Email deliverability checklist

Email deliverability is not luck. Whether your mail reaches the inbox or the spam folder comes down to a handful of signals that receiving servers check on every message. Get them right and most spam-folder problems disappear.

The authentication trio

These three records are the foundation. Missing or misconfigured, they are the most common reason legitimate mail is filtered:

SPF lists which servers are allowed to send mail for your domain, as a DNS TXT record. If you send through a provider not listed, receivers treat it as suspicious.
DKIM adds a cryptographic signature to each message, using a private key, that receivers verify against a public key in your DNS. It proves the message was not altered and genuinely came from your domain.
DMARC ties the two together: it tells receivers what to do when SPF or DKIM fails, and where to send reports. Without DMARC, the other two are advisory; with it, you set policy.

Beyond the trio

Authentication passing is necessary but not sufficient. Receivers also weigh:

Reverse DNS (PTR). Your sending IP should resolve back to a hostname, and ideally that hostname forward-resolves to the same IP. Missing PTR is a classic spam signal.
Blacklist status. If your sending IP is on a DNSBL, much of your mail is blocked outright, regardless of authentication.
Alignment. DMARC wants the domain in the visible From to match the domain SPF and DKIM authenticate. Passing SPF for a different domain does not help alignment.
Reputation and content. Sending volume, complaint rates, and list hygiene all feed the receiver's reputation model.

The order to check

Work top down: confirm SPF, DKIM, and DMARC exist and are correct, verify reverse DNS, then check the sending IP against blacklists. Most deliverability problems are solved in the first three.

The Email Health tool checks SPF, DKIM, and DMARC for a domain in one pass. From there, why is my IP blacklisted and reverse DNS and PTR records cover the remaining layers.