{"id":8786,"date":"2026-08-11T02:41:05","date_gmt":"2026-08-11T02:41:05","guid":{"rendered":"https:\/\/dextora.agency\/insights\/email-deliverability-spf-dkim-dmarc-what-they-are-worth\/"},"modified":"2026-08-11T02:41:05","modified_gmt":"2026-08-11T02:41:05","slug":"email-deliverability-spf-dkim-dmarc-what-they-are-worth","status":"publish","type":"insight","link":"https:\/\/dextora.agency\/en\/insights\/email-deliverability-spf-dkim-dmarc-what-they-are-worth\/","title":{"rendered":"The Email That Does Not Arrive: SPF, DKIM, DMARC and What They Are Actually Worth"},"content":{"rendered":"<p>Email is the only marketing channel where failure is invisible. A campaign that lands in spam produces the same dashboard as a campaign nobody found interesting: sent, delivered, low engagement. Nothing in the report says &#8220;this never appeared in front of a human&#8221;, so teams optimise subject lines for months while the actual problem is a missing DNS record.<\/p>\n<p>The phrase &#8220;half your email never arrives&#8221; circulates widely and is not true. The real numbers are less dramatic and more actionable: platform-wide deliverability sits somewhere around 83&#8211;89%, Gmail inbox placement has been measured at roughly 87% against 89.8% two years earlier, and Microsoft-operated inboxes come in noticeably lower, around 75%. That is not half. It is still one message in eight going nowhere useful, and the gap between senders who authenticate and senders who do not is large enough to be the whole story.<\/p>\n<h2>Two different numbers, one word<\/h2>\n<p>Before any of the fixes, one distinction does most of the diagnostic work, and almost every dashboard blurs it.<\/p>\n<table>\n<thead>\n<tr>\n<th>Metric<\/th>\n<th>What it means<\/th>\n<th>Where you see it<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Delivery rate<\/td>\n<td>The receiving server accepted the message and did not bounce it<\/td>\n<td>Your sending platform, typically 97&#8211;99%<\/td>\n<\/tr>\n<tr>\n<td>Inbox placement<\/td>\n<td>The message reached the inbox rather than spam or promotions<\/td>\n<td>Nowhere, unless you test for it<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div class=\"accent-block\">\n<p>A 98% delivery rate is compatible with a 60% inbox placement rate. Both statements can be true at once, and only the second one affects revenue. When a platform reports &#8220;deliverability&#8221;, it almost always means the first. Assume you are not measuring placement unless you deliberately set out to.<\/p>\n<\/div>\n<h2>The three records, and what each actually does<\/h2>\n<p>Authentication is not a spam filter setting. It is a set of published claims about who is allowed to send using your domain, checked by the receiving server.<\/p>\n<ul>\n<li><strong>SPF<\/strong> lists the servers permitted to send for your domain. It answers &#8220;did this come from a machine you approved&#8221;. It breaks silently when mail is forwarded, and it has a hard limit of ten DNS lookups that busy domains exceed without noticing.<\/li>\n<li><strong>DKIM<\/strong> signs the message cryptographically, so the receiver can verify it was not altered and genuinely came from your domain. It survives forwarding, which is why it carries more weight than SPF in practice.<\/li>\n<li><strong>DMARC<\/strong> tells receivers what to do when SPF and DKIM fail, and asks them to send you reports. Without it the other two are advisory.<\/li>\n<\/ul>\n<p>The published figure most worth internalising is the gap: authenticated senders and unauthenticated senders differ by tens of percentage points in inbox placement, with the difference commonly reported at around 45 points. No subject line rewrite competes with that. It is also, unusually for marketing work, a one-off task with a permanent effect.<\/p>\n<h2>The rules changed in 2024 and nobody sent a memo<\/h2>\n<p>Google and Yahoo introduced enforced requirements for bulk senders, and while the threshold is nominally five thousand messages a day to their users, the practical effect reached much further, because the same filtering logic applies below it. Three requirements are worth restating.<\/p>\n<ol>\n<li><strong>Authenticate with SPF, DKIM and DMARC.<\/strong> A DMARC record is now a baseline expectation rather than an advanced measure.<\/li>\n<li><strong>One-click unsubscribe<\/strong> in the message header, working within two days. A link in the footer alone is no longer sufficient.<\/li>\n<li><strong>Keep the spam complaint rate below 0.3%,<\/strong> measured by the receiver. Three complaints per thousand is a far lower tolerance than most senders assume.