Email deliverability, answered plainly

The questions that come up every time a domain fails an authentication audit.

What actually decides whether my email reaches the inbox?

Three things, in order. First, authentication: can the receiving server prove the message really came from you? That is SPF, DKIM and DMARC, and it is the part you control entirely through DNS. Second, reputation: how have recipients reacted to your mail before, and is your sending IP on a blocklist? Third, content: links, images, spammy phrasing. Most businesses that struggle are failing the first one, which is also the cheapest to fix.

I have SPF set up. Why is my mail still filtered?

The most common reasons are a record ending in ~all or ?all instead of -all, more than ten DNS lookups (which makes SPF fail outright), or two SPF records published at once (which also makes it fail outright). SPF alone is also not enough for bulk senders — Google and Yahoo require DMARC, and DMARC needs SPF or DKIM to align with the visible From address.

What is DKIM and why does it matter more than SPF?

DKIM adds a cryptographic signature to every message you send. Unlike SPF, it survives forwarding and mailing lists, because it travels with the message rather than depending on the connecting server's IP address. If a recipient forwards your email and it arrives unauthenticated, DKIM is usually what was missing.

Is p=none good enough for DMARC?

It satisfies the letter of the Google and Yahoo bulk-sender requirements, and it turns on reporting, which is valuable. But it instructs receivers to do nothing when a message fails authentication, so it stops no spoofing at all. Treat p=none as a two-to-four week observation period, then move to quarantine and finally reject.

Can moving to p=reject break my email?

Yes, if you skip the monitoring step. Every legitimate service that sends as your domain — your CRM, invoicing tool, help desk, marketing platform — has to be authenticating correctly first. That is exactly what the aggregate reports at your rua address tell you. Enforce only once those reports show every real sender passing.

How long do DNS changes take?

Usually 15 minutes to an hour, occasionally up to 24 if the old record had a long TTL. Use the re-check button on any finding in your report to verify a specific record rather than rescanning everything.

My mail server IP is on a blocklist. Now what?

Find the cause before requesting removal, or you will be relisted within days. The usual culprits are a compromised mailbox sending spam, an open relay, or a purchased or scraped recipient list generating complaints. Once the source is fixed, each blocklist has its own delisting form — Spamhaus processes quickly, some smaller lists expire automatically.

Do I need BIMI, MTA-STS and DNSSEC?

None are required, and none will rescue bad authentication. MTA-STS and DNSSEC are genuine security improvements and cost little. BIMI puts your logo beside your messages in Gmail and Apple Mail, but it requires DMARC enforcement plus a paid Verified Mark Certificate, so treat it as a finishing touch rather than a fix.

Why did the scanner not find my DKIM key?

DKIM selectors cannot be discovered from DNS — you have to know the name. We probe more than fifty of the most common ones used by major providers, but a custom selector will not show up. If your provider confirms DKIM is signing, treat that check as passing.