Deliverability is the one part of email marketing where doing nothing has a cost. Your best-written campaign converts nothing from the spam folder, and by the time you notice — revenue quietly down, opens quietly down — you have usually been filtered for weeks.
This guide covers the technical setup that gets you trusted, the rules Gmail and Yahoo now enforce on bulk senders, how to warm a new sending domain, and a diagnostic sequence for when your mail is already landing in spam.
What deliverability actually measures
Two terms get used interchangeably and should not be.
| Delivery rate | Deliverability | |
|---|---|---|
| Measures | Messages a provider accepted rather than bounced | Messages that reached the primary inbox, not spam or a promotions bucket |
| Easy to measure? | Yes — it is in every dashboard | No |
| Usually looks | Fine | Unknown |
| Determines revenue? | No | Yes |
A 99% delivery rate is perfectly compatible with half your mail sitting in spam — providers accept and then quietly file. That gap is why a sudden drop in clicks with no change in bounces is nearly always a deliverability problem, not a copy problem.
Authentication: the part that is not optional
Authentication proves that mail claiming to come from your domain actually did. Without it, bulk mail is filtered or rejected outright.
SPF
A DNS TXT record listing which servers may send for your domain. Two things to watch: you may only publish one SPF record per domain (multiple records is a hard failure, and it happens constantly when a second tool is added), and SPF has a limit of ten DNS lookups — chained includes silently blow past it.
DKIM
A cryptographic signature added to every outbound message, with the public key published in DNS. Your sending provider generates the key pair and tells you which records to publish. Use a selector per provider so you can add or remove a sender without breaking the others.
DMARC
The policy layer. DMARC tells mailbox providers what to do when SPF or DKIM fails, and where to send aggregate reports. Publish it in three stages:
| Stage | Failing mail is… | Stay here until |
|---|---|---|
p=none | Delivered as normal — you only collect reports | Two to four weeks of reports have surfaced every legitimate sender you forgot about: the invoicing tool, the helpdesk, the CRM |
p=quarantine | Sent to spam | It is clean. Roll out with a percentage tag first if your volume is meaningful |
p=reject | Refused outright | This is the end state — the one that actually protects your domain from spoofing |
BIMI
Optional, and only eligible once DMARC is at quarantine or reject. It displays your logo next to your messages in supporting clients, which helps recognition. Treat it as a finishing touch, not a fix.
The bulk sender rules you have to meet
Google, Yahoo, and Microsoft have converged on a shared baseline for high-volume senders — roughly 5,000 or more messages a day to a given provider's users. The requirements:
- SPF and DKIM on every message, with at least one aligned to your From domain.
- A published DMARC record on the sending domain. p=none satisfies the letter of it; enforcement is better.
- One-click unsubscribe in the message headers (RFC 8058, the List-Unsubscribe-Post header), honoured within a couple of days. A visible unsubscribe link in the body is still required — this is in addition to it.
- Valid forward and reverse DNS on the sending IP, and TLS on the connection.
- A spam complaint rate that stays low. Google publishes 0.30% as the enforcement threshold and recommends staying under 0.10%.
Treat 0.10% as the ceiling, not the target. Complaint rate is a lagging indicator: the filtering starts before the number in your dashboard catches up.
If you send through CampGain, the provider you connect — SendGrid, Resend, or Gmail SMTP — handles the transport-level items. The DNS records and the list quality are yours.
Reputation: domain first, IP second
Sender reputation is built from how recipients treat your mail, and it attaches to two things.
| Domain reputation | IP reputation | |
|---|---|---|
| Attaches to | Your sending domain | The sending IP |
| Survives a provider switch? | Yes — it follows you everywhere | No |
| On a shared pool | Still entirely yours | You inherit the pool's behaviour |
| Matters most when | Always, at typical ecommerce volume | You send high, consistent volume |
Which makes the dedicated-IP question clearer than it usually gets: a dedicated IP only pays off if you send enough, consistently enough, to establish a pattern. Below that, sparse sending from a dedicated IP looks like a dormant sender waking up every few weeks — which is exactly what spam looks like. Most stores should stay on a shared pool and put the effort into domain reputation and list quality.
The signals that move it
- Complaints — the heaviest negative signal by a wide margin.
- Hard bounces — invalid addresses suggest a list you did not build yourself. Keep under about 2%, and suppress permanently on the first hard bounce.
