Email Deliverability in 2026: SPF, DKIM, DMARC and the Habits That Get Your Campaigns Seen
Sending an email isn't the same as reaching an inbox.
A campaign can leave your marketing dashboard successfully and still land in spam, be temporarily deferred or fail authentication. When that happens, changing the subject line won't fix a broken sending domain.
Visisto helps you organise Contacts, send Email campaigns, use supported Automations and review the results. But the real work of dependable email marketing starts with the sender: domain authentication, permission-based audiences, clear messages and responsible sending behaviour.
You don't need to become a mail-server engineer to understand those fundamentals.
Start with a verified sending identity. Send something people asked for. Watch the signals. Improve the next campaign.
Start email campaigns with Visisto.
Delivery, deliverability and inbox placement aren't the same number
Marketing dashboards often use terms that sound interchangeable.
They aren't.
| Term | What it means | What it doesn't prove |
|---|---|---|
| Accepted by sending provider | The provider accepted your sending request | That the recipient's mail server accepted it |
| Delivered | The recipient's mail system accepted the message, depending on provider reporting | That the message reached the primary inbox |
| Inbox placement | The message actually appeared in an inbox rather than spam or another folder | That the person read it |
| Open rate | A tracking signal suggested an email was opened | That a human definitely saw or valued it |
| Click rate | A measurable link interaction happened | That the click led to a sale |
A platform's high delivery percentage cannot guarantee your specific recipients' inbox placement. Mail servers use authentication, reputation, user feedback, filtering rules and other signals.
Google explicitly notes that it cannot verify third-party open rates.
The job isn't to make the “sent” counter rise. It's to build a sender people and inbox providers have good reasons to trust.
SPF: tell receiving servers which systems may send for your domain
SPF stands for Sender Policy Framework. It publishes a DNS-based policy identifying systems authorised to send mail using a particular envelope-domain identity.
A simplified conceptual record might look like:
`v=spf1 include:example-provider.invalid ~all`
That is illustrative syntax only, not a working Visisto configuration. Do not copy it into DNS.
Use the record values and instructions supplied by the email-sending system you actually use. If your domain already sends mail through other legitimate systems, plan SPF changes carefully so you don't accidentally break existing mail.
Important details:
- SPF typically evaluates the SMTP envelope sender domain, not merely the address displayed to a reader.
- A visible From address can look correct while the underlying authentication isn't aligned.
- A domain should not be given multiple conflicting SPF TXT records.
- DNS records need time to propagate and must be verified after editing.
Don't paste an SPF record you found in a blog unless it exactly matches the providers sending your mail.
DKIM: attach a verifiable signature to the email
DKIM stands for DomainKeys Identified Mail.
The sending system signs selected message content and headers, and the receiving system uses a public key published in DNS to verify the signature.
A valid DKIM signature helps demonstrate that signed parts of the message weren't altered in a way that breaks verification and that the signing domain can be associated with the message.
You will usually configure a DNS record or records provided by your email service, including a selector-specific host. The exact value depends on the provider.
Check whether the sending system reports DKIM as verified. Send a controlled test and inspect authentication results where available.
Don't confuse a record existing in DNS with the outgoing messages actually signing correctly.
DMARC: specify how SPF or DKIM relates to the From domain
DMARC stands for Domain-based Message Authentication, Reporting and Conformance.
It builds on SPF and DKIM and focuses on alignment with the visible From domain.
A conceptual monitoring policy could be:
`v=DMARC1; p=none; rua=mailto:dmarc-reports@example.invalid`
Again, this is illustrative, not a recommended record for copying. Your domain's actual DMARC policy and reporting destination must be chosen carefully.
The policies most commonly discussed are:
- p=none: monitor and collect applicable authentication reports without requesting quarantine or rejection solely under the DMARC policy.
- p=quarantine: request that failing mail be treated suspiciously, often by routing it to spam or another restricted location.
- p=reject: request rejection for mail failing DMARC under the policy.
A DMARC pass generally requires a passing SPF or DKIM result that aligns appropriately with the visible From domain.
