The three records, in plain terms
SPF is a DNS record listing which servers are allowed to send mail for your domain. A receiving server checks the sending IP against that list. If your email platform isn't in it, you fail.
DKIM attaches a cryptographic signature to each message, which the receiver verifies against a public key in your DNS. It proves the message wasn't altered in transit and genuinely came from your domain.
DMARC ties the two together and tells receivers what to do when a message fails: nothing, quarantine, or reject. It also gives you reporting — which is how you discover the third-party tools sending as your domain that nobody remembered.
Since February 2024, Google and Yahoo require all three from anyone sending over 5,000 messages a day, along with one-click unsubscribe and a complaint rate under 0.3%. These stopped being best practice and became entry requirements.
Start with a DMARC policy of p=none for two weeks and read the reports before enforcing. Going straight to p=reject reliably breaks something you had forgotten was sending mail.
Engagement is the signal that matters most
Once authentication is correct, inbox placement is driven mainly by how recipients behave. Opens, replies, and moving a message out of spam are positive. Deletions without opening, and complaints, are negative.
The consequence is counterintuitive and it is the thing most teams resist: sending to unengaged subscribers actively harms delivery to engaged ones. A list segment that hasn't opened in a year isn't neutral dead weight — it is dragging down placement for everyone else.
This is why aggressive list growth without hygiene backfires. Ten thousand addresses acquired through a giveaway will produce complaints and non-engagement that damage your ability to reach the customers who actually want to hear from you.
Sunsetting, which nobody wants to do
A sunset policy removes subscribers who haven't engaged within a defined window. It feels like destroying an asset. It usually improves revenue.
Define engagement by purchase cycle
For consumables, 90 days without an open is meaningful. For considered purchases, 12 months. Applying a 90-day rule to a business with an annual cycle deletes people who were going to buy.
Run a win-back before removing
A three-email sequence with a genuine reason to return. Whoever engages comes back into the active list; whoever doesn't was never going to.
Suppress rather than delete
Keep the records for suppression and analysis, just stop sending. You may want the data later, and you need it to honour opt-outs permanently.
Expect metrics to look better immediately
Open and click rates rise the moment you stop sending to people who never open. That is a measurement artifact, not an improvement — the real gain is placement for everyone else.
Warming, and why it can't be rushed
A new sending domain or a damaged reputation both require warming: starting with small volumes to your most engaged subscribers and increasing gradually while placement holds.
A realistic ramp starts at a few hundred sends a day to your most recently engaged segment and roughly doubles every few days, watching complaint and bounce rates at each step. Getting to full volume typically takes four to eight weeks.
The failure mode is impatience. Jumping volume because early numbers look good is how a warming programme turns into a fresh reputation problem, and the second recovery is slower than the first.
Separate your sending domains
Transactional mail — password resets, order confirmations, security alerts — must reach the inbox unconditionally. Marketing mail carries complaint risk by nature.
Sending both from the same domain means a marketing campaign that draws complaints can degrade delivery of password resets. That is a support and security problem created by a marketing decision.
Use a subdomain structure: transactional on one, marketing on another, both authenticated under your root domain. Reputation is largely tracked at subdomain level, which contains the damage.
How to tell if you have a problem
Open rate alone won't tell you, particularly since Apple Mail Privacy Protection inflates opens. Look at these instead.
Placement by provider
Seed-list testing or a placement tool showing inbox versus spam per major provider. A sharp Gmail-specific drop with Outlook stable points at engagement rather than authentication.
Complaint rate trend
Google Postmaster Tools shows this directly for Gmail. Anything approaching 0.3% needs immediate action, not a scheduled review.
Click-to-open ratio
More reliable than open rate after Mail Privacy Protection. A stable click-to-open with falling opens usually means placement issues, not content issues.
Hard bounce rate
Above 2% suggests list quality problems, and continuing to send to bouncing addresses compounds the reputation damage.
Terms used in this piece
We do this for a living
If you'd rather not build this yourself, these are the services where it lives.