Deliverability

Deliverability is whether your mail reaches the inbox instead of the spam folder or a silent drop. Read this page before a first production send.

Deliverability splits in two. One half is infrastructure, which Postbox owns. The other half is a function of what you send and who you send it to, which no provider can own on your behalf.

The infrastructure half is done. The rest is sending behaviour, which this page can only advise on.

What inbox placement depends on

Receiving servers (Gmail, Outlook, Yahoo, corporate filters) decide placement on three things, roughly in this order:

1. Authentication. Can the receiver prove the mail is really from your domain and was not altered in transit? This is pass/fail and it is table stakes. Fail it and nothing else matters.
2. Reputation. Does mail from your domain, and from the IPs it sends over, have a history of being wanted? Reputation is earned slowly and lost quickly.
3. Engagement. Do recipients open, reply, and not mark it as spam? This is what turns a neutral reputation good or bad over time.

Postbox gets you a clean pass on the first and manages the mechanics of the second. The third is entirely a product of your sending behaviour.

Authentication

Three standards prove a message is genuinely yours. Postbox sets up all three during domain verification; this is what those DNS records are for.

SPF and MAIL FROM alignment. SPF lets a receiver check that the server sending your mail is one your domain authorises. The send. CNAME you publish points the message's MAIL FROM domain at Postbox, so SPF authenticates against a subdomain of your domain rather than the provider's. That alignment is what lets DMARC pass on SPF. Without the CNAME you can still send, but you lose SPF alignment, and some receivers weight that.

DKIM. Every outbound message is signed with a private key whose public half lives at the DKIM CNAME on your domain. The receiver recomputes the signature and confirms the body and key headers were not changed after you sent them. DKIM is signed on every message with no action from you. It is the strongest of the three signals because it survives forwarding, which SPF does not.

DMARC. DMARC ties the other two together: it tells receivers what to do with mail that claims to be from your domain but fails both SPF alignment and DKIM. Postbox reports DMARC during verification but never requires it, so a domain activates without it. You should still publish it. The record graduates:

Move up one step at a time, and only after the reports show your own mail passing. Jumping straight to p=reject on a misconfigured domain sends your own mail to the spam folder. The default record Postbox suggests is p=quarantine, which is a reasonable place to land after a short monitoring period.

Reputation

Reputation is the receiver's running answer to "do people want mail from this sender". It attaches to two things: your domain, and the IP addresses the mail sends over.

Domain reputation is yours and it is portable. It follows the domain wherever it sends from, which is why authentication matters so much: without it, a receiver cannot attribute good behaviour back to you, so you never build any.

IP reputation is managed for you. Postbox sends over managed IP pools and tracks reputation per pool. Entry tiers share a pool. Higher tiers are allocated a dedicated pool, so their reputation is isolated from other senders. In both cases you do not provision IPs, warm them, or monitor blocklists.

On a shared pool, one sender's bounce and complaint behaviour affects every sender in it. That is why suppression and the reputation states below are enforced rather than advised.

The reputation states

Postbox tracks your sending reputation and moves you through three states automatically as feedback arrives:

The jump to under_review is deliberately not a block. It is the signal to look at your bounce and complaint stats and fix what is driving it, before it becomes a paused that stops you cold. A paused account gets a clear error on send and has to talk to us to come back.

The numbers that matter

Two rates decide whether receivers keep trusting you. These are the published thresholds the major receivers act on:

• Bounce rate under 5%. Sustained higher and receivers start treating you as someone mailing stale or purchased lists.
• Complaint rate under 0.1%. That is one spam-marking per thousand delivered messages. Cross this and reputation damage is fast.

GET /v1/stats/bounces returns both, per day, so you can watch them move. Complaint rate is measured against delivered mail rather than attempted, because a complaint can only come from a message that actually landed.

Suppression and list hygiene

When a message hard-bounces (the address does not exist) or a recipient marks it as spam, Postbox adds that address to your suppression list automatically, and later sends to it are refused at send time. See Sending.

