Your email campaign went out. Open rates look fine. But conversions are off, replies are thin, and you’re starting to wonder if anyone actually got it.
Here’s what nobody tells you: a lot of those emails never landed in the inbox at all. They hit a spam folder, bounced silently, or got swallowed by a mail server that gave your sending domain a quiet thumbs-down.
Email deliverability isn’t a setting you configure once. It’s an ongoing signal your domain sends to every mail server you touch — and those servers are making judgments about you on every send. Understanding how that works is the difference between a list that performs and one that quietly degrades your reputation every time you use it.
What email deliverability actually means
Deliverability gets used as a catch-all term, but it’s worth being precise. It breaks into two things:
Delivery rate is whether your email reached a mail server at all — didn’t bounce, wasn’t rejected outright. Most sending tools report this number, and most of the time it looks fine.
Inbox placement rate is the one that actually matters: of the emails that got delivered, what percentage landed in the inbox vs. spam vs. promotions? This number is hard to measure and most senders don’t track it. Which is exactly why deliverability problems stay hidden until they’re serious.
The gap between those two numbers is where sender reputation lives.
How mail servers decide what to do with your email
When you send an email, the receiving mail server runs it through a rapid-fire evaluation. It’s not reading the content first — it’s checking signals about you as a sender before it even gets that far.
The main checks happen in roughly this order:
Authentication: Does your domain pass SPF, DKIM, and DMARC? These three protocols confirm you are who you say you are. SPF says which servers are allowed to send on your domain’s behalf. DKIM adds a cryptographic signature to your emails. DMARC tells the receiving server what to do if either check fails. If you’re not passing all three, you’re starting behind.
Reputation signals: What does the receiving server know about your sending IP and domain? It pulls from reputation databases — Spamhaus, Barracuda, Senderscore — and checks whether you’ve been flagged before. A single campaign to a dirty list can land your IP on a blocklist that takes weeks to clear.
Engagement history: Gmail and Outlook in particular use engagement signals from their own users. If people who previously got your emails marked them as spam, ignored them entirely, or unsubscribed at high rates, that feeds into how future emails from you get treated. Engagement is a signal of trust, and trust is earned over time and lost quickly.
List quality: Sending to invalid addresses, spam traps, or role accounts (info@, admin@, noreply@) tells mail servers your list is poorly maintained. Spam traps specifically — email addresses set up to catch senders who are buying lists or scraping without consent — are a hard signal that something’s wrong. Hit enough of them and you’re blacklisted.
The bounce rate problem most senders underestimate
Hard bounces are the visible part of a list quality problem. A hard bounce means the email address doesn’t exist — the mailbox is gone, the domain has expired, or the address was never real. Mail servers treat a high hard bounce rate as a red flag that you either bought a list or haven’t cleaned yours in years.
The threshold most ESPs use before they start throttling or suspending accounts: 2%. That sounds generous until you realize a list of 100,000 addresses with 3% invalids means 3,000 hard bounces on a single send.
But hard bounces are actually the easy part to fix. The harder problem is soft bounces and catch-all domains.
A soft bounce means the email was rejected temporarily — the mailbox was full, the server was down, the message was too large. Senders are usually instructed to retry soft bounces, and most ESPs do this automatically. The issue is when soft bounces are systematic, not random. An address that soft-bounces repeatedly is essentially invalid, but it never shows up in your hard bounce rate.
Catch-all domains are trickier. These are domains configured to accept email sent to any address at that domain — whether or not the mailbox exists. So anyone@company.com will “deliver” even if there’s no one named anyone. Verification tools that only check delivery can’t distinguish between a real mailbox and a catch-all black hole. You need a verification tool that specifically identifies catch-all domains and gives you a risk signal — not just a binary valid/invalid.
Sender reputation: what it is and how you lose it
Sender reputation is a score — sometimes explicit, sometimes implicit — that ISPs and mail providers maintain on your sending IP and domain. You don’t get to see it directly. You infer it from your inbox placement rates, open rates, and whether you start appearing on blocklists.
Here’s how reputation degrades:
You send to a stale list. Some addresses are invalid — hard bounces. Some are spam traps. Some belong to users who haven’t opened anything from you in 18 months and have been quietly marking your stuff as spam. The ISP sees all of this. Your reputation score drops. The next campaign gets filtered more aggressively. Your open rate falls, which looks like an engagement problem, which triggers more aggressive filtering. The cycle compounds.
Recovering from this takes months of clean sending. That means low volume, high engagement, verified lists, and impeccable authentication — consistently. There’s no shortcut. This is why prevention is so much cheaper than remediation.
List hygiene: the unsexy thing that actually saves deliverability
List hygiene is just keeping your email list clean. It’s not glamorous. It doesn’t make a great case study. But it’s the single most controllable variable in your deliverability equation.
What it actually involves:
Verification before sending. Any list that’s more than 90 days old should be verified before you send to it. Addresses go stale faster than most people expect — B2B lists especially, where job changes mean abandoned corporate emails. A 12-month-old list of 50,000 contacts might have 5,000–8,000 invalids by now.
