The Complete Email Deliverability Course

Every email passes through a chain of specialized servers before reaching its destination.

The email journey: MUA → MSA → MTA → MTA → MDA → MUA

Component	What it does	Port
MUA (Mail User Agent)	Your email client (Gmail, Outlook, Thunderbird)	—
MSA (Mail Submission Agent)	Accepts mail, requires authentication	587
MTA (Mail Transfer Agent)	Routes mail between servers via DNS MX lookups	25
MDA (Mail Delivery Agent)	Places message in recipient's mailbox	—

Three ports every pro must know:

• Port 25 — Server-to-server relay (increasingly blocked for residential IPs)
• Port 587 — Standard submission port with STARTTLS
• Port 465 — Implicit TLS (encrypted from the first byte)

STARTTLS vs. Implicit TLS: STARTTLS is opportunistic — a man-in-the-middle can strip the TLS upgrade. Implicit TLS on port 465 starts encrypted and stays encrypted. This vulnerability is exactly what MTA-STS was designed to address.

When an MTA needs to deliver mail to user@example.com, it queries DNS for MX records.

How MX priority works:

• Lower numbers = higher priority
• 10 mail1.example.com is tried before 20 mail2.example.com
• If no MX record exists, the MTA falls back to the domain's A record (RFC 5321)

Each MX hostname is resolved to an IP via A/AAAA records. The MTA attempts delivery to the highest priority server first, falling back to secondary servers if needed.

Understanding headers is key to diagnosing deliverability issues.

Header	Purpose
From	Visible sender address; used in DMARC alignment
Return-Path	Envelope sender; used for SPF alignment and bounces
Reply-To	Where replies go (can differ from From)
Message-ID	Unique identifier for threading
Received	Trace route — read bottom-to-top
Authentication-Results	SPF, DKIM, DMARC pass/fail results
DKIM-Signature	Cryptographic signature details
List-Unsubscribe	Unsubscribe URIs (required for bulk senders)

⚠️ Key insight: The Return-Path (used for SPF) and the From header (used for DMARC alignment) are often different domains. This is the #1 source of authentication confusion.

Hard bounces (5xx) are permanent failures. Remove immediately after one occurrence.

Code	Meaning
550 5.1.1	Mailbox does not exist
550 5.1.2	Domain doesn't exist
553	Mailbox name not allowed
554	Transaction failed

Soft bounces (4xx) are temporary. MTAs auto-retry with exponential backoff.

Code	Meaning
421	Try again later (rate limiting)
450	Mailbox temporarily unavailable
451	Greylisting / local error
452	Insufficient storage

🎯 Target: Keep bounce rates below 2% across all sends.

Feedback Loops (FBLs): Let you know when recipients click "Report Spam."

• Microsoft JMRP — Register via SNDS portal
• Yahoo CFL — Domain-based, requires DKIM
• Gmail — No traditional FBL; use Postmaster Tools instead

SPF authenticates the envelope sender by checking if the sending IP is authorized in DNS.

Every SPF record must begin with v=spf1.

Mechanisms and DNS lookup impact:

Mechanism	Counts toward 10-lookup limit?
ip4 / ip6	❌ No
a	✅ Yes
mx	✅ Yes
include	✅ Yes
exists	✅ Yes
redirect	✅ Yes
all	❌ No

The 10 DNS lookup limit is the most common SPF misconfiguration. Exceeding it returns PermError, which DMARC treats as a fail.

Common SPF mistakes:

• ❌ Multiple SPF records on one domain (causes PermError)
• ❌ Using +all or ?all (authorizes everyone)
• ❌ Stale include statements for old services
• ❌ Not ending with -all or ~all

DKIM uses public-key cryptography to verify messages haven't been altered and are associated with the signing domain.

Key sizes: RFC 8301 recommends 2048-bit RSA as the standard. Ed25519 exists but major providers don't verify it yet.

The DKIM-Signature header contains:

• d= — Signing domain (used for DMARC alignment)
• s= — Selector name
• c= — Canonicalization (use relaxed/relaxed)
• h= — Signed headers (must include from)
• bh= — Body hash
• b= — Signature

Key rotation: Every 6–12 months. Publish the new key while keeping the old one active for 1–2 weeks.

