Email deliverability in 2026: DMARC, BIMI and IP warming

"We send a newsletter to 20,000 contacts and we're stuck at a 12% open rate." Behind that figure rarely lies a content problem: more often than not, a chunk of the messages simply never reached the inbox. That's the whole point of deliverability: the ability of your emails to land in the inbox rather than in spam, or to be flat-out refused by receiving servers. And ever since Gmail, Yahoo and Microsoft tightened their authentication requirements, this topic has gone from comfortable optimization to entry condition.

This article is the field report on what actually tips a send from the spam folder into the primary inbox in 2026. Four concrete work streams, in the order I tackle them: authenticate solidly with SPF, DKIM and a DMARC enforcement policy, display your logo with BIMI, warm up an IP without burning it, and keep impeccable list hygiene, the silent engine of the whole reputation.

A perfectly written email that lands in spam converts no one. Deliverability isn't a technical detail for engineers: it's the precondition for any email performance. You can't measure a channel that never arrives.

Deliverability isn't measured by send rate

First confusion to clear up: "emails sent" and "emails delivered to the inbox" are two different things. A provider can show you 98% of messages "delivered" while a good share landed in the Promotions tab or straight in spam. The real indicator is inbox placement, which classic send statistics don't measure.

In 2026, mailbox providers filter first on two signals: authentication (does your domain prove it's really the sender?) and engagement (do your recipients open, reply, or mark you as junk?). Content comes after. That's why we always start with authentication: without it, even the best list and the best content go to the filter. And because measuring what actually arrives requires clean tracking, this work connects to analytics and tracking: you only steer well what you observe.

SPF, DKIM, DMARC: the authentication baseline

Three protocols, one goal: prove to receiving servers that you are who you claim to be. SPF declares, in your DNS, the list of servers authorized to send on your behalf. DKIM adds a cryptographic signature to every message guaranteeing its integrity and origin. DMARC, finally, builds on both and decides: what should the mailbox provider do if an email fails authentication? Let it through, quarantine it, or reject it?

Since 2024, the major providers require this trio for bulk senders. A merely published DMARC no longer cuts it, it has to be aligned and consistent. In 2026, a domain without properly configured SPF, DKIM and DMARC no longer fools anyone: its emails end up at best in spam, at worst refused at the door.

Moving DMARC to p=reject without breaking your sends

The mistake would be to publish a DMARC at p=reject overnight: if a single one of your legitimate sending sources (provider, CRM, billing, support tool) isn't properly aligned, its emails will be blocked. The right method is gradual. You start at p=none (monitoring only), enable aggregate reports (the RUA tag) to see every source sending on your behalf, fix and align each one, then move to p=quarantine, and finally to p=reject once all legitimate traffic passes. It's precisely this controlled ramp-up that separates a clean deployment from a send outage in the middle of a campaign.

BIMI: displaying your logo in the inbox

BIMI (Brand Indicators for Message Identification) is the logical next step once authentication is locked down. The principle: display your brand's official logo next to the email in the inbox, where most senders only get a grey initial. The effect is twofold: immediate brand recognition, and a trust signal that tends to improve open rates.

But BIMI has a non-negotiable prerequisite: a DMARC enforcement policy (quarantine or reject). Without it, no logo. Most major providers also require a verified mark certificate (VMC, or its CMC equivalent), which assumes a registered trademark and costs several hundred euros per year. For a consumer brand that cares about its inbox presence, the return is tangible. For a small sender, it's the cherry on top: you lock down authentication and hygiene first, BIMI comes after.

IP (and domain) warming

A brand-new sending IP, or a new domain, has no reputation. To mailbox providers, it's a stranger: blasting 50,000 emails at once from a fresh IP is the best way to trigger every spam filter. Warming consists of ramping volume up gradually, over several days to several weeks, to build a positive reputation with each provider.

The method rests on a few principles. You start with your most engaged contacts (those who open and click regularly), because their positive signals build the reputation. You increase volume in reasonable steps day after day, provider by provider (Gmail, Outlook and Yahoo have distinct thresholds). And you continuously watch bounce and complaint rates to slow down if reputation tightens. The same reasoning applies to a new sending domain, often underestimated: reputation rides as much on the domain as on the IP.

List hygiene, the real reputation engine

This is the least spectacular and most decisive work stream. Mailbox providers judge a sender on recipient behavior: if you send to dead addresses, to people who never open, or who report you as spam, your reputation collapses, and then all your sends, even to your best contacts, suffer.

A few non-negotiable rules: never buy or rent a list (the royal road to a block); favor double opt-in at signup; apply a sunset policy that removes inactives after several months without an open; keep the spam complaint rate under 0.3%, the threshold beyond which Gmail considers the sender problematic; and offer one-click unsubscribe, now required for bulk sends. An easy unsubscribe always beats a spam complaint, which durably damages your reputation.

Measure and correct continuously

Deliverability isn't a setting you configure once and forget: it's a living reputation. Three tools are enough to steer it. The providers' postmaster tools (Google Postmaster Tools, Microsoft SNDS) show your domain and IP reputation, your spam and authentication rates, seen from their side. Aggregate DMARC reports reveal who sends on your behalf, including potential spoofers. And seed tests measure where your emails actually land at the main providers.

This monitoring connects to a broader logic of tracking that respects the legal framework, the same spirit I detail for GDPR-first tracking with Consent Mode v2: collect and measure what matters, without damaging trust. And because a delivered email is only a starting point, what follows plays out in designing automation sequences that convert, then in optimizing the landing page on the conversion (CRO) side.

In the crucible: turning the send into a delivery

Delivering well isn't about finding the perfect subject line or sending more. It's about building, layer by layer, the trust mailbox providers grant your domain: prove your identity through authentication, ramp up without rushing your reputation, and only write to people who want to read you. Content only weighs once that trust is earned.

Taken in this order, inbox placement stops being a lottery and becomes a result you hold over time. If you want to concretely audit your deliverability (authentication, reputation, base hygiene) and sort the fixes that truly pay off, it's all laid out on my email expertise page, where I connect sending technique, automation and conversion in a single logic.