAC Supply in Columbus, Ohio, is about to load 500 facilities managers into her sequencer. Before she does, she splits the list by status.

Group Where it goes Why
Valid Main sequence, main domain, daily cap per mailbox Confirmed mailboxes protect the domain
Risky Separate campaign on a warmed secondary domain, batches of about 50 Catch-alls can bounce days later
Not found Call list, mobiles first No guessed address enters a sequence

Then she sends a test to her own Gmail account, opens the original message and confirms that SPF, DKIM and DMARC pass and that both unsubscribe headers are there. She checks the compliance status in Postmaster Tools. Only then does the first step go out.

Common email deliverability problems and fixes

Four problems come up again and again, even on well-run programs.

Postmaster Tools shows no data

Postmaster Tools only counts mail to personal Gmail accounts, and can skip low-volume days. A B2B team emailing company domains may see little. Fix: rely on your own bounce, reply and unsubscribe numbers per campaign, and use Postmaster Tools for its compliance status.

Your SPF record broke after you added a tool

Each include: adds DNS lookups. Past 10, SPF fails with a permanent error on every message. Fix: remove tools you no longer use, and test the record after every change.

Blocks after a volume jump

A 5.7.x bounce means the server refused you, not that the address is dead. Fix: cut volume, check authentication, keep the contacts, and ramp back up slowly.

Replies dropped, but nothing bounced

Your email may be landing in spam. Fix: send tests to inboxes you control at Gmail and Outlook.com, check the folder, then review your latest list source and content change.

Email deliverability checklist

Run this checklist before every new campaign and after any change to your sending setup.

Email deliverability checklist of 12 items: verify, split statuses, remove hard bounces, SPF DKIM DMARC, one-click unsubscribe, steady volume, spam rate below 0.10%
Four list checks, four domain checks, four sending checks: if one fails, fix it before the first step goes out.

What to look for in an email verification tool

The tool that checks your list decides what reaches your domain. Look for:

  • Separate statuses for confirmed mailboxes and catch-alls, not a single pass or fail.
  • Checks for syntax, domain, MX records, the mailbox itself, catch-all, disposable domains and spam-trap signals.
  • Verification at the moment an email is found, plus bulk checks for lists you already have.
  • A status column you can export to your sequencer or CRM.
  • No charge for contacts where nothing is found.

How Scalelist helps you send to a clean list

Scalelist, an AI Lead Finder, verifies every email before it returns it and labels it Valid or Risky. It finds and verifies contact details on demand rather than serving a pre-compiled list.

  • Lists you already have: the Scalelist Email Verifier checks syntax, domain, MX, mailbox, catch-all, disposable and spam-trap signals. Verification is included in every plan.
  • New lists: describe your buyer in one sentence in Scalelist Lead Finder and get people with verified emails and mobile numbers: 1 credit per lead found, 1 per email found (Valid or Risky), 20 per mobile found, 0 when nothing is found.
  • Clean handoff: push selected leads to HubSpot, with a Push Valid Emails Only option, or send them to lemlist, Instantly, Smartlead, Woodpecker or Saleshandy.
  • Risky or Not found: reach the person by phone with the Scalelist Mobile Finder, 20 credits per mobile found.

New accounts get 20 free credits, no credit card required. Plans start at 29 USD a month for 500 credits (Scalelist pricing).

Build a list where every email is labeled Valid or Risky before it reaches your sequencer.

Get 20 credits to test it

FAQ

What is email deliverability?

Email deliverability is the share of your emails that land in the recipient’s inbox instead of the spam folder or bouncing back. It depends on your list (dead addresses, catch-alls, spam traps), your domain’s authentication (SPF, DKIM and DMARC) and how recipients react. Validity measured 83.5% inbox placement for legitimate marketing email in 2024.

How do I improve email deliverability quickly?

Start with the list. Verify every address right before sending, remove hard bounces, and move Risky (catch-all) emails to a separate campaign on a secondary domain. Then confirm that SPF, DKIM and DMARC pass, add one-click unsubscribe, and lower your daily volume until bounces and spam complaints come back down.

What is the difference between delivery and deliverability?

Delivery means the receiving server accepted your email instead of bouncing it. Deliverability is where the accepted email ends up: the inbox or the spam folder. A campaign can show a high delivery rate while many messages sit in spam, so watch replies, not sends.

Do Gmail’s sender rules apply to B2B cold email?

Only partly. Google’s published rules cover mail sent to personal Gmail accounts, and its FAQ says they do not apply to messages sent to Google Workspace accounts. Company inboxes on Google Workspace still pass through Google’s spam protection, so meet the rules anyway: SPF, DKIM, DMARC, one-click unsubscribe and a low spam rate.

What spam complaint rate is too high?

Anything above 0.10% at Gmail. Google tells senders to keep the spam rate shown in Postmaster Tools below 0.10% and never reach 0.30%. Its FAQ says rates above 0.1% already hurt inbox delivery, and bulk senders above 0.3% lose eligibility for mitigation. Yahoo requires every sender to stay below 0.3%.

Should I send Risky emails?

Yes, carefully, and never from your main domain. Risky means the domain is catch-all, so the mailbox cannot be confirmed. Scalelist’s help center estimates about 20 to 30% of Risky emails are deliverable and recommends a secondary domain. Send small batches, check for late bounces, and call the contacts that matter most.

Sources

Arnaud Renoux

Co-Founder at Scalelist