Email deliverability 2026: SPF, DKIM, DMARC, BIMI explained

Email deliverability: why 2024 changed everything

In February 2024, Gmail and Yahoo massively tightened their email acceptance rules for any sender pushing more than 5,000 messages per day to their mailboxes. New requirements:

• SPF + DKIM + DMARC mandatory (previously: 1 out of 2 was often enough)
• Complaint rate < 0.3 % (above that: automatic throttling)
• 1-click unsubscribe mandatory (List-Unsubscribe-Post header)
• Aligned authentication (From domain must match SPF and DKIM)

Consequence: in 2026, a sender without a clean setup sees 20 to 60 % of emails going to spam, regardless of platform (Mailchimp, Brevo, ActiveCampaign, Lemlist). This guide explains every mechanism and how to configure it.

Summary of the 4 mechanisms

1. SPF (Sender Policy Framework)

SPF declares which IPs are authorized to send for your domain. Example:

`

yourcompany.com TXT "v=spf1 include:_spf.google.com include:sendgrid.net include:_mailcust.gandi.net ~all"

`

Best practices:

• List all your ESPs (Brevo, Mailchimp, Google Workspace, etc.)
• Limit: 10 DNS lookups (above that, SPF goes permerror)
• End with ~all (softfail) on launch, -all (hardfail) once stable
• Verify with MXToolbox SPF Lookup or dmarcian

2. DKIM (DomainKeys Identified Mail)

DKIM signs every email with a private key, and publishes the public key in DNS. The receiver validates the signature.

Example record (selector google for Google Workspace):

`

google._domainkey.yourcompany.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQ..."

`

Best practices:

• Configure DKIM for every ESP (Brevo, Mailchimp, Lemlist, Google, etc.)
• Use distinct selectors (brevo._domainkey, mailchimp._domainkey, etc.)
• 1024-bit RSA keys minimum, 2048-bit recommended

3. DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC tells receivers what to do with an email that fails SPF or DKIM, and where to send reports.

Progressive example record:

`

_dmarc.yourcompany.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com; ruf=mailto:dmarc-forensics@yourcompany.com; fo=1; aspf=r; adkim=r; pct=100"

`

Policies (p=):

• p=none — monitoring only, no blocking (week 1)
• p=quarantine — non-compliant emails go to spam (weeks 2-4 after audit)
• p=reject — non-compliant emails rejected (target after 60-90 days)

DMARC deployment workflow:

• Start at p=none for 2-4 weeks to analyze reports
• Identify all legitimate sources (ESP, Google Workspace, transactional)
• Move to p=quarantine; pct=10 then 25 → 50 → 100 over 2-4 weeks
• End at p=reject when 100 % of legitimate traffic is aligned

DMARC report parsing tools: dmarcian, Postmark DMARC Monitoring, Valimail Monitor, EasyDMARC, Mailhardener.

4. BIMI (Brand Indicators for Message Identification)

BIMI displays your brand logo next to your emails in Gmail, Yahoo, Apple Mail (iOS 16+). Prerequisites: DMARC at p=quarantine or p=reject + a VMC (Verified Mark Certificate, ~1,200-1,500 USD/year at DigiCert or Entrust).

Example record:

`

default._bimi.yourcompany.com TXT "v=BIMI1; l=https://yourcompany.com/logo.svg; a=https://yourcompany.com/bimi-vmc.pem"

`

Effect: +5 to 10 % average open rate once shown, brand effect.

5. Deliverability monitoring

Weekly 2026 monitoring routine:

• Mail-Tester on 1 send (target > 9/10)
• Google Postmaster Tools: domain reputation "High"
• MXToolbox blacklist check: no active blacklist (Spamhaus, SORBS, etc.)
• DMARC reports: 100 % SPF align + 100 % DKIM align on legitimate traffic

6. IP reputation vs domain reputation

• Shared IP (Brevo Free, Mailchimp Essentials, etc.) — you share reputation with other senders. Pro: easy entry. Con: a bad neighbor drags your deliverability.
• Dedicated IP (from Brevo Business, Mailchimp Premium, ActiveCampaign Enterprise) — your reputation only. Recommended above 100,000 sends/month.
• Domain reputation — your subdomains (mail.yourcompany.com, news.yourcompany.com) build distinct reputations. Cold email strategy: dedicated secondary domain.

7. Warmup of a new domain or IP

A new domain/IP must send progressively to build reputation. Standard 4-6 week plan:

Automated warmup tools: Mailwarm, Warmy.io, Lemwarm (Lemlist), Smartlead warmup, Instantly warmup.

8. Top 10 mistakes that tank deliverability

• SPF with > 10 DNS lookups (permerror)
• DKIM not set up on the secondary ESP
• DMARC at p=reject without prior audit of legitimate sources
• Main domain used for cold email
• New IP without warmup (10,000/day blast from day 1)
• Unverified bought lists (bounce > 5 %)
• Image/text ratio > 50/50 (Bayesian filters)
• Bit.ly/short link instead of custom tracking domain
• No List-Unsubscribe header
• Too frequent sends (3+ per week without value)

Kolonell positioning

For instance Kolonell, a Dakar-based digital agency, audits and configures SPF/DKIM/DMARC/BIMI for its SME and corporate clients (7-14 day delivery, 30-day monitoring included).

FAQ

How do I know if my emails go to spam?

3 methods: Mail-Tester (test send, 0-10 score), Google Postmaster Tools (Gmail reputation), GlockApps (multi-provider inbox placement). If Mail-Tester < 8 or Postmaster "Low", urgent.

How long to fix bad deliverability?

30 to 90 days depending on depth: 30 d for DNS setup to fix, 60-90 d if IP/domain reputation is degraded (requires warmup + list cleanup + DMARC).

Is DMARC p=reject risky?

Yes if rolled out without prior monitoring. Always start at p=none 2-4 weeks, analyze reports, identify all sources, then migrate progressively (quarantine pct=10 → 50 → 100, then reject).

Does an SME need a dedicated IP?

No below 100,000 sends/month. The dedicated IP itself must be warmed and have sustained volume. Under 100 K, a good ESP shared IP (Brevo, ActiveCampaign, Postmark) performs better.

Is BIMI worth the 1,200 USD/year VMC?

For a B2C brand with > 50 K engaged subscribers and recognizable logo: yes (open rate +5-10 %). For a B2B SME under 10 K contacts: no, no proven ROI.

Let''s talk about your deliverability

Want a full SPF/DKIM/DMARC audit + 30-day monitoring + remediation plan? WhatsApp +221 77 596 93 33.