Email Deliverability: The Complete Guide for Bulk Senders (2026)
Email deliverability decides whether your campaigns reach the inbox or vanish into spam. Here is the complete, no-fluff guide: authentication, reputation, warm-up, POPIA and what actually moves the needle.
Email deliverability is the measure of whether the emails you send actually reach the recipient's inbox, rather than landing in spam, getting delayed, or being rejected outright. It is governed by sender authentication (SPF, DKIM and DMARC), the reputation of your sending domain and IP, how clean your list is, and how recipients behave when your mail arrives. Get those four right and the inbox follows.
Key takeaways
- Deliverability is not the same as delivery. A server can accept your email (delivery) and still dump it in spam (poor deliverability).
- Three technical records, SPF, DKIM and DMARC, form the baseline. Without them, modern inboxes barely give you a hearing.
- Since February 2024, Google and Yahoo enforce specific rules for anyone sending more than 5,000 messages a day to their users, including a hard cap on spam complaints.
- Reputation is earned slowly and lost quickly. A brand-new domain needs warm-up; an established one can be wrecked by a single bad send.
- POPIA shapes who you are allowed to email in South Africa in the first place, which is the first deliverability decision most senders skip.
What is email deliverability, and how is it different from "delivery"?
Email deliverability is whether your message reaches the inbox and gets seen, not just whether the receiving server accepted it. Delivery is a yes/no handshake between servers. Deliverability is the outcome after that handshake: inbox, promotions tab, spam folder, or silently dropped.
This distinction trips up a lot of senders. You can have a100% delivery ratein your dashboard (every message technically accepted) while half of it sits in spam, unread. The platforms that only report delivery are telling you the easy half of the story.
A Cape Town coffee roaster sending a monthly newsletter to 8,000 subscribers (an illustrative example) might see every email "delivered" according to their tool, yet open rates sitting at 4%. That gap is almost always a deliverability problem, not a content problem: the emails arrived, they just arrived in the wrong folder.
What actually determines whether an email reaches the inbox?
Inbox placement is decided by a handful of signals that mailbox providers (Gmail, Yahoo, Outlook, local South African ISPs) weigh every time your mail arrives. None of them is magic; all of them are checkable.
| Signal | What it tells the mailbox provider | How you get it right |
|---|---|---|
| Authentication (SPF, DKIM, DMARC) | You are who you say you are | Publish all three records correctly for every sending domain |
| Sender reputation | Your history of good behaviour | Consistent sending volume, low complaints, low bounces, over time |
| Engagement | Recipients actually want this mail | Opens, clicks, replies; the opposite of deletes-without-opening |
| List quality | You are not spraying strangers | Permission-based lists, regular hygiene, no purchased addresses |
| Content and structure | The message itself isn't a spam pattern | Real content, working links, no deceptive subject lines |
| Infrastructure | Your sending platform behaves | Dedicated sending setup, proper rate limiting, no shared "burnt" IPs |
No single row on that table saves you if the others are broken. A perfectly authenticated domain still lands in spam if nobody opens your emails. A beautifully written campaign still bounces if you never set up DKIM.
What are SPF, DKIM and DMARC, and why do all three matter?
SPF, DKIM and DMARC are the three DNS records that prove an email claiming to be from your domain actually came from you, and they work together rather than as alternatives. Skip one and mailbox providers treat your domain as only partially verified, which quietly caps how much of your mail reaches the inbox.
SPF (Sender Policy Framework)lists which servers are allowed to send mail on behalf of your domain. Think of it as a guest list at the door: if the sending server isn't on it, the receiving mailbox gets suspicious.
DKIM (DomainKeys Identified Mail)attaches a cryptographic signature to each message, proving the content wasn't altered in transit and really did come from your domain. It's the wax seal on the envelope.
DMARC (Domain-based Message Authentication, Reporting and Conformance)tells receiving servers what to do if a message fails SPF or DKIM (quarantine it, reject it, or do nothing) and sends you reports when that happens. Without DMARC, SPF and DKIM are just two unconnected checks with no enforcement behind them.
All three are DNS records you publish once per sending domain. Getting them wrong, or never finishing the setup, is still the single most common reason a legitimate South African business ends up in spam.
What changed with Gmail and Yahoo's 2024 sender rules, and do they still apply in 2026?
Yes, and they are now simply how bulk sending works, not a temporary adjustment. Since February 2024, Google requires anyone sending more than 5,000 messages a day to Gmail addresses to authenticate with SPF and DKIM, set up a valid DMARC record, and keep spam complaint rates below a strict threshold. According toGoogle's email sender guidelines, bulk senders must"keep spam rates reported in Postmaster Tools below 0.3%", with Google recommending senders aim closer to 0.1% for safety.
