Deliverability: Getting into the Inbox

The pillars of deliverability

1. Authentication: SPF, DKIM and DMARC passing and aligned with your From domain.
2. Reputation: built by sending wanted email consistently; damaged by bounces, spam complaints and spam traps.
3. Content: clear, relevant, not deceptive.
4. Engagement: people opening and not reporting your messages.

Protect your reputation

• Only email people who signed up; never buy lists.
• Verify addresses at sign-up with a confirmation email.
• Remove addresses that hard bounce (do not exist) immediately; providers usually suppress them automatically.
• Stop emailing people who mark you as spam (complaint feedback).
• Ramp up volume gradually on a new domain or provider ("warming up").

Content tips

• A recognisable From name and a subject that matches the content.
• Balanced text and images; no image-only emails.
• Avoid URL shorteners and link to your own domain.
• Include your business's physical address and an unsubscribe link in marketing email (legally required in many countries).

Webhooks for delivery events

Providers send webhooks for delivered, bounced, complained and more. Store them:

@hooks_bp.post("/webhooks/email")
def email_events():
    verify_signature(request)                 # provider-specific signing secret
    event = request.get_json()
    if event["type"] in ("email.bounced", "email.complained"):
        mark_undeliverable(event["data"]["to"])
    return "", 204

Diagnosing spam placement

• Check message headers in Gmail ("Show original") for SPF, DKIM and DMARC results.
• Use Google Postmaster Tools and Microsoft SNDS for reputation data.
• Test with a seed list across providers, and check blocklists if delivery suddenly drops.

Exercise

Add bounce and complaint webhooks to your app, suppress affected addresses, and send test messages to Gmail and Outlook accounts, confirming authentication passes in the headers.

Check yourself

• Name the four pillars of deliverability.
• What should happen to an address that hard bounces?
• Where do you check whether DKIM passed?