Common DKIM failures:

• Selector-DNS mismatch
• Body modification by mailing lists
• 2048-bit keys exceeding DNS string limits
• Missing from in the h= tag

DMARC adds alignment checking — verifying that SPF or DKIM domains match the visible From header — plus a policy for failures.

DMARC deployment roadmap:

Phase	Policy	Duration
1. Monitor	p=none; rua=mailto:...	2–4 weeks
2. Fix	p=none continues	2–8 weeks
3. Soft quarantine	p=quarantine; pct=10	2–4 weeks
4. Ramp	p=quarantine; pct=25→100	4–8 weeks
5. Soft reject	p=reject; pct=10	2–4 weeks
6. Full reject	p=reject; pct=100	Ongoing

Relaxed vs. strict alignment: Relaxed allows subdomain matching (recommended). Strict requires exact domain match.

The total journey typically takes 3–6 months for mid-size organizations.

BIMI displays your brand logo next to emails in supporting clients.

Two certificate types:

• VMC (Verified Mark Certificate) — Requires registered trademark, ~$1,500+/year, shows blue checkmark in Gmail
• CMC (Common Mark Certificate) — No trademark needed, ~$700-1,200/year, logo without checkmark

Provider support (2025-2026):

• ✅ Gmail (VMC or CMC required)
• ✅ Yahoo Mail (self-asserted, no certificate needed)
• ✅ Apple Mail (VMC required)
• ✅ Fastmail (self-asserted)
• ❌ Microsoft Outlook (not supported)

Prerequisite: DMARC at p=quarantine (pct=100) or p=reject.

SVG requirements: Tiny Portable/Secure format, square, max 32KB, no scripts or animations.

Use shared IP when:

• Sending < 100,000 emails/month
• Sending irregularly or just starting out
• No warmup needed, benefit from ESP's pool

Use dedicated IP when:

• Sending > 100,000-250,000 emails/month consistently
• Need full control over reputation
• Must warm over 2-4 weeks

⚠️ If you go 30+ days without sending, reputation data is lost and you'll need to re-warm.

Day-by-day warming schedule:

Period	Daily Volume	Audience
Days 1–3	50–200	Most engaged (opened in last 30 days)
Days 4–7	200–5,000	Expand within 30-day engaged
Days 8–14	5,000–40,000	Add 60-day engaged
Days 15–21	40,000–500,000	Add 90-day engaged
Days 22–30+	Full volume	Maintain consistency

Critical rules:

• 🟢 Start with transactional email (highest engagement)
• 🟢 Don't skip days — consistency is key
• 🟢 Spread sends across the day
• 🔴 If bounces exceed 3-5%, hold or reduce volume

In 2025-2026, domain reputation is the primary filtering signal for Gmail.

Why domain reputation matters more:

• Domains are harder to swap than IPs
• Tied to brand identity
• Follows you across ESP changes
• IP reputation does NOT transfer

Three domains evaluated independently:

1. From address domain
2. DKIM signing domain
3. URL domains in email body

Microsoft is the exception — still weighs IP reputation heavily. A reputation problem at Outlook but not Gmail is likely IP-related.

Recovery timelines:

• IP reputation: 2-4 weeks
• Domain reputation: 6-12 weeks 😬

Google Postmaster Tools V2 (Oct 2025):

• Replaced "High/Medium/Low/Bad" with binary Compliance Status
• Shows Pass/Fail for each requirement
• Spam Rate graph with 0.10% and 0.30% thresholds

Microsoft SNDS: Traffic-light system per IP:

• 🟢 Green: <10% flagged
• 🟡 Yellow: 10-90% flagged
• 🔴 Red: >90% flagged

Key Blocklists:

• Spamhaus — Most impactful, protects 3+ billion mailboxes
  • SBL (spam IPs), XBL (compromised), PBL (policy), DBL (domains)
• Barracuda BRBL — Smaller ISPs and enterprises
• SURBL / URIBL — URL/domain blocklists in email content

🎯 Cardinal rule: Fix the root cause BEFORE requesting delisting.