Real-time verification at signup. If you’re collecting emails through a form, verify them before they enter your system. This catches typos, fake submissions, and disposable email addresses the moment they happen — before they pollute your list. The latency on a good verification API is under 300 milliseconds. That’s fast enough to check before the form even submits.
Suppression lists. Everyone who hard-bounces, unsubscribes, or marks you as spam goes on a suppression list and never gets mailed again. This sounds obvious. It’s surprising how often systems fail to maintain this properly, especially when you’re syncing lists across multiple tools.
Re-engagement campaigns — and knowing when to stop. Before you kill a segment of contacts who haven’t opened anything in six months, run one re-engagement campaign. Give them a reason to stay and an easy way to leave. Whoever doesn’t respond gets suppressed. Sending to chronically unengaged addresses is one of the cleanest ways to tank your reputation with Gmail.
What happens when things go wrong
Deliverability problems don’t announce themselves. They reveal themselves slowly through symptoms you can misdiagnose:
Open rates drop. You assume it’s the subject line. You A/B test. The winner is still underperforming. The actual problem is that 30% of your list is now going to spam.
Revenue from email falls. You attribute it to seasonality or audience fatigue. The actual problem is that your domain is on a blocklist you haven’t checked.
A specific ESP segment stops performing. You think it’s a list segment issue. The actual problem is that your sending IP has been flagged by Spamhaus and a major ISP is blocking you outright.
None of these are immediately obvious. Which is why monitoring matters — checking your blocklist status regularly, watching your bounce rates by category (hard vs. soft vs. unknown), and tracking inbox placement with seed list testing if you’re sending at high volume.
The infrastructure side: what actually controls your reputation
Authentication protocols set the floor. Without SPF, DKIM, and DMARC properly configured, you’re unverified — and unverified senders get treated with suspicion by default. This is table stakes in 2026, not a differentiator.
Above that floor, a few factors matter more than most senders realize:
IP warmup. A new sending IP has no reputation — which is almost as bad as a bad reputation. ISPs see high volume from an unknown IP and get cautious. Warmup means starting with low volume, gradually increasing it over weeks, so you build a track record of clean sending before you hit it hard. Skip this and your first big campaign can permanently damage an IP you were about to rely on.
Dedicated vs. shared IPs. Most SMBs send through shared IP pools — your reputation is tied to everyone else sending through that pool. Dedicated IPs give you full control of your own reputation, but they also mean you own any problems. At high enough volume (generally above 200,000 emails/month), dedicated IPs are worth the overhead.
Sending consistency. Mail servers prefer predictable patterns. A domain that sends 500 emails every Tuesday is more trustworthy than one that’s silent for two months and then blasts 200,000 at once. Consistency signals a legitimate sending operation. Sporadic high-volume bursts trigger filtering.
How email verification fits into all of this
Verification is the input control. Everything else in deliverability is about how you behave once your list is built — but verification determines the quality of what you’re building from.
A proper verification pipeline does several things that a simple “is this email address formatted correctly?” check doesn’t:
It runs a real SMTP handshake with the mail server and checks whether the mailbox exists. Syntax checks are necessary but not sufficient — plenty of correctly-formatted email addresses don’t resolve to real inboxes.
It identifies catch-all domains separately, so you can make informed decisions about whether to include them rather than treating them as confirmed deliverable.
It checks against known disposable email domains — the throwaway addresses people use to get past signup gates. These addresses have high spam rates and zero legitimate engagement. They have no place on a marketing list.
It cross-references against spam trap signatures. Spam traps look like legitimate addresses. They pass syntax checks. Some of them even pass basic SMTP checks because they’re set up to accept email. The only way to catch them is to check against a maintained database of known traps.
The result isn’t a perfect list — no tool gives you that, and any tool claiming otherwise is overstating. What you get is a significantly lower risk profile: fewer hard bounces, fewer spam trap hits, and a meaningful reduction in the probability that your next campaign accelerates reputation damage instead of revenue.
Getting practical: where to start
If you’ve read this far and you’re not sure where your deliverability actually stands, start with the basics before anything else:
Check your authentication. Run your domain through MXToolbox and verify that SPF, DKIM, and DMARC are all configured correctly. If any of them are missing or misconfigured, fix that before anything else.
Check the blocklists. MXToolbox also has a blacklist checker. Run your sending IP and domain. If you’re listed somewhere, that explains a lot — and you’ll need to address it directly with the relevant blocklist provider.
Verify your list. Especially if it’s over 90 days old or came from any source other than confirmed opt-in. Run it through a verification tool, suppress anything that comes back as invalid or high-risk, and don’t send to catch-all addresses unless you have a specific reason to accept the risk.
After that: set up real-time verification at your signup points, add hard bounces to your suppression list automatically, and make a habit of re-engagement before suppression for any segment that’s been cold for more than six months.
Deliverability problems compound quietly over time. The right moment to address them is before you can see them in your metrics — because by the time they’re visible, you’re already in remediation mode.
Start with a clean list. Keep it that way. Everything else gets easier from there.
