Guides

Email deliverability checklist for small firms

31 October 2026

For a small business, deliverability comes down to two things: proving the mail is yours, and sending only to people who want it. That means SPF, DKIM, and DMARC on your domain, one-click unsubscribe on marketing mail, a clean list, and a spam complaint rate under 0.3%. The checklist below follows the order to do them in, with the source for each item.

Work top to bottom. The first section is DNS you can finish in an afternoon. The later sections are habits.

1. Know who sends as you

List every service that sends email from your domain. Your mailbox (Google Workspace or Microsoft 365), newsletter platform, store, help desk, invoicing, booking, and any website form. Each one needs to be authenticated separately.
Send from your own domain, not a free address. Mailchimp’s domain authentication article says public email services like Gmail and Yahoo cannot be authenticated, and Google’s sender guidelines say not to impersonate Gmail From headers. A newsletter sent “from” a gmail.com address through a marketing tool does both.
Use a consistent From address for each kind of mail. Google suggests separate addresses for things like receipts, promotions, and account alerts, and says not to mix promotional content into receipts.

2. Authenticate the domain

One SPF record listing the services that send with your domain in the envelope sender. One TXT record, ending in ~all or -all, under ten DNS lookups. See how to create an SPF record, fixing too many lookups, and ~all versus -all.
DKIM on your domain for every service. It is the check most likely to keep passing DMARC when mail is forwarded. Use 2048-bit keys where offered. Google requires at least 1024 bits for mail to Gmail. See how to set up DKIM, plus platform specifics for Google Workspace, Microsoft 365, and Mailchimp and Klaviyo.
A DMARC record with reports. Start with v=DMARC1; p=none; rua=mailto:… at _dmarc.yourdomain.com. Google’s DMARC setup page suggests waiting 48 hours after SPF and DKIM before adding it.
Alignment. For DMARC to pass, SPF or DKIM must pass on a domain that matches your From address. A pass on the provider’s domain does not count. See why DMARC fails.
Lock down domains you do not send from. Microsoft’s SPF guidance gives v=spf1 -all for parked domains, and its DMARC guidance gives v=DMARC1; p=reject;.

3. Meet the big-provider rules

Google, Yahoo, and Microsoft all publish requirements. Our guide to the Google and Yahoo sender requirements has the detail. The short version:

Every sender: SPF or DKIM, valid forward and reverse DNS on the sending IP, TLS, properly formatted messages, and a spam rate under 0.3%. Your email platform handles the IP and TLS parts. You handle the DNS.
More than 5,000 messages a day to Gmail: SPF and DKIM, DMARC that passes with an aligned domain, and one-click unsubscribe on marketing mail. Google’s FAQ says the count includes subdomains of the same primary domain, and that bulk sender status never expires.
Yahoo bulk senders: the same list, without a published number for “bulk.” Yahoo’s page asks that unsubscribes be honored within two days.
Outlook.com: domains sending more than 5,000 messages a day must pass SPF and DKIM and publish DMARC of at least p=none, according to Microsoft’s postmaster policies.

Even if you send less than that, meeting the bulk list costs little and covers you if a campaign ever pushes you over.

4. Make unsubscribing easy

A visible unsubscribe link in every marketing message. Google says always give recipients an easy way to unsubscribe.
One-click unsubscribe headers on marketing and subscribed mail: List-Unsubscribe with an HTTPS link and List-Unsubscribe-Post: List-Unsubscribe=One-Click, as defined in RFC 8058. Check whether your newsletter platform adds them for you.
Honor requests within two days. Yahoo says two days. Google’s FAQ says 48 hours.
Transactional mail is exempt from the one-click rule. Google lists password resets, reservation confirmations, and form confirmations as examples.

5. Keep the list clean

Google’s sender guidelines are specific here:

Confirm opt-in. Make sure each person chose to get your messages. Confirm the address before subscribing it.
Never buy lists. Google says not to purchase email addresses from other companies.
No pre-checked boxes that subscribe people automatically at checkout or signup.
Check in periodically that subscribers still want your mail.
Drop people who never open and addresses that bounce repeatedly. Google suggests considering both.

6. Write mail that looks like what it is

No hidden content. Google says hiding content with HTML or CSS can get messages marked as spam.
No fake “Re:” or “Fwd:” on messages that are not replies or forwards.
Clear links. Google asks that links be visible so recipients know where they go.
Do not impersonate other domains or senders.

7. Watch the numbers

Google Postmaster Tools. Verify your domain to see spam rate, authentication results, and reputation for mail to Gmail. Google says to keep the spam rate below 0.10% and never let it reach 0.30%.
DMARC reports. Read them weekly at first. They list every source sending as your domain and whether it passed. See how to read a DMARC report.
Bounces. A bounce that mentions authentication or DMARC points at your DNS. Google’s FAQ lists its codes, such as 5.7.27 for SPF and 4.7.30 or 5.7.30 for DKIM.
Shared IPs. Google notes that on a shared IP, every sender’s activity affects the reputation of all of them. If you are on a newsletter platform’s shared pool, your own list hygiene is the part you control.

8. Tighten DMARC when the reports are clean

Once every legitimate source passes, move from p=none to p=quarantine, and later to p=reject if it suits your domain. That asks receivers to filter or refuse mail that pretends to come from your exact domain. Google’s recommended rollout suggests at least a week at p=none first. Our guide to DMARC policies covers the steps. With enforcement in place, BIMI becomes an option if you want your logo in the inbox.

What a checklist cannot promise

Google says authenticated messages are less likely to be rejected or marked as spam. Less likely, not never. Providers also weigh complaints, engagement, content, and sending history. The checklist removes the avoidable reasons for trouble. Mail to people who did not ask for it will still struggle, however good the DNS.

The checklist, short form

Every sending service listed.
Sending from your own domain.
One SPF record, under ten lookups.
DKIM on your domain for every service, 2048-bit where offered.
DMARC at p=none with rua reports.
SPF or DKIM aligned with the From domain for every source.
Unused domains locked with v=spf1 -all and p=reject.
Visible unsubscribe link plus one-click headers on marketing mail.
Unsubscribes honored within two days.
Opt-in only, no bought lists, no pre-checked boxes.
Inactive and bouncing addresses removed.
Postmaster Tools set up, spam rate under 0.10%.
DMARC reports reviewed, then policy moved to quarantine or reject.