What poor email deliverability actually costs, and how to diagnose it

01What it actually costs

The visible cost is marketing mail nobody sees. The expensive cost is transactional mail - password resets, order confirmations, invoices, verification codes. When those land in spam, you get support tickets, failed signups, unpaid invoices and customers who conclude your product is broken.

This is why separating transactional and bulk sending matters. A marketing campaign that damages your reputation should not be able to stop password resets arriving, and on a single sending domain it absolutely can.

02Diagnose in this order

Start with DNS, because most problems are visible there before you look at anything else. Check SPF resolves within the lookup limit, DKIM signs with a current key, DMARC exists and is being monitored, and reverse DNS matches your sending host. A surprising share of deliverability incidents are a DNS change nobody connected to the symptom.

Then check reputation: are you on any blocklists, what do your DMARC aggregate reports show, and has sending volume changed abruptly? Only after both of those is content worth examining, and by then you usually do not need to.

03The warm-up mistake

New sending infrastructure has no reputation. Launching at full volume from a fresh IP is the single most common cause of a new platform landing in spam, and it is entirely avoidable - receiving providers treat a sudden high-volume sender from an unknown address as exactly what it looks like.

The fix is unglamorous: start low, increase gradually over weeks, and watch bounce and complaint rates as you go. Teams under pressure to migrate quickly skip this and then spend far longer recovering reputation than the warm-up would have taken.

04DMARC done properly

Setting DMARC to p=reject on day one blocks your own legitimate mail from services you forgot were sending on your behalf - the CRM, the invoicing tool, the support desk. The correct sequence is p=none with aggregate reports monitored, identify every legitimate sender, authenticate them, then escalate to quarantine and finally reject.

The reports are the point. They tell you exactly who is sending as your domain, which is usually more sources than anyone expected, and that inventory is what makes enforcement safe rather than disruptive.

• Start at p=none with reports actively monitored.
• Inventory every legitimate sender before escalating.
• Move to quarantine, then reject, once sources are authenticated.
• Keep monitoring after enforcement - new tools get added.

05When to get help

If transactional mail is affected, treat it as an incident rather than a marketing issue - it is directly blocking customers from using your product. If you have been blocklisted more than once, the underlying cause has not been fixed and delisting again will not help.

A deliverability audit is typically a short engagement: DNS and authentication review, reputation check, sending pattern analysis and a remediation plan. It is one of the few pieces of work where the diagnosis is fast and the fix is usually configuration rather than a project.