Most advice about email deliverability best practices is written for brands blasting two million emails a week. They talk about dedicated IPs, IP allocation strategy, and warm-up plans that assume you can send 50,000 messages a day. If you send fewer than 10,000 emails a month, following that advice can actively hurt you.
Small senders play by different rules. You have less data, less reputation history, and less margin for error. One bad list import can sink you for months. The good news: your fixes are cheaper, faster, and mostly free. This guide walks through 12 of them in plain language, and each one comes with a way to verify it actually worked using free tools.
Why Small Senders Need Different Deliverability Advice
Mailbox providers like Gmail, Outlook and Yahoo judge you on patterns. Enterprise senders generate enough volume that patterns emerge in hours. You generate them over weeks. That creates three practical differences:
- Your complaint rate is noisy. At 500 recipients, two spam complaints puts you at 0.4%, which is already above Google’s danger threshold. One angry subscriber can distort your whole score.
- You should almost never use a dedicated IP. Dedicated IPs need consistent volume to build reputation. Under roughly 100,000 emails a month, a shared IP pool from a reputable provider will outperform it.
- Domain reputation matters more than IP reputation. Because you sit on shared infrastructure, your authenticated sending domain is what providers actually track. Protect it.
What “good” looks like at your size
| Metric | Healthy target | Act now if |
|---|---|---|
| Delivery rate (accepted by server) | 98% or higher | Below 97% |
| Inbox placement (not spam folder) | 95% or higher | Below 90% |
| Hard bounce rate | Under 0.5% | Above 2% |
| Spam complaint rate | Under 0.1% | Above 0.3% |
| Unsubscribe rate | Under 0.5% | Above 1% |
| Open rate (as a signal, not a KPI) | 20% or higher | Below 12% and falling |
Track the trend, not the single number. Three sends in a row moving the wrong way is a signal. One weird Tuesday is not.
The Free Toolkit You Will Use Throughout This Guide
- Mail-Tester.com – send one email to a generated address, get a score plus authentication breakdown. Free for a few tests per day.
- MXToolbox – lookup tools for SPF, DKIM, DMARC and blacklists.
- Google Postmaster Tools – free Gmail reputation, spam rate and authentication data for your domain.
- Microsoft SNDS and Smart Network Data – useful if you are on your own IP; otherwise rely on your provider.
- Postmark Spam Check – free SpamAssassin scoring on a raw message.
- learndmarc.com – visual walkthrough of what happens to your message during authentication.
- A manual seed list – free Gmail, Outlook.com, Yahoo and iCloud accounts you own, plus one or two friendly business inboxes on Google Workspace and Microsoft 365.
The 12 Fixes, In The Order You Should Do Them
Fix 1: Send from a domain you control, never a free mailbox address
If your campaigns say From: [email protected] while being sent through an email platform, Gmail’s own DMARC policy tells receiving servers to reject or quarantine the message. This is the single most common reason a small business lands in spam.
Send from your own domain. Use a subdomain for marketing if you also send important transactional or personal mail from the same domain, for example news.yourdomain.com for campaigns and the root domain for invoices and replies. That way a bad campaign week does not damage the reputation of the mail your customers actually need.
How to verify: Send a test to your Gmail seed address. Open the message, choose “Show original”, and confirm the mailed-by and signed-by lines both reference your domain, not your platform’s. It is argued more carefully on salesforce.com.
Fix 2: Publish one correct SPF record
SPF is a DNS record listing which servers are allowed to send on behalf of your domain. Two rules trip up small senders constantly:
- You may only have one SPF record per domain. Two records means both fail. Merge them.
- You get 10 DNS lookups maximum. Every include: counts. Stack Google Workspace, a newsletter tool, a CRM and a helpdesk and you will blow the limit silently.
A typical small-sender record looks like this: v=spf1 include:_spf.google.com include:sendgrid.net ~all
Use ~all (softfail) while testing and -all (hardfail) once you are certain every legitimate sending source is listed.
