The Ultimate Guide to Email Deliverability

What is email deliverability? In a nutshell, it's the difference between people receiving your emails and not receiving them. This guide is for anyone whose job depends on emails actually landing - not bouncing, not getting marked as spam, not silently vanishing into a junk folder.

1. IP Reputation

IP (Internet Protocol) is essentially an address - a string of numbers uniquely identifying the server sending your emails. Email providers like Google and Microsoft check the IP address of a sender and assess its reputation, much like a credit score for email trustworthiness. Get a bad IP reputation, and your emails start landing straight in junk.

Protect it by sending from a dedicated, clean IP address rather than a shared one - if another domain sharing your IP sends spam, you go down with them. At minimum, monitor your domain reputation using a third-party tool like Senderscore.

In short: Kulea sends through dedicated IPs via Mailgun, blocks any campaign exceeding a 5% bounce rate, and maintains sender scores above 99%.

2. Domain Reputation

Your domain name is the human-readable translation of your IP address, and it carries its own reputation that needs protecting independently. Email providers - and dedicated blacklist services like Spamhaus and Barracuda - assiduously check sender domains, not just IPs. You can check whether your domain appears on any blacklist at mxtoolbox.com/blacklists.aspx.

Established domains that have sent legitimate email for a while build up good reputation. Brand new domains have none yet, and get treated cautiously by default - similar to having no credit history.

Protect your domain reputation by setting up the right DNS records (see Technical Setup below) and following good sending practice generally. If you've had a reputational mishap, it can be rebuilt over time with consistent, clean sending. Don't risk tarnishing it by sending to poor-quality data or poor-quality content.

In short: a clean domain reputation, kept clean through Mailgun, is what stops your emails being treated with the same suspicion as a brand-new, unverified sender.

3. Technical Setup: SPF, DKIM, DMARC and BIMI

Make sure you have the right DNS settings for your domain by logging into your domain host (GoDaddy, 123-reg, Gandi, etc.) and adding the following records:

MX - Mail Exchange

Governs receiving email. If a domain has MX records, it means it can actually receive replies, rather than just broadcasting outbound - a domain that only sends and never receives looks suspicious.

SPF - Sender Policy Framework

SPF specifies a list of servers or providers authorised to send email for your domain - a public declaration of who's allowed to send on your behalf, which helps email providers reject anyone spoofing your domain. It's added as a TXT record (not an "SPF" record - those are no longer valid). Kulea's own SPF record looks like this:

v=spf1 include:eu.mailgun.org include:_mailcust.gandi.net ~all

In plain English: v=spf1 states the SPF version in use; include:eu.mailgun.org include:_mailcust.gandi.net publicly vouches for Mailgun and Gandi to send on Kulea's behalf; and ~all sets how strictly failed checks should be treated.

DKIM - DomainKeys Identified Mail

DKIM is effectively a digital signature added to your email header, proving a message genuinely came from your domain. Unlike SPF, it uses encryption for an extra layer of verification - we recommend setting up both SPF and DKIM, not just one.

DMARC - Domain-based Message Authentication, Reporting & Conformance

DMARC sits on top of SPF and DKIM, defining a standardised policy for how to treat non-verified emails: do nothing but log the failure, quarantine it to spam, or reject it outright. It also lets you register a reporting address so providers can send you logs, helping you track potential abuse of your domain. As of February 2024, DMARC is no longer optional for any meaningful sender - see Google and Yahoo's requirements below. If SPF and DKIM are already in place, DMARC is a relatively easy next step - mxtoolbox.com's DMARC generator is a good starting point.

BIMI - Brand Indicators for Message Identification

BIMI lets you attach your verified logo to outbound emails so it displays in the recipient's inbox - and adoption has moved fast. Gmail, Yahoo, and Apple Mail now all support it. To qualify, you typically need DMARC enforced at p=quarantine or p=reject (not just p=none), plus a Verified Mark Certificate (VMC) for your logo in most major inboxes. It's no longer an early-adopter curiosity - it's a genuine trust signal worth setting up once your DMARC policy is strict enough to support it. See bimigroup.org for current requirements.

Subdomains

It's long been considered best practice to separate day-to-day corporate email from marketing email using a subdomain (e.g. sending marketing from andrew@my.acme.com rather than andrew@acme.com). This protects your root domain from any reputation damage caused by sales and marketing activity - though you'll still need SPF and DKIM records set up for the subdomain itself.

