Email deliverability checklist: how to reach the inbox in 2026

Deliverability is decided before anyone reads your message. Receivers check who sent it, whether that sender is authorized, how the sending server is set up and how recipients have reacted to your mail before. This checklist covers each item in the order a receiving server meets it, with the published thresholds from Gmail, Yahoo and Outlook.com. If your mail is already landing in spam, start with why are my emails going to spam to diagnose it.

What do mailbox providers check before accepting your email?

Since February 2024, Google and Yahoo have published written rules for senders, and Microsoft followed for Outlook.com in 2025. They overlap heavily. In short:

• Everyone sending to Gmail needs SPF or DKIM, valid forward and reverse DNS, TLS, and a user-reported spam rate below 0.3% (Google's sender guidelines).
• Bulk senders to Gmail (close to 5,000 messages a day), Yahoo (no published threshold) and Outlook.com (more than 5,000 a day) also need both SPF and DKIM, plus a DMARC record of at least p=none that passes with an aligned From domain (Yahoo's best practices, Microsoft's 550 5.7.515 article). Outlook.com rejects mail that misses them with 550 5.7.515.
• Marketing mail to Gmail and Yahoo from bulk senders needs one-click unsubscribe.

Our guide to Gmail, Yahoo and Microsoft bulk sender requirements has the full side-by-side table, the dates and the exact definitions.

Google says that from November 2025 Gmail is "ramping up its enforcement on non-compliant traffic", including temporary and permanent rejections (Google FAQ). Treat the bulk rules as the baseline even if you send less. It costs little and every receiver reads the same signals.

How do you authenticate your mail?

1. List every service that sends as your domain

Mailboxes, marketing platform, CRM, help desk, billing, website forms, scanners. Anything that puts your domain in the From address belongs on the list. Most deliverability problems start with a sender nobody remembered.

2. SPF: one record, under 10 lookups

Publish a single SPF record that authorizes each service. Keep it within the 10-DNS-lookup limit, or receivers return PermError and SPF stops counting. Check it with the SPF Checker, and see how to fix too many SPF lookups if you're over.

3. DKIM: signed with your domain, not the vendor's

Many platforms sign with their own domain until you add yours. That passes DKIM but doesn't align with your From address. Turn on custom DKIM in every tool and verify each selector with the DKIM Checker.

4. DMARC: published, with reports

Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. That is the minimum policy all three providers accept. Gmail bulk senders, Yahoo and Outlook.com require DMARC to pass. Then read the reports and work toward enforcement; see DMARC from p=none to p=reject.

5. Alignment: confirm it in a real message

DMARC passes only when SPF or DKIM passes for the domain in your From address. Records can look perfect and still fail alignment. Send a real message and read the Authentication-Results header, or use the free Email Deliverability Test, which reports SPF, DKIM and DMARC results and which check gave alignment.

How should your sending servers be set up?

6. Forward and reverse DNS (PTR) that match

Google requires that "sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records". Yahoo asks for valid, meaningful, non-generic PTR names. The PTR name should resolve back to the same IP, which is called forward-confirmed reverse DNS. If you use a hosted platform, it handles this. If you run your own server, check it with the PTR Lookup and read our reverse DNS setup guide. Gmail rejects mail that fails this check with 550 5.7.25.

7. TLS on every connection

Google's all-sender rules say to "use a TLS connection for transmitting email." Modern platforms do this by default. Self-hosted servers need a valid certificate and STARTTLS enabled; see what STARTTLS protects.

8. A clean IP and domain reputation

Check your sending IPs with the Blacklist Checker. A listing usually points to a real problem, such as a compromised account, a bad list or a misconfigured form. Fix the cause first, then follow how to get removed from a blacklist.

How do you handle unsubscribes and complaints?

9. One-click unsubscribe for marketing mail

RFC 8058 defines two headers:

List-Unsubscribe: <https://example.com/unsub/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The mailbox provider sends an HTTPS POST to that URL. The RFC says the POST "MUST NOT include cookies, HTTP authorization, or any other context information", so the URL itself must identify the recipient. Your server must not answer with a redirect, and the message needs a valid DKIM signature covering both headers. Google excludes transactional messages, such as password resets, from the requirement.

