What it means
There are three states a message can be in after you press send, and most teams only measure the first one.
- Accepted. The receiving server answered the SMTP conversation with a 250. It has taken custody of the message. It has promised nothing about where the message will end up.
- Delivered. The message was not bounced. This is the number your sending platform reports, and it is almost always above 98 percent, which is why it is such a comforting and such a useless metric.
- Inboxed. The message is in the primary inbox where a human might see it. This is deliverability. Nobody can measure it directly from the sending side, because the filtering decision happens inside the recipient's mail provider after acceptance.
The gap between delivered and inboxed is where campaigns quietly die. A 99.4 percent delivery rate with 60 percent inbox placement means four in ten of your recipients never saw the mail and you have no error message telling you so. The silence is the point: modern spam filtering almost never bounces, it files.
Authentication: what each record actually proves
Authentication is the price of admission. It does not make you trusted, it makes you identifiable, and you cannot build a reputation without a stable identity to attach it to. The three records are usually recited as a set, but they prove different things and fail in different ways.
The critical and most-misunderstood piece is DMARC alignment. SPF validates against the envelope sender, which for most sending platforms is a subdomain of the platform, not you. DKIM validates against whatever domain signed the message. DMARC checks that at least one of those passing domains matches the domain in the From header the human actually sees. That alignment requirement is the whole point: without it, anyone could pass SPF on their own domain while displaying yours.
Roll DMARC out in the order every serious sender uses: p=none with an rua address, read the aggregate reports for a few weeks until you can account for every legitimate source sending as your domain, then move to p=quarantine, then p=reject. Going straight to reject is how a company discovers, on a Monday morning, that its invoicing system was sending through an unaligned relay.
The 2024 bulk sender rules, and the arithmetic behind them
In 2024 Google and Yahoo published requirements for bulk senders that turned a set of best practices into hard gates. The substance: authenticate with SPF and DKIM, publish a DMARC policy, support one-click unsubscribe in the header per RFC 8058, and keep spam complaints below a threshold. The published ceiling is 0.3 percent, with 0.1 percent described as the level to stay under.
Put numbers on that, because the percentages sound generous and are not:
- 10,000 sends at the 0.1 percent target: 10 complaints. Ten people out of ten thousand clicking the spam button.
- 10,000 sends at the 0.3 percent ceiling: 30 complaints. You are now in the range where Gmail starts filing you differently.
- One bad segment: mail 2,000 people who signed up three years ago and forgot you, get 25 complaints from that segment alone, and a single send has pushed a 10,000-recipient campaign past the ceiling.
This is why the unsubscribe link should be easy and the header unsubscribe must work. Every person who unsubscribes instead of reporting spam is a complaint you did not receive. Making unsubscribing hard does not keep subscribers, it converts them into reputation damage.
Reputation: domain, IP, and which one you cannot escape
Mailbox providers score two identities. The IP address is the one people obsess over and the easier one to change: switch providers, get a new pool, start fresh. The sending domain is the one that actually follows you, because it is the identity your recipients recognise and the one DMARC binds everything to. A burned domain is a genuinely expensive problem, which is the argument for sending cold outbound from a separate domain rather than your primary one.
On shared versus dedicated IPs, the honest answer is volume dependent. Below a few thousand sends a day, a dedicated IP hurts: reputation requires consistent volume to establish, and an IP that sends 400 messages on Tuesday and nothing until Friday looks like an unknown to every filter, every time. A reputable shared pool borrows the aggregate good behaviour of everyone on it. The trade is that you also inherit their mistakes, which is a real risk on a low-quality provider and a small one on a good one.
We live on the other side of that trade at Pinlyx: outbound notification mail for every workspace goes through a shared transactional sender, so one tenant running a careless campaign degrades placement for all of them. That is why suppression is enforced centrally rather than per workspace, and why a bounce recorded for one tenant blocks that address platform-wide.
Engagement is the filter, not the content
Modern filtering is behavioural. Providers weight what recipients do: opening, replying, moving a message out of spam, adding the sender to contacts, and on the negative side deleting without reading, ignoring repeatedly, or reporting. A sender whose recipients reply is treated very differently from one whose recipients never open, even when every technical record is identical.
The practical consequence is that list hygiene outperforms copywriting by a wide margin. Suppressing people who have not opened anything in six months raises your aggregate engagement rate, which raises placement for the people who do engage. Teams resist this because the list gets smaller and the list size is the number on the slide. The delivered-and-read count is the number that matters.
