Some links on this site are affiliate links. If you buy through them we may earn a commission at no extra cost to you.

← Back to Articles
Guides

Email Deliverability Basics for Solo Founders

What SPF, DKIM, and DMARC actually do, why Gmail and Outlook now reject unauthenticated mail, and the habits that keep you out of spam.

Email Deliverability Basics for Solo Founders

You write the email, you check the links, you hit send, and your platform reports that it went out to 400 people. What it does not report is how many of those 400 will ever see it. Delivered and read are two different numbers, and the gap between them is where most one-person email programs quietly lose their audience. A message that gets routed to spam still counts as delivered, so nothing in your dashboard tells you anything went wrong.

Deliverability is the set of technical and behavioral signals that decide which of those two outcomes you get. Most of it is unglamorous DNS setup you do once, plus a few list habits you keep going. It takes an afternoon, and the alternative is writing carefully for people who never get the chance to read you.

Delivered and read are different numbers

When your email platform marks a message as delivered, it means the receiving mail server accepted it. That acceptance happens in a fraction of a second, before anything has decided where the message belongs. Inbox placement is a separate judgment made after the handoff, by filters at Gmail, Outlook, Yahoo, or whoever hosts your subscriber's mail. Your platform never sees that decision, which is why your delivery rate can sit at 99% while a third of your list finds you in the junk folder.

Open rate is the closest proxy most solo senders have, and it is an imperfect one. Apple's Mail Privacy Protection pre-loads tracking pixels for a large share of readers, which inflates opens and blurs the signal. What the number is still good for is spotting sudden changes. If a small, engaged list has been opening at 40% and drops to 12% over two sends with no change in your writing, the likely cause is placement, not content.

The three records that vouch for you

Three DNS records do the work of proving you are who you say you are. DNS records are the settings that live at your domain registrar or host, in the same panel where you would point your domain at a website. You add these as text entries, and receiving mail servers look them up every time you send.

SPF, short for Sender Policy Framework, is a list of the servers allowed to send email using your domain. When a message arrives, the receiving server checks whether the sending server appears on your list. DKIM, or DomainKeys Identified Mail, adds a cryptographic signature to every message you send, and the receiver looks up your public key in DNS to confirm the message really came from you and was not altered along the way. DMARC sits on top of both and tells receivers what to do when SPF and DKIM fail, while also sending you reports about who is sending mail using your name.

The piece people miss is alignment. DMARC only passes when the domain your reader sees in the From line matches the domain that SPF or DKIM authenticated. You can have all three records in place and still fail if your visible From address and your authenticated domain do not match.

RecordWhat it provesWhere it livesWho needs it
SPFThis server is allowed to send for my domainA TXT record on your domainEvery sender
DKIMThis message is unaltered and signed by my domainA TXT record, usually on a selector subdomainEvery sender
DMARCHere is what to do if the first two fail, and here is where to report itA TXT record at _dmarc.yourdomain.comRequired for bulk senders, worth it for everyone

The rules got stricter, and they apply to smaller senders than you think

Google's sender requirements have been in force since February 2024. Every sender, at any volume, needs SPF or DKIM on the sending domain, valid forward and reverse DNS, a TLS connection, and a spam complaint rate below 0.3% as measured in Google Postmaster Tools. Yahoo published effectively the same list on the same timeline. Bulk senders, defined as anyone sending 5,000 or more messages a day to Gmail addresses, additionally need both SPF and DKIM, a published DMARC record set to at least p=none, From-domain alignment, and one-click unsubscribe that gets honored within two days.

Microsoft joined in on May 5, 2025, applying the same 5,000-per-day threshold to Outlook.com, Hotmail.com, and Live.com addresses. The consequence there is worth reading twice. Non-compliant bulk mail is rejected outright with a 550 5.7.15 error rather than filed into junk, which means the message does not arrive at all and your platform records a hard failure.

You probably send a few hundred emails a week, so the 5,000-per-day bulk threshold does not describe you. Set all three records up anyway, for three reasons. The threshold is measured per day, and a product launch or a webinar reminder to a growing list can cross it faster than you expect. Authentication also functions as a reputation signal for senders of every size, not just a compliance checkbox for large ones. And DMARC is the only thing standing between your domain and someone spoofing it in a phishing campaign, which is a problem that costs far more to clean up than to prevent.

Your From address is a deliverability decision

The most common self-inflicted problem is sending marketing email from a free Gmail or Outlook address through a third-party platform. You cannot publish SPF or DKIM records for gmail.com because you do not control that domain, and Google publishes a strict DMARC policy for it. Your messages will fail alignment on arrival, and the filters treat that as a strong signal that something is off. Send from your own domain, always, even if the address is just hello@yourdomain.com.

Whether to use a subdomain for marketing mail is a real trade-off rather than a settled best practice. Sending campaigns from news.yourdomain.com keeps their reputation separate from the mail you send to clients and the invoices you cannot afford to have filtered. The cost is that a fresh subdomain starts with no reputation at all and has to build its own from zero. For someone sending a few hundred emails a week, the root domain is usually simpler and works fine. Split them once you are sending real volume, or once you have client mail on the same domain that you genuinely cannot risk.

While you are in there, drop the no-reply address if you use one. Replies are one of the clearest positive engagement signals a mailbox provider can observe, and a sender who invites them looks different from one who does not.

