Email deliverability for SMBs: SPF, DKIM, DMARC, and the warm-up curve

A brand-new sending domain hits spam on day one. That is not a fluke. The mailbox providers — Gmail, Outlook, Yahoo — treat any new domain as untrusted until the domain has built a sending reputation. The full path from “new domain” to “500 sends a day without complaints” runs about thirty days and goes through three layers: the DNS records, the warm-up curve, and the monitoring stack you put in place on day 31. This guide walks all three.

1. The three DNS records

SPF, DKIM, and DMARC are not three of the same thing. They are three different layers and you need all three.

SPF tells the world which IPs are allowed to send mail claiming to be your domain. The record is a TXT entry on your root domain and looks likev=spf1 include:_spf.google.com include:sendgrid.net -all. The -all at the end is the part most teams get wrong. It says “anything not in the include list is hard-fail.” If you use a soft fail (~all) the mailbox providers treat your SPF as advisory rather than authoritative.

DKIM is a cryptographic signature. Each outgoing message gets a hash signed with your private key; the receiver looks up your public key in DNS and verifies the signature. If the signature verifies, the receiver trusts that the message body has not been tampered with in transit. Without DKIM, Gmail downranks your domain immediately.

DMARC tells the receiver what to do if SPF or DKIM fail. It also tells them where to send the report. The minimum useful record looks likev=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com. The p=quarantine is the policy — Gmail will route SPF/DKIM-failing messages to spam rather than rejecting them outright. Therua address gives you the aggregate-report feed which is gold for diagnosing problems.

2. The 30-day warm-up curve

Once the records are in place, you start warming. The warm-up curve is a slow ramp from 50 sends/day to your target volume, calibrated so the mailbox providers see your domain build a clean reputation rather than spiking into spam-flag territory.

A typical curve for a domain with a target of 500 sends/day looks like this. Days 1–7: 50/day. Days 8–14: 100/day. Days 15–21: 200/day. Days 22–28: 350/day. Day 29 onward: 500/day.

Two rules during warm-up that most teams break and pay for.

• Only send to engaged recipients. Use your existing customer list or a verified opted-in list for the first 7 days. No cold prospects. The early reputation is built on high-open-rate, low-complaint mail.
• Never spike. Going from 100/day to 400/day overnight is a guaranteed throttle. The mailbox providers spot velocity changes faster than they spot bad content.

3. The monitoring stack

Day 31 onwards you are in steady state. Steady state has its own failure modes — a single bad campaign can burn the reputation in 48 hours. You watch four metrics.

• Complaint rate (Google Postmaster Tools). The single most important number. Above 0.10% sustained is bad; above 0.30% is account-ending. Pull the daily figure into your dashboard and alert on 0.08%.
• Spam rate (DMARC aggregate reports). The mailbox providers send you weekly XML reports telling you how many messages were routed to spam. Parse them with a tool like dmarcian or postmark’s DMARC monitor.
• Bounce rate. Hard bounces over 2% means your list is bad. Suppress aggressively; re-verify your lists before they hit the queue.
• Blocklist status. Spamhaus, Barracuda, SORBS. A weekly automated check that pings each blocklist for your sending IPs and your sending domain.

4. When the reputation breaks

It will break. Everybody has a campaign that misfires. The recovery playbook.

Stop the bleeding first — pause all outbound from the affected domain for 72 hours. Identify the offending campaign from the spike pattern in the complaint chart. Suppress every address the campaign touched. Resume warm-up at 50% of the previous volume for two weeks. The reputation will repair if you give it time.

The recovery does not work if you keep sending while it heals. Patience is the most underrated deliverability skill.

There is no shortcut — but you may be solving the wrong half

Nothing above can be outsourced to us. Leafer does not send your mail, so the records, the ramp and the monitoring are yours to set up in whatever tool you send with. Anyone who tells you a platform can hand you a warm domain is selling you the ramp you would have had anyway.

What is worth saying is why domains burn in the first place. Complaint rate is a relevance measurement wearing an infrastructure costume. Perfect SPF, DKIM and DMARC on a list that does not want to hear from you buys you a slightly slower death; the recipients still mark it as spam, and Gmail is measuring them, not your DNS. Every deliverability disaster we have watched up close started as a targeting problem and only became a reputation problem later.

That earlier half is the part Leafer works on: finding people from a public signal that they have a problem right now, verifying the address before anything is written to it, and drafting a message that quotes the thing they actually said — then holding it in a queue until a human agrees it is worth sending. Fewer messages, aimed better, is the only deliverability strategy that compounds. Do the DNS work in this post too; it is the floor, not the answer.