How to verify: Run your domain through MXToolbox SPF Record Lookup. It flags multiple records and counts your DNS lookups. Then check a test message header for spf=pass.
Fix 3: Turn on DKIM in your sending platform
DKIM signs your message cryptographically so receivers can confirm it was not altered and really came from your domain. Every serious platform gives you CNAME or TXT records to paste into DNS. Do it for every tool that sends mail as you.
Use a 2048-bit key if your DNS provider supports it. If your platform offers automatic key rotation, leave it on.
How to verify: Look for dkim=pass header.d=yourdomain.com in the raw headers of a test message. The header.d value must be your domain. If it shows your platform’s domain, DKIM is signing but not aligned to you, and DMARC will not benefit. apollo.io makes the same point with more data.
Fix 4: Add DMARC, starting at p=none
Since 2024, Gmail and Yahoo require a DMARC record for bulk senders, and Microsoft extended similar expectations to high-volume Outlook senders in 2025. Even at low volume, a missing DMARC record is now a visible negative signal. It is also your only source of reporting on who is spoofing your domain.
Start with monitoring only:
v=DMARC1; p=none; rua=mailto:[email protected]; fo=1;
Read the aggregate reports for four to six weeks. Once every legitimate source passes alignment, move to p=quarantine; pct=25, then 100, then p=reject. Never jump straight to p=reject if you use forms, invoicing tools or booking software that emails on your behalf.
How to verify: Use MXToolbox DMARC lookup to confirm the record parses. Then use a free DMARC report parser (dmarcian and Postmark both offer free tiers for low volume) to read the XML reports rather than squinting at raw files.
Fix 5: Align your link tracking and reply address
Two silent killers. First, if your links redirect through a shared tracking domain used by thousands of other senders, one of them getting blacklisted can drag your click-throughs into filters. Most platforms let you set a custom tracking domain like links.yourdomain.com. Set it.
Second, use a real, monitored reply-to address. A noreply@ address discourages the exact behaviour, replies, that mailbox providers treat as a strong positive engagement signal.
How to verify: Hover a link in a test email and confirm the URL begins with your own domain. Check that domain in MXToolbox Blacklist Check, and reply to your own test to confirm the message arrives in a human inbox. Turning this into conversions is what a sharp marketing studio does best.
Fix 6: Make unsubscribing easy, including one-click
A subscriber who cannot find the unsubscribe link will hit “report spam” instead, and that costs you roughly ten times more. Requirements you should meet regardless of volume:
- List-Unsubscribe header with the one-click List-Unsubscribe-Post variant
- A visible text link in the footer, in readable size and contrast
- Processing within two days, no login required, no survey required
- A physical postal address in the footer
How to verify: In Gmail, a properly configured email displays an “Unsubscribe” link next to the sender name at the top of the message. If it is missing, your headers are wrong. Confirm in “Show original” that List-Unsubscribe and List-Unsubscribe-Post both appear.
Fix 7: Fix the front door before you fix the list
Bad addresses are usually a collection problem, not a cleaning problem. Before scrubbing anything:
- Add real-time syntax and MX validation to your signup form.
- Add a honeypot field or invisible captcha to block bot signups that poison your list with spam traps.
- Use confirmed opt-in (double opt-in) for anything sourced from ads, giveaways or lead magnets, where signup quality is lowest.
- Set clear expectations at signup: what you send, how often, starting when.
And the obvious one that still needs saying: never buy, rent, scrape or import a list you did not collect yourself. At small volume, a purchased list of 3,000 addresses can end your domain reputation in a single send.
How to verify: Sign up through your own form using a typo’d address and a disposable-domain address. Both should be rejected. Then confirm the confirmation email arrives within a minute.
Fix 8: Clean the existing list, then sunset the quiet ones
List hygiene at your scale is a monthly 15-minute job:
- Remove hard bounces immediately, after the first bounce, not the third.
