Email Deliverability Fundamentals

If you send email at any meaningful volume — marketing campaigns, transactional receipts, product notifications — deliverability is no longer a "nice to optimize" concern. As of 2026, the major inbox providers actively reject or quarantine mail from senders who haven't properly authenticated their domain. This isn't a future requirement to plan for; it's already enforced.

The requirement, plainly

Google and Yahoo began requiring bulk senders to publish a DMARC record back in February 2024. Microsoft followed with enforcement starting May 2025, and Gmail escalated further in November 2025 with active enforcement — including both temporary and permanent rejections for senders that don't meet authentication requirements. The threshold that triggers "bulk sender" rules is 5,000 or more emails per day to consumer accounts, but the underlying authentication setup (SPF, DKIM, DMARC) is worth having correctly configured regardless of volume, because it affects inbox placement even below that threshold.

The three records, in order

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email on behalf of your domain. It stops the crudest form of spoofing — someone sending mail claiming to be you@yourdomain.com from a server you never authorized.

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing mail, generated with a private key your mail server holds and verified against a public key published in your DNS. It proves the message wasn't altered in transit and genuinely originated from a server you control.

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells receiving mail servers what to do when a message fails both checks — quarantine it, reject it outright, or do nothing (just report). DMARC also gives you visibility: receiving servers send aggregate reports back to an address you specify, showing who's sending mail claiming to be your domain, which is often the first time a company discovers it's being spoofed.

The recommended rollout order matters: start with a DMARC policy of p=none (report only, don't act), verify your legitimate mail is passing SPF and DKIM cleanly using those reports, then move to p=quarantine, and finally p=reject once you're confident nothing legitimate is failing. Jumping straight to p=reject without that verification step risks silently dropping real customer emails.

BIMI: the visual layer, but only after DMARC is enforced

Once your DMARC policy is at p=reject, you become eligible for BIMI (Brand Indicators for Message Identification), which displays your logo next to your sender name in supporting inboxes. There are two certificate paths: a VMC (Verified Mark Certificate), which requires a registered trademark and costs roughly $1,500/year but is supported by Gmail, Yahoo, and Apple Mail; and a CMC (Common Mark Certificate), which doesn't require a trademark but is currently Gmail-only. Senders using BIMI logos report open rates up to 39% higher — a meaningful lift for a one-time setup cost, if you already have DMARC enforcement in place.

To implement it: create an SVG of your logo in the required Tiny PS format, obtain a VMC or CMC from an approved certificate authority, and publish a BIMI TXT record at default._bimi.yourdomain.com pointing to your hosted logo and certificate file.

Beyond the DNS records

Authentication gets you past the first filter, but it doesn't guarantee inbox placement by itself. Sending consistently to an engaged, opted-in audience is what actually drives good placement over time — mailbox providers track engagement signals (opens, replies, "not spam" reports) per sending domain and adjust placement accordingly. Bounce rate matters too: if it regularly climbs above 2%, providers may assume you're sending to purchased or stale lists, which drags down deliverability even for a domain with perfect SPF/DKIM/DMARC setup.

AI-driven spam filtering changed what "good engagement" means

Beyond the DNS authentication layer, 2026 brought a structural shift in how the major inbox providers evaluate mail after it passes SPF/DKIM/DMARC: Gmail's Gemini AI integration now acts as an active gatekeeper that interprets, summarizes, and prioritizes incoming mail before a human ever sees it, rather than functioning as a passive delivery pipe. Domain reputation has become the dominant signal in this system, now outweighing IP reputation the way it didn't in older filtering models — authentication (SPF, DKIM, DMARC) is treated as a mandatory baseline prerequisite rather than something that itself differentiates a sender's reputation, since virtually every legitimate sender now has it configured.

What's changed more substantively is how engagement quality gets evaluated. AI-driven filtering can now distinguish genuine mailbox-to-mailbox engagement from simulated interaction, which has real consequences for warm-up practices: a warm-up process built on headless browser automation or artificial pixel-loading to simulate opens is increasingly detectable and can actively damage sender reputation rather than helping it, since it reads as inauthentic engagement rather than real activity. The more effective current approach is persona-based warm-up — maintaining a network of real, human-operated mailbox identities that engage with each other and with your sending domain in ways that authentically mirror how real people actually use email, rather than scripted, bot-driven opens. On the negative side, the signals that damage reputation fastest under AI filtering are specific and worth monitoring directly: emails deleted without any interaction, messages that go consistently ignored, explicit spam reports, and volume spikes followed by a drop in engagement — all of which AI models now weight more heavily and respond to faster than older, simpler reputation-scoring systems did.

A minimal setup checklist

• Publish SPF listing every legitimate sending source (including any third-party tools — your CRM, your transactional email provider, your marketing platform).
• Enable DKIM signing through your email service provider and publish the public key.
• Publish a DMARC record starting at p=none, monitor aggregate reports for two to four weeks, then move to p=quarantine and eventually p=reject.
• Keep bounce rate under 2% by regularly cleaning your list and removing hard bounces.
• Consider BIMI once DMARC is enforced, if brand recognition in the inbox is worth the certificate cost.

None of this is exotic — it's DNS records and list hygiene. But it's now the difference between mail that lands in the inbox and mail that gets silently rejected before a human ever sees it.

Sources: EasyDMARC — DMARC Best Practices Guide 2026, IronScales — BIMI Technical Guide, MailReach — AI Email Deliverability in 2026: How to Improve Inbox Placement, Folderly — Gmail Gemini AI & Email Deliverability in 2026