'Do Not' Rules of Email Deliverability
Most deliverability problems do not come from one mysterious inbox provider decision. They come from a handful of avoidable mistakes: weak authentication, risky signup forms, stale lists, sudden volume spikes, and missing feedback loops.
This guide is the practical "what not to do" version. It is based on the problems we see running an email service provider: list bombing attacks at 4:30 AM, holiday campaigns that went out too hard, broken DKIM records, abused invite emails, and domains that had to be paused before the damage got worse.
Use it as a preflight check before you send meaningful volume, migrate providers, open a new signup flow, or troubleshoot a drop in inbox placement. The goal is simple: protect your reputation so your product, marketing, and transactional email keeps landing in the inbox.
Infrastructure & Authentication
Start here if you are setting up Bento, migrating from another provider, or seeing unexplained delivery problems. Authentication and sender identity are the foundation. If this layer is shaky, the rest of your email program has to work much harder.
Authentication is no longer optional. Google and Yahoo require proper authentication for bulk senders, and smaller senders still benefit from it because inbox providers use these records to decide whether your mail looks legitimate.
Missing or broken records can drag down opens quickly. Before you send, confirm your SPF, DKIM, and DMARC records are present, valid, and pointed at the sending setup you are actually using.
We once saw a customer with strangely low opens. Monitoring caught it, we paused the campaign, and found that their DKIM keys had been removed. Once the records were restored, opens moved from around 3% to above 20%. One missing authentication piece can pull the whole campaign down.
A new domain is not a shortcut. Inbox providers treat brand new domains with suspicion because they are often used for spam and phishing. If your primary domain has reputation issues, fix the underlying cause first.
Build reputation on your real domain over time. It is slower, but it creates a sender identity that can last.
Some top-level domains are used heavily by spam and phishing operations because they are cheap and easy to register. That history can make filters more cautious.
Use an established domain tied to your business. If you want strong deliverability, make the sender identity boring, consistent, and easy to trust.
Your delivery is affected by the infrastructure you send through. On shared IPs, that means your neighbors matter. Good providers actively monitor their pools, separate risky senders, and help strong senders stay with other strong senders.
Bento watches this closely because one sender's behavior can affect others. If you are sending responsibly, we want you on infrastructure that reflects that.
If you want the deeper version, watch our video on IP pools: https://www.youtube.com/watch?v=t6qIi8AYt7I&ab_channel=Bento
Transactional email needs to be reliable. Password resets, order confirmations, invoices, and magic links should not inherit the reputation swings of marketing campaigns.
Where possible, separate transactional and marketing traffic by from address, subdomain, and sending infrastructure. That separation helps inbox providers understand what each stream is for.
Domain reputation follows you, but sending infrastructure changes still matter. If you migrate to a new email service provider and immediately send at full volume, inbox providers may treat that pattern as unusual.
Start gradually. Watch bounces, complaints, opens, and clicks. Increase volume once the new setup is behaving normally.
Link branding rewrites links and image URLs so they use your domain before redirecting to the final destination. This creates a cleaner, more consistent sender identity.
Enable it for your sending domain. Inbox providers are more comfortable when the sender, links, and tracking domain all line up.
Security & Form Protection
Many reputation problems start outside the email tool. If an attacker can abuse a signup form, invite flow, password reset, or webhook, they can use your domain to send unwanted mail. Lock these flows down before they become a deliverability problem.
Unprotected forms let attackers submit large numbers of email addresses. That can flood innocent inboxes, create complaints, and damage your sender reputation.
Add rate limits, CAPTCHA where appropriate, and honeypot fields. A good form can be protected without making the experience painful for real subscribers.
A 4:30 AM list bombing alert is a miserable way to learn that a form needs rate limiting. Almost every version of this problem starts the same way: a public form allows unlimited submissions, then someone uses it to send unwanted email to victims. Put a sensible limit in front of it.
Every endpoint that can trigger an email should have a limit: signups, password resets, team invites, form submissions, account verification, and contact forms.
Without limits, attackers can turn normal product flows into spam infrastructure. Start with a conservative rule, such as a few attempts per hour, then adjust based on your product's legitimate usage.
Names, custom fields, and invite messages can all become attack surfaces if they are rendered into email without care. Malicious HTML or spammy text sent from your domain creates both security and deliverability risk.
Sanitize input. For critical system emails such as password resets, magic links, and invites, strongly consider removing personalization entirely.
We have seen invite emails abused by putting spam text into a name field, then triggering the invite flow at scale. The durable fix was simple: remove personalization from those emails and add rate limits to invites. Invite emails are one of the most common attack paths.
Personalization is useful in marketing email, but it can be risky in account emails. Attackers look for places where they can inject a name, message, company field, or URL into a trusted email from your domain.
