Email Deliverability

Email deliverability is the ability of a sent email to successfully reach a recipient's inbox rather than being filtered to spam, quarantined, rejected, or silently dropped. For ecommerce brands, it governs the operating reliability of both marketing email (promotional campaigns, automated flows) and transactional email (order confirmations, shipping updates, password resets). Deliverability is determined by a compound of infrastructure authentication, sender reputation, list quality, content signals, and compliance with mailbox provider requirements.

How it works

Inbox providers (Google Gmail, Microsoft Outlook, Yahoo, Apple Mail) evaluate each inbound email across several signal layers before deciding where to route it:

1. Authentication checks — Does the sending domain pass SPF, DKIM, and DMARC? If not, the message may be rejected or routed to spam.
2. Reputation scoring — What is the historical behaviour of the sending IP and domain? High bounce rates, spam complaints, and sending to unknown addresses all degrade reputation.
3. Engagement signals — Do recipients open, click, and reply? Low engagement from a list indicates recipients don't want the mail.
4. Content signals — Does the email resemble spam? Heavy image-to-text ratios, misleading subject lines, and spam-flagged phrases affect filtering.
5. List quality — Are the addresses valid and opted in? Spam traps, invalid addresses, and unengaged contacts generate signals that damage sender reputation.

The bulk sender requirements wave (2024–2025)

Starting February 2024, Gmail and Yahoo mandated that any domain sending 5,000+ messages per day must have SPF, DKIM, and DMARC configured and aligned, spam complaint rates below 0.10% (hard ceiling 0.30%), one-click unsubscribe (RFC 8058) on marketing email, valid forward/reverse DNS (PTR records), and TLS-encrypted transmission. The bulk-sender classification is permanent even if send volume later drops below 5,000 (as-of 2026-03-12, per Chronos Agency).

Microsoft Outlook followed with equivalent requirements starting May 5, 2025, for any domain sending 5,000+ messages per day to @outlook.com, @hotmail.com, and @msn.com addresses. Non-compliant senders receive hard rejection error "550; 5.7.515 Access denied, sending domain [SenderDomain] does not meet the required authentication level." (as-of 2025, per Validity).

Gmail escalated from soft deferrals to permanent 550 rejections for non-compliant senders from November 2025 onward, meaning bounced messages with no retry (as-of 2026-03-12, per Chronos Agency).

Google reported the 2024 enforcement drove a 65% reduction in unauthenticated messages to Gmail users — 265 billion fewer — and more than 500,000 domains published new DMARC records in response (as-of 2024, cited by emailwarmup.com).

Authentication: SPF, DKIM, DMARC

SPF (Sender Policy Framework)

SPF authenticates the sending mail server by listing authorised IP addresses in the sending domain's DNS record. A critical failure mode for ecommerce brands: SPF authentication fails if resolving the record requires more than 10 DNS lookups. Brands using multiple sending tools (e.g. Klaviyo, Salesforce, Zendesk, HubSpot) often exceed this limit without realising it. Fix: SPF flattening or subdomain delegation (as-of 2026-03-12, per Chronos Agency).

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to outbound email. A minimum 1024-bit key is required; 2048-bit is the 2026 recommended best practice. The d= domain in the DKIM signature must align with the From header domain (as-of 2026-03-12, per Chronos Agency).

DMARC

DMARC instructs inbox providers what to do with email that fails SPF or DKIM: p=none (monitor only), p=quarantine (send to spam), or p=reject (block entirely). The 2026 recommended progression is: start at p=none with a reporting address → monitor via Google Postmaster Tools → move to p=quarantine once all legitimate streams are authenticated → progress to p=reject. Staying at p=none indefinitely signals to inbox providers that authentication data is not being acted on (as-of 2026-03-12, per Chronos Agency).

Three new DMARC RFCs (9989, 9990, 9991) governing incremental standard updates were published in 2025, per SpamResource (as-of 2025-06).

Global DMARC adoption reached 52.1% of the top 1.8 million domains as of 2026, up from 47.7% in 2025 and 27.2% in 2023 (as-of 2026, per DuoCircle). However, a January 2025 Validity study found 84% of domains used in email From addresses still do not have a published DMARC record — suggesting the growth is concentrated in larger sending domains.

BIMI

BIMI (Brand Indicators for Message Identification) displays a brand's logo as a visual badge in the inbox. It builds on a p=quarantine or p=reject DMARC policy. As of Braze's 2026 deliverability predictions, the Verified Mark Certificate (VMC) requirement is now optional — senders need only a valid DMARC record and an SVG-format trademarked logo. Gmail supports BIMI as a visible brand signal in the inbox, and Braze characterises BIMI as transitioning from a branding perk to a baseline deliverability requirement in 2026 (as-of 2026, per [[Braze]]).