Suppression is enforced, not advisory. Continuing to mail an address that has already hard-bounced is the clearest signal to a receiver that a list is not being maintained, and it is one of the fastest ways to lose reputation.

The behaviour that keeps the list short is yours:

• Only send to people who asked. Confirmed opt-in, ideally double opt-in (they click a link in a first email before you send anything else). A purchased or scraped list will bounce and complain its way to a paused account quickly.
• Never reuse a list that has gone cold. A list you have not mailed in a year is full of dead addresses and people who forgot they signed up. Mailing it looks exactly like spam to a receiver.
• Remove roles and typos at capture. admin@, info@, and obvious typos (gmial.com) bounce or complain at high rates. Catch them at signup, not after they have hurt your rate.

Warming a new domain

A brand-new domain has no reputation, which means no trust. If its first day of life is ten thousand messages, receivers read that as a spammer who just registered a domain, because that is what spammers do.

Ramp instead. There is no in-product throttle that does this for you, so it is a sending discipline:

• Start small and grow gradually. Order of a few hundred messages on day one, then roughly double each day as long as your bounce and complaint rates stay clean. Back off if they climb.
• Send your most engaged recipients first. The people most likely to open and reply build reputation fastest. Save the long tail for once the domain is warm.
• Keep it steady. A domain that sends a consistent daily volume looks more trustworthy than one that spikes and goes silent. Erratic volume itself is a spam signal.

If you can, use a dedicated subdomain for bulk or marketing mail (news.acme.com) separate from your transactional mail (mail.acme.com). It keeps a marketing misstep from dragging down the reputation of the mail your product depends on.

Content that lands

Filters read the message itself, not just its envelope. The rules are dull and they work:

• Always send a plain-text part alongside the HTML. A multipart message with both is more trusted than HTML alone, and /messages/send takes both bodyText and bodyHtml for exactly this reason. HTML-only is a mild spam signal on its own.
• Keep the HTML clean and the link-to-text ratio sane. A message that is one giant image, or all tracking links and no words, scores badly. Write mail a person would read.
• Match the From name to reality. The displayName on the mailbox is the From name recipients see. Sending "Acme Support" from a domain that has never sent support mail is a mismatch filters notice.
• Do not fake urgency or dress up subject lines. All-caps, excess punctuation, and "FREE!!!" are the oldest spam signals there are, and they are still scored.

Unsubscribe. For anything bulk or marketing, an easy unsubscribe is both the law in most places and a hard requirement from Gmail and Yahoo for bulk senders. Practically, a complaint is a recipient who could not find the unsubscribe link, and complaints cost you far more than unsubscribes do. Put a real one-click unsubscribe in the body and honour it immediately.

Monitoring

Check these on a regular cadence, not only after something breaks:

• Your bounce and complaint rates, from GET /v1/stats/bounces. This is the earliest and most direct signal, because it is your own data with no lag.
• Delivery events. Subscribe to message.bounced and message.complained over webhooks or the event stream and act on them as they arrive rather than in a weekly review.
• Google Postmaster Tools and Microsoft SNDS. Free, and the closest you get to seeing your reputation through the two biggest receivers' own eyes. Register your sending domain with both and read them alongside your Postbox stats.

A pre-send checklist

Before your first real send from a new domain:

1. Domain shows active, with ownership, DKIM, and MAIL FROM all passing in /domains/{id}/records.
2. DMARC published at p=none or p=quarantine, and its reports show your own mail passing.
3. Every message carries both a text and an HTML part.
4. Your list is confirmed opt-in, with no addresses you cannot account for.
5. A working unsubscribe path, honoured by suppressing opt-outs.
6. A plan to ramp volume over days, starting with your most engaged recipients.
7. GET /v1/stats/bounces wired into monitoring you review.

These seven cover the failures that infrastructure cannot compensate for.