You sent the newsletter, watched the open rate settle at 9%, and rewrote the subject line for the third time. The subject line was never the problem.

By Validity's 2025 benchmark, around one in six legitimate emails never reaches the inbox — it lands in spam or disappears before anyone sees it. Which six are yours is decided mostly by three records you have probably never touched, not by the words you keep editing. That gap has a name: email deliverability. And since 2024, the rules quietly got stricter.

TL;DR. Deliverability is whether your email reaches the inbox, not whether it was sent. About one in six never arrives — usually because the sending domain has no SPF, DKIM or DMARC, not because the copy is weak. Gmail and Yahoo started enforcing this in 2024; Microsoft followed in 2025. Fix the three records first, then the list.

Deliverability is not delivery, and it's not your subject line

Delivery means a mail server accepted your message. Deliverability means it reached a human's inbox. Those are different numbers, and the space between them is where your enquiries quietly vanish.

Most owners never see the gap. The dashboard says "sent." The reply never comes. So you do the only thing you can see — you blame the writing, rewrite the subject line, and test send times. None of it moves the number, because the message was sitting in a spam folder the whole time.

You can't A/B test a subject line on an email that never arrived.

Picture a founder refreshing the stats in Brevo after a quiet week. Open rate stuck at 9%. She assumes her list has gone cold. The real cause: her domain has no DKIM signature, so a chunk of every send to Gmail is filed as suspicious before a single person scrolls past the preview. The copy was fine. The plumbing was broken.

What changed in 2024 and 2025 — and why your results quietly dropped

In 2024 and 2025 the biggest mailbox providers stopped treating authentication as a nice-to-have. If your domain can't prove who you are, your mail now gets punished by default.

From 1 February 2024, Google's sender guidelines require anyone sending more than 5,000 messages a day to Gmail to authenticate with SPF and DKIM, publish a DMARC record, offer one-click unsubscribe honoured within two days, and keep their spam-complaint rate below 0.30%. Yahoo applied matching rules on the same date. Then on 5 May 2025, Microsoft did the same for Outlook and Hotmail — non-compliant mail routed to Junk, then rejected outright.

Here is the part the headlines miss. The 5,000-a-day line is who gets enforced first. The signals are the same whether you send 50 emails or 50,000. A six-person business sending a weekly update is judged on the same authentication and reputation checks as a national retailer — it just won't get a warning email about it. If your results softened sometime after early 2024 and you never found out why, this is a strong candidate. The owned channel you spent months building an audience for only works if the mail behind it is signed.

The three records that decide whether you reach the inbox

Three small DNS records do most of the work. In plain English:

• SPF is a public list of which servers are allowed to send email for your domain. It answers: "Is this sender even authorised?"

• DKIM is a cryptographic signature stamped on every message. It proves the email genuinely came from you and wasn't tampered with in transit.

• DMARC tells the mailbox what to do when a message fails the first two — ignore, quarantine, or reject — and sends you reports on who is sending mail in your name.

Set all three and you stop looking like a stranger. The data backs the effort: across 2025 deliverability benchmarks, only about 7.6% of sending domains enforce DMARC, and fully authenticated domains are roughly 2.7 times more likely to reach the inbox than unauthenticated ones. Three records put you in a small, trusted minority.

This is also the most common wrong fix. An owner watches deliverability slide, decides the email tool is the problem, and migrates to a fancier platform — sending from the same unauthenticated domain. Nothing improves, because reputation and authentication live on your domain, not your software. The new tool just sends the same unsigned mail through a different door. The fix is engineering, not shopping.

Why the same email reaches one customer and vanishes for another

Two people get the same email. One sees it in seconds; the other never does. The difference is usually their mailbox provider.

By Validity's 2025 data, Gmail places about 87.2% of legitimate mail in the inbox. Microsoft's Outlook and Hotmail manage roughly 75.6%, with a spam rate near 14.6% — an eleven-point gap on identical messages. If your customers skew towards Outlook, your real-world deliverability is worse than any global average suggests.

Take a six-person B2B firm that sends a quote, then a follow-up, to a prospect on a corporate Outlook address. Both land in Junk. A week later the founder writes the prospect off as another ghost, when the prospect simply never saw a word. The deal didn't die on price or timing. It died in a spam folder, on a domain that never told Microsoft who it was.

The unglamorous half: list hygiene, complaints, and the unsubscribe link you're hiding

Authentication gets you to the door. Your sending habits decide whether you're let back in.

Mailbox providers watch how people react to you. Too many complaints and you're marked as spam for everyone — Gmail's own threshold is that sub-0.30% complaint rate. So the basics matter more than any clever tactic: send only to people who actually asked, prune addresses that hard-bounce or haven't opened in months, and make the unsubscribe one click, honoured fast. A visible unsubscribe link feels like you're inviting people to leave. In practice it's the opposite — burying it pushes annoyed readers to hit "report spam" instead, which is the single worst signal you can send.

The fastest way to torch a domain is a bought or scraped list. One big send to cold, unconsenting addresses spikes complaints and bounces, your reputation craters, and suddenly even the loyal customers who want your email get it in spam. In Europe that list was never legal to email in the first place. Consent here is the law — and it's also the thing that keeps you in the inbox.

Fix it in order: a senior triage for a non-technical owner

You don't need to become a deliverability engineer. You need to do five things in the right order, once.

1. Authenticate the sending domain. Add SPF and DKIM records in your DNS — your email tool documents the exact values. It's the one step that does the most work.

1. Publish DMARC, then tighten it. Start at p=none so nothing breaks, read the reports for a week or two to see who's sending as you, then move to quarantine and finally reject.

1. Test before you send, don't guess. Check Google Postmaster Tools and run a free pass through a tool like mail-tester. Both show where your mail is actually landing.

1. Clean the list. Remove hard bounces and long-dead contacts, and segment by engagement so your most active readers protect your reputation.

1. Stay consistent. Send from one domain or subdomain, keep volume steady rather than spiky, and honour every unsubscribe inside two days.

None of this produces something you can show off. There's nothing to screenshot and nothing to demo. It's the least glamorous afternoon in marketing — and it's the difference between an owned channel that compounds and one that leaks every week. If wiring this up across your stack and automating the follow-ups isn't where you want to spend your week, it's the kind of quiet, high-value work a senior partner should just own.

FAQ

What's a good email deliverability rate?

Aim for inbox placement above 90%. The global average sits near 84%, so anything consistently below 80% is a signal that authentication, list quality or sender reputation needs attention. Your email platform's reports and Google Postmaster Tools show where your mail is actually landing — not just whether it was accepted.

Do I need DMARC if I only send a few hundred emails a month?

Yes. Low-volume senders are judged on the same authentication signals, and DMARC also stops criminals spoofing your domain to scam your customers. It takes an afternoon to set up at p=none and costs nothing but the time. Treat it as cheap insurance for your name, not an enterprise-only feature.

Will switching email tools or buying a custom domain fix deliverability?

On its own, no. Reputation and authentication travel with your domain, not your software. A new platform sending from an unauthenticated domain changes nothing. Set up SPF, DKIM and DMARC first; a better tool only helps once the records behind it are correct.

Email is the one audience you own — act like it

Every message that lands in spam is a reply, a booking, an enquiry you paid to earn and never saw. The fix isn't a sharper subject line. It's three records and a clean list, set up once and left to compound — the opposite of the loud, visible work most people chase.

If you're not sure what's landing and what's leaking, that's exactly the kind of thing a senior pair of eyes can read in an afternoon. Book a 30-min call — get an honest read on your digital growth. Every plan and price is on the Plans page; you don't need a call to see the number.

Plan. Build. Iterate.