Tracking and optimizing deliverability

Tracking and optimizing deliverability used to be a one-number job, and here’s the number that broke my faith in it. A Mailchimp dashboard reports 97.3% delivery rate after a 50,000-email send. The client is thrilled. Then I run the same campaign through GlockApps, pull the Postmaster Tools data, and the picture falls apart – around 60% effective inbox placement, a big chunk landing in spam at one major provider, and a slice sitting “delivered” but buried so far down the inbox that nobody scrolls to it. The ESP didn’t lie, exactly. It answered a different question than the one anybody actually cares about.

That gap is the whole article. What used to mean “did the receiving server accept the email” now means tracking three separate layers – delivery rate, inbox placement rate, and effective inbox placement – which are three different problems with three different fixes. Most senders are still reporting on the first one and quietly wondering why their campaigns underperform. So let’s walk through what each layer measures, which tools tell you the truth, and what to fix when the gaps widen.

This piece sits next to the Apple MPP article and the top engagement metrics article in the same section. The MPP one diagnosed the death of the open rate. The engagement-metrics one covered what to track instead. This one is about whether the email even arrives somewhere those metrics can fire.

Delivery rate, inbox placement rate, effective inbox placement – three different numbers

Three words that sound interchangeable and absolutely are not.

Delivery rate is what your ESP brags about. It means the server accepted the message – it can route that message to spam a millisecond later and delivery rate will never know. Nearly meaningless on its own.

Inbox placement rate is the percentage of delivered mail that reached the actual inbox rather than spam, junk, or the silent place some receivers drop things. Validity’s benchmark data puts the global average around 83.5%. The spread by industry is wide enough that the average is close to useless as a personal target: B2B SaaS sits near 92%, while retail, eCommerce, and education all cluster lower, around 86%. (Treat any single industry figure as directional – Validity’s own per-industry cuts have shown SaaS as low as the low 80s in some reads, so the numbers are noisier than the vendors imply.) And Microsoft consumer placement (Outlook.com, Hotmail, Live) is its own slow-motion crisis – Mailmend’s seedlist data clocked it falling to 26.77%, which is the reason every Outlook deliverability conversation got urgent in the last twelve months. Worth flagging that Validity’s blended Microsoft number is far gentler at ~77%, so that 26.77% is an aggressive seedlist read, not gospel – but even the kind reading is the worst of the major providers.

Effective inbox placement is the newest layer, and right now it’s basically a Gmail story. Since early 2026 – Google made the “Gemini era” official on January 8 – Gmail’s AI ranks messages inside the inbox by inferred relevance, so an email can be technically in the Primary tab but sit so far down that the recipient never gets there. Folderly says up to 40% of “delivered to inbox” mail gets deprioritized this way. Unspam’s 2025 deliverability report measured global effective placement at roughly 60% across all visible mailbox locations.

Delivery rate is infrastructure health. IPR is filter health. Effective placement is attention health. Fixing one does nothing for the other two.

That’s the part most “tracking and optimizing deliverability” guides still miss – they treat the whole thing as a binary delivered/not-delivered question. It hasn’t been binary in years.

The signals mailbox providers actually use

Before we get to fixes, here’s roughly what the algorithms weight, in the order they seem to care. The exact ordering is observed-in-the-wild plus what’s documented in sender guidelines, so take the ranking as approximate.

• Authentication. SPF, DKIM, DMARC alignment. As of November 2025 Gmail moved from soft enforcement to active rejection at the SMTP layer for non-compliant bulk traffic. Microsoft got there first, in May 2025, with the now-familiar 550 5.7.515 reject code. SPF passing alone is no longer enough.
• Sender reputation, by IP and by domain. Both persist independently. Domain reputation survives IP changes, IP reputation survives domain changes. This gets genuinely annoying when you migrate ESPs and inherit somebody else’s history.
• Spam complaint rate. Gmail’s published ceiling is 0.3%. The unpublished signal-to-noise floor is closer to 0.1%. Watch the slope, not just the line – a program at 0.12% climbing 10% month-over-month is in worse shape than a stable 0.20% one.
• Engagement signals. Opens (still a signal even with MPP noise), clicks, replies, archive vs delete, “mark as not spam.” Replies are the heaviest positive signal Gmail uses – the working rule of thumb in deliverability circles is that one genuine reply outweighs a stack of opens, which is wild when you consider how many programs still send from noreply@.
• List-Unsubscribe-Post header (RFC 8058). Mandatory under Gmail and Yahoo’s bulk sender rules since June 2024. Tons of ESPs add the List-Unsubscribe header and skip the List-Unsubscribe-Post variant Gmail actually checks. It’s genuinely ridiculous – it’s a one-line header and it’s one of the most under-implemented requirements in the whole 2026 ecosystem.
• Content quality (newer, Gmail-specific). The Gemini layer evaluates structural HTML integrity and information density. Unspam’s 2025 data found 74% of tested emails had structural HTML issues, and emails failing HTML checks showed measurably lower placement at Gmail and Outlook. Five years ago malformed HTML was a rendering problem. Now it’s a deliverability problem too.