- Remove role addresses such as info@, sales@, admin@, contact@ unless someone there specifically asked to subscribe.
- Run a validation service before any send to a list you have not mailed in over 90 days.
- Sunset the disengaged: no open, click or reply in 6 to 9 months means one re-permission email, then removal.
Small senders resist deleting subscribers because the list feels tiny already. Understand the trade: 800 engaged subscribers reach the inbox, 3,000 mostly dead ones reach the spam folder, including those 800.
How to verify: Watch your bounce rate on the next send. It should drop below 0.5%. In Google Postmaster Tools, your domain reputation should climb from Low or Medium toward High over two to three sends.
Fix 9: Warm up new domains slowly, with real subscribers
Enterprise warm-up plans start at 5,000 a day. Yours should not. If your domain or sending platform is new, ramp like this, mailing your most engaged contacts first:
| Week | Recipients per send | Who to send to |
|---|---|---|
| 1 | 50 to 100 | Recent buyers, people who replied to you |
| 2 | 200 to 400 | Opened in the last 30 days |
| 3 | 600 to 1,000 | Opened in the last 90 days |
| 4 | 1,500 to 2,500 | Opened in the last 180 days |
| 5+ | Full active list | Everyone not sunsetted |
Two extra rules. Do not double your volume if the previous send showed a complaint rate above 0.1%: hold flat instead. And ignore paid “warm-up” services that exchange artificial opens between bot inboxes. Gmail has been discounting that behaviour for years and it can look like manipulation.
How to verify: Track inbox placement across your manual seed accounts at each step. If Outlook or Yahoo starts foldering you, pause the ramp for a week before continuing.
Fix 10: Pick a cadence and hold it
Consistency beats frequency. A predictable twice-monthly newsletter outperforms bursts of six emails followed by four months of silence, because dormant lists forget you and forgotten senders get reported.
- Choose a cadence you can genuinely sustain: weekly, biweekly or monthly.
- Send at a similar time and day, so the pattern is recognisable.
- If you have gone quiet for 90 days or more, restart with a small re-engagement send to your most active segment, not a full blast.
- Split large sends across a couple of hours rather than dumping everything in one burst if your platform allows throttling.
How to verify: In Google Postmaster Tools, the Spam Rate chart should stay flat and below 0.10% across consecutive sends. Sharp spikes usually correlate with cadence changes.
Fix 11: Write and build emails that do not look like bulk mail
Content-based spam myths waste a lot of small-sender energy. The word “free” will not kill you. These will:
- One giant image with almost no text. Keep a healthy text-to-image balance and always include real HTML text.
- Missing plain-text version. Send multipart messages with both HTML and text.
- Link shorteners. bit.ly and similar are heavily abused. Use your own tracking domain instead.
- Mismatched or spammy subject and preheader. Clickbait drives complaints, and complaints drive filtering.
- Attachments. Link to files, do not attach them.
- Broken or unbranded imagery hosted on a bad domain.
Segmentation helps too. Sending your product update only to customers, and your beginner guide only to new subscribers, raises engagement per send, which is the metric providers actually reward.
How to verify: Run the final HTML through Postmark Spam Check or Mail-Tester. Aim for a Mail-Tester score of 9/10 or above. Anything under 7 needs work before you send.
Fix 12: Monitor after every send, not once a quarter
Pre-send checks tell you the email is technically sound. Post-send data tells you whether real inboxes accepted it. You need both. Build a five-minute routine:
- Before sending: seed test to your own Gmail, Outlook.com, Yahoo and Microsoft 365 accounts. Note inbox versus Promotions versus Spam.
- 24 hours after: check delivery, bounce, complaint and unsubscribe rates in your platform.
- Weekly: check Google Postmaster Tools for domain reputation, spam rate and authentication pass rates.
- Monthly: blacklist check on your sending domain and tracking domain.
- Quarterly: read your DMARC aggregate reports for unexpected sending sources.
