Email Deliverability 101: SPF, DKIM, DMARC for SMBs

Plugging in a SendGrid API key is the easy part — what inbox providers decide to do with your emails after that is an entirely different problem.

About 17% of legitimate commercial email never reaches the inbox. It’s not there by accident; inbox providers put it there because the sending domain failed to prove it was legitimate, or had a reputation that gave them reason to be suspicious. If your campaigns show healthy open rates in testing and flat numbers in production, this is almost certainly why.

The fix has several moving parts, and one wrong configuration can undermine everything else. This post walks through authentication, sender reputation, domain warmup, and ongoing hygiene in the order you should tackle them.

01 Why Your Emails Land in Spam

Three things determine where your email ends up:

Authentication: Whether the sending domain has proven it's allowed to send from this server. SPF, DKIM, and DMARC cover this. Without them, inbox providers can't verify you are who you claim to be, and missing authentication alone is enough to get you filtered.
Sender reputation: Whether your domain has a track record of sending mail people want. Reputation operates at the domain level and the IP level. A high bounce rate, a spam complaint rate above 0.1%, or a sudden volume spike will damage it fast.
Content and engagement: Are people opening and clicking, or immediately archiving and reporting spam? Inbox providers track this, and a pattern of low engagement drags down domain reputation over time. Fix authentication first. It's the only factor entirely within your control on day one.

02 SPF — Tell Mail Servers You’re Allowed to Send

SPF is a DNS TXT record that lists every server authorized to send email for your domain. When a receiving mail server gets a message from you, it checks your DNS for this record. If the sending server isn't on the list, the message fails.

For SendGrid, your SPF record looks like this:

v=spf1 include:sendgrid.net ~all

~all vs -all: ~all is a soft fail, meaning unauthenticated messages get flagged but usually delivered. -all is a hard fail that rejects them outright. Start with ~all while you're configuring everything; switch to -all once SPF, DKIM, and DMARC are all verified.

One SPF record per domain. If you already have one for G Suite or another service, don't add a second record. Merge them:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Two separate SPF records on the same domain break lookups and fail authentication silently. Run MXToolbox's SPF checker before moving on; it catches malformed records, conflicting entries, and the 10 DNS lookup limit that's easy to hit once you're sending through multiple services.

03 DKIM — Sign Every Email Cryptographically

Where SPF validates the sending server, DKIM validates the message itself. When you enable DKIM in SendGrid, it generates a public/private key pair. SendGrid signs outgoing mail with the private key; receiving servers verify the signature using the public key you publish in DNS. If even one byte of the message changes between sending and receiving, the signature fails.

To set this up in SendGrid:

Go to Settings → Sender Authentication
Set up domain authentication for your sending domain
Add the two CNAME records SendGrid provides to your DNS
Click Verify in SendGrid once DNS propagates (allow 5–10 minutes)

SendGrid defaults to 1024-bit DKIM keys. Request 2048-bit — some inbox providers give preferential treatment to stronger keys, and you’re only doing this once. A misconfigured CNAME fails silently and is one of the most common causes of DKIM errors, so don’t skip the verification step.

04 DMARC — Enforce the Rules and Watch What Happens

DMARC ties SPF and DKIM together and tells inbox providers what to do when messages fail those checks. It also sends you aggregate reports, so you can see what's failing before it becomes a deliverability crisis.

As of February 2024, Google and Yahoo require DMARC for anyone sending more than 5,000 emails/day to their addresses. If you’re not at that volume yet, implement it now. The cost is one DNS record; the downside of waiting is a surprise enforcement notice mid-campaign.

Publish the record at _dmarc.yourdomain.com. Roll out in three steps:

Step 1 — Monitor only (run for 2–4 weeks)

v=DMARC1; p=none; rua=mailto:[email protected]

This logs failures without blocking anything. The rua= tag tells DMARC where to send aggregate reports. Check those reports weekly. They'll show whether SPF or DKIM is misconfigured before you start enforcing anything.

Step 2 — Quarantine

v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=25

The pct=25 tag applies the quarantine policy to 25% of failing messages. Increase gradually as your reports show clean authentication. When you’re at pct=100 with a consistently clean report, move to Step 3.