Things to avoid: don't make your "send from" address different from your sender domain - it looks suspicious and providers check for it. Don't set up SPF/DKIM/DMARC without testing they validate correctly (check twice with a tool like MX Toolbox). And make sure there's an actual mailbox - and a person - on the receiving end of your sending domain; the quality of real conversations happening through a domain is one of the strongest signals of its legitimacy.

Google and Yahoo Bulk Sender Requirements

Since February 2024, Google and Yahoo have enforced a stricter set of rules for anyone sending 5,000+ emails a day to their users - and the bar has only gone up since. If you're sending any real volume, these aren't optional extras, they're the baseline:

• DMARC is mandatory at a minimum of p=none - having SPF and DKIM alone is no longer enough.
• One-click unsubscribe is required (RFC 8058): a List-Unsubscribe and List-Unsubscribe-Post header on every marketing email, with the unsubscribe request honoured within two days. Burying an unsubscribe link three clicks deep in a footer no longer cuts it.
• Spam complaint rate must stay under 0.3%, tracked via Google Postmaster Tools. Cross 0.3% and you risk bulk filtering into junk regardless of how clean your authentication is.

None of this replaces the fundamentals above - it sits on top of them. A sender with perfect SPF/DKIM/DMARC but a clunky unsubscribe flow and a high complaint rate will still get filtered. See our full breakdown of the Google/Yahoo rollout for who's affected and the enforcement timeline.

In short: if you're not already monitoring your complaint rate in Google Postmaster Tools and offering true one-click unsubscribe, that's the highest-priority gap to close - ahead of anything else in this guide.

4. Data Quality

Poor data quality means: addresses that bounce because the person left two years ago, addresses that never get opened (like no-reply@), and addresses belonging to people who've unsubscribed or complained. Good data quality is the opposite - legitimate, relevant, well-targeted contacts who've actually opted in and engage with what you send.

Since GDPR, make sure of two things: that your list is made up of real people who opted in, and that they have a clear way to opt out. Watch out for catch-all email addresses too - they don't technically bounce, but they're not good data either, since no real person is reliably reading them.

Since Apple's Mail Privacy Protection update, opens are no longer a reliable signal on their own - Apple's own systems can trigger an "open" without the recipient ever seeing the email. Track clicks, page visits, and other genuine engagement instead, and treat a contact who keeps "opening" but never clicking with appropriate caution.

Clean your list before importing it - tools like Neverbounce will flag invalid and catch-all addresses before you ever send to them. Then watch who is and isn't engaging: give unengaged contacts a chance to re-opt in, but be willing to remove them from future sends if they continue to ignore you.

In short: Kulea auto-archives bouncing contacts and pauses any campaign that crosses a 5% bounce threshold, so a dirty list can't quietly damage your domain reputation.

5. Email Content

Once your IP reputation, domain reputation, technical setup, and data are all in good shape, the last variable is the email itself. Content should be relevant to the people receiving it - something they actually signed up for, not generic noise.

Know your audience

You already know something about your subscribers based on how they joined your list - an event, a form, a webinar. Target content to match that context rather than sending the same message to everyone.

Subject line

Alongside the sender name, your subject line is the single biggest factor in whether an email gets opened. A few rules of thumb: always have one (an empty subject line isn't mysterious, it's annoying); keep it short, since most readers are on mobile; avoid SHOUTY CAPS; don't promise something you won't deliver; and be specific about the problem you're solving for them.

Images

A common rule of thumb is roughly 60:40 text-to-image ratio - more words, fewer images. Always include alt text for recipients with image-loading turned off. Despite people saying they prefer image-heavy HTML emails, plain-text emails often outperform them on response rate by a meaningful margin - so don't assume more visual always means more effective.

Call to action

Include a clear call to action in every email - otherwise how do you know if anyone engaged beyond opening it? Keep it to one clear action rather than several competing ones, use a coloured, underlined hyperlink or button so it's obviously clickable, and avoid burying a link inside an image that doesn't visibly say "click here."

Useful Links

• How reputable is your IP? - Senderscore
• Is your tech set up OK? - MX Toolbox
• How clean is your data? - Neverbounce
• How spammy is your email? - Mail-Tester

Get the technical foundations right, keep your data clean, and write content people actually want to read - and your deliverability looks after itself. If you'd rather not manage all five pillars yourself, talk to us about how Kulea handles IP and domain reputation, DNS setup, and data hygiene as standard.

Frequently Asked Questions