Yahoo introduced equivalent requirements on the same timeline: authentication, a working one-click unsubscribe link in every marketing message, and the same complaint-rate discipline. One-click unsubscribe isn't optional politeness any more, it's a technical requirement (built on a standard called RFC 8058), and providers expect unsubscribe requests to be honoured fast, typically within 48 hours.
The practical effect for a bulk sender in 2026: if you're sending real volume and you haven't authenticated your domain, a meaningful share of your list simply never sees your email. Gmail and Yahoo between them cover a huge proportion of consumer inboxes in South Africa, so this isn't a niche technical detail, it's the floor.
Why does sender reputation matter more than content?
Sender reputation is the trust score mailbox providers build up about your sending domain and IP address over time, and it influences inbox placement more than almost anything in the email itself. You can write a flawless, relevant campaign and still land in spam if your domain's history is shaky.
Reputation is built from real signals, not vibes: consistent sending patterns, low bounce rates, low complaint rates, and recipients who open and click rather than delete unread. It's slow to build and fast to damage. One aggressive send to a stale, unengaged list can knock a healthy domain's reputation down for weeks.
Here's the part people don't like hearing:your platform's reputation affects you too.If you share sending infrastructure with senders who behave badly, their bad behaviour can drag your deliverability down, through no fault of your own. This is why dedicated sending infrastructure per account, rather than one shared pool for every customer on a platform, matters more than most sign-up pages admit.
What is domain and account warm-up, and why does a new domain need it?
Warm-up is the gradual, deliberate increase of sending volume on a brand-new domain or IP so mailbox providers can build trust in it before you rely on it for full volume. Mailbox providers are naturally suspicious of a domain with zero sending history suddenly blasting out 50,000 emails. That pattern looks exactly like a spammer spinning up a new domain to dodge a block.
A sensible warm-up starts small (a few hundred emails to your most engaged subscribers) and increases over days or weeks, letting positive engagement signals accumulate before volume scales up. Skip this step and even a perfectly authenticated, perfectly permission-based list can get throttled or filtered simply because the domain looks untested.
A Durban online store switching email platforms (again, an illustrative scenario) is the classic case: they move to a new domain, send their full 20,000-name list on day one, and watch open rates collapse. Not because the content got worse. Because the domain had no reputation to stand on yet.
How do list hygiene and engagement affect deliverability?
List hygiene, keeping your list free of invalid, inactive and uninterested addresses, directly affects your sender reputation, because mailbox providers read high bounce rates and low engagement as signs you're not sending wanted mail. A list full of addresses that never open anything is a slow leak in your deliverability, even if every one of them opted in two years ago.
The fix isn't complicated, it's just unglamorous:
- Remove hard bounces immediately; a dead address never becomes a live one.
- Watch for subscribers who haven't opened anything in six months or more, and either re-engage them deliberately or stop emailing them.
- Never buy, rent or scrape a list. Purchased lists are, almost without exception, a deliverability disaster, because the people on them never asked for your mail.
- Use double opt-in where you can. It shrinks your list but keeps the people on it genuinely interested.
Engagement is a feedback loop. Good engagement protects reputation, which improves inbox placement, which improves engagement further. The reverse spiral is just as real, and much faster.
What is a suppression list, and why does it matter for deliverability?
A suppression list is the record of every address you must never email again, whether because they unsubscribed, bounced hard, or marked you as spam, and it exists to stop you from accidentally repeating the mistake that caused the problem in the first place. Good platforms maintain this automatically; if yours doesn't, you're relying on a human to remember, which is how deliverability disasters happen.
Sending to someone who already complained once is one of the fastest ways to compound a reputation problem. Mailbox providers notice repeat offences far more harshly than first-time ones.
How does South Africa's POPIA affect email deliverability and compliance?
POPIA, the Protection of Personal Information Act, governs who you're legally allowed to email in South Africa in the first place, and getting that wrong creates the complaints and low engagement that wreck deliverability downstream. The Act has been in full effect since 1 July 2021, according to South Africa'sInformation Regulator, the body that oversees and enforces it.
POPIA requires a lawful basis for processing someone's personal information, which for marketing email generally means clear consent, a legitimate existing relationship, or another recognised ground, plus an easy way to opt out. This isn't just a legal box to tick. A list built on real consent is, almost by definition, a list that opens, clicks and doesn't complain, which is exactly what protects deliverability.
Two things worth saying plainly here, because this isn't the kind of thing a platform should fudge:
POPIA tooling is not the same as legal advice.A platform can give you audit logs, data export and the ability to honour a deletion request. Whether your specific consent wording or marketing practice is compliant is a question for a professional or the Information Regulator directly, not a blog post.
A compliant list is usually also a better list.Consent-based subscribers are warmer leads than scraped ones, by definition.
How do you monitor and measure deliverability?
You measure deliverability by watching the signals that sit downstream of "sent", not the send confirmation itself: opens, clicks, bounces, spam complaints, and per-recipient delivery status. A sending tool that only tells you "sent successfully" is telling you the least useful thing it knows.