Bounces feed the same scoring. A hard bounce means the address does not exist, and it must be suppressed permanently on the first occurrence: a repeated send to a known-dead address is the clearest possible signal that you do not manage your list. A soft bounce is temporary, a full mailbox or a transient server problem, and the standard treatment is retry with backoff and suppress after a run of consecutive failures.
Spam traps: what each type tells you
- Pristine traps. Addresses that never belonged to a person, seeded on web pages specifically to catch scrapers. Hitting one means your list contains harvested data. This is the more damaging of the two, because there is no innocent explanation for how the address reached you.
- Recycled traps. Addresses that once belonged to a real person, were abandoned, and were reactivated by the provider to catch senders mailing stale data. Hitting one means your list is old and you are not suppressing inactives. The fix is hygiene, and double opt-in at acquisition prevents most of them from ever entering.
What to measure now that open rate is broken
Apple Mail Privacy Protection, introduced in 2021, prefetches remote images including the tracking pixel for Apple Mail users, regardless of whether the person read anything. If a third of your list is on Apple Mail, a third of your opens are fiction, and the fraction varies by audience, so you cannot even correct for it reliably.
Replace it with signals that are harder to fake:
- Reply rate. Unambiguous, human, and the strongest positive engagement signal a provider can observe.
- Click rate. Still distorted by security scanners that fetch links, but far less noisy than opens, especially if you exclude clicks that arrive within a second of delivery.
- Google Postmaster Tools. Domain reputation, spam rate and authentication pass rates straight from the largest receiver, for the domain you actually send from. If you set up one thing after reading this page, set up this.
- Seed testing. A panel of real accounts across major providers that reports whether your campaign landed in the inbox, Promotions, or spam. It is a sample, not the truth, and it is still the closest thing to a direct measurement of inbox placement that exists.
The same problem on messaging channels
Every channel we operate has a deliverability analogue, and none of them tell you when they filter you. On Telegram, messaging people who do not have you in their contacts is rate limited and, past a threshold of reports, restricted outright, which surfaces as flood waits and peer restrictions rather than a spam folder. On Instagram and X, reach and message delivery degrade in ways the platforms mostly do not document, the phenomenon operators call a shadowban. In all three cases the underlying model matches email: the platform scores the sender based on recipient behaviour, and the sender finds out late.
The other shared rule is ramp. A brand new sending domain, a brand new Telegram account and a brand new Instagram account all get treated as unknown, and all three punish a sudden jump in volume. That schedule is its own topic: see account warm-up.
Common mistakes
- Reading delivery rate as deliverability. The two numbers can be 40 points apart and only one of them appears in your dashboard.
- Sending cold outbound from the primary domain. One bad list can damage the domain your invoices, password resets and support mail depend on. Use a separate sending domain for cold, and see cold outreach for the rest of that playbook.
- Buying a dedicated IP at 500 sends a day. You have bought an identity with no reputation and not enough volume to build one.
- Hiding the unsubscribe link. This converts unsubscribes, which cost you nothing, into spam complaints, which cost you everything.
- Jumping straight to DMARC p=reject. Publish p=none, read the reports, then tighten. The failure mode of getting this wrong is that your own legitimate mail disappears.
- Blaming content. Rewriting a subject line is the cheapest action available, which is why teams do it first. It is almost never the binding constraint.
Related concepts
- Double opt-in: the acquisition gate that produces a list worth sending to.
- Account warm-up: the ramp schedule for a new domain, mailbox or messaging account.
- Flood wait: the Telegram equivalent of a throttle, with an explicit error you can read.
- Shadowban: the social equivalent, with no error at all.
- Spintax: breaks the duplicate-content fingerprint that filters key on.
- Deduplication: sending the same person three copies is a complaint generator.
How Pinlyx handles it
Pinlyx enforces suppression centrally: a hard bounce, an unsubscribe or a spam complaint recorded anywhere blocks that address across the platform, because outbound notification mail shares sender reputation across workspaces and one careless campaign would otherwise degrade placement for everyone. Every outbound email carries a working one-click unsubscribe header, bounce and complaint webhooks write back to the contact record in real time, and inactive segments can be suppressed from an audience by rule rather than by hand. On messaging channels the same discipline applies through different mechanics: paced sending, per-account rate limits with flood-wait backoff, and account rotation, so the equivalent of a spam folder never opens in the first place.