Gmail blocks 99.9% of spam — nearly 15 billion messages daily — using multi-layered ML including LLM-based semantic analysis.

Engagement signals Gmail tracks:

✅ Positive signals:

• Replies (the MOST powerful — 2-3% reply rate > 40% open rate with no replies)
• Opens, clicks, forwards
• Time spent reading
• Moving from Promotions to Primary
• "Not Spam" markings

❌ Negative signals:

• Spam reports (most damaging)
• Deletions without reading
• "Mark as read" without opening
• Ignored/unread emails

⚠️ Since November 2025, Gmail issues permanent 550 rejections for non-compliant bulk senders. No more second chances.

The Promotions tab is NOT spam — emails there still drive significant engagement.

Microsoft/Outlook:

• Replaced SmartScreen with Exchange Online Protection (EOP)
• Weighs IP reputation more heavily than domain reputation
• New senders face "presumed guilty" default
• Since May 2025: rejects non-compliant bulk with 550 5.7.515
• Focused Inbox ≠ spam filtering (predicts interest, not spam)

Yahoo/AOL (shared infrastructure):

• Evaluates authentication, reputation, engagement, content, complaints
• No whitelisting program — inbox placement can't be guaranteed
• Same thresholds: <0.1% complaint rate recommended, >0.3% triggers restrictions

"Spam trigger words" are mostly a myth in 2025:

• Modern ML evaluates context, not keywords
• Character tricks ("fr33", "M4ke M0ney") are now RED FLAGS
• What matters: sender reputation + authentication + engagement

The 2025-2026 inbox placement hierarchy (ranked):

1. 🏆 Sender reputation (domain + IP) — the dominant factor
2. 🔐 Authentication (SPF, DKIM, DMARC) — unauthenticated = 30-50% inbox vs 85-95%
3. 📊 Spam complaint rate — must stay below 0.1% (max 0.3%)
4. 💡 Engagement metrics — opens, clicks, replies, forwards
5. 📉 Bounce rate — keep below 1-2%
6. ✉️ List quality — spam trap avoidance, valid addresses
7. 📆 Sending consistency — regular cadence, no sporadic spikes
8. 📝 Content quality — evaluated holistically, not by keywords

Double Opt-In (DOI):

• Subscriber clicks confirmation link after signup
• Eliminates typos, bots, fake addresses
• Produces higher-quality lists
• 20-30% drop-off at confirmation step
• Effectively required in Germany, strongly recommended for GDPR

Single Opt-In (SOI):

• Adds subscribers immediately
• Faster growth, but higher risk of invalid addresses
• CAN-SPAM (US) allows opt-out model with no prior consent

🍯 Pristine (Honeypot) Traps:

• Fake addresses that never belonged to real people
• Created by ISPs and blocklist operators
• Impact: Immediate blocklisting
• Avoidance: Never purchase or scrape email lists

♻️ Recycled Traps:

• Abandoned addresses reactivated after 12+ months
• Key insight: The address hard bounces before becoming a trap
• If you removed bounces promptly, you'd never hit one

⌨️ Typo Traps:

• Common misspellings: gmial.com, yaho.com, hotnail.com, .con
• Avoidance: Real-time validation, autocomplete suggestions, DOI

Sunset policy timeline:

Inactivity	Action
30-60 days	Move to "at-risk" segment; reduce frequency
60-90 days	Trigger re-engagement campaign
90-120 days	Final "last chance" email
120-180 days	Suppress from marketing
180+ days	Remove from active list entirely

Re-engagement sequence:

1. Day 0 — "We miss you" with emotional appeal
2. Day 7 — Value-based offer (exclusive content/discount)
3. Day 14 — Preference update (frequency/topic options)
4. Day 21 — Final warning: "Last email unless you confirm"
5. Day 28+ — No engagement? Remove immediately.

⚠️ Account for Apple Mail Privacy Protection — define "inactive" as no opens AND no clicks.

