Email Deliverability for Small Organizations: The Unglamorous Checklist

The hardest email lesson I have learned managing communications for multiple organizations is this: the writing is the easy half. You can spend a week polishing a newsletter, agonizing over the subject line, getting the story just right, and none of it matters if the message lands in a spam folder. Whether the message arrives at all is decided by plumbing most small organizations have never touched, and in many cases have never heard of.

I learned this the way most people do, which is to say the embarrassing way. Years ago I sent an announcement to a list of people who had explicitly asked to receive it, and then spent the next week fielding variations of "I never got your email." They had gotten it. It was sitting in their junk folders, keeping company with pharmacy offers and fake invoices, because our domain had none of the technical credentials that mailbox providers use to decide who is trustworthy. The message was fine. The messenger looked like a stranger in a trench coat.

Since then I have set up or repaired email sending for churches, ministries, nonprofits, and small businesses, and the pattern is always the same. Nobody skipped this work because it was hard. They skipped it because nobody told them it existed. So here is the unglamorous checklist, in plain language, in the order I would do it.

Prove you are allowed to send

Three DNS records decide most of your fate, and all three live in the same place: the DNS settings for your domain, wherever your domain is registered or hosted.

SPF is a public list of which services are allowed to send mail on behalf of your domain. If your newsletters go out through one platform and your receipts through another, both belong on the list. When a mailbox provider receives a message claiming to be from your domain, it checks the sending server against your list. Not on the list, instant suspicion.

DKIM puts a cryptographic signature on each message. Think of it as a wax seal. The receiving server can verify that the message really came from an authorized sender and was not altered along the way. Your sending platform generates the keys; you publish one record in DNS; the platform signs everything automatically from then on.

DMARC is the policy layer on top. It tells receiving servers what to do when a message fails the first two checks: let it through anyway, quarantine it, or reject it outright. It also, wonderfully, asks providers to send you reports about who is sending mail claiming to be you, which is how you discover both your own forgotten services and other people's forgeries.

The big mailbox providers now effectively require all three for anyone sending in volume. This is not a best practice anymore. It is the price of admission. Setting them up is an afternoon with your DNS records and your email provider's documentation, and every reputable sending service has a step-by-step guide with the exact records to paste. If you have never done DNS work, it feels scarier than it is. You are copying strings into a form. Copy carefully, wait for propagation, verify, done.

One warning from experience: when you check these records, actually check them. Send yourself a message, open the technical headers, and look for the lines that say SPF, DKIM, and DMARC each passed. A record that exists but is subtly wrong fails silently, and you will not know until your open rates quietly fall off a cliff.

Separate your kinds of mail

Not all email is the same kind of email, and mailbox providers know it even if you do not.

Transactional mail is the mechanical stuff: receipts, confirmations, password resets, form notifications. People expect it, open it, and almost never mark it as spam. Broadcast mail is your newsletters and announcements, and however lovingly written, some fraction of recipients will always flag it, usually because deleting it felt like too much work that day.

Those two streams should not share a reputation. Send them through different services, and ideally from different subdomains, so that the mailbox providers score them separately. When a newsletter takes a reputation hit from a few tired recipients, you do not want that damage taking your receipts and password resets down with it. The person who flagged your newsletter still needs the confirmation email for the event they registered for, and there is a real irony in your own list cleanup depending on emails that your list habits got junked.

The subdomain trick matters more than it sounds. Reputation attaches to the sending domain, so mail from a dedicated newsletter subdomain builds its own track record, insulated from the main domain and from your transactional stream. It costs nothing but a few more DNS records, which you are already in there editing anyway.

Reputation is earned slowly and spent quickly

Here is the mental model that makes the rest of the decisions easy: every domain has a credit score with the mailbox providers, you cannot see the number, and everything you send either builds it or spends it.

A brand-new domain that suddenly sends five thousand emails looks exactly like a spammer, because that is precisely what spammers look like. It does not matter that your list is legitimate and your cause is good. The pattern is the pattern. So warm up gradually. Start with your most engaged people, the ones who reliably open, because early positive signals, opens, replies, moves out of the junk folder, teach the providers that mail from you is wanted. Grow the volume over weeks, not hours.

Then do the thing nobody wants to do: prune the addresses that never open. I know. The list took years to build. Every address feels like a relationship. But sending to people who never engage is not neutral, it is actively harmful, because providers read a pattern of ignored mail as evidence that you are sending things people do not want. The dead weight on your list is degrading delivery to the people who actually read you.

List size is vanity. Inbox placement is groceries. A list of eight hundred people who open is worth more than a list of five thousand who do not, by every measure that translates into anything real: attendance, giving, signups, replies. When I finally convinced one organization to cut a list nearly in half, open rates did not just rise as a percentage, which is arithmetic. The absolute number of opens went up, because more of the mail was reaching inboxes at all.

Run the prune on a schedule, twice a year, with a re-engagement message first that gives sleepers one honest chance to stay. Then let them go.

Test like a stranger

Everything above is setup. This last discipline is maintenance, and it is the one that catches problems while they are still small.

You cannot judge your deliverability from your own inbox. You send yourself a test, it arrives, everything looks fine, and meanwhile half your list is finding you in the junk folder. Your own mailbox has years of history with you. It is the single least representative address on your list.

So test like a stranger. Keep fresh accounts at the major mailbox providers, accounts with no history with your domain, and send your real campaigns to them. See where you land: inbox, promotions tab, junk. Open the message headers and confirm all three authentication checks pass. It takes ten minutes.

Do this quarterly on the calendar, and always, always after changing any service in the chain. New newsletter platform, new form provider, new website host that sends notification mail, any of these can silently break your SPF record, because the record is a list of services and you just changed the services. The most common deliverability disaster I see is not a mystery penalty. It is a stale DNS record that no longer matches reality, discovered months after the switch, by which point the reputation damage is done and must be slowly earned back.

While you are at it, watch the boring numbers: open rates by provider, bounce rates, spam complaint rates. You do not need a dashboard obsession. You need to notice when a line that has been flat for a year suddenly moves, because that movement is the earliest signal you will get.

An afternoon against a void

None of this is exciting. There is no creative satisfaction in a DNS record, and nobody will ever compliment your DMARC policy. I have set these records up for organization after organization, and the work is identical every time: an afternoon of careful copying, a week of watching, a calendar reminder to check again in three months.

But I keep doing it, and keep pushing it up the priority list ahead of shinier projects, because of what is actually at stake. Small organizations run on their ability to reach their own people. The volunteer schedule, the event registration, the prayer request, the thank-you note to donors. Every one of those depends on a delivery system most organizations have never inspected, and that system fails silently. There is no bounce notice for the spam folder. There is just a slow, invisible drift toward talking to fewer and fewer of the people who asked to hear from you.

All of it, the records, the separation, the warm-up, the pruning, the quarterly test, is the difference between communicating and performing communication into a void. Take the afternoon.