<\/li>\n<\/ol>\n<p>The complaint threshold is the one that catches small businesses. A list built from purchases three years ago, mailed for the first time in a new campaign, generates complaints not because people object to the content but because they do not recognise the sender.<\/p>\n<h2>What breaks in small businesses specifically<\/h2>\n<p>Large senders have specialists. The failures below are the ones we find repeatedly on business sites, and all of them are cheap to fix.<\/p>\n<ul>\n<li><strong>Website forms sending as the visitor.<\/strong> A contact form that puts the visitor&#8217;s address in the From field is forging their domain. It fails authentication by design. Send from your own address and put the visitor in Reply-To.<\/li>\n<li><strong>Marketing and transactional mail on the same domain.<\/strong> A promotional campaign that annoys people can drag your order confirmations into spam with it. Separate them by subdomain.<\/li>\n<li><strong>DMARC left at p=none forever.<\/strong> The monitoring-only policy is the correct starting point and a poor destination. It publishes that you do not care what happens to failures.<\/li>\n<li><strong>A shared IP on cheap hosting.<\/strong> Sending through the same server that hosts the site means inheriting the reputation of everyone else on it, which is a reason to treat mail as a separate service from <a href=\"https:\/\/dextora.agency\/en\/insights\/business-hosting-what-to-choose-where-not-to-save\/\">the hosting decision<\/a>.<\/li>\n<li><strong>Nobody reading the DMARC reports.<\/strong> They arrive as XML, look unfriendly, and contain the exact list of systems sending as you, including the ones you forgot about.<\/li>\n<\/ul>\n<h2>Authentication is a security control, not just a marketing one<\/h2>\n<p>The reason to publish a strict DMARC policy is not deliverability alone. Without one, anyone can send email that appears to come from your domain, and the most common commercial fraud pattern is exactly that: an invoice or a change of bank details, apparently from a company that suppliers already trust.<\/p>\n<p>Moving from monitoring to quarantine to reject closes that path. It belongs in the same category as the other measures in <a href=\"https:\/\/dextora.agency\/en\/insights\/cybersecurity-for-small-business-baseline-protection-guide\/\">a small business security baseline<\/a>, and it is one of the few controls that improves marketing performance and reduces fraud exposure with the same change.<\/p>\n<h2>What matters after authentication<\/h2>\n<p>Records get you considered. Behaviour decides where you land, and receiving providers weigh engagement heavily.<\/p>\n<ol>\n<li><strong>Send to people who open things.<\/strong> The single most effective deliverability intervention available to a small sender is to stop mailing addresses that have not engaged in six to twelve months. It reduces volume and raises placement simultaneously.<\/li>\n<li><strong>Keep volume steady.<\/strong> Nothing looks more like a compromised account than a domain that sends forty messages a month and then twenty thousand on a Tuesday. Warm up gradually.<\/li>\n<li><strong>Make unsubscribing easier than complaining.<\/strong> Every spam complaint is a permanent reputational cost; an unsubscribe is not. Hiding the link converts the cheap action into the expensive one.<\/li>\n<li><strong>Fix the bounce handling.<\/strong> Repeatedly mailing addresses that hard-bounced is read as a sign that you do not maintain your list, because it is one.<\/li>\n<li><strong>Watch the complaint rate as a standing metric,<\/strong> not an incident. It moves before placement does, which makes it the early warning, in the same way <a href=\"https:\/\/dextora.agency\/en\/insights\/analytics-without-illusions-events-to-track\/\">a well-chosen event set<\/a> warns before revenue moves.<\/li>\n<\/ol>\n<h2>Testing placement without buying a tool<\/h2>\n<p>Commercial seed-list services exist and are worth the money at volume. Below that, a manual version gives you most of the signal for the cost of an afternoon and a few free mailboxes.<\/p>\n<p>Create one address at each provider your customers actually use, which in the markets we work in means Gmail, Outlook, and the local providers that still hold real share. Interact with those mailboxes like a person would: open some messages, move nothing, reply occasionally. A mailbox that has never done anything is a poor model of a real recipient and will give you pessimistic results.