Step 3 — Reject

v=DMARC1; p=reject; rua=mailto:[email protected]

Failing messages are blocked outright. This is where you want to end up long-term. Don't jump straight from p=none to p=reject; work through quarantine first. For reading the XML reports, dmarcian and Postmark's DMARC analyzer both make them human-readable.

05 Sender Reputation: The Score You Can’t Buy

Clearing authentication tells inbox providers who you are. Whether they trust that enough to actually deliver your mail depends on your sending reputation, which is harder to build and faster to lose.

Reputation exists at two levels:

Domain reputation: built over time by how recipients engage with mail from your domain. Hard bounce rate, spam complaints, and whether recipients add you to contacts all feed into it. Every new sending domain starts from zero.

IP reputation: the history of the sending IP. On SendGrid's shared IP pools, you inherit the collective reputation of every other sender on those IPs. A dedicated IP makes sense at roughly 50,000 emails per month once you're ready to build your own track record rather than borrow someone else's.

Three thresholds will get your account flagged:

Hard bounce rate above 2%: inbox providers start flagging you
Spam complaint rate above 0.1%: Google Postmaster Tools flags you; above 0.3% and you risk sending suspension
Volume spikes: 500/day to 50,000/day overnight is a red flag regardless of list quality

Reputation rebuilds slowly and collapses fast. A single blast to a stale list can cause weeks of inbox problems. Clean your list, send mail people asked for, and suppress anyone who hasn’t opened in 90 days.

06 Warm Up Your Sending Domain Before You Blast

A cold domain that suddenly sends 10,000 emails in a day looks exactly like a spam operation — because most spam operations do exactly that.

Run a warmup schedule over four to five weeks. Start at 50-100 emails per day, scale up gradually, and let inbox providers build a reputation baseline before you hit full volume.

A reasonable schedule:

Week 1: 50–100 emails/day
Week 2: 200–300 emails/day
Week 3: 500–800 emails/day
Week 4: 1,500–2,500 emails/day
Week 5+: Scale gradually toward full volume

Two rules matter more than the specific numbers:

Send to your most engaged contacts first. The people most likely to open, click, and not complain give you the early positive signals that set the tone for the whole warmup. High initial engagement tells inbox providers your mail is wanted.

Don’t rush it. Every deliverability problem caused by skipping warmup takes longer to fix than the warmup would have taken.

SendGrid has an automated IP warmup tool for dedicated IPs that adjusts sending volume based on your schedule. It handles the pacing, not the list quality. You still need to start with clean, engaged contacts.

07 The Ongoing Hygiene That Keeps You Out of Spam

Getting to inbox is step one. Staying there requires ongoing maintenance.

Monitor bounce codes. Soft bounces (4xx) are temporary delivery failures at the recipient's server; watch the trend but don't suppress on a single instance. Hard bounces (5xx) mean the address is invalid and should be suppressed immediately. A hard bounce rate above 2% is enough to get your account flagged at most ESPs.

Watch your complaint rate in Google Postmaster Tools. It's free, and it tracks complaints against Gmail accounts, which is typically most of your list. Keep complaints below 0.08%. Above 0.1% your deliverability starts degrading. Above 0.3% you're heading toward a sending suspension.

Check blacklists monthly using MXToolbox's blacklist checker, which runs against 100+ lists at once. Spamhaus and Barracuda are the two that affect most inbox providers. Delisting always takes longer than it should, regardless of why you were listed.

Test before major campaigns. Mail-Tester and GlockApps give you a full deliverability report: SPF pass/fail, DKIM signature, DMARC alignment, spam score, and inbox placement predictions across major providers. Run this before any high-stakes send.

The Bottom Line

SPF, DKIM, and DMARC done right gets you to a fair evaluation by inbox providers. Every sender who avoids the spam folder has them configured. What proper authentication does is stop inbox providers from filtering your email before it's even evaluated on its merits. From there, your sending behavior, complaint rate, and list hygiene determine the result. Miss the 0.1% complaint threshold consistently and no amount of clean DNS configuration will save you.

Drip Drop is a visual marketing automation platform built on the BYOA model. You connect your own SendGrid account, build conditional drip workflows, and own your sending reputation end to end. No shared IP pools. No deliverability problems caused by someone else's list or blast schedule.