Email deliverability

Lesson 25 of 50Module 5 · Outreach that works7 min read

By Bill Hartzer · Hartzer Consulting · 25+ years in search, domains and expert witness work

Why this belongs in a link building course

Because the most common cause of a campaign with zero replies is not a bad pitch. It is that the mail went to spam, or was rejected at the gateway, and nobody checked.

The symptom is distinctive and easy to misread: no replies, no refusals, no unsubscribes, no bounces. Nothing at all. Teams respond by rewriting the subject line, which is like adjusting the wording of a letter you are posting into a drain.

The second reason matters more, because it costs real money. Sender reputation attaches to your domain and it is durable. A month of bulk outreach from your primary business domain can degrade delivery for your invoices, support replies and sales mail — for months, invisibly, because nothing tells you when a message is silently filtered.

You do not need to become a mail administrator. You need to understand three authentication records, one architectural decision, and one ramp-up discipline.

SPF, DKIM and DMARC

These three are the authentication layer. All are DNS records published on the sending domain, and all three are effectively mandatory now: major mailbox providers have tightened requirements to the point where bulk senders without them are filtered or rejected.

SPF (Sender Policy Framework) is a published list of the mail servers permitted to send on behalf of your domain. The receiving server looks up the record and checks whether the connecting server is on the list. It looks like this:

v=spf1 include:_spf.google.com include:sendingtool.example ~all

Each include: authorizes another sender. The trailing ~all means treat anything else as suspect; -all means reject it. There is a hard limit of ten DNS lookups in an SPF record, and exceeding it breaks the record silently — a common failure once a company has accumulated a dozen tools.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message using a private key held by the sending system. The matching public key is published in DNS at a selector subdomain, so the receiver can verify the message really came from your domain and was not altered in transit:

selector1._domainkey.example.com

Your sending platform generates the key and gives you the record to publish. The common mistake is publishing DKIM for one sending system and then sending through another that is not signed.

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the other two together. It tells receivers what to do when SPF and DKIM fail, and where to send reports:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

The policy p=none means monitor only. Start there, read the reports until you know every legitimate source of mail on your domain, then tighten to p=quarantine and eventually p=reject. Jumping straight to p=reject is how organizations discover, painfully, that their invoicing system was sending unauthenticated mail.

Authentication is necessary and not sufficient. It proves you are who you say you are. It does not make you welcome — a perfectly authenticated sender with a bad complaint rate still gets filtered.

Separate the sending domain

Do not run outreach from your primary business domain. This is the single highest-value structural decision in this lesson.

Register a separate domain for outreach and use it for nothing else. The usual pattern is a close variant of your brand — the same name on a different TLD, or with a word like mail or team attached. Two constraints: it must be obviously and honestly connected to your real organization, because deception fails the test in Lesson 4.4; and it must have a real website, even a single page, because a sending domain with no site attached is a spam signature.

What separation buys you:

• Blast radius containment. If reputation degrades, it degrades on a domain whose only job is outreach. Your invoices still arrive.
• Independent measurement. You can see the outreach domain's reputation without it being masked by normal business mail volume.
• A recovery path. A burned outreach domain can be retired. A burned primary domain is a serious business problem, and recovery takes months of good behavior.

Two cautions. A brand-new domain has no history, and no history is itself mildly suspicious — register it and let it sit for several weeks before sending. And do not run twenty near-identical domains through one platform to multiply volume. That is a spam pattern, it is detected, and it means you have decided volume is the answer.

The exception: genuine digital PR pitches to journalists should come from your real domain. A journalist needs to verify who you are, and a message from a lookalike domain undermines that. PR volumes are low enough that the risk is manageable.

Warmup

Mailbox providers evaluate sending patterns. A domain that has sent nothing for a year and then emits two hundred messages in an afternoon looks exactly like a compromised account, and is treated as one.

Warmup is the process of establishing a normal-looking history before you need it. The mechanics are simple and the discipline is the hard part.

• Start very low. A handful of messages a day in the first week.
• Increase gradually. Roughly doubling weekly is a common approach, subject to the signals below.
• Prioritize replies. Engagement is the strongest positive signal there is. Mail that gets opened and replied to teaches providers you are legitimate faster than volume ever will.
• Watch the signals. Rising bounces or spam placement means stop increasing and step back, not push through.
• Allow several weeks. A month before running meaningful volume is normal.

I am skeptical of automated warmup services, the ones that exchange mail between pools of accounts to simulate engagement. They generate correspondence with no human on either end, providers have been detecting and discounting these networks for some time, and participation puts you in a pool alongside senders whose behavior you cannot see. Warming an address by sending real mail to real people who reply is slower, and it is the version that holds up.

Whatever you do, cap steady-state volume per address well below what the platform allows. Twenty to fifty a day is a sane ceiling, and if that feels impossibly small, the constraint is telling you something true about the list.

Why a shared marketing platform is usually the wrong tool

The instinct is to use the email platform the company already pays for. It is nearly always a mistake, for structural reasons rather than feature ones.

• Shared IP pools. Bulk platforms send from shared address ranges, so your reputation is partly the reputation of everyone else on that range.
• The message looks like marketing. These platforms wrap links for click tracking, insert unsubscribe footers and tracking pixels, and often force an HTML template. Every one of those is a bulk-mail signal, and a wrapped redirect URL in place of the plain link is exactly what an editor does not want to see.
• Threading and replies. Outreach is correspondence. Replies must land in a real inbox, in a thread, where a human answers them. Broadcast platforms are built to send, not to converse.
• Category filtering. Mail sent through a known bulk platform is more likely to be routed to a promotions or updates tab, where an editor will never see it.
• Contractual terms. Many marketing platforms explicitly prohibit cold outreach in their acceptable use policies, so a link campaign can cost you the account you use for legitimate mailing.

The right tool sends plain-text mail from a real mailbox, threads replies into that mailbox, does not wrap links, and lets you turn tracking off entirely. That is a different product category, and the distinction is worth insisting on.

If your campaign is small — a few dozen genuinely researched pitches — the correct tool is your ordinary mail client, sent by hand. That is not a compromise. It is the highest-deliverability option available, and for Tier A prospects it should be the default regardless of campaign size.

Diagnosing a delivery problem

Rule out delivery before you rewrite the pitch. In order:

1. Check for the signature symptom. Zero of everything across more than about thirty sends is a delivery problem until proven otherwise. Real campaigns generate refusals.
2. Verify authentication is actually passing. Publishing the records is not the same as passing. Send a test to an address you control at a major provider and inspect the received headers for SPF, DKIM and DMARC results.
3. Read your DMARC reports. This is what rua= is for, and almost nobody reads them. They tell you which sources are sending as your domain and which are failing.
4. Test placement across providers. Delivery is not uniform. Send to seed addresses at several providers and check whether the message landed in the inbox, a category tab, or spam.
5. Check blocklists. Look up the sending domain and the sending IP on the main public blocklists. A listing explains everything at once.
6. Then look at content. Attachments, tracking pixels, link shorteners, wrapped redirect URLs, large images, and a mismatch between the From domain and the link domains are the usual culprits — in roughly that order.

When you find a problem, stop sending. Continuing while filtered actively deepens the reputation damage, and every message sent into a filter is a prospect you cannot pitch again with a clean slate.