When open rates drop and emails start landing in spam, the cause is almost always one of three things: missing or misaligned authentication, sending to people who stopped engaging, or a sudden change in volume or setup. Work through this email deliverability checklist in order: authentication, the Gmail and Yahoo sender rules, list hygiene, engagement, then monitoring. It applies whether your lifecycle revenue comes from Klaviyo flows or SaaS onboarding sequences.
Signs you have a deliverability problem
Not every open-rate drop is a deliverability problem. Apple Mail Privacy Protection records opens that never happened, and a shift in which mail apps your audience uses can move the number without a single email going to spam. Check what else moved before you rebuild anything.
| Signal | What it suggests |
|---|---|
| Opens and clicks drop together | A placement problem, not a tracking quirk |
| Drop concentrated at one mailbox provider | A reputation issue with that provider |
| Rising bounces or deferred messages | The provider is throttling or rejecting your mail |
| Spam complaints climbing | Frequency, content or audience mismatch |
| Seed tests to personal Gmail, Yahoo and Outlook accounts land in spam | Likely placement issue; confirm with provider-level data |
| Drop right after a change | New domain, ESP migration, list import or DNS edit |
Start by breaking performance down by recipient domain. If Gmail clicks fell off and Outlook held steady, you’ve narrowed it to one provider’s view of you.
Authentication: SPF, DKIM and DMARC
Authentication proves you’re allowed to send from your domain. Without it, mailbox providers have no reason to trust you, and the large ones now enforce it.
SPF
SPF is a DNS TXT record listing the services allowed to send mail for your domain. It checks the Return-Path (bounce) domain, not the From address people see, so many ESPs have you set up a sending subdomain instead of editing your root record.
- Exactly one SPF record per domain; two records break SPF entirely
- Every tool that sends with your domain in the Return-Path included: Google Workspace or Microsoft 365, helpdesk, billing tool, and any ESP or CRM that asks for an
include: - Under the limit of 10 DNS lookups; stacking
include:statements past it makes SPF fail - Ends in
~allor-all, never+all
DKIM
DKIM signs each message with a key published in your DNS.
- Custom DKIM set up in every sending tool, signing with your domain rather than the platform’s shared one
- 2048-bit keys wherever the provider supports them
In Klaviyo this means setting up a branded sending domain. In HubSpot it means connecting your email sending domain.
DMARC
DMARC tells providers what to do with mail that fails, and it introduces alignment: the domain in your visible From address must match the domain that passed SPF or DKIM.
- A TXT record at
_dmarc.yourdomain.com - Start at
p=nonewith arua=address so you receive aggregate reports - Read the reports for a few weeks to find legitimate senders you missed
- Move to
p=quarantine, thenp=reject, once every legitimate source passes
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comReports arrive as raw XML, so use a DMARC reporting tool to read them.
A quick check: send a campaign to a Gmail address and choose “Show original.” You want SPF, DKIM and DMARC all showing PASS, and the signing domain matching your From domain. When I audit lifecycle programs, the most common gap is DKIM signed with the platform’s domain instead of the brand’s. DKIM passes, but DMARC alignment fails.
Many teams also send marketing from a subdomain, such as mail.yourbrand.com, to keep campaigns separate from everyday team mail.
Bulk sender requirements for Gmail and Yahoo
Since February 2024, Gmail and Yahoo have required more from bulk senders. Google defines a bulk sender as anyone sending close to 5,000 or more messages a day to personal Gmail accounts, and once you cross that threshold you’re treated as one from then on. Microsoft announced similar rules for Outlook.com addresses in 2025. Enforcement has tightened since launch, so non-compliant mail now risks being rejected, not just filtered.
- SPF and DKIM both set up for your sending domain
- DMARC published, at least
p=none, with the From domain aligned to SPF or DKIM - One-click unsubscribe (List-Unsubscribe and List-Unsubscribe-Post headers) on marketing email, plus a visible unsubscribe link in the body
- Unsubscribes honored within two days
- User-reported spam rate in Google Postmaster Tools below 0.3%, ideally under 0.1%
- Valid forward and reverse DNS for sending IPs and TLS for transmission (your ESP handles these on shared infrastructure)
Klaviyo and HubSpot add the unsubscribe headers to marketing email. They can’t fix your DNS or your spam rate.
The spam rate is the requirement teams underestimate. A worked example with round numbers: a campaign delivered to 200,000 Gmail users that draws 400 spam reports sits at 0.2%. That’s under the hard limit but double the recommended ceiling, and one bad send to an old segment can push you over.
