How to Fix Email Deliverability Issues (2026 Guide)

Start With a Deliverability Audit

Deliverability is one number with a lot hiding behind it: how many of your emails reach the inbox instead of the spam folder. Before you change a single setting, find out where your mail is currently going and why. That means looking at your sending infrastructure, the state of your list, and what you have actually sent over the past month.

Four things to pull. Your sender identity, which means reading your DNS records rather than trusting the dashboard that claims they are fine. Your bounce logs, sorted into hard and soft failures. Your engagement metrics for the last 30 days. And your sending volume, compared against what your domain has done historically.

The point of all this is to find out which problem you have, because a domain with weak authentication needs a completely different fix than a list full of dead addresses. The temptation is to skip ahead to the interesting work, warming a new domain or scrubbing contacts, and plenty of teams do exactly that before discovering the real culprit was a duplicate SPF record.

Check Your Email Authentication Best Practices

Authentication proves to receiving servers like Gmail and Outlook that your mail actually comes from you. Three DNS records do that work, and they have to agree with each other. (There is a fourth thing to get right, the MAIL FROM domain, covered alongside these in the four DNS records every sender needs.) It is also not a set-and-forget job: providers change, records drift, and nobody notices until the bounce rate moves.

SPF: Define Who Can Send

SPF (Sender Policy Framework) is a DNS TXT record that lists every server authorized to send email for your domain. The format looks like this: v=spf1 include:_spf.google.com include:sendgrid.net ~all.

The most common mistake is having more than one SPF record. The specification allows exactly one SPF TXT record per domain (RFC 7208). If you have two, receiving servers will often return a permerror and fail the check outright. Consolidate every sending service into a single record and stay under the 10-DNS-lookup limit. A tool like MXToolbox will show you your current record and its lookup count.

DKIM: Sign Your Mail

DKIM (DomainKeys Identified Mail) uses a public-private key pair to add a digital signature to your email headers. The private key stays on your sending server, and the public key is published as a DNS TXT record. When a receiving server gets your mail, it looks up your public key to decrypt the signature and verify the message was not tampered with.

A common issue is a missing or incorrect DKIM selector. Your email service provider will give you a specific selector (e.g., google, s1, k1) to use in the DNS record. If the selector is wrong, the lookup fails. Verify it by sending a test email and checking the full headers for dkim=pass.

DMARC: Set the Policy

DMARC (Domain-based Message Authentication Reporting and Conformance) tells receiving servers what to do when an email fails both SPF and DKIM. It also requires that the domain in the From header align with the domain used in those checks. A DMARC record looks like this: v=DMARC1; p=none; rua=mailto:you@yourdomain.com.

Start with p=none, which monitors traffic without affecting delivery. The rua tag sends aggregate XML reports to your inbox showing which messages pass and which fail. After a few weeks of reports, tighten to p=quarantine or p=reject (the DMARC FAQ sets out the sequence). Jumping straight to p=reject can silently block legitimate mail if your alignment is not already perfect, and I would rather read boring reports for a month than explain to sales why their sequences vanished.

The Verification Workflow

Propagation after a DNS change can take up to 48 hours, so confirm the record is live with a lookup tool before you test anything. Then send a message to a Gmail address and read the full headers. You want spf=pass, dkim=pass, and dmarc=pass; a fail or a neutral means the configuration is still wrong, no matter what the provider's setup wizard told you. Do this before you scale up sending, not after. One Gmail address only tells you about Gmail, so how to test inbox placement is the wider version of the same check.

Troubleshoot Email Bounce Codes by Type

Bounce codes in your SMTP logs tell you exactly why a message was rejected. Reading them properly is the fastest route to a fix, because the right action depends entirely on the kind of failure.

Hard Bounces vs. Soft Bounces

A hard bounce means the address does not exist or the receiving server has permanently refused delivery. Typos, deactivated accounts, and dead domains are the usual causes. Remove these addresses right away, since repeated sends to invalid addresses lower your sender reputation. If you want to know what a tolerable rate looks like before you panic about yours, that is what counts as a normal bounce rate.

A soft bounce is temporary: a full mailbox, an out-of-office responder, a server timeout. Track them rather than acting on the first one. Contacts who soft bounce across several campaigns are worth removing too, because those mailboxes are not receiving your mail in practice.

The response for each type:

Clean Your List to Improve Engagement Metrics

List hygiene means pulling inactive, invalid, and unengaged contacts before they drag your metrics down. A list full of addresses that never open anything tells receiving servers your mail is unwanted, and that judgment applies to the next campaign too.