SPF, DKIM and DMARC are related, not interchangeable checkboxes.
If your business sends through several products—such as transactional mail, employee mail and marketing mail—inventory those senders before moving from monitoring to stricter enforcement.
Google's 2026 sender requirements: what actually applies
Google's Email sender guidelines distinguish between requirements for all senders to Gmail accounts and additional requirements for senders sending more than 5,000 messages per day to personal Gmail accounts.
For all senders, Google requires SPF or DKIM, relevant DNS configuration, TLS for transmitting email, compliant formatting and responsible sending behaviour.
For senders above the bulk threshold, Google specifies SPF and DKIM, DMARC for the sending domain, appropriate alignment and unsubscribe requirements for marketing and subscribed messages.
Google's sender FAQ also explains one-click unsubscribe requirements for marketing and promotional mail, and that transactional messages such as certain service confirmations are handled differently.
Don't read “5,000 per day” as a general permission to ignore authentication below that volume. Smaller senders still have requirements and can suffer filtering or rejections.
Google recommends keeping user-reported spam rates below 0.1% and avoiding 0.3% or higher. Those thresholds refer to the specific spam-rate measurements in its systems, not to every dashboard's “complaint rate”.
Check the current official guidance because enforcement practices evolve.
One-click unsubscribe: make leaving easier than reporting spam
A person who doesn't want your newsletter should have a simple way to stop it.
That means you need an understandable unsubscribe experience, correct suppression handling and—where bulk-sender rules apply—proper one-click unsubscribe support for marketing or subscribed messages.
The visible link in the email body and protocol-level one-click support are related but different requirements. A footer link alone may not satisfy the applicable one-click implementation rule.
Don't assume that a transactional booking confirmation is identical to a promotional newsletter. Different message purposes may have different obligations and policies.
In Visisto, test the unsubscribe and suppression behaviour for your actual campaign and automation setup before a high-volume send.
An easy unsubscribe isn't lost revenue. It's a signal you respect the recipient and their inbox.
The biggest reputation factor: send to people who expected you
Authentication helps identify a sender. It doesn't make unwanted messages welcome.
A legitimate audience is one built from appropriate permissions or other applicable legal bases, with clear expectations about content and frequency.
Avoid buying lists. Avoid importing addresses without checking whether they may be used for the proposed marketing purpose. Preserve opt-outs and suppression records during migrations.
A newsletter subscriber who asked for occasional practical tips might not expect a promotional email every morning.
Ask yourself:
- Did this person request this type of message?
- Does the content match the signup promise?
- Can they recognise the sender?
- Is the timing reasonable?
- Is the unsubscribe route easy to find?
- Have we honoured earlier opt-outs?
Deliverability begins before the first campaign: at the moment someone decides whether to hear from you.
Warm up your sending behaviour responsibly
Suddenly sending far more email than your domain has sent recently can create risk, particularly when the audience is old or unengaged.
There isn't one universal “warm-up schedule” that guarantees inbox placement.
Instead:
- Authenticate the domain and test it.
- Start with recipients who genuinely expect your communication.
- Use a sensible initial volume and monitor results.
- Investigate authentication, bounces and complaints before expanding.
- Increase volume based on actual performance and sender guidelines, not a mythical number of daily percentage increases.
If you're migrating providers, plan for overlapping sender configurations and carefully test the switch. Do not send duplicate campaigns from both systems to demonstrate that the new platform works.
How to investigate a campaign with poor results
Suppose a campaign was sent to 3,000 eligible contacts.
The sending dashboard shows:
- 2,940 messages accepted as delivered under its reporting definition.
- 40 hard bounces.
- 20 temporary or other failures.
These are hypothetical numbers for troubleshooting.
The important questions are not just “What's the delivery percentage?”
Ask instead:
Authentication: Did the messages pass the applicable SPF, DKIM and DMARC checks?
Bounces: Are invalid addresses concentrated in a particular imported list? Are temporary failures related to throttling?
Complaints: Are recipients marking the emails as unwanted? Was the signup promise different from the content?
Links and content: Does the email contain broken links, misleading claims or an expired offer?