Segmentation directly improves domain reputation because ISPs see consistently high interaction rates.

Tier	Criteria	Strategy
🏆 VIP	Opened/clicked within 30 days	Full frequency; first during warmup
✅ Engaged	Activity within 30-60 days	Standard frequency
⚠️ Moderate	Activity within 60-90 days	Reduced frequency; test variations
🔶 At-Risk	No engagement 90-120 days	Re-engagement campaigns only
🔴 Inactive	No engagement 120-180+ days	Sunset/suppress

Separating transactional and marketing email onto different subdomains provides reputation isolation.

Recommended structure:

• trans.example.com → Order confirmations, password resets
• news.example.com → Marketing newsletters
• example.com (parent) → Corporate communications only

Each subdomain needs its own SPF, DKIM, and DMARC configuration.

⚠️ Note: Reputation can still "leak" between subdomains sharing a parent domain, but isolation significantly reduces cross-contamination.

Proactive throttling means deliberately capping send rates to stay within ISP limits.

Best practices:

• 📊 Segment sends by receiving domain
• 📦 Split databases into batches
• ⚙️ Use MTA-level controls (messages/minute)
• 📆 Maintain consistent daily volume

Watch for 421 soft bounces — ISPs explicitly asking you to slow down.

Gmail prefers consistent, predictable volume. Microsoft treats outlook.com, hotmail.com, and msn.com as the same servers.

🔴 Avoid: Alternating between massive sends and silence.

Key rules for cross-client compatibility:

• 📐 Use table-based layouts (flexbox/grid aren't reliable)
• 🎨 Apply inline CSS (many clients strip <style> blocks)
• 📏 Keep total size under 102KB (Gmail clips larger messages)
• 📝 Include plain text alternatives via MIME multipart

Gmail clips messages exceeding 102KB with a "View entire message" link, which breaks tracking and CTAs.

Some spam filters penalize HTML-only messages — always include a meaningful plain text version.

Link best practices:

• ❌ Never use generic URL shorteners (bit.ly, tinyurl.com)
• ✅ Use branded tracking domains through your ESP
• 🔗 Limit redirect chains — multiple hops look suspicious
• 📊 Keep total links reasonable (20+ faces scrutiny)

One-click unsubscribe (RFC 8058) — Required since June 2024 for bulk senders:

List-Unsubscribe: <https://example.com/unsubscribe?token=ID>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

• Process unsubscribe requests within 2 days
• Applies to marketing emails only (transactional exempt)
• Must have valid DKIM signature covering both headers

CAN-SPAM (United States) — Opt-out law:

• No false headers or deceptive subject lines
• Identify as an ad, include physical address
• Honor opt-outs within 10 business days
• Penalties: up to $51,744-$53,088 per email

GDPR (European Union) — Consent-based:

• Consent must be freely given, specific, informed
• No pre-ticked boxes
• Penalties: €20 million or 4% of global turnover
• Largest email fine: TIM (Italy) at €27.8 million

CASL (Canada) — Among world's strictest:

• Express consent: explicit opt-in, permanent until withdrawn
• Implied consent: limited to 2 years (business) / 6 months (inquiry)
• Penalties: $10 million per violation

🌍 Global strategy: Comply with the strictest applicable law (usually GDPR or CASL).

What consent records must contain for audit-proof compliance:

• ⏰ Exact timestamp (UTC)
• 🌐 IP address
• 📋 Source/method (form URL, channel)
• 📝 Exact consent language shown
• ✅ Consent type and version
• 🔄 DOI confirmation timestamp + IP
• 🎛️ Preference selections
• ❌ Withdrawal records

CASL requires records for 3 years after the relationship ends.

UK PECR has a soft opt-in exception for existing customers if:

• Details collected during a sale
• Marketing relates to similar products
• Clear opt-out was offered at collection
• Every email includes easy opt-out

The most important distinction in deliverability:

• Delivery rate = Any successful delivery (including spam folder)
• Inbox placement rate (IPR) = Only messages reaching the actual inbox

An email "delivered" to spam still counts as delivered by your ESP. The gap between these two reveals problems invisible to standard reporting.

