Email Deliverability Best Practices: A Working Checklist

The core email deliverability best practices are: authenticate every sending domain with SPF, DKIM and DMARC; send only to people who consented and whose addresses you verified; make unsubscribing one click; keep volume steady; separate mail streams; and review bounces and complaints weekly. Everything else is refinement.

This page is the checklist version. The reasoning behind each item is in how to improve email deliverability; here you get the list to run against your own setup.

1. Identity: authenticate everything

• [ ] SPF record published, one per domain, under 10 DNS lookups (see the lookup limit).
• [ ] DKIM signing enabled for every service, with your domain in the d= tag.
• [ ] DMARC published, with a rua= address someone reads.
• [ ] From domain aligns with the domain that passes SPF or DKIM.
• [ ] Sending IPs have valid forward and reverse DNS, and mail uses TLS.
• [ ] Records re-tested after every change with a tool like the free BusinessMCP deliverability checker.

The setup guide walks through each record.

2. Consent and list quality

• [ ] Every address was given to you for the purpose you are using it for.
• [ ] Signup forms say what and how often.
• [ ] Double opt-in where typos or bots are a risk.
• [ ] Addresses verified before sending (how verification works).
• [ ] Hard bounces suppressed permanently.
• [ ] Catch-all and role addresses treated as risky.
• [ ] Long-inactive subscribers removed or re-permissioned.
• [ ] No purchased or scraped lists for marketing mail.

Key takeaway: deliverability is mostly a by-product of sending wanted mail to real people. The technical items keep you out of trouble; the consent items keep you in the inbox.

3. Unsubscribe and complaints

• [ ] Visible unsubscribe link in every marketing message.
• [ ] List-Unsubscribe and List-Unsubscribe-Post headers for one-click unsubscribe (RFC 8058).
• [ ] Opt-outs suppressed immediately; providers expect them within two days.
• [ ] Spam complaint rate kept below 0.3%, targeting below 0.1%, as Google’s guidelines recommend.
• [ ] Complaint feedback loops registered where providers offer them.

The numbers and the full rule set are in Gmail and Yahoo bulk sender requirements.

4. Sending behaviour

• [ ] New domains ramped over weeks, not days.
• [ ] Volume changes introduced gradually.
• [ ] Consistent cadence rather than rare giant sends.
• [ ] Most engaged recipients mailed first after an incident.
• [ ] No sudden switch of platform or IP without a plan.

5. Stream separation

Stream	Suggested home	Why
Customer and staff mail	Primary domain	Highest trust, lowest risk
Transactional (receipts, resets)	Own subdomain	Insulated from marketing complaints
Newsletters, lifecycle	Own subdomain	Warm audience, own reputation
Cold outreach	Separate secondary domain	Isolation from everything else

Remember Google counts bulk volume across a primary domain and its subdomains, so subdomains separate streams but do not hide volume. See sending domain versus subdomain and BusinessMCP’s cold email infrastructure guide for the cold-mail version.

6. Content hygiene

• [ ] Real From name and a monitored reply address.
• [ ] Plain-text part included.
• [ ] Few links, mostly on your own domain; avoid shorteners and long redirects.
• [ ] Subject lines that match the content.
• [ ] Images supporting the text rather than replacing it.

7. Monitoring routine

Cadence	Task
Weekly	Review bounces and complaints; check Postmaster Tools if populated
Monthly	Read DMARC reports; re-run DNS checker; send a header test
Quarterly	Prune SPF includes; audit senders; clean the list
After any change	Re-test authentication and send a test message

Our article on how to check email deliverability describes the monthly routine in more detail, and the deliverability tools overview lists what to use for each task.

8. Know your limits

• Authentication does not guarantee the inbox. If everything passes and mail still lands in spam, work through the spam diagnostic.
• Thresholds such as 0.3% and 5,000 messages a day come from providers and change; confirm them on Google’s guidelines and Yahoo’s Sender Hub.
• Legal consent rules vary by country. This site cannot advise on your obligations, and BusinessMCP’s cold email deliverability and compliance guide is an overview, not legal advice.

Minimum viable version

If you only have an hour: publish SPF, DKIM and DMARC; verify your list; add a visible unsubscribe link and one-click headers; send steadily; and write a calendar reminder to check bounces and complaints every week. That alone puts you ahead of most senders and keeps you inside the providers’ stated rules.

Practices that apply to specific sender types

Checklists suit everyone, but priorities differ by sender. These are judgement calls rather than rules, so adapt them.

Sender	Biggest risk	Priority practice
Small ecommerce store	Mixing receipts with promotions	Separate transactional stream, one-click unsubscribe
SaaS company	Many tools sending as the domain	Sender inventory, DKIM for each tool, DMARC reports
Newsletter publisher	Complaints from ageing lists	Sunset policy, easy exit, steady cadence
Sales team	Cold outreach from the primary domain	Secondary domain, verification, volume caps
Agency managing client domains	Inconsistent setups	Standard onboarding checklist per client

Common sources of drift

Even a clean setup decays. The usual culprits are a new tool added without updating SPF, a DKIM key rotated by a vendor, a marketing platform changed without migrating the domain authentication, and a DMARC report address that no longer exists. A short written runbook that says which tools send as the domain, which selectors they use and who owns DNS prevents most of it. Review the runbook when staff change.

Where to read the primary sources

When you need the authoritative wording, go to the providers rather than to summaries. Google’s email sender guidelines and Yahoo’s Sender Hub define the rules. For a plain-language rundown with a recorded verification date, BusinessMCP publishes its Google and Yahoo sender requirements guide. For the mechanics of each record, see BusinessMCP’s SPF, DKIM and DMARC guide. If you want a quick graded view of your current records, the free email deliverability checker will give you one in a minute.