Email Deliverability Checklist for Developers: SPF, DKIM, DMARC, and Beyond

Posted on by — No Comments ↓

If you’re building any tool that sends email — whether it’s transactional notifications, marketing campaigns, or cold outreach — deliverability is the invisible layer that determines whether your emails actually reach inboxes.

Here’s a practical checklist for developers who want to get email delivery right from the start.

1. Set Up SPF (Sender Policy Framework)

SPF tells receiving mail servers which IP addresses are authorized to send email on behalf of your domain. 

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Key points:

  • Add a TXT record to your domain’s DNS
  • Include all services that send email for you (ESP, transactional provider, etc.)
  • Use ~all (soft fail) or -all (hard fail) at the end
  • Keep your SPF record under 10 DNS lookups — exceeding this silently breaks validation

2. Configure DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to your email headers, letting receivers verify the message wasn’t altered in transit. 

selector._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3..."

Key points:

  • Generate a public/private key pair (most ESPs provide this)
  • Publish the public key as a DNS TXT record
  • The private key signs outgoing messages automatically
  • Rotate keys periodically (every 6-12 months is reasonable)

3. Publish a DMARC Policy

DMARC ties SPF and DKIM together and tells receivers what to do when authentication fails. 

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100"

Policy options:

  • p=none — Monitor only (start here)
  • p=quarantine — Send failures to spam
  • p=reject — Block failures entirely

Start with p=none to collect reports, then gradually tighten.

4. Warm Up New Domains and IPs

Sending a large volume from a brand new domain or IP is the fastest way to get flagged as spam.

Warming strategy:

  • Week 1: 20-50 emails/day to engaged recipients
  • Week 2: Double the volume
  • Week 3-4: Continue scaling gradually
  • Monitor bounce rates and spam complaints at each step

5. Monitor Your Sender Reputation

Use free tools to check your domain and IP reputation:

  • Google Postmaster Tools — Shows domain reputation, spam rate, authentication results
  • MXToolbox — DNS record validation and blacklist monitoring
  • Mail-tester.com — Send a test email and get a deliverability score

6. Handle Bounces and Complaints

Hard bounces (invalid addresses) and spam complaints directly damage your sender reputation. 

// Example: webhook handler for bounce processing
app.post('/webhook/bounce', (req, res) => {
  const { email, bounceType } = req.body;

  if (bounceType === 'hard') {
    // Immediately remove from all lists
    removeFromMailingList(email);
  } else if (bounceType === 'soft') {
    // Retry up to 3 times, then remove
    incrementRetryCount(email);
  }

  res.sendStatus(200);
});

7. Content Best Practices

Even with perfect authentication, poor content triggers spam filters:

  • Avoid ALL CAPS subjects and excessive punctuation
  • Include a plain-text version alongside HTML
  • Keep your text-to-image ratio reasonable (not image-only emails)
  • Always include an unsubscribe link
  • Use a consistent “From” name and address

Why This Matters for SaaS Builders

When we built ColdMailAI, one of the core design decisions was to generate emails that follow these deliverability principles by default — proper structure, natural language patterns, and no spam trigger words. The tool doesn’t send emails itself; it generates content designed to work well with whatever sending infrastructure you already have.

Deliverability isn’t a one-time setup. It’s an ongoing practice. Get the foundation right, and your emails will actually reach the people you’re writing to.

Resources:

Leave a Reply