Make your email land in the inbox, not in spam

Before sending newsletters

Authentication gets you through the door. Reputation keeps you there. Each item below exists because of a specific way mail goes wrong; set your volume to see what Gmail treats as required.

1. SPF and DKIM on every sending service

   Required: SPF or DKIM

   Why it exists: Receivers check the sending IP against SPF and the signature against DKIM before they look at the content. Set up both: DKIM survives forwarding, SPF does not.

2. DMARC published, with the From domain aligned

   Strongly recommended

   Why it exists: It tells receivers what to do with mail that fails, and the reports show every service sending as your domain, including the ones nobody remembered.

3. Reverse DNS that matches

   Required

   Why it exists: Mail from an IP whose PTR record does not resolve back to the same host name is refused or filtered by many receivers.

   $ dig +short -x 192.0.2.25
   mail.example.fi.
   $ dig +short A mail.example.fi
   192.0.2.25

4. TLS on every connection

   Required

   Why it exists: Receivers flag mail delivered without encryption. Mail servers do this automatically once a valid certificate is installed.

5. One-click unsubscribe headers (RFC 8058)

   Strongly recommended

   Why it exists: People can leave with the mail app’s own button instead of pressing Report spam. Gmail and Yahoo require it for bulk marketing mail and expect requests honoured within two days.

   List-Unsubscribe: <https://example.fi/unsubscribe/7f3a9c>, <mailto:[email protected]?subject=unsubscribe>
   List-Unsubscribe-Post: List-Unsubscribe=One-Click

6. Complaint rate watched

   Required: under 0.3%

   Why it exists: Above 0.3% spam reports in Google Postmaster Tools, Gmail filters or refuses your mail. Aim for under 0.1%, and watch Microsoft SNDS and the Yahoo feedback loop too.

7. List hygiene

   Strongly recommended

   Why it exists: Confirmed opt-in, hard bounces removed at once and inactive contacts retired. Old addresses become spam traps and bounces, and both damage the reputation of the sending domain.

8. Order email and newsletters kept apart

   Strongly recommended

   Why it exists: Send campaigns from a subdomain such as news.example.fi or a separate service, so a bad campaign cannot push order confirmations and password resets into spam.

Based on the sender guidelines Google and Yahoo published in 2024 and the rules Microsoft added for Outlook.com in 2025. They change; check each provider's current pages before a large send.

From p=none to p=reject without losing mail

Jumping straight to reject blocks your own invoices and newsletters if one sender was missed. The safe route takes a few weeks and is driven by the reports.

1. 1

   Read the headers

   A real message sent to Gmail and Outlook, opened with "Show original", so the Authentication-Results line tells us what actually fails.

2. 2

   Fix SPF, DKIM and reverse DNS

   Every sending service in SPF, DKIM keys on, a PTR record matching the mail host name, and the server IP checked against the main blacklists.

3. 3

   Monitor p=none

   Two to four weeks of aggregate reports show every server that sends as your domain, including the ones nobody remembered.

4. 4

   Authorise or stop each sender

   Legitimate services get aligned SPF or DKIM; anything unknown is investigated before the policy tightens.

5. 5

   Tighten p=quarantine p=reject

   Quarantine first, then reject once the reports are clean, so spoofed mail stops and your own still lands.

When I would not recommend this

Good DNS is necessary, not magic.

• 01You want your own mail server for a handful of mailboxes. Microsoft 365 or Google Workspace costs less to keep running; I set up the DNS and move the mail instead.
• 02The list was bought or scraped. No record fixes complaints from people who never asked for the mail, and I will not help send it.
• 03One message went to spam once and your provider already publishes SPF, DKIM and DMARC. Forward me the headers; that is often a short email answer, not a package.