Email Deliverability Best Practices for SaaS Sending

Email deliverability best practices come down to one job: prove you are a real sender, send only to people who want your mail, and never send more than your reputation can carry. Get those three right and your onboarding emails, trial nudges, and password resets land in the inbox. Get them wrong and your product looks broken to users who never saw the message.

Deliverability is the share of your email that actually reaches the inbox, as opposed to delivery, which only means the receiving server accepted the message. Your tool reports delivery; the inbox decides deliverability. This is a checklist, not a lecture. It is organized the way you would actually work through it: what to set up once, what to do before every send, and what to watch continuously. It is written for SaaS teams whose email reacts to user behavior (signups, trials, activation, churn), so the practices here account for transactional and lifecycle sending, not just a weekly marketing blast. Every record and threshold below is copyable, and each is tied to a rule a mailbox provider actually enforces.

Key takeaways

• Deliverability is inbox placement, not "delivered." Your tool can report 99 percent delivered while a chunk sits in spam, so measure placement separately.
• Authentication is table stakes. Gmail and Yahoo require SPF, DKIM, and DMARC for bulk senders, and Gmail now rejects non-compliant mail outright.
• Keep your spam complaint rate under 0.10 percent and never let it touch 0.30 percent. Per Google's sender guidelines, 0.30 percent is the enforcement line.
• Warm a new domain slowly and send to your most engaged people first. A steady, human-looking volume curve is the single clearest positive signal.
• Do not trust raw open rates. Apple Mail Privacy Protection inflates them, so segment on clicks, replies, and true opens, not machine opens.

The one-page best-practices checklist

If you read nothing else, work this list top to bottom. The sections after it explain the why and give copyable records.

Set up once (foundation)

• Publish SPF, DKIM, and DMARC on your sending domain, and start DMARC at p=none.
• Send from a subdomain you control (for example mail.yourapp.com), not your bare root domain, so a deliverability problem never touches your corporate mail.
• Set up a branded, one-click unsubscribe in the message header.
• Turn on Google Postmaster Tools and a Microsoft SNDS account so you can see your reputation.

Before every send (hygiene)

• Remove hard bounces and addresses that have not engaged in six months.
• Confirm every recipient opted in. Never send to a purchased or scraped list.
• Segment by behavior so each message goes to people it is actually relevant to.
• Run a spam-score check on the message and send a real test to inboxes you control.

Continuously (monitoring)

• Watch your spam complaint rate in Postmaster Tools and act before it nears 0.30 percent.
• Track true opens, clicks, and replies, not raw opens, as your engagement signal.
• Keep sending volume steady. Avoid sudden spikes off a cold domain.
• Sunset unengaged contacts on a schedule instead of mailing them forever.

The rest of this guide turns each block into something you can copy and run.

Best practice 1: Authenticate before you send anything

Authentication is how a receiving server proves an email really came from your domain and was not forged. Gmail and Yahoo made it mandatory for bulk senders in February 2024, and from late 2025 Gmail shifted from delaying non-compliant mail to rejecting it. If these three records are wrong, no other best practice on this page will save you. The full mechanics live in our SPF, DKIM, and DMARC explainer; here is what to publish.

SPF lists which servers may send for your domain. One TXT record on the domain you send from. For Amazon SES it looks like this:

Type: TXT
Host: @
Value: v=spf1 include:amazonses.com ~all

Use exactly one SPF record. If you send through more than one service, merge the includes into that single record rather than publishing two.

DKIM adds a cryptographic signature so the receiver can confirm the message was not altered. Your provider gives you the keys as CNAMEs with a selector. With SES you publish three CNAMEs it generates:

Type: CNAME
Host: abcd1234._domainkey.yourapp.com
Value: abcd1234.dkim.amazonses.com

DMARC tells receivers what to do when SPF or DKIM fails and asks them to send you reports. Start in monitor mode:

Type: TXT
Host: _dmarc.yourapp.com
Value: v=DMARC1; p=none; rua=mailto:[email protected]; fo=1

Leave p=none for two to four weeks, read the aggregate reports, confirm all your legitimate mail passes, then tighten to p=quarantine and eventually p=reject. Jumping straight to p=reject before you have watched the reports is how teams send their own transactional mail to spam.

Best practice 2: Only mail people who asked for it

Reputation is earned by sending to people who want your mail. The fastest way to wreck it is to mail addresses that never opted in, because those recipients hit "report spam" instead of unsubscribing, and complaints are the heaviest negative signal there is.

