The Cleanify deliverability guide.

What deliverability actually means.

Deliverability is not "did the email send." It's "did the email reach the inbox, on time, with the header your recipient will trust." Those are three different things and you can be winning on one while silently losing the other two.

Every email you send is evaluated by the receiving mailbox provider against three axes: identity (is this really from who it claims?), reputation (do we trust this sender's history?), and content (does this message look like what that sender usually sends?). Failing any one drops you to promotions; failing two sends you to spam; failing three blocks you at the SMTP layer.

Authentication — SPF, DKIM, DMARC.

These three DNS records are the baseline for "identity." Without them, large providers treat your domain as anonymous and your mail gets the treatment anonymous mail deserves.

SPF · who is allowed to send?

An SPF record lists the IPs and hostnames permitted to send on your domain's behalf. Keep it under 10 DNS lookups. Over that, providers return permerror and your authentication collapses.

DKIM · did the message arrive intact?

A DKIM signature is a cryptographic proof that the headers and body haven't been tampered with since the signing server sent them. Rotate keys annually. Use 2048-bit at minimum.

DMARC · what happens on failure?

DMARC ties SPF and DKIM to the From header and tells receivers what to do when something's off: none (monitor), quarantine (spam), or reject. Start at p=none, read the reports for 30 days, then move to p=quarantine.

Reputation signals — the scorecard.

Providers weight roughly a dozen signals. The important ones, in rough order:

• Complaint rate — subscribers hitting "mark as spam." Target under 0.1%.
• Bounce rate — hard bounces after send. Target under 1%.
• Engagement — opens, clicks, replies. Rising trend matters more than absolute number.
• Send-volume consistency — sudden spikes look like spam campaigns. Ramp gradually.
• Spam trap hits — any hit is bad; a recycled trap hit is catastrophic.
• Authentication pass rate — close to 100% or you look spoofable.

List hygiene — the actual lever.

You can't control Gmail's algorithm. You can control what you send into it. Clean lists are the single highest-leverage action available to most senders.

Three hygiene rules

• Verify on capture. Every signup runs through the API inline. Disposable and obviously-invalid addresses never reach your ESP.
• Verify before import. Any list you didn't capture yourself — purchased, event-sourced, re-engaged — gets a bulk pass first.
• Re-verify every 90 days. Lists decay at roughly 2–3% per month. What was clean in January is medium-dirty by April.

Bounce handling.

Bounces come in two flavors — and treating them identically is how most teams dig the hole deeper.

Hard bounces

Permanent failures: mailbox does not exist, domain is dead, explicit reject. Remove from active lists within 24 hours of the bounce. Never re-send.

Soft bounces

Transient failures: mailbox full, server unreachable, greylisted. Retry twice on a backoff (6h, 24h). After a third failure in 30 days, treat as hard.

Spam traps & feedback loops.

A spam trap is an address that exists only to catch senders with bad practices. Hitting one tells the receiving provider "this sender does not maintain their list." Three kinds:

• Pristine traps — addresses that were never valid. If you hit one, you scraped or bought your list. Providers weight these heaviest.
• Recycled traps — addresses that used to be real, were abandoned for 12+ months, and are now turned into traps. Indicates you don't re-verify.
• Typo traps — e.g. @gmial.com. Catch these at capture with validation, not verification.

Warming a new sending domain.

If you move to a new domain, ramp your volume over four weeks. Day 1: 50 sends to your most engaged segment. Double every 2–3 days. Watch complaint and bounce metrics at every step.

Incident response.

You're being throttled. Opens have dropped 30% overnight. What you do in the first 48 hours determines how long recovery takes.