Segment by engagement. Contacts who have not opened or clicked in 90 days get a re-engagement campaign. Whoever ignores that goes to a suppression list. The practice is often called sunsetting, and it exists to protect your sender reputation from your own history.

Where you are building a list people join themselves, double opt-in is the strongest hygiene measure available: a new subscriber confirms their address by clicking a link in a verification message before joining, which filters out most invalid addresses and bots at the source. Outbound never gets that option, because a prospect has not opted in to anything. What you can do instead is verify the addresses before the first send and know where the list came from.

How to Warm Up a New Sending Domain

A new domain has no history, and receiving servers treat unknown senders with suspicion. Warming means raising your volume gradually so mail servers build a picture of your domain before you ask anything of them.

Consistency matters more than the starting number. Begin small and increase slowly, on something like a 30-day warmup schedule. A domain that sends 50 emails a day for a week and then fires off 5,000 will trip filters, because that pattern looks like a compromised account rather than a growing business. Keep the volume steady and let it climb over days or weeks, and note that finishing the schedule is not the same as being finished, which is why day 21 is not the finish line.

Who you send to during warmup matters more than how much you send. Use your most engaged contacts, the people who open and click reliably, because their behavior is the evidence receiving servers use. Purchased lists and unengaged addresses do the reverse, and negative signals during this early period can set your reputation back significantly.

Email Sender Reputation Repair That Sticks

Reputation repair means restoring trust with receiving servers after your domain has been flagged. It takes time and a stretch of consistently good behavior, which is the part people find hardest to accept.

First, work out what caused the damage. Check your bounce rate and your spam complaint rate, and check whether the domain has been blacklisted. Feedback loops from the major mailbox providers report when recipients mark your mail as spam, which usually points at a specific campaign.

Then stop it. Pause the campaign that spiked complaints and review both its content and the segment it went to. Remove the contacts who complained. Test your unsubscribe flow properly while you are there, because a recipient who cannot find the unsubscribe link will use the spam button instead.

Monitor Results and Adjust Your Sending Pattern

Once the records are fixed, the list is trimmed, and the bounces are handled, you still need a way to notice when things slip again. Spam filters are machine learning models now, and they keep adjusting to your sending behavior and to how recipients react to it.

How Modern Spam Filters Think

Old filters ran on keyword lists and simple rules. The models at Gmail and Outlook weigh hundreds of signals, and most of them describe behavior rather than content: opens, replies, and spam complaints. The metrics do tell you when it is happening, if you know the shape: what it looks like when Google starts filtering you.

Your sending pattern is therefore a signal in its own right. A sudden volume spike from a domain with low engagement resembles a compromised account, whatever is in the message body. Because the model keeps updating, the work is ongoing rather than a state you reach.

The 30-Day Post-Fix Monitoring Workflow

A monthly glance at the dashboard will not tell you whether a fix held. Thirty days of structured attention will.

Start at a reduced volume, somewhere around 50-75% of your normal cadence, and check authentication pass rates every day for the first week. Bounce rate should drop below 2%. Any fail status in the headers means your DNS work is not finished.

In week two, bring volume back to normal and watch spam complaints. Anything above 0.1% is a warning sign. If you see a spike, pause the sends and look at both the content and the segment that produced it.

Week three is when engagement becomes readable. A sudden drop in opens usually means messages are being filtered to spam. If your open rate is more than 20% below baseline, the domain is still recovering and you should hold volume where it is.

At the end of the month, read the full data set. Stable metrics in healthy ranges mean you can resume normal sending. If they are not stable, run the cycle again with attention on whatever specific issue turned up.

Transactional vs. Marketing Sending Patterns

Transactional mail, password resets and order confirmations, is expected by the recipient, generates high engagement, and rarely gets filtered. Promotional and outbound mail is not expected in the same way and faces stricter scrutiny. Send both from the same IP and domain and you can drag your password resets into the filters your promotions earned. Keep the two setups separate, and keep promotional content out of transactional messages.

Conclusion

The sequence for fixing deliverability is unglamorous: audit the infrastructure, verify the authentication records, act on bounce codes according to type, clean the list, and warm new domains gradually. SEMAOS configures DKIM and DMARC out of the box and runs CAN-SPAM unsubscribe handling and suppression checks on every send. It also scores every contact 0-100 for engagement nightly, which surfaces inactive addresses before they affect your metrics, and custom sending domains warm on a curve that accounts for both calendar age and cumulative volume.

Most deliverability problems are not mysterious. They come from broken DNS records, stale lists, or erratic sending patterns, and each has a known fix. Run the audit first.

FAQ