Deliverability means your email reaches the inbox instead of the spam folder. The biggest part you control is domain authentication: three DNS records that prove your email really comes from you. Gmail and Microsoft now expect DMARC, on top of SPF and DKIM, from anyone sending bulk email.
The Deliverability screen checks those records for the domain you send from and tells you how to add anything that is missing.
Where to find it:
Click Delivery, then Deliverability. The Domain authentication check is at the top and the Suppression list is below it.
Running the check:
- The box is already filled with the domain you send from, taken from the from address in your default sender profile. The line under it says which domain and which address it is checking.
- To check a different domain, type it in the box.
- Click Check SPF / DKIM / DMARC / MX.
The result gives a score out of 100, 25 points for each of the four records, and a line for each with a tick or a cross and what was found.
Check the domain in your from address, not your website's address. If your site is yoursite.com but you send as anna@mail.yoursite.com, the records that matter are the ones for mail.yoursite.com, and the line under the box tells you when the two differ.
What each record does:
- SPF lists which mail servers may send email using your domain. Without it, receiving servers cannot tell your real email from a forgery.
- DKIM signs every email with a key, so the receiving server can prove it really came from you and was not changed on the way.
- DMARC tells receiving servers what to do when SPF or DKIM fails, and sends you reports about it.
- MX says where email sent to your domain is delivered. You need it to receive replies and bounce notices.
Fixing what is missing:
For every record that is missing, the result opens a How to fix panel with plain steps and an example record. Records that pass are folded away, marked as set up correctly.
All four are DNS records, added wherever your domain is managed, such as your registrar or Cloudflare.
- SPF: your sending service gives you an include value. Add a TXT record with Name set to @ and a value that starts v=spf1. You may only have one SPF record, so if one exists, add the new include into it.
- DKIM: in your sending service, open its domain verification screen. It gives you one or more records, usually CNAME records with long names. Add each one exactly as given, then click verify in the service.
- DMARC: set up SPF and DKIM first. Then add a TXT record with Name set to _dmarc and a value such as v=DMARC1; p=none; rua=mailto:dmarc@yoursite.com, using a mailbox you read.
- MX: your email host, such as Google Workspace, Microsoft 365 or your web host, gives you the MX values to add.
DNS changes can take a few hours to show. Run the check again the next day.
Starting DMARC gently:
p=none only watches: it changes nothing about delivery and sends you reports. After a couple of weeks of clean reports, change it to p=quarantine, and later p=reject if you want the strongest protection.
About DKIM selectors:
DKIM lives under a name your sending service chooses, called a selector. The check looks at the common selectors used by the main services. Some services use a selector unique to your account, so your domain can be fully signed and still not show a DKIM tick here. If that happens, look at the domain status in your sending service's own dashboard: if it says verified, you are signed.
The suppression totals:
Below the check, four tiles count the addresses on your suppression list: Unsubscribed, Bounced, Complained and Manual. An address on this list is never emailed. Watch Bounced and Complained over time: a sudden rise usually points to an old or poorly kept list. See The Suppression List.
A real example:
Anna sends Leafwise Gardening's newsletter as anna@yoursite.com through Amazon SES. She opens Deliverability and the box already says yoursite.com. She adds the SES include to her SPF record in Cloudflare, adds the three DKIM CNAME records that SES gave her, and adds a DMARC record with p=none sending reports to dmarc@yoursite.com. The next day she runs the check again and all four records pass.
Tips:
- Set up authentication before your first big send. A good reputation is much easier to keep than to rebuild.
- Run the check again whenever you change or add a sending service.
- Turn on your sending service's bounce and complaint webhook too. See Hard And Soft Bounces.
- Keep complaints under 0.1% and bounces under 2% of what you send. See List Health: Unsubscribes, Bounces And Complaints.