• Never buy or scrape a list. Purchased lists are full of spam traps: real-looking addresses whose only purpose is to catch senders who did not collect consent. One hit can tank your domain reputation.
• Use confirmed opt-in where the stakes are high. For marketing and newsletter signups, a confirmation click weeds out typos and bots before they ever bounce.
• Make unsubscribe effortless. A visible one-click unsubscribe in the header is required for bulk senders and, counterintuitively, protects you: an easy unsubscribe is a person choosing to leave quietly instead of filing a complaint.
• Suppress, do not delete, on unsubscribe. Keep a suppression list so an unsubscribed address can never be re-added by an import.

For SaaS specifically, separate your transactional consent from your marketing consent. A user who signed up for your product consented to password resets and receipts; they did not necessarily consent to a weekly product newsletter. Mailing the newsletter to people who only wanted transactional mail is a complaint magnet.

Best practice 3: Keep your list clean on a schedule

A big stale list always loses to a smaller engaged one, because mailbox providers grade you on engagement per send. List hygiene is the recurring chore that keeps that number healthy.

• Remove hard bounces immediately. A hard bounce means the address does not exist. Continuing to mail it signals you do not maintain your list.
• Sunset the unengaged. Set a policy: if a contact has not opened or clicked in six months, move them to a re-engagement track, and if that fails, stop mailing them. Some teams run this at 90 days for high-frequency sending.
• Watch soft bounces for patterns. A single soft bounce is a full mailbox; a rising trend is a reputation warning.
• Validate at the point of capture. Syntax and MX validation on your signup form stops bad addresses from ever entering the list.

Behavioral segmentation is where SaaS teams have an edge. Because you know what a user did in the product, you can send the trial-ending nudge only to trial users who have not upgraded, instead of blasting the whole list. Fewer, more relevant sends means higher engagement per send, which is exactly what protects placement. Our sender reputation guide goes deeper on how these signals compound.

The same checklist, grouped by when you actually do it: once at setup, before each send, and on an ongoing basis.

Best practice 4: Warm up new domains and IPs

A brand-new sending domain has no reputation, and to a mailbox provider "no reputation" reads as "suspicious." Sending 20,000 emails from a domain that sent zero yesterday is the clearest spam signal you can produce. Warm-up is the practice of ramping volume gradually so providers see a steady, human-looking pattern.

There is no official schedule, but this conservative ramp works for a new domain mailing an engaged list:

Two rules make warm-up work. Send to your most engaged people first, because their opens and clicks are the positive signal that builds trust. And keep the curve smooth, with no spikes. If you send big broadcasts, a reputation-safe chunked send that paces a large blast into batches keeps you from ever creating a spike by accident. The deeper version, with re-warming after a reputation dip, is in our email warm-up guide.

Best practice 5: Respect the bulk-sender rules Gmail and Yahoo enforce

Since February 2024, if you send 5,000 or more messages a day to Gmail addresses, Google treats you as a bulk sender, and Yahoo applies parallel rules. Per Google's published sender guidelines, bulk senders must:

• Authenticate with SPF and DKIM, and publish DMARC at a minimum of p=none with alignment.
• Offer one-click unsubscribe in the header and honor it within two days.
• Keep spam complaints, as measured in Google Postmaster Tools, below 0.10 percent, and never reach 0.30 percent.
• Maintain valid forward and reverse DNS (PTR) records and send over TLS.

The 0.30 percent ceiling is smaller than it sounds. At 10,000 sends, just 30 complaints hits the line. Per Google's guidelines, once you cross it you have to hold under 0.30 percent for seven straight days to recover. This is why the hygiene practices above are not optional busywork: every stale address is a candidate to complain.

Best practice 6: Watch the right numbers

Providers decide placement from what your recipients do. Opens, clicks, replies, and "move to inbox" are positive; deletions without reading and spam complaints are negative. So monitor the signals that actually predict placement, and set up the free tools that show them.

