Deliverability best practices

Mailbox providers decide placement on authentication and hygiene. The platform makes most of it unavoidable. The rest depends on your practices.

Authentication (done for you)

The platform DKIM-signs every message with the active 2048-bit key (ep1) of the domain. SPF authenticates the message through the bounce.<domain> Return-Path. DMARC uses adkim=s and aspf=r so the bounce subdomain aligns. A domain cannot send until those records verify. Keep them verified; a DNS drift alert tells you when one breaks.

Warm-up

New domains start with a daily allowance of 200 messages. A daily job raises the stage (500, 1,000, 2,000, 5,000, 10,000, then no cap) when bounce and complaint rates stay under target. Overflow waits; the platform does not lose it. Do not try to route around the allowance by adding domains.

Targets

Metric	Target	Why
Hard-bounce rate	< 2 %	Above it the tile turns red and a bounce-rate alert can fire.
Complaint rate	< 0.1 %	The spam-rate threshold of Gmail is 0.3 %; stay far under.
Delivery rate	≥ 98 %	The cut-over bar in the migration playbook.

Hard bounces and complaints suppress the address automatically. Never remove those suppressions to try again.

Bulk vs transactional

• Give bulk messages a bulk kind (digest.*, bulk.*, sequence.*, or send them as a broadcast) and one recipient per message. You then get RFC 8058 one-click unsubscribe headers, which Gmail and Yahoo require, and honoured unsubscribes within seconds.
• Keep transactional messages transactional: no unsubscribe header, no marketing content.
• Tie bulk messages to a topic, so an unsubscribe removes the person from that stream and not from your invoices.
• Set the postal address of the organization in Settings; the worker then adds it to bulk footers.

Lists

Only send messages to people who signed up. Import with the properties that you filter on. Use segments rather than sending to everyone. Watch stats.suppressed on broadcasts. A growing number means a stale list.

DMARC ramp: none → quarantine → reject

Domains start at p=none, so receivers block nothing while reports accumulate at your dmarc.f5send.com intake. Read the DMARC tab of the domain. The recommendation card suggests the next step after 30 days of reports, ≥ 99 % alignment and no failing source above 1 % of volume. Unaligned sources on the tab are other systems that still send as your domain. Move them or stop them before you tighten the policy.

The policy is a domain setting, not a hand edit in DNS. An admin sets it in the DMARC policy card, or clicks Apply recommendation on the DMARC tab. Start quarantine with a low pct (for example 10) and raise it as reports stay clean. Then move to reject. Cloudflare domains get the new record published at once. Manual domains show the new record to copy; verify after you replace it.

Feedback loops

Gmail and Microsoft send complaint data only to senders who enrol. Yahoo requires an active Complaint Feedback Loop (CFL) for every DKIM domain. Do this once per sending domain:

1. Gmail Postmaster Tools — add the domain and the platform service account (see Metrics & alerts). The checklist ticks itself when data arrives.
2. Yahoo CFL — enrol the DKIM domain at senders.yahooinc.com with an address you read; mark it on the domain page.
3. Microsoft SNDS — register the sending IP ranges or the domain at sendersupport.olc.protection.outlook.com; mark it on the domain page.

The Deliverability checklist card on each domain page shows the state of all six items.

Optional hardening

• MTA-STS / TLS-RPT for domains that receive mail (domain page toggle).
• Open/click tracking only where you need it (track on the message). It needs the link.<domain> CNAME.