Inbox placement benchmarks (as-of 2026)

Validity's 2026 Email Deliverability Benchmark Report found that Gmail achieves an average inbox placement rate of 89.8% (with Gmail holding 42.9% of global mailbox market share), and that the global average across all providers was 87.2% — a 3.7 percentage-point year-over-year improvement. Validity also states 1 in 7 legitimate, permission-based marketing emails never reaches the inbox (as-of 2026, per Validity — gated report, vendor conflict of interest noted).

Cleanlist's 2026 benchmark (published 2026-02-18) shows ecommerce inbox placement at 82% and retail at 80%, below the cross-industry average. By hygiene practice: daily/real-time verification = 0.3% bounce rate + 95% inbox placement; monthly cleaning = 1.5% bounce + 87% inbox placement; never cleaning = 6.5%+ bounce + 68% inbox placement.

Unauthenticated senders land between 30%–50% inbox placement; fully authenticated senders with clean lists reach 85%–95% (as-of 2026, per Cleanlist and DigitalApplied).

Spam complaint thresholds (as-of 2026)

Gmail's published framework: target below 0.10%, warning zone 0.10%–0.29%, critical at 0.30%+. Crossing 0.30% makes a domain ineligible for Google's delivery mitigation program; it remains ineligible until the spam rate stays below 0.30% for seven consecutive days (as-of 2026-03-12, per Chronos Agency).

Outlook's working ceiling is 0.10% — lower than Gmail's hard threshold — per Klaviyo (as-of 2025-01-04).

Cleanlist's 2026 data shows B2C ecommerce spam complaint rates sitting at 0.05%–0.06% on average — near but under the 0.10% working ceiling (as-of 2026-02-18).

Bounce handling

Klaviyo auto-suppresses any email address that hard bounces, and suppresses addresses that soft bounce more than 7 consecutive times. Once suppressed, profiles are removed from all lists. Only soft bounces within the past 2 years count toward the 7-bounce threshold. Klaviyo also flags addresses as "suspicious" across its entire infrastructure — a hard bounce in any Klaviyo customer's account causes the address to be automatically skipped by all other Klaviyo senders. Klaviyo's deliverability hub (Analytics > Deliverability) provides a heatmap of bounce categories by inbox provider (as-of 2026-02-13, per Klaviyo Help Center).

Klaviyo bounce targets: hard bounce under 0.2%, soft bounce under 2% (as-of 2025-01-04, per Klaviyo blog).

List hygiene and data decay

Email lists lose approximately 22.5% of their B2B contact value per year due to job changes (Bureau of Labor Statistics, 2025, cited by Cleanlist). B2C ecommerce lists decay more slowly but still require active management.

Cleaning cadence recommendations: daily/real-time for the highest inbox placement; monthly for high-volume senders (100,000+ emails/month); quarterly for smaller senders (as-of 2026, per Cleanlist and Hustler Marketing).

Sunset flows targeting unengaged subscribers are standard practice. Recommended inactivity window before suppression: 6–9 months for general ecommerce; up to 18 months for categories with longer buying cycles. Braze 2026 found that only 23.6% of businesses verify their email lists before every campaign.

The primary free reputation-monitoring tools: Google Postmaster Tools v2 (Gmail-specific spam rate, authentication status, delivery errors), Microsoft SNDS (Outlook/Hotmail equivalent), and Sender Score (Validity, a 0–100 aggregated domain reputation score). Senders with a Validity Sender Score below 70 typically see inbox placement drop under 50% (as-of 2026, per DigitalApplied citing Validity data).

Google Postmaster Tools v2

As of September 30, 2025, all users were migrated to Google Postmaster Tools v2; v1 (including Domain Reputation and IP Reputation dashboards) was permanently retired. Postmaster Tools v2 evaluates senders on a binary Pass/Fail Compliance Status rather than the granular reputation scores of v1. In early June 2026, Google added a "Deliverability analysis" section within the v2 Compliance Status dashboard providing plain-language verdicts and recommended actions (as-of 2026, per TrulyInbox/Act-On).

Key 2025–2026 inbox changes affecting ecommerce

Gmail Promotions tab relevance sort (September 2025)

On September 11, 2025, Gmail switched the Promotions tab from chronological ("Most Recent") to algorithmic ("Most Relevant") by default. Emails from lower-engagement senders are pushed further down the tab. Practitioners reported open rate declines following this change.

Gmail open tracking decline (early 2026)

Gmail open rates began declining in early 2026 in ways that don't correlate with sender-side changes. The leading theory among deliverability analysts: Gmail is reducing the frequency of its image prefetching, meaning fewer tracking pixels fire before a subscriber actually opens — suppressing reported open rates even for healthy senders (as-of 2026, per Validity and beehiiv).