Keep password resets, magic links, account invites, and verification emails simple. The less user-generated content they include, the less attractive they are to attackers.
A common abuse pattern is a script that signs up with malicious content in the name field, then triggers password resets or invites to send that content to victims. Removing personalization from account emails closes off a lot of that attack surface.
Spammers often use temporary email services to probe signup flows, invite systems, and abuse protections. Blocking disposable addresses will not stop every attack, but it raises the cost and removes a common testing path.
List Management & Hygiene
A clean list is not just a compliance detail. It is one of the clearest signals you can send to inbox providers that people asked for your email and still want it.
Purchased lists often contain old addresses, spam traps, scraped contacts, and people who never asked to hear from you. Sending to them can create bounces, complaints, and blocklistings quickly.
Grow your list through clear opt-ins. Smaller lists with real consent beat larger lists that damage your reputation.
Continuing to send to invalid, bounced, or long-inactive addresses tells inbox providers your mail is unwanted. That signal can hurt the people who do want your emails.
Use a sunset policy for subscribers who have not opened or clicked in a reasonable window, such as 6 to 12 months. Remove hard bounces and complaints immediately.
Confirmed opt-in asks new subscribers to verify their email address before they receive ongoing mail. It reduces fake signups, typo addresses, and list bombing risk.
You may see fewer total subscribers, but the people who remain are more likely to engage. That trade is usually worth it.
Segmentation helps you send more relevant email based on behavior, preferences, purchase history, lifecycle stage, or engagement. Relevant mail earns more opens and fewer complaints.
If you are unsure who should receive a campaign, start with the most engaged segment. Expand only when the results support it.
Laws such as GDPR, CCPA, and CAN-SPAM define how consent, data handling, and unsubscribe requirements work. They also reflect what inbox providers and recipients expect from legitimate senders.
Make consent clear, honor unsubscribes quickly, and keep your privacy policy aligned with what you actually do.
Unsubscribes are not a suggestion. Honor them quickly, ideally with one-click unsubscribe support, and do not re-add people during imports, migrations, or list cleanup.
If someone wants back in, get a new confirmed opt-in. Anything else risks complaints and trust.
Sending Practices
Good sending is steady, expected, and easy to understand. The fastest way to create delivery trouble is to suddenly change volume, audience, or content in a way inbox providers cannot explain.
Rapid volume increases can trigger filtering because they look like a compromised sender or a risky campaign. This is especially true around high-volume periods such as Black Friday and Cyber Monday.
Increase gradually. If you plan a larger campaign, warm the audience and volume before the important send, not during it.
Sending everything at once gives you no time to catch problems. If bounces, complaints, or blocks spike, the damage has already reached the whole list.
Batch larger sends over time. Batching smooths volume and gives you a chance to pause if early signals look wrong.
A list you have not contacted in months is not warm just because those people once subscribed. Inbox providers may treat a sudden send to old contacts as unwanted mail.
Re-engage carefully before major campaigns. Start with recent engagers, then test older segments in smaller batches while watching complaints and bounces.
Every third-party domain in an email carries reputation risk. Links, images, and embedded content from unfamiliar domains can make a good sender look messier than necessary.
Use trusted domains and proxy links through your branded domain when possible. We have seen single third-party links affect inbox placement, so keep the message clean.
Clear, one-click unsubscribe is now table stakes. If people cannot easily leave, they are more likely to hit spam, and that hurts future delivery.
Put unsubscribe where email clients can find it, including the header where supported. If someone does not want the email, make it easy for them to get off the list.
Monitoring & Compliance
Deliverability is easier to protect when you catch problems early. Watch the signals that inbox providers care about, then respond before a small issue becomes a domain-level problem.
A blocklist listing can affect delivery across many inbox providers. Monitor your domain status and investigate listings quickly.
Bento automatically monitors these signals and shows them in the dashboard so you are not finding out after a campaign underperforms.
Complaints are one of the clearest signs that recipients do not want a message. Even a small complaint rate can affect inbox placement if the pattern is strong enough.
Remove complainers, review the campaign source, and check whether the audience actually expected the email. Never keep mailing people who already complained.
Inbox providers care about what recipients do with your mail. Low opens, poor clicks, deletes without reading, and repeated ignores all point in the wrong direction.
When delivery drops, compare engagement by segment, campaign type, and sending source. The answer is often hiding in the audience, not the template.
Marketing emails need the basics: a clear sender, a physical mailing address where required, and a working unsubscribe path. Missing these elements can create compliance problems and filtering risk.
Bento includes automated checks for common compliance elements before sending so small mistakes are easier to catch.
Gmail, Yahoo, Outlook, and other free mailbox domains are not built for branded business sending through an email service provider. They also make authentication and reputation alignment harder.
Use a domain you control. It gives you the records, branding, and reputation history needed for reliable sending.