Sending pattern: Did the domain suddenly jump from low volume to a large campaign?
Engagement: Do trusted interaction signals show the message is useful, without treating open tracking as perfect?
Correct the underlying cause before repeating the send.
Where Visisto fits into the sending workflow
Visisto makes it possible to organise eligible contacts and create recurring email campaigns. Supported Automations can handle appropriate follow-ups when their triggers and stop rules have been tested.
A practical workflow:
Verified sending domain → eligible Contacts → Email campaign → delivery review → useful follow-up → Results
Keep the authentication values from your deployed Visisto account. The platform may use underlying sending infrastructure, but the domain-record values should come from the actual sender-verification instructions—not from an invented example in a marketing article.
Never claim “best deliverability”, “guaranteed inbox”, or a universal delivery percentage for every customer without current, reproducible evidence.
A confidence-building message is simpler:
You control your audience and message. Visisto gives you the tools to send and improve campaigns responsibly.
A deliverability checklist before every important campaign
| Area | What to verify |
|---|---|
| Sending identity | Correct From name, address and domain |
| Authentication | Appropriate SPF, DKIM and DMARC configuration |
| Audience | Eligible contacts, with opt-outs suppressed |
| Subject and copy | Accurate, recognisable and relevant |
| Links | Working, trustworthy and related to the promise |
| Unsubscribe | The correct mechanism and suppression behaviour |
| Volume | Reasonable for the domain and recent sending history |
| Automations | No unexpected duplicate or conflicting messages |
| Reporting | Delivery, bounce, complaint and click signals understood |
If a test fails, fix it before exposing your whole audience to the problem.
What do Visisto email plans include?
Visisto's current approved plan catalog separates contact storage from email sending.
| Plan | Monthly | Monthly email sends |
|---|---|---|
| Free | £0 | 15,000 |
| Choice — Email campaigns & automations | £9 | 50,000, with 10 active automations |
| Growth | £29 | 150,000, with 25 active automations |
| Agency | £199 | 2,500,000 |
The plans include unlimited stored contacts, with separate account, feature and sender eligibility requirements. Sending capacity is not the same as throughput, authentication success or guaranteed inbox placement.
The email Choice group upgrades only the selected product area. You don't need higher ticketing or booking limits to run more email campaigns.
See the current Visisto pricing page.
Frequently asked questions
Do I need all three: SPF, DKIM and DMARC?
The precise minimum depends on the receiving provider and your sending volume. Google requires SPF or DKIM for all senders to Gmail, and SPF, DKIM and DMARC for the specified bulk-sender category. A robust domain strategy should verify appropriate authentication and alignment across your real sending systems.
Does “delivered” mean “in the inbox”?
No. Delivery reporting commonly means a receiving server accepted the message, not that the reader saw it in their main inbox.
What's a good email open rate?
Open rates can be distorted by privacy features and automated image loading. Focus on relevant, reliable metrics and avoid interpreting every tracked open as a human reading the email.
Is 15,000 free monthly emails a guarantee of instant bulk sending?
No. It is a plan allowance, subject to account policies, sending setup and operational limits.
Does Visisto automatically fix a bad sender reputation?
No platform can promise that. Authentication, consent, list quality, content and responsible sending all matter.
Good email marketing earns its place in the inbox
No flashy deliverability claim can replace the fundamentals.
Authenticate your domain. Send to an audience that expected the message. Make the next communication useful. Learn from the results.
Visisto gives you campaigns, contacts and supported automations to build that habit. Start with a verified sending identity and one valuable email.
Create your first Visisto email campaign — free.
Official sources and technical notes
Reviewed 10 October 2026.
- Gmail email sender guidelines — SPF, DKIM, DMARC, DNS, TLS, sender reputation and unsubscribes.
- Gmail sender guidelines FAQ — bulk-sender thresholds, unsubscribe rules and enforcement.
- Visisto pricing — plan sending allowances.
DNS examples use invalid demonstration domains and must not be copied into production. Delivery statistics are illustrative; inbox placement and compliance depend on the actual configuration and audience.
Written by Visisto Team
Visisto