Email deliverability for SMBs: SPF, DKIM, DMARC, and the warm-up curve

A brand-new sending domain hits spam on day one. That is not a fluke. The mailbox providers — Gmail, Outlook, Yahoo — treat any new domain as untrusted until the domain has built a sending reputation. The full path from “new domain” to “500 sends a day without complaints” runs about thirty days and goes through three layers: the DNS records, the warm-up curve, and the monitoring stack you put in place on day 31. This guide walks all three.

1. The three DNS records

SPF, DKIM, and DMARC are not three of the same thing. They are three different layers and you need all three.

SPF tells the world which IPs are allowed to send mail claiming to be your domain. The record is a TXT entry on your root domain and looks likev=spf1 include:_spf.google.com include:sendgrid.net -all. The -all at the end is the part most teams get wrong. It says “anything not in the include list is hard-fail.” If you use a soft fail (~all) the mailbox providers treat your SPF as advisory rather than authoritative.

DKIM is a cryptographic signature. Each outgoing message gets a hash signed with your private key; the receiver looks up your public key in DNS and verifies the signature. If the signature verifies, the receiver trusts that the message body has not been tampered with in transit. Without DKIM, Gmail downranks your domain immediately.

DMARC tells the receiver what to do if SPF or DKIM fail. It also tells them where to send the report. The minimum useful record looks likev=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com. The p=quarantine is the policy — Gmail will route SPF/DKIM-failing messages to spam rather than rejecting them outright. Therua address gives you the aggregate-report feed which is gold for diagnosing problems.

2. The 30-day warm-up curve

Once the records are in place, you start warming. The warm-up curve is a slow ramp from 50 sends/day to your target volume, calibrated so the mailbox providers see your domain build a clean reputation rather than spiking into spam-flag territory.

A typical curve for a domain with a target of 500 sends/day looks like this. Days 1–7: 50/day. Days 8–14: 100/day. Days 15–21: 200/day. Days 22–28: 350/day. Day 29 onward: 500/day.

Two rules during warm-up that most teams break and pay for.

• Only send to engaged recipients. Use your existing customer list or a verified opted-in list for the first 7 days. No cold prospects. The early reputation is built on high-open-rate, low-complaint mail.
• Never spike. Going from 100/day to 400/day overnight is a guaranteed throttle. The mailbox providers spot velocity changes faster than they spot bad content.

3. The monitoring stack

Day 31 onwards you are in steady state. Steady state has its own failure modes — a single bad campaign can burn the reputation in 48 hours. You watch four metrics.

• Complaint rate (Google Postmaster Tools). The single most important number. Above 0.10% sustained is bad; above 0.30% is account-ending. Pull the daily figure into your dashboard and alert on 0.08%.
• Spam rate (DMARC aggregate reports). The mailbox providers send you weekly XML reports telling you how many messages were routed to spam. Parse them with a tool like dmarcian or postmark’s DMARC monitor.
• Bounce rate. Hard bounces over 2% means your list is bad. Suppress aggressively; re-verify your lists before they hit the queue.
• Blocklist status. Spamhaus, Barracuda, SORBS. A weekly automated check that pings each blocklist for your sending IPs and your sending domain.

4. When the reputation breaks

It will break. Everybody has a campaign that misfires. The recovery playbook.

Stop the bleeding first — pause all outbound from the affected domain for 72 hours. Identify the offending campaign from the spike pattern in the complaint chart. Suppress every address the campaign touched. Resume warm-up at 50% of the previous volume for two weeks. The reputation will repair if you give it time.

The recovery does not work if you keep sending while it heals. Patience is the most underrated deliverability skill.

The shortcut

Leafer ships SPF / DKIM / DMARC checks as part of the setup wizard, runs the warm-up curve automatically, and pipes the four monitoring metrics into the workspace dashboard. None of the underlying tech is secret — it is documented in this post — but if you would rather not assemble the stack yourself, the platform is what we built so we did not have to.