• Google Postmaster Tools shows your spam complaint rate, domain and IP reputation, and authentication results on real Gmail traffic. Set it up first; the Postmaster Tools setup guide walks through domain verification.
• Microsoft SNDS does the equivalent for Outlook and Hotmail traffic.
• Your true open rate, not raw opens. Since Apple introduced Mail Privacy Protection in 2021, Apple Mail pre-loads your tracking pixel whether or not a human opened the message, which inflates opens and mixes real opens with machine opens. Corporate scanners like Mimecast and Proofpoint do the same. If you segment or sunset based on raw opens, a privacy proxy is making the decision for you. Use analytics that separate genuine human opens from scanner and privacy-proxy opens, and lean on clicks, replies, and conversions.

When mail does start landing in spam, work the layers bottom-up: re-check authentication, check blacklists, read your spam rate, clean the list, cut content triggers, then slow down and re-warm. Our guide on why emails go to spam is the full triage walkthrough, and the companion piece on how to improve email deliverability in 30 days turns this checklist into a week-by-week plan if you are recovering from a real problem.

A copyable pre-send checklist

Run this before any broadcast or new lifecycle campaign goes live:

1. SPF, DKIM, DMARC all pass and align (run a domain checker).
2. Sending from an authenticated subdomain, not the bare root domain.
3. One-click unsubscribe present and working.
4. Audience is opted-in, deduped, and behaviorally segmented.
5. Hard bounces and six-month-inactive contacts suppressed.
6. Message passes a spam-score check (no all-caps subject, healthy text-to-image ratio, no link shorteners, no broken links).
7. Real test send to a Gmail, Outlook, and Yahoo inbox you control, and you confirmed placement.
8. Volume fits your warmed capacity, with no sudden spike off a cold domain.

Where Meisa fits

Most of this checklist is provider-agnostic on purpose, because deliverability is a discipline, not a feature you buy. But the discipline is easier when the tool is built around it. Meisa is an email platform for SaaS teams that runs on your own Amazon SES, so you own your sending and your sender reputation instead of renting a shared pool. It handles domain verification with DKIM, SPF, and DMARC, paces large broadcasts with a reputation-safe chunked send it calls Warm Send, reports a true open rate that separates human opens from Apple MPP and corporate-scanner opens, and fires lifecycle sequences on real product events so each message reaches only the people it is relevant to. That behavioral targeting is the same thing that keeps engagement per send high.

To be straight about the landscape: if you only send transactional email and want a bare API, a developer-first service like Resend is a cleaner fit. If your world is ecommerce, Klaviyo owns that lane. Meisa is built for the SaaS team that runs behavior-triggered lifecycle email plus broadcasts and wants to own its deliverability end to end. If that is you, see the lifecycle email guide for SaaS for how behavioral sending and deliverability reinforce each other, and note that every best practice here works no matter which tool you choose.

Frequently asked questions

What are the best practices for email deliverability?

The core set: authenticate with SPF, DKIM, and DMARC; send only to opted-in contacts; keep your list clean by removing hard bounces and unengaged addresses; warm up new domains slowly and send to engaged people first; offer one-click unsubscribe; keep your spam complaint rate under 0.10 percent; and monitor real engagement (clicks, replies, true opens) rather than raw opens.

What is a good email deliverability rate?

Per Validity, a good deliverability rate is at least 85 percent, with 98 to 99 percent considered ideal and anything below 70 percent needing work. Treat those as the source's figures. The more reliable proof is an inbox-placement test showing where your mail actually lands, plus a spam complaint rate under 0.10 percent in Google Postmaster Tools.

How do I keep my spam complaint rate low?

Only mail people who opted in, make unsubscribe a visible one-click action, remove unengaged contacts on a schedule, and segment so each message is relevant. Per Google's sender guidelines, keep complaints under 0.10 percent and never reach 0.30 percent. Watch the number in Google Postmaster Tools and pull back from your least engaged segment the moment it climbs.

Do I need a dedicated IP for good deliverability?

Not always. A shared IP pool with a well-run provider is fine for lower volume, since your reputation rides mostly on your domain. A dedicated IP makes sense once you send consistently high volume and want full control over your IP reputation, but it requires disciplined warm-up and steady volume to stay healthy. Running on your own Amazon SES lets you choose either as you grow.

Which best practices matter most?

Authentication comes first, because a broken SPF, DKIM, or DMARC record can cause a total collapse and nothing else helps until it is fixed. After that, the highest-return habits are only mailing engaged, opted-in contacts and keeping your list clean, since those directly control the complaint and bounce rates providers grade you on. Warm-up matters most when you are on a new domain. For a sequenced timeline that puts these in order, see our 30-day plan to improve email deliverability.