<\/p>\n<p>Then send each campaign to that set alongside the real list, and record where it landed. Three findings usually emerge within a month. Placement differs sharply between providers, so a single test tells you little. It also differs between campaign types, with promotional layouts landing worse than plain text from the same domain. And it moves after list changes, which is the feedback loop that makes hygiene work visible instead of theoretical.<\/p>\n<p>Record the results in a simple table by date, provider and campaign. Deliverability problems develop gradually, and a history is the only way to notice a slide before it becomes a collapse.<\/p>\n<h2>A twenty-minute check<\/h2>\n<p>This costs nothing and answers whether you have a problem.<\/p>\n<ul>\n<li>Look up your domain&#8217;s SPF, DKIM and DMARC records. If DMARC is absent, that is the finding and the first task.<\/li>\n<li>Send a message to a mailbox at each major provider you actually sell to and see where it lands. Inbox, promotions and spam are three different outcomes.<\/li>\n<li>Check the From address on every automated message the site sends: forms, order confirmations, password resets. These are often configured once and never revisited.<\/li>\n<li>Open a DMARC report. If you cannot, set up a service that turns them into something readable; several are free at small volumes.<\/li>\n<li>Count how many separate systems send email as your company. The answer is almost always higher than expected, and every one of them needs to authenticate.<\/li>\n<\/ul>\n<h2>Why this is worth the afternoon<\/h2>\n<p>Email remains the highest-return channel available to most small businesses, with returns commonly reported in the region of forty dollars per dollar spent. Those figures come from platform vendors and deserve the usual scepticism, but the direction is not seriously disputed, and it is the reason the channel keeps being worth fixing rather than replacing.<\/p>\n<p>What makes deliverability unusual is the shape of the work. Most marketing improvement is incremental and reversible. This is a one-time configuration with a step-change effect, after which the ongoing cost is list hygiene, which is the same discipline that makes <a href=\"https:\/\/dextora.agency\/en\/insights\/marketing-automation-small-business-where-to-start\/\">automation pay for itself<\/a> in the first place.<\/p>\n<h2>The short version<\/h2>\n<p>&#8220;Half your email never arrives&#8221; is wrong; roughly one in eight does not reach a useful place, and that is bad enough. Delivery rate and inbox placement are different numbers and your dashboard shows the flattering one. SPF says which servers may send, DKIM proves the message was not altered and survives forwarding, DMARC decides what happens when the other two fail and reports back; the placement gap between authenticated and unauthenticated senders is commonly reported at around 45 points. Since 2024 Google and Yahoo have enforced authentication, one-click unsubscribe and a spam complaint rate below 0.3%. In small businesses the recurring failures are forms sending as the visitor, marketing and transactional mail sharing a domain, DMARC parked at p=none, and nobody reading the reports. After the records, engagement decides placement, so mailing fewer, more recent addresses is the strongest lever available. And a strict DMARC policy is a fraud control as much as a marketing one.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Delivery rate and inbox placement are different numbers and your dashboard shows the flattering one. What each authentication record does, the 2024 rules nobody announced, and a twenty-minute check.<\/p>\n","protected":false},"author":5,"featured_media":8777,"template":"","insight_category":[158],"insight_tag":[180,168,186],"class_list":["post-8786","insight","type-insight","status-publish","has-post-thumbnail","hentry","insight_category-case-studies-2","insight_tag-automation","insight_tag-business-process","insight_tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight\/8786","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight"}],"about":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/types\/insight"}],"author":[{"embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/users\/5"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/media\/8777"}],"wp:attachment":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/media?parent=8786"}],"wp:term":[{"taxonomy":"insight_category","embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight_category?post=8786"},{"taxonomy":"insight_tag","embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight_tag?post=8786"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}