Measuring IPR requires seed list testing tools like Validity Everest or GlockApps.

📊 Key insight: A 98% "delivery rate" means nothing if 30% of those deliveries land in spam.

Launched September 2021 with iOS 15, Apple MPP pre-fetches all tracking pixels through proxy servers regardless of whether the recipient opens the email.

What MPP broke:

• ❌ Open rates (nearly doubled post-MPP)
• ❌ Click-to-open rates
• ❌ Open-based automations
• ❌ Send-time optimization based on opens
• ❌ Location-based personalization

What still works:

• ✅ Click-through rates
• ✅ Reply rates
• ✅ Conversions
• ✅ Unsubscribes
• ✅ Bounce rates & spam complaints

Apple Mail accounts for ~49% of all email opens — the impact is massive.

🎯 Action: Shift to click-based metrics as your primary engagement indicator.

Google Postmaster Tools V2 (Oct 2025):

1. Sign in at gmail.com/postmaster
2. Add domain (DKIM d= or SPF Return-Path domain)
3. Verify via DNS TXT record
4. Allow 48 hours for data

Compliance Status dashboard shows Pass/Fail for: SPF, DKIM, DMARC, From alignment, TLS, one-click unsubscribe, spam rate

Microsoft SNDS:

1. Portal: sendersupport.olc.protection.outlook.com
2. Enter sending IPs, verify via WHOIS
3. View per-IP per-day data: 🟢🟡🔴 filter results
4. Requires 100+ messages/day
5. Covers consumer mailboxes only, not M365 business
6. Data retained for 90 days

When inbox placement drops, follow this sequence:

1. 🔐 Check authentication — Verify SPF, DKIM, DMARC pass rates
2. ⭐ Check reputation — GPT compliance, SNDS, Sender Score
3. 🚫 Check blocklists — Spamhaus, Barracuda, SpamCop via MXToolbox
4. 📝 Check content — Text-to-image ratio, link reputation, HTML structure
5. 📋 Check list quality — Bounce spikes, spam traps, complaint increases
6. 📊 Check sending patterns — Volume spikes, gaps, segment quality
7. ⚙️ Check infrastructure — DNS records, TLS, server configuration

Reading email headers:

• Read Received headers bottom-to-top
• Bottom = originating server; each subsequent = next hop
• Check Authentication-Results for verdicts
• Verify originating IP matches authorized infrastructure

Temporary (4xx) — MTA will retry:

Code	Meaning
421	Service unavailable / rate limiting
450	Mailbox temporarily unavailable
451	Local error / greylisting
452	Insufficient storage

Permanent (5xx) — Delivery failed:

Code	Meaning
550 5.1.1	Mailbox does not exist
550 5.7.1	Policy rejection (spam/DMARC)
550 5.7.26	DMARC policy failure (Gmail)
552	Message too large

Gmail-specific:

• 421 4.7.26 — SPF/DKIM failure (temporary)
• 421 4.7.28 — Rate limiting ("unusual rate")
• 550 5.7.26 — DMARC fail (permanent rejection since 2024)

Microsoft-specific:

• 550 5.7.515 — Non-compliant bulk sender (since May 2025)

Blocklist recovery sequence:

1. Identify which list(s) via MXToolbox
2. Find root cause (compromised server, spam traps, purchased lists)
3. Fix the issue before requesting removal
4. Submit delisting through each list's process
5. Monitor for re-listing

Delisting timelines:

• SpamCop: Auto-delists 24-48 hours after reports stop
• Spamhaus XBL/CSS: Minutes via self-service
• Spamhaus SBL: Requires ISP abuse team — hours to weeks

Debugging authentication:

• SPF fails: Too many lookups, missing includes, multiple records
• DKIM fails: Selector mismatch, body modified, key < 1024 bits
• DMARC fails: Both SPF and DKIM domains fail to align with From
• Fix: Configure custom Return-Path and DKIM signing domains via ESP

ARC solves authentication breaking during email forwarding.