10. Process unsubscribes fast

Google recommends fulfilling unsubscribe requests within 48 hours. Yahoo requires bulk senders to honor them within 2 days. Make sure every tool that mails the same list shares one suppression list.

11. Keep the spam rate low

Google measures the spam rate as the share of messages delivered to the inbox that recipients then mark as spam. It recommends staying "below 0.1%" and never reaching 0.3%. Above 0.3%, a bulk sender loses eligibility for mitigation until the rate stays below that level for seven consecutive days (Google FAQ). Yahoo also sets 0.3% and says an active Complaint Feedback Loop is needed for all DKIM domains.

How do you keep your list clean and warm up sending?

12. Mail only people who asked

Google's guidance is to "send email only to people who want to get messages from you" and to "confirm each recipient's email address before subscribing them." Never buy or rent lists. Old, unconfirmed addresses produce bounces and complaints.

13. Remove bounces automatically

Google recommends that you "automatically unsubscribe recipients who have multiple bounced messages." A hard bounce such as 550 5.1.1 means the address doesn't exist; stop mailing it. See hard vs soft bounces for which codes mean remove and which mean retry.

14. Warm up new domains and IPs slowly

Google says to "start with a low sending volume to engaged users, and slowly increase the volume over time," and warns against "sudden volume spikes if you do not have a history of sending large volumes." Begin with your most engaged recipients. If you see temporary rate limits such as Gmail's 421 4.7.28, slow down rather than retry harder. Our warm-up guide lays out a cautious ramp and what to monitor.

15. Keep streams consistent

Google suggests sending from the same IP where possible, and using a different IP for each message type if you must use several. It also recommends a consistent From address per category of mail. A common pattern is to send marketing from a subdomain such as news.example.com, so a campaign problem doesn't drag down your staff's everyday mail.

How do you monitor deliverability after setup?

Records drift. Someone adds a tool, a vendor changes its include, a key expires. Build monitoring into your routine.

A few details are easy to miss:

• Postmaster Tools lags. Google says the Compliance status dashboard uses a rolling average over multiple days and recommends checking again after 7 days.
• SNDS is IP-based. Smart Network Data Services lets you request access to the IPs you're responsible for. If you send through a shared platform, the platform holds that data, not you.
• DMARC reports are XML. Our DMARC Report Analyzer reads them in your browser, and how to read DMARC reports explains each field.

How do you test a message before a big send?

Test with a real message, not just DNS lookups. DNS shows what you published. A message shows what the receiver actually saw.

1. Send a normal message from each sending service, using the real From address and template.
2. Send one to our free Email Deliverability Test. It reports SPF, DKIM and DMARC with alignment, the sending server's reverse DNS and forward confirmation, blocklist status, the TLS version used, and our spam filter's verdict.
3. Send one to a personal Gmail and Outlook.com address and open the headers in the Email Header Analyzer. Look for spf=pass, dkim=pass and dmarc=pass.
4. Confirm the unsubscribe headers are present on marketing mail, and that clicking them works without a login.
5. Fix anything that fails, then test again with a new message.

No test can promise inbox placement at Gmail or Outlook, because each receiver uses its own signals. A test can show you the problems those receivers check first.

What if your mail still lands in spam?

Work from the bounce or the headers. A rejection code tells you what the receiver objected to; look it up in the SMTP Error Code Lookup. Gmail's 550 5.7.26 points to authentication, for example. If there's no bounce and the message simply landed in junk, our guide on why an email lands in spam walks through the likely causes.

Next steps

1. Run the free Email Health Check to see your MX, SPF, DKIM and DMARC records in one scan.
2. Send one message from each sending service to the Email Deliverability Test and fix any failed check.
3. Register your domain in Google Postmaster Tools, and SNDS if you own your sending IPs.
4. If you send transactional mail from your own apps, iBlockSpam's outbound relay DKIM-signs it, with 500 messages a month included. Keep bulk campaigns on a dedicated marketing platform.

To catch DNS changes that quietly hurt delivery, the Free Domain Watch checks your SPF, DMARC, MX and MTA-STS records weekly and emails you when one changes.

Browse more guides on running email day to day.