Email deliverability checklist

A contact form that emails you, a password reset, an order confirmation—all of it is worthless if the message lands in spam or bounces silently. Deliverability is largely a DNS and reputation problem, and most of it can be checked and fixed before it ever costs you a customer.

Core authentication records

• SPF (Sender Policy Framework) is published as a TXT record listing which servers are authorized to send mail for your domain
• DKIM (DomainKeys Identified Mail) is configured so outgoing mail is cryptographically signed, letting receiving servers verify it wasn't altered or spoofed
• DMARC is published, telling receiving servers what to do with mail that fails SPF or DKIM, and where to send reports about it
• Only one SPF record exists per domain—multiple SPF TXT records is a common, silent misconfiguration that breaks the check entirely
• Every legitimate sending source—your website's contact form, your email provider, any marketing or transactional email service—is actually included in SPF and set up for DKIM, not just your main mailbox provider

DMARC rollout

• DMARC starts at a monitoring-only policy so you can see what's actually passing and failing before enforcing anything
• DMARC aggregate reports are actually reviewed, not just generated and ignored, so legitimate mail that's failing gets fixed before enforcement tightens
• Policy is only tightened toward rejecting unauthenticated mail once you're confident every legitimate sending source is properly authenticated

Sender reputation & content

• The sending domain and IP have a track record of low spam complaints and low bounce rates—reputation is built over time and can be damaged quickly
• Transactional email (receipts, password resets, notifications) is kept genuinely separate in tone and volume from marketing email, since the two have very different risk profiles
• Recipient lists are kept clean—sending to addresses that consistently bounce or never engage drags down deliverability for everyone on the domain
• Unsubscribe or opt-out requests are honored promptly and completely for any marketing mail

Website-specific sending

• Contact-form and notification emails are sent through a properly authenticated path, not spoofed from an address the sending server isn't authorized to use
• The "from" address used by automated site email is a real, monitored address where practical, not a no-reply address that silently swallows replies
• Transactional emails (order confirmations, password resets, receipts) are tested end-to-end and confirmed to actually arrive, not just confirmed to leave the server

Testing & monitoring

• SPF, DKIM and DMARC records are checked with a free DNS lookup tool such as MXToolbox to confirm they're published correctly and consistently
• A test message is sent and its full authentication result reviewed, not just glanced at for a generic "sent successfully" confirmation
• Google Postmaster Tools (or an equivalent from a major mailbox provider) is used if mail volume is high enough to get meaningful reputation data from it
• Deliverability is re-checked after any change to hosting, DNS, or the service actually sending the mail

See the security checklist for the broader DNS and domain-security picture, and the site migration checklist for keeping email working through a host or DNS change.