Email deliverability in 2026: the short list of things that actually matter

Deliverability advice has a folklore problem. Ask ten people why mail lands in spam and you will hear about trigger words, image ratios, the phase of the moon. Meanwhile the mailbox providers have quietly told everyone exactly what they measure. Google and Yahoo published their bulk sender requirements in 2024 and have been enforcing them since. There is no mystery left. There is only whether you did the work.

We run inbound email infrastructure for a living, and we run our own sending domains next to it. This is the list we actually check. It is short because the list that matters is short.

01Authentication is the entry fee, not a bonus

SPF, DKIM, and DMARC are no longer best practice. They are the price of admission. Gmail rejects or junks bulk mail that fails alignment, full stop. If you send from a domain without all three, the rest of this article cannot help you.

The setup takes twenty minutes and people still get it wrong in the same three places:

• SPF with too many includes. The spec allows ten DNS lookups. Every include: you paste in from some tool's setup page eats one or more. Blow past ten and your record silently returns permerror, which evaluators treat as a fail. Audit the record; delete senders you no longer use.
• DKIM at 1024 bits because that was the default in 2015. Use 2048. Every serious provider issues 2048 now. If yours does not, that tells you something about the provider.
• No DMARC record at all, because "we'll add it later." Publish p=none with a reporting address on day one. It costs nothing, it satisfies the bulk sender requirement, and the aggregate reports will show you who is spoofing your domain. You can tighten to quarantine once the reports look clean.

02Complaint rate is the number that ends careers

Gmail's stated threshold is a 0.3% spam complaint rate, with a strong recommendation to stay under 0.1%. Read that again with real numbers attached: on a send of 1,000 messages, three spam clicks put you at the ceiling and one puts you at the target. That is how thin the margin is.

What actually keeps complaints down is not clever copy. It is three boring mechanisms:

1. Consent you can defend. If the recipient did not ask for this mail, some fraction of them will press the spam button, and no subject line changes that. Purchased and scraped lists produce complaint rates 5 to 20 times higher than opted-in lists. The math does not survive it.
2. One-click unsubscribe in the headers. The List-Unsubscribe and List-Unsubscribe-Post headers make Gmail render its own unsubscribe button next to your sender name. Every person who uses it is a person who did not press spam instead. It is required for bulk senders anyway, but even below the threshold it is the cheapest complaint insurance that exists.
3. A suppression list that actually suppresses. Bounces, complaints, and unsubscribes have to flow back into your system and block future sends automatically. If a human has to remember to remove addresses, addresses will not get removed. This is a plumbing problem, and plumbing problems have plumbing solutions.

Postmaster Tools is free and shows you Gmail's view of your complaint rate and domain reputation directly. If you send any volume at all and have not registered, you are flying blind by choice.

03Volume discipline, or why fresh domains go to spam

A domain with no sending history has no reputation, and mailbox providers treat no reputation as suspicion. The pattern they are watching for is exactly the one an impatient sender produces: a domain registered last Tuesday that suddenly blasts 5,000 messages on Friday. Spam filters were built on that silhouette.

Warming up is not optional and it is not complicated. Start around 10 to 20 messages a day to your most engaged recipients. Double the volume roughly weekly. Watch bounces and complaints as you go. After two to three weeks of clean ramping you can send at normal volume. The whole procedure costs you three weeks of patience and buys you a domain that lands in inboxes for years.

Two details people miss:

• Warm to engagement, not to a list. Early sends should go to addresses likely to open and reply. Opens and replies are positive reputation signals. Sending your warmup traffic to your coldest, oldest addresses teaches the filter the wrong lesson at the worst time.
• Keep the ceiling in mind even after warmup. Reputation is a moving average. One enormous spike after weeks of gentle sending still reads as anomalous. Grow into higher volumes; do not jump.

04Separate your domains by job

The domain your product runs on should never be the domain your bulk mail goes out from. This is standard practice at every company that has been burned once. Transactional mail (receipts, password resets) goes from one domain or subdomain. Marketing and outreach go from another. If a campaign damages the marketing domain's reputation, your password resets keep landing.

The same logic applies to inbound. Replies, bounces, and feedback loop notifications are operational data, and they deserve real infrastructure rather than a shared inbox someone checks on Fridays. That inbound stream is where your suppression list comes from, where complaints surface first, and where deliverability problems announce themselves days before the metrics dashboards catch up. Treat it as part of the sending system, because it is.

05The things that mostly do not matter

For balance, the folklore items we have never seen move a number:

• Spam trigger words. Content filtering exists, but a legitimate sender with authentication, low complaints, and warmed volume can write the word "free" without incident. Word lists are a 2005 mental model.
• Sending at magic hours. Time of day affects open rates, not spam placement.
• Image to text ratio. An email that is one giant image is bad for other reasons. It is not why you are in the spam folder.

If your mail is not landing, the cause is almost certainly in sections one through three. Fix authentication, control complaints, warm your volume. Everything else is decoration.

06The pre-send checklist

The condensed version, the one we run before any domain sends message one:

1. SPF published, under ten lookups, ends in ~all or -all
2. DKIM at 2048 bits, verified passing
3. DMARC published at p=none with a reporting address
4. Alignment confirmed by reading real headers, not by trusting a dashboard
5. One-click unsubscribe headers on every bulk message
6. Bounce and complaint feedback wired into an automatic suppression list
7. Postmaster Tools registered
8. Warmup schedule written down, with dates, before the first send

Eight lines. None of them are hard. The senders who end up blocklisted are not the ones who found this list too difficult. They are the ones who decided it did not apply to them.