- Spam trap hits — recycled or pristine addresses that exist only to catch bad list practice. Zero tolerance; a hit means your acquisition or hygiene is broken.
- Positive engagement — opens, clicks, replies, and being moved out of spam all count in your favour. This is why sending only to engaged contacts during a repair actually works.
Warming a new sending domain
A new domain has no history, and mailbox providers treat "no history plus sudden volume" as the classic spam signature. Ramp deliberately:
| Weeks | Send to | Volume | Watch |
|---|---|---|---|
| 1–2 | Contacts who engaged in the last 30 days | Low daily | These people open, and those opens are the reputation you are buying |
| 3–4 | Expand to 60-, then 90-day engaged | Increasing gradually | Bounce and complaint rates after every step — hold if either moves |
| 5–6 | Still no unengaged contacts | Full | Only add the unengaged once the ramp is complete |
List hygiene is a deliverability control
Most "our deliverability collapsed" stories are list stories.
- Suppress hard bounces immediately and never re-add them, even if they come back through a form.
- Set a sunset policy. Contacts with no opens, clicks, or orders in six to twelve months should stop receiving regular sends. Give them one re-permission campaign, then let them go.
- Use double opt-in where acquisition is noisy — paid lead magnets, giveaways, offline capture. It costs you subscribers and saves you a sending programme.
- Never buy, rent, or scrape a list. Purchased lists are how you hit spam traps, and no amount of technical setup survives that.
The counterintuitive part: cutting your list often increases total revenue, because the mail that remains reaches people who wanted it. Our customer segmentation guide covers how to build engagement tiers you can actually send against.
Content signals that still matter
Content is a smaller factor than authentication and reputation, but it is not zero:
- Keep a real text-to-image balance. An email that is one giant image gives filters nothing to read and breaks entirely when images are blocked.
- Send a plain-text alternative alongside the HTML. Its absence is a small negative signal and it costs nothing.
- Keep your From name and address consistent. Recognition drives engagement, and engagement drives placement.
- Watch link reputation. Link shorteners and domains you do not control are a genuine risk — a shortener that other people abuse drags your mail down with it.
- Write like a person. Chasing a "spam word list" is mostly folklore, but all-caps subject lines, walls of exclamation marks, and hidden text are real patterns filters recognise.
Diagnosing a live problem
If your mail is already going to spam, work in this order rather than changing five things at once.
- Verify authentication end to end. Send to an address you control at each major provider and inspect the headers for SPF, DKIM, and DMARC results — including alignment.
- Check Google Postmaster Tools. It shows your domain reputation and spam rate for Gmail. A complaint rate spike will usually name the date the trouble started.
- Line the date up against what you changed. New sending domain, new template, a big import, a list you had not mailed in a year — the cause is normally in that list.
- Segment by provider. If Gmail is fine and Outlook is not, it is a provider-specific reputation issue, not a broken record.
- Shrink to your engaged core. Send only to contacts who engaged in the last 30 days for two to three weeks. Rebuilding positive signal is slower than losing it, and there is no shortcut.
- Fix acquisition before you scale back up. If the source of the bad contacts is still running, you will be back here in a quarter.
Where CampGain helps
CampGain does not replace your DNS setup — no platform can — but it removes the guesswork from what happened after you pressed send.
- Per-contact delivery detail. Every campaign shows sent, delivered, opened, and clicked per step and per recipient, with the provider's stated reason on anything that failed. A bounce that says why is a bounce you can act on.
- Test sends before launch. Send the full workflow to a handful of addresses, check rendering and headers, and only then release it to the segment.
- Segments that support a sunset policy. Combine your own engagement conditions with Shopify data to build the engaged-only audiences a warm-up or a repair depends on.
- Your own sending provider. You connect SendGrid, Resend, or Gmail SMTP, so the reputation you build stays yours.
See what the platform includes for the full picture.
The short version
Publish SPF, DKIM, and DMARC and confirm alignment. Meet the bulk sender baseline before you need to. Warm new domains on engaged contacts only. Suppress bounces, sunset the dormant, and never buy a list. Then watch complaint rate as closely as you watch revenue — it is the metric that predicts whether the rest of your email programme gets to work at all.
With that foundation in place, the campaigns in our ecommerce email marketing guide can actually reach the people you built them for.