The things worth watching, in rough order of urgency:
- Bounce rate.Hard bounces (invalid address) should be near zero if your list is clean. A rising hard bounce rate is an early warning, not a footnote.
- Complaint rate.This is the number mailbox providers actually act on. Staying meaningfully under the thresholds Google and Yahoo publish is not optional for anyone sending real volume.
- Open and click rates, read over time and by segment, not as a single vanity number. A sudden drop across your whole list usually means a deliverability problem, not a sudden loss of interest.
- Per-recipient delivery status, so you can see not just "the campaign sent" but which individual addresses bounced, complained, or never opened at all.
If your current platform can't show you bounce and complaint data per campaign, in something close to real time, you're flying without the one instrument that actually matters.
What are the most common deliverability mistakes bulk senders make?
Most deliverability problems trace back to a short list of avoidable habits, not bad luck or a platform conspiring against you.
| Mistake | Why it hurts you | The fix |
|---|---|---|
| Skipping DMARC after setting up SPF and DKIM | No enforcement policy means failures go unreported and unpunished-by-you | Publish a DMARC record for every sending domain, even a lenient one to start |
| Full-volume sending on a brand-new domain | Looks identical to a spammer's pattern | Warm up gradually over 1 to 3 weeks |
| Buying or scraping lists | Guarantees high complaints from people who never asked for your mail | Build lists on genuine opt-in only |
| Ignoring bounce and complaint reports | Reputation damage compounds silently until volume collapses | Monitor per campaign, act within days not months |
| Emailing a stale, unengaged segment at full frequency | Drags down overall engagement signals for the whole send | Separate and re-engage or retire inactive subscribers |
| Sharing sending infrastructure with unrelated senders | Someone else's bad behaviour becomes your problem | Prefer dedicated sending per account where available |
Where deliverability advice has to be honest about its limits
No platform, including Nimbl, can promise you 100% inbox placement. Anyone who promises that is selling you something. Deliverability is a shared responsibility between the sending platform's infrastructure and the sender's own behaviour: list quality, content, frequency, and how you treat your subscribers.
A platform can hand you properly authenticated domains, dedicated infrastructure, and clean warm-up. It cannot fix a list built on purchased addresses, or a sending cadence so aggressive that recipients start complaining out of fatigue.The tooling removes the technical obstacles. It doesn't replace good sending practice.
It's also worth saying where deliverability stops being the deciding factor. If you send one newsletter a year to forty people, the technical side of deliverability barely matters, your bigger risk is simply being forgotten. Deliverability earns its importance at real volume and real frequency, which is most bulk senders, but not quite all of them.
How does Nimbl Mail approach deliverability?
Inbox. Not spam. That's the whole job.That line isn't a slogan bolted on afterwards, it's genuinely the thing we built the sending infrastructure to do, because it's the thing most bulk email tools treat as an afterthought or an upsell.
In practice, that means a few concrete things. When you add a sending domain to Nimbl, we generate and publish the SPF, DKIM and DMARC records for you and verify them on the spot, no support ticket, no manual DNS fiddling required on our end. Every account gets its own dedicated sending infrastructure rather than a shared pool, and new domains go through automatic warm-up so you're not throwing a cold domain at full volume on day one. We build to Gmail and Yahoo's 2024 sender rules as a baseline, not a feature you have to ask for, with live bounce and complaint monitoring and alerts so a problem shows up in hours, not after a month of declining opens.
The rest of the platform is built around the same honesty. You get a proper drag-and-drop campaign builder (with an MJML code mode if you want to get hands-on), 25-plus starter templates, and live preview across desktop, tablet and mobile. List management is unlimited, lists, tags and segments, on every plan, with full engagement history per subscriber so you can actually see who's opening and who's gone quiet. Reporting covers opens, clicks, bounces, complaints, link performance and per-recipient delivery status, so you're not guessing. POPIA tooling, audit logs, data export, the right to deletion, comes standard rather than gated behind a higher tier. And because we charge for the emails you actually send, not the size of your list, a 50,000-subscriber list emailed once a month costs the same as a 5,000-subscriber list sent just as often.List growth should never be the reason your deliverability gets squeezed by a smaller budget.
Pricing is in rand, month to month, no lock-in: Solo at R249 a month for 10,000 emails, Starter at R695 for 50,000 (the most popular plan), and Enterprise at R1,195 for 100,000, with custom volume above that by contacting marketing@nimbl.one. There's no free plan, and we're upfront about why: free tiers get abused by spammers, which wrecks deliverability for everyone sharing that infrastructure, including the honest senders. That's not a feature we're missing. It's a trade-off we made on purpose.
If you want to see how that stacks up against the other tools South African senders actually consider, the honest comparisons live on ourcomparison hub, and the plain-English answers to the questions people ask most often are on ourFAQ page.
Last updated: 23 October 2026.