Md Nayeem Hossain | Software Engineer

Email Deliverability for Developers: SPF, DKIM, DMARC and Beyond#

When we built our own SMTP server to send transactional and campaign email without per-message fees, the server itself was the easy part. Getting Gmail and Outlook to actually put those emails in the inbox — not the spam folder — was the real project.

Sending email is trivial. Being trusted as a sender is not. This post covers what developers need to know.

Why email ends up in spam#

Mailbox providers decide where a message goes based on two questions: can they prove who sent it, and does this sender have a good reputation? Authentication answers the first. Your sending behavior answers the second. Since early 2024, Gmail and Yahoo require proper authentication for bulk senders, so this is no longer optional.

SPF: who is allowed to send#

Sender Policy Framework is a DNS record listing the servers allowed to send mail for your domain:

text

1example.com.  TXT  "v=spf1 ip4:203.0.113.25 include:_spf.google.com -all"

ip4: authorizes your own sending server.
include: authorizes a provider you also send through.
-all tells receivers to reject anything else.

Watch the 10-DNS-lookup limit. Every include can trigger nested lookups, and exceeding the limit makes SPF fail entirely.

DKIM: proof the message was not altered#

DomainKeys Identified Mail signs each outgoing message with a private key. The public key is published in DNS, and receivers verify that the signature matches:

text

1s1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOC..."

Use 2048-bit keys, keep the private key secure on the sending server, and rotate keys periodically using selectors (s1, s2) so you can switch without downtime.

DMARC: tying it together#

SPF and DKIM prove things about servers and signatures, but not necessarily about the address the user sees in the From: header. DMARC requires alignment: the domain that passed SPF or DKIM must match the visible From domain. It also tells receivers what to do when checks fail, and sends you reports.

text

1_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=s; aspf=s"

Roll it out gradually:

Start with p=none and collect aggregate reports for a few weeks.
Fix every legitimate source that fails — forgotten tools, marketing platforms, a CRM sending on your behalf.
Move to p=quarantine, then p=reject once reports are clean.

A p=reject policy also stops attackers from spoofing your domain in phishing emails.

Reverse DNS and the basics of your own server#

If you run your own SMTP server, a few more things must be right:

Reverse DNS (PTR record): the sending IP should resolve back to a hostname, which resolves forward to the same IP.
TLS: support STARTTLS for both receiving and sending.
A clean IP: check that the IP is not on public blocklists before you start using it.
Bounce handling: process bounces and stop sending to invalid addresses immediately.

Reputation is earned slowly#

Authentication gets you considered. Reputation gets you delivered.

Warm up new IPs and domains. Start with small volumes to your most engaged recipients and increase over weeks. Sending a large campaign from a brand-new IP is the fastest way onto a blocklist.
Separate transactional and marketing mail, ideally with different subdomains or IPs, so a marketing campaign with complaints never hurts password-reset delivery.
Keep lists clean. Remove hard bounces immediately and stop mailing people who have not engaged in months.
Make unsubscribing easy. Include a one-click List-Unsubscribe header. Users who cannot unsubscribe click "Report spam" instead, which is far more damaging.
Keep complaint rates very low. Mailbox providers watch spam complaint rates closely, and even a fraction of a percent can trigger filtering.

Content still matters, a little#

Authentication and reputation dominate, but content can tip the balance:

Send a plain-text alternative along with HTML.
Avoid link shorteners and mismatched link text.
Keep a reasonable balance between images and text.
Make sure the sender name and subject are honest and expected.

Monitor deliverability continuously#

Use Google Postmaster Tools and Microsoft SNDS to watch domain and IP reputation.
Read DMARC aggregate reports, or use a service that summarizes them.
Track bounce, complaint and open rates per campaign type, and alert on sudden changes.

Conclusion#

Inbox placement depends on proving who you are and behaving like a trustworthy sender. Publish SPF, sign with DKIM, enforce DMARC gradually, configure reverse DNS and TLS on your own server, warm up new infrastructure, separate transactional from marketing mail and keep lists clean. Get these right and your emails land where you intended — in the inbox.