Note that Gmail landing in the Promotions tab is not a deliverability failure. It is still the inbox. Chasing the Primary tab by stripping images and links is usually not worth the trade. mailgun.com walks through the specifics.
Generic Advice That Backfires For Small Senders
| Common advice | Why it hurts under 10K/month | Do this instead |
|---|---|---|
| Get a dedicated IP | Not enough volume to build or maintain reputation | Stay on a reputable shared pool and focus on domain reputation |
| Send more often to boost engagement | Small lists fatigue fast, complaints spike | Improve relevance and segmentation at the same cadence |
| Go straight to DMARC p=reject | Small businesses use many third-party tools that send as them | p=none, read reports, then tighten in stages |
| Cap at 50 emails per day per mailbox | That is cold outreach guidance, not marketing guidance | Use a proper ESP for opt-in campaigns and follow the warm-up table above |
| Never use spam trigger words | Distracts from authentication and list issues that actually matter | Fix SPF, DKIM, DMARC, hygiene and complaints first |
Your 30-Day Deliverability Repair Plan
- Days 1 to 3: Move off free-mailbox sending, publish or repair SPF, enable DKIM, add DMARC at p=none. Verify with Mail-Tester and one Gmail header check.
- Days 4 to 7: Set up a custom tracking domain, fix your unsubscribe headers and footer, register for Google Postmaster Tools.
- Days 8 to 14: Validate the list, purge hard bounces and role addresses, tag a re-engagement segment, add form protection.
- Days 15 to 21: Send a small campaign to your most engaged segment. Seed test before, measure 24 hours after.
- Days 22 to 30: Scale volume per the warm-up table, sunset non-responders, review Postmaster Tools and your first DMARC reports.
Frequently Asked Questions
What is a good email deliverability rate for a small business?
Aim for a 98% or higher delivery rate and 95% or higher inbox placement, with complaints below 0.1% and hard bounces below 0.5%. Delivery rate only means the receiving server accepted the message. Inbox placement tells you whether a human will see it, and that needs seed testing or a placement tool to measure.
Do I really need DMARC if I send fewer than 5,000 emails a day?
Yes. The strict Gmail, Yahoo and Microsoft bulk-sender rules formally target higher volumes, but filtering systems now treat a missing DMARC record as a weak trust signal at any volume. A record at p=none costs nothing, takes five minutes, and gives you visibility into domain spoofing.
How do I test email deliverability for free?
Combine three free methods: send a test to Mail-Tester for a technical score, send to a manual seed list of Gmail, Outlook.com, Yahoo and Microsoft 365 accounts you control to see actual folder placement, and monitor Google Postmaster Tools for ongoing Gmail reputation and spam-rate data.
Should I use double opt-in?
Use it for any source where signup quality is uncertain: paid ads, giveaways, lead magnets, embedded third-party forms. For checkout opt-ins and in-person signups where intent is clear, single opt-in with strong validation is usually fine. If your bounce or complaint rate is elevated, switch everything to double opt-in until it recovers.
Why did my deliverability drop suddenly?
Look at the four usual culprits in order: a list import from an unfamiliar source, a long gap since your last send, a DNS or platform change that broke authentication, and a content or offer change that spiked complaints. Check your DKIM and SPF pass rates first, since a single edited DNS record explains most overnight collapses.
Does Gmail’s Promotions tab count as spam?
No. Promotions is part of the inbox and subscribers who expect marketing often look there deliberately. Only the Spam folder counts as a deliverability failure. Do not gut your email design chasing the Primary tab.
The Short Version
The email deliverability best practices that matter most for small senders are unglamorous: authenticate properly with SPF, DKIM and DMARC, send from a domain you own, collect addresses honestly, delete the dead ones, warm up gradually, keep a steady cadence, and check the results after every single send. Do those and you will beat plenty of much larger senders into the inbox.
Need a second pair of eyes on your setup? Get in touch and we will run a full deliverability audit on your domain, your list and your last three campaigns.