When forwarding services modify messages:

• SPF fails (new sending IP)
• DKIM may fail (body modifications)
• Legitimate mail fails DMARC

ARC adds three headers at each hop:

1. ARC-Authentication-Results — Snapshot of SPF/DKIM/DMARC at this hop
2. ARC-Message-Signature — DKIM-like signature over the message
3. ARC-Seal — Signature over all previous ARC headers

The final receiver validates the ARC chain and can use the first hop's results to override a DMARC failure.

Supported by: Gmail, Microsoft 365, Yahoo, Proton Mail

MTA-STS (RFC 8461) prevents TLS downgrade attacks.

Two components required:

1. DNS TXT record at _mta-sts.<domain>
2. Policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt

Policy file specifies mode (testing or enforce), authorized MX hostnames, and max-age.

Limitation: First policy fetch is unprotected (TOFU — Trust On First Use).

TLS-RPT (RFC 8460) provides visibility into TLS failures:

• DNS TXT record at _smtp._tls.<domain>
• Receives JSON-formatted daily reports
• Reports successful connections, failure details, affected servers

DANE (RFC 7672) — The gold standard for SMTP transport security:

• Binds TLS certificates directly to DNS via DNSSEC-signed TLSA records
• Eliminates TOFU vulnerability of MTA-STS
• Doesn't depend on certificate authorities
• Barrier: DNSSEC must be active across the entire DNS chain
• DANE and MTA-STS are complementary

SRS (Sender Rewriting Scheme) — Fixes SPF breakage during forwarding:

Original: MAIL FROM: alice@example.org Forwarded: MAIL FROM: SRS0=HHH=TT=example.org=alice@forwarder.com

• Stateless (hash + timestamp for verification)
• Fixes SPF only — DKIM must still pass for DMARC
• Microsoft 365 uses SRS for all forwarded mail since August 2023

Key dates:

Date	Event
Oct 2023	Google & Yahoo announce bulk sender requirements
Feb 2024	Enforcement begins with temporary 421 errors
Apr 2024	Google starts permanent 550 rejections
Jun 2024	One-click unsubscribe deadline
Apr 2025	Microsoft announces its requirements
May 2025	Microsoft begins rejecting with 550 5.7.515
Oct 2025	Google retires Postmaster Tools V1, launches V2
Nov 2025	Google activates full enforcement

The industry now calls this "Yahooglesoft" — unified enforcement across Google, Yahoo, and Microsoft.

Google defines bulk sender as 5,000+ messages/day to personal Gmail accounts. Once reached, you're permanently categorized as bulk.

Requirements for ALL senders:

• ✅ SPF or DKIM must pass
• ✅ Spam complaint rate < 0.3%
• ✅ Valid forward & reverse DNS (PTR records)
• ✅ TLS encryption

Additional for BULK senders (5,000+/day):

• ✅ Both SPF AND DKIM implemented
• ✅ DMARC published (p=none minimum)
• ✅ From header alignment with SPF or DKIM
• ✅ One-click unsubscribe (RFC 8058) for marketing email
• ✅ Unsubscribe processing within 2 days
• ✅ Spam rate below 0.10% (target)

Requirement	Gmail	Yahoo	Microsoft
SPF	✅	✅	✅
DKIM	✅	✅	✅
DMARC	✅ (p=none min)	✅ (p=none min)	✅ (p=none min)
One-click unsub	✅	✅	"Functional link"
Spam rate max	0.3%	0.3%	0.3%
Reputation weight	Domain-heavy	Balanced	IP-heavy

Three structural changes define this era:

1. Authentication is table stakes. SPF, DKIM, and DMARC aren't competitive advantages — they're minimum requirements. The journey to p=reject is an operational necessity.

2. Reputation follows the domain, not the IP. You can't escape damaged reputation by switching ESPs. Building domain reputation through consistent, engaged sending is the long game.

3. Recipient experience drives filtering. ML-based filters analyze hundreds of behavioral signals. "Avoid saying 'free'" is obsolete. What matters: do recipients open, read, click, and reply — or delete, ignore, and report?

🎯 The takeaway: Technical compliance gets you through the gate, but authentic engagement keeps you in the inbox.