Email deliverability in 2026: the technical baseline
SPF, DKIM, DMARC, BIMI — and the things behind them that actually matter.
Authentication records have hardened the floor. The ceiling is still set by sender behaviour. Brands that fix the technical baseline and ignore the behaviour side often end up worse off — they've removed the technical excuses for poor reputation without changing what's actually causing it.
The technical baseline
- SPF aligned to your sending domain.
- DKIM with rotated 2048-bit keys on a sub-domain.
- DMARC at p=reject (not none, not quarantine) after a 90-day monitoring period.
- BIMI for branded inbox display — requires a VMC, but raises open rates 8–12%.
- One-click List-Unsubscribe header on every bulk send.
The behaviour
Engagement-based sending. Sunset inactive contacts at 90 days. Warm new domains over six weeks. Skip any of these and your reputation tanks regardless of how clean your authentication is.
Monitoring
Google Postmaster Tools daily, Microsoft SNDS weekly. Watch for IP reputation drops before they hit user-visible inbox placement. The first sign of trouble is usually a 5–10% drop in Gmail engagement; complaints lag by days.
Recovery
If you've already blown reputation, throttle aggressively to your most engaged 10% for six weeks. Don't try to send your way back — Gmail and Outlook both score on engagement velocity, and high-volume recovery makes it worse.