What your platform handles, and what stays your job

A decent email platform covers a meaningful share of this for you. It signs your messages with DKIM once you add the record it gives you, adds the one-click unsubscribe headers that Google and Yahoo require, processes bounces and complaints, and maintains feedback loops with the major providers. It also puts you on a shared IP pool, which is the right choice for almost every solo sender. Shared pools are already warmed and have an established history with receivers, so you can send immediately instead of ramping volume for weeks.

Dedicated IPs sound better and usually are not, at least not yet. A dedicated IP needs a warm-up period of roughly four to eight weeks and consistent ongoing volume to hold its reputation. Below about 50,000 sends a month, and especially with the uneven sending pattern most solo businesses have, a dedicated IP performs worse than a shared one because there is not enough traffic to establish a stable pattern. This is why GetResponse keeps dedicated IPs on its highest enterprise tier and puts everyone else on shared infrastructure, and the same structure holds across most platforms in this category. GetResponse's free tier tops out around 500 contacts, and paid plans start near $19 a month at 1,000 contacts with a discount for annual billing, though pricing in this category moves often enough that it is worth checking the current page before you commit. If you are still choosing a platform, the GetResponse and Kit comparison covers that decision in more detail.

What no platform can do for you is publish your DNS records or decide who goes on your list. Those two things stay yours, and they are the two that matter most.

The habits that matter more than the records

Authentication gets you past the front door. Engagement decides whether you keep getting in. Mailbox providers watch how people react to your mail, and on a small list you have less statistical room to absorb a bad reaction than a large sender does. The 0.3% complaint threshold works out to three complaints per thousand messages, so on a list of 500, a single complaint on one send puts you at 0.2% and two puts you over the line.

Permission is the foundation, and it means people actively asked for this specific thing. Purchased lists, scraped addresses, and contacts imported from a conference badge scan will hurt you more than a slow signup rate ever will. Double opt-in, where subscribers confirm through a link before they are added, costs you some signups and buys you a cleaner list with fewer typos, fewer bot signups, and lower complaint rates. Whether that trade is worth it depends on how you acquire subscribers, and it is usually worth it if any part of your signup flow is public or incentivized.

Consistency matters in a way that surprises people. Sending nothing for eight months and then mailing 2,000 contacts at once resembles a compromised account, and it gets treated accordingly. Regular sending at a modest cadence builds a more reliable pattern than sporadic bursts. Alongside that, keep the list clean by letting your platform remove hard bounces automatically, verifying any old list before importing it, and adopting a sunset policy that stops mailing people who have not opened anything in six to twelve months. Removing unengaged subscribers feels like going backwards when your list is small, and it improves your placement with everyone who remains.

How to check your work before you send

Start with mail-tester.com. It generates a throwaway address, you send it a real campaign, and it returns a score out of ten along with a breakdown of SPF, DKIM, DMARC, reverse DNS, blacklist status, and content flags. It is free and it catches most first-time setup mistakes in about a minute. MXToolbox SuperTool covers the other half of the check, letting you look up your records directly to confirm they exist and parse correctly, and scanning your domain and IP against more than a hundred blacklists.

Google Postmaster Tools is the closest thing to a direct readout from the receiving side, showing your spam complaint rate and domain reputation as Gmail sees them. The catch for solo senders is volume. Google suppresses data below roughly a hundred messages a day to Gmail addresses, and reputation views often need more than that, so a small list may see an empty dashboard for a while. Connect it anyway, because the data accrues once you cross the threshold and you will want the history.

The crudest test is also the most direct. Keep your own accounts at Gmail, Outlook, and Yahoo on a private seed list, send every campaign to them, and look at where the message actually lands. It is not statistically rigorous, and it will tell you within thirty seconds when something has changed.

FAQ

Why are my emails suddenly going to spam? The most common causes are a recent change to your sending domain or platform that broke SPF or DKIM alignment, a spike in complaints after mailing an old or unengaged segment, or a long gap in sending followed by a large campaign. Run mail-tester first to rule out a broken record, then look at what changed about your list or cadence in the last two sends.

Do I need DMARC if I only send a few hundred emails a month? It is not required below the 5,000-per-day bulk threshold, and it is still worth setting up. A DMARC record at p=none costs nothing, gives you reports on anyone spoofing your domain, and means you are already compliant if a launch pushes you over the threshold for a day.

Can I send marketing emails from my Gmail address? Not through a marketing platform. You cannot publish authentication records for a domain you do not own, so those messages fail DMARC alignment at the receiving end. Use an address on a domain you control instead.

How do I check if SPF and DKIM are set up correctly? Use MXToolbox SuperTool to look up the records on your domain and confirm they resolve, then send a live test to mail-tester.com to confirm they actually pass on a real message. Records that exist but do not pass are a common failure, so do both checks rather than just the first.

What counts as a good spam complaint rate? Google's hard limit is 0.3%, which is three complaints per thousand messages, and the practical target is under 0.1%. On a list under a thousand people, a couple of complaints on a single send can put you over, so treat any complaint as worth investigating rather than as noise.

Where to start this week

Do the setup in one sitting rather than spreading it out. Confirm your sending address uses a domain you own, then add the SPF and DKIM records your email platform gives you, then add a DMARC record at p=none with a reporting address. Send one real campaign to mail-tester.com and fix whatever it flags, and connect Google Postmaster Tools even if it shows nothing yet.

After that, the work shifts from configuration to habit. Send on a predictable schedule, keep your signup honest about what people are getting, remove subscribers who stopped opening months ago, and watch your open rate for sudden drops that signal a placement problem rather than a writing one. None of this is difficult, and it is the difference between an email list that grows into an asset and one that slowly stops reaching anybody.