List hygiene and sunset policies
Providers judge you by how recipients react. Every address that never opens, clicks or buys tells them your mail isn’t wanted.
- Hard bounces suppressed automatically (confirm your ESP does this)
- Addresses that soft-bounce repeatedly suppressed
- No purchased, rented or scraped lists, ever
- Double opt-in or real-time validation on signup forms, especially giveaway and discount pop-ups
- Bot protection on forms, so fake signups don’t pollute the list
- Old imported lists re-permissioned or dropped, not blasted
These also keep you away from spam traps: abandoned addresses that providers repurpose, and typo domains like gmial.com. Hitting them tells providers you don’t manage consent.
Sunset policy
A sunset policy decides when someone stops getting regular email.
- Define unengaged. No click, site visit or order in a window of typically 90 to 180 days, set from your send frequency and buying cycle. For SaaS, product logins count as engagement.
- Send a re-engagement sequence. One or two emails asking whether they still want to hear from you.
- Suppress non-responders from campaigns. Keep them eligible for transactional mail such as receipts and password resets.
Use clicks, not opens, as the signal. For the Klaviyo build, see the sunset flow in essential Klaviyo flows for ecommerce.
Engagement-based segmentation
Instead of sending every campaign to the full list, send by engagement tier. Engaged subscribers produce positive signals that carry the send; cold ones drag it down.
| Tier | Example definition | Send to |
|---|---|---|
| Hot | Clicked or bought in last 30 days, or subscribed in last 30 days | Every campaign |
| Warm | Last click 31 to 90 days ago | Most campaigns |
| Cooling | Last click 91 to 180 days ago | Best-performing campaigns only |
| Cold | No click in 180+ days | Sunset sequence, then suppress |
Adjust the windows to your cadence. A brand sending daily needs shorter windows than a SaaS company sending a monthly newsletter.
Protect your triggered mail. Abandonment flows and onboarding emails go to people who just acted, so they earn strong engagement, but they share a domain reputation with campaigns. One broadcast to cold contacts can pull down the emails that make the most money. For SaaS teams, route product and transactional email through a separate stream or subdomain where your tools allow it, so a campaign problem doesn’t delay password resets or onboarding emails.
Warming new domains and IPs
Providers distrust volume from senders they don’t know. A new sending domain, a new dedicated IP or an ESP migration all reset some of your history.
Most brands don’t need a dedicated IP. On a shared pool, your platform manages IP reputation, but your domain reputation still follows you, so warm the domain either way.
- Start with the hot tier only
- Move triggered flows first; their audiences engage by nature
- Send consistently, daily or close to it
- Increase volume only while bounces and complaints stay flat
- Hold or cut back the moment deferrals or complaints rise
An example ramp for a list of around 200,000, with made-up round numbers:
| Week | Daily volume (example) | Audience |
|---|---|---|
| 1 | 2,000 to 5,000 | Clicked in last 30 days |
| 2 | 5,000 to 20,000 | Clicked in last 60 days |
| 3 | 20,000 to 50,000 | Clicked in last 90 days |
| 4+ | Full engaged list | Engaged in 180 days; cold stays suppressed |
Larger lists or shaky starting reputations take longer. When migrating ESPs, never send to the full imported list on day one.
Monitoring and troubleshooting
What to check weekly
- Google Postmaster Tools: spam rate and compliance status for your domain
- ESP reports by recipient domain: click, bounce and complaint rates for Gmail, Yahoo and Outlook separately
- DMARC reports: new failing sources or senders you don’t recognize
- Blocklists: check major lists such as Spamhaus when bounce messages mention a block
Troubleshooting sequence
When placement drops, work in this order and stop when you find the cause:
- Confirm it’s real. Clicks and conversions fell too, not just opens.
- Isolate it. Which provider? Campaigns, flows or transactional?
- Check authentication. “Show original” plus DMARC reports. Website migrations and DNS host changes often delete records.
- Check the rules. Spam rate in Postmaster Tools and working unsubscribe headers.
- Check what changed. A list import, a wider segment, higher frequency, new link domains or URL shorteners.
- Read bounce messages. Provider bounce codes often name the reason.
- Recover. Send only to the hot tier for a few weeks, then widen gradually, exactly like a warm-up.
Don’t switch domains or platforms to escape a reputation problem. It resets you to a cold start with the same list habits that caused it.
Deliverability is the unglamorous base of every lifecycle marketing program I run: flows and copy only matter once mail reaches the inbox.
Get it built
If your open rates dropped and you’re not sure why, I’ll audit authentication, list health and sending patterns, then fix what’s broken. The Growth Audit is $1,500 fixed and credited if we continue. See pricing or get in touch.