Deliverability: will the newsletter arrive?

An email can be technically sent and still never be read – because it lands in the spam folder or is rejected. Large mailbox providers decide this on the basis of many signals. Senders can control two of them themselves: whether the email demonstrably comes from them and whether the recipients want it.

Three checks, briefly explained

DMARC policies: p=none (no instruction, only observe), p=quarantine (suspicious, e.g. into the spam folder) and p=reject (reject). With reports (rua=) you find out who is sending emails in your name – including whether your newsletter platform is set up correctly. The former percentage switch pct has been dropped in the current version (RFC 9989); it is replaced by the test mode t=y or t=n. In guides based on the older version RFC 7489 you will still find pct. How the reports are structured is described in the companion documents RFC 9990 (aggregate reports) and RFC 9991 (failure reports).

Creating and checking an SPF record

An SPF record is a TXT record in the DNS of the sender domain. It always begins with v=spf1; this is followed by building blocks that describe the permitted senders and, at the end, a rule for all other servers.

An example from RFC 7208 itself is v=spf1 ip4:192.0.2.0/24 mx -all: the network 192.0.2.0/24 and the domain’s mail servers may send, nobody else. The addresses and example.net above are example values; what your sending platform asks you to enter is in its instructions.

Five checkpoints according to RFC 7208:

1. Only one record per domain. If the recipient finds more than one record with v=spf1, the result is an error (“permerror”, Section 4.5). A new sending platform therefore goes into the existing record, not into a second one.
2. No more than ten DNS lookups. include, a, mx, ptr, exists and redirect trigger lookups; more than ten also lead to “permerror” (Section 4.6.4). ip4, ip6 and all do not count. An include counts together with everything in the included record. In addition, checkers should allow no more than two lookups without a result (“void lookups”), and an mx may trigger no more than ten address lookups (also Section 4.6.4).
3. No ptr. According to RFC 7208, this building block should no longer be published (Section 5.5).
4. A clear ending. If you want recipients to be able to recognise unauthorised senders unambiguously, the record must end with -all (Section 2.1). Without such an ending, no definitive statement is possible.
5. SPF alone is not enough for DMARC. SPF checks the sender in the envelope of the email (“MAIL FROM”) and the name of the sending server (“HELO”), not the visible sender line. DMARC additionally requires this domain to match the visible sender address (alignment, see the table above).

You can put the record together with the SPF builder: it counts the DNS lookups of the building blocks you enter, but does not check anything live. Whether the record has been published correctly is shown by the DMARC reports or your DNS provider.

What the large mailbox providers require

Even those who send less should set up SPF, DKIM and DMARC: Gmail requires at least SPF or DKIM from all senders, and Microsoft recommends all three methods to all senders. According to Google, authentication protects recipients against spoofing and phishing and the sender against identity theft.

One-click unsubscribe

RFC 8058 describes how an email header (List-Unsubscribe and List-Unsubscribe-Post) signals that recipients can unsubscribe with a single click – without a web page and without a confirmation step. The email program then shows, for example, an “Unsubscribe” link next to the sender. This does not replace the unsubscribe link in the body of the email.

Common reasons for ending up in the spam folder

• Sender domain without SPF/DKIM/DMARC, or sending via a service that is not listed in the SPF record.
• Bought or old address lists: many bounces and spam reports.
• Unsubscribing hidden or slow – recipients then click “Spam”.
• Suddenly sharply rising sending volumes: Google gives the example that even an immediate doubling can lead to rate limiting or a worse reputation.

Tool

You can put together a suitable DMARC record with our DMARC builder and an SPF record with the SPF builder – both run in your browser and explain every option (Tools).

Further reading

• Setting up DMARC: step by step
• Gmail, Yahoo and Outlook.com: requirements compared
• Newsletter landing in spam: finding the causes
• Metrics: bounce and complaint rate
• Glossary: SPF, DKIM, DMARC and other terms
• Start your own newsletter