Gmail "Manage Subscriptions" view (2025-09-30)

Gmail launched a dedicated "Manage Subscriptions" view showing all brands a subscriber receives marketing from, recent send frequency per brand, and a one-click unsubscribe — bypassing individual email unsubscribe flows (as-of 2025-09-30, per [[Klaviyo]]).

Microsoft Outlook rate-limiting (February 2026)

Starting February 23, 2026, Outlook and Hotmail deployed aggressive rate-limiting, generating error "451 4.7.650 — mail server has been temporarily rate limited due to IP reputation." Operators reported that password resets, order confirmations, and 2FA codes to outlook.com/hotmail.com addresses stopped arriving. Persistent 421 deferrals continued post-March 2026 (as-of 2026-02, per SpamResource and engagor.ai).

Yahoo storage cut and soft bounce surge (August 2025)

Yahoo reduced free storage from 1 TB to 20 GB with the change fully in effect August 27, 2025. Senders reported a notable increase in over-quota soft bounces for Yahoo addresses following this change (as-of 2025-08, per beehiiv).

AI summarisation in inboxes

Gmail and Outlook are generating subject-line summaries and prioritisation tiers before recipients see the actual email, creating a new deliverability-adjacent filter layer beyond traditional spam classification (as-of 2025-11, per ecommerce email marketing practitioner YouTube source).

Ecommerce-specific practices

Transactional vs. promotional separation

Practitioners consistently recommend sending order confirmations, shipping notices, and password resets from a different subdomain or domain than promotional campaigns. If marketing reputation declines, transactional emails — which are critical to revenue and customer trust — should be insulated. RFC 8058 one-click unsubscribe does not apply to transactional email (per Chronos Agency, 2026-03-12).

Branded sending domains

Using a branded/custom sending domain (rather than a shared ESP domain) is a de facto requirement for bulk Gmail and Yahoo senders. Without it, emails show "via klaviyomail.com" in Gmail's From header — flagged as a trust signal by inbox providers (as-of 2025, per InboxArmy and Aeolidia citing Klaviyo and Shopify requirements).

BFCM period risks

Volume spikes, stale lists, and seasonal fatigue are the three primary inbox placement risks during Black Friday / Cyber Monday (BFCM). Pre-BFCM list cleaning and dedicated sender warm-up are the standard recommended mitigations (as-of 2025-09-16, per ZeroBounce/Klaviyo BFCM webinar).

Country-specific factors (Europe)

Deliverability strategy differs by market: in the US and UK inbox providers primarily score on user engagement (opens, clicks); in Germany the key factor is infrastructure (dedicated IP, double opt-in legally required, clean list); in France content is paramount — the Vade filter (used by Orange and SFR) blocks repetitive or un-personalised sends and Free temporarily blocks IPs if content appears spammy (as-of 2026, per YOCTO Agency — Klaviyo Elite Partner, companion content updated 2026-06-07).

IP and domain warm-up

Warm-up guidance (2026): start at 5–10 emails per day, increase by 10–20 per week over 4–8 weeks; fresh domains need 12+ weeks to reach full maturity. Cold outreach should be capped at 100–150 emails per day per mailbox; volumes above 150/day trigger throttling on Gmail and Outlook within a week (as-of 2026, per mailtoaster.ai). Warm-up networks operate at scale: TrulyInbox uses 40,000+ real high-reputation inboxes; Warmbox uses 35,000+ private email accounts across 100+ countries.

Inbox placement testing tools (as-of 2026)

• InboxMonster — recommended for high-volume senders (3M+ emails/month)
• GlockApps — mid-tier inbox placement testing
• Mail-Tester.com — lightweight option for smaller senders
• Litmus — pre-send spam testing (70% of emails show at least one detectable spam issue before send, per Litmus)

Key terms

Term	Meaning
Inbox placement rate (IPR)	% of sent emails that land in the inbox (not spam, not bounced)
Hard bounce	Permanent delivery failure (invalid address, domain doesn't exist)
Soft bounce	Temporary delivery failure (mailbox full, server unavailable)
Spam complaint rate	% of recipients who click "This is spam" — the primary reputation-damage metric
SPF	DNS record listing IP addresses authorised to send mail for a domain
DKIM	Cryptographic email signature verifying message integrity and sender domain
DMARC	Policy that tells inbox providers what to do when SPF/DKIM fails
BIMI	Standard for displaying brand logo in inbox; builds on DMARC p=quarantine or p=reject
One-click unsubscribe (RFC 8058)	HTTP POST mechanism allowing instant list removal; required by Gmail/Yahoo bulk sender rules
Sender Score	Validity's 0–100 domain reputation metric
Sunset flow	Automated sequence that identifies and suppresses chronically unengaged subscribers
Warm-up	Gradual increase in send volume from a new IP/domain to build reputation before full deployment