The takeaway: the algorithm isn’t one thing, it’s a stack. The senders who do well in 2026 treat every item above as an instrumented input instead of checking off authentication and walking away.

Authentication – the non-negotiable foundation for tracking and optimizing deliverability

This is the part where most senders think they’re finished because their ESP set up SPF for them back in 2018. They are not finished.

SPF

Lists the IPs and hosts authorized to send for the domain. Where it breaks in 2026: senders running multiple ESPs – transactional via Postmark, marketing via Klaviyo, support via Intercom, alerts via SendGrid – blow past the 10-DNS-lookup limit and quietly fail validation. dmarcian’s SPF flattener helps. The real fix is auditing the SPF chain quarterly. And SPF can pass without aligning if the From: domain doesn’t match the Return-Path domain – Gmail and Microsoft both want alignment now, not just a pass.

DKIM

A cryptographic signature the receiving server can verify. Cloudflare Radar’s Q1 2026 data puts DKIM at a 90.90% global pass rate, the highest of any auth method. A few rules:

• Rotate keys older than 12 – 18 months.
• Anything below 1024 bits gets flagged by some receivers.
• Klaviyo, Mailchimp (post-2024), Postmark, and SendGrid rotate keys automatically. Older self-hosted setups need a calendar reminder, because nobody remembers otherwise.

DMARC

The policy layer – it tells receivers what to do when SPF or DKIM fail or don’t align. Three levels:

Roughly 75% of Fortune 500 domains have a DMARC record by 2026, per Cloudflare Radar – but a lot of them park at p=none forever. Only about 35% of the Fortune 500 are at p=reject, and globally, enforcement (quarantine or reject) is still very much the minority. Most domains with a record never move past monitoring.

My recommendation: every sending domain at p=none minimum within a week of the first marketing send. Any domain that isn’t going to clear p=none within six months almost certainly has a sending-source visibility problem worth diagnosing. The aggregate (rua=) reports are the diagnostic – dmarcian, EasyDMARC, Valimail, and Postmark Aggregator all parse the XML into something human-readable. The parsing tool matters less than the habit of actually looking.

A war story I think about a lot: mid-sized e-commerce client, running on Klaviyo with custom domain authentication. April 2025, their Office 365 placement dropped 26 points overnight. They didn’t notice until week three – by which point a chunk of their warmest subscribers had been quietly retrained to find the brand in spam. Cause: misaligned DMARC after an SPF flatten their previous agency had done back in 2022. Nobody had opened an aggregate report in three years. The fix took an afternoon. The reputation recovery took six weeks.

BIMI

Displays the brand logo next to authenticated mail in Gmail, Apple Mail, and Yahoo. (Not Microsoft – Outlook still doesn’t support BIMI as of 2026, which is a real blind spot if your audience is B2B.) Requires DMARC at p=quarantine or stronger. Two certificate paths:

The VMC price spread is real – Sectigo sits near the bottom, DigiCert and Entrust toward the top, so the old “VMCs are $1,500+” line is outdated. Adoption is still slow either way. Valimail’s 2026 State of DMARC report puts global BIMI adoption around 4%, with actual logo-display lower still, and the gap between “has a BIMI record” and “logo actually shows” is mostly DMARC misconfiguration. My take: BIMI’s worth it for B2C brands where inbox trust visibly drives revenue, especially now the CMC path exists. For B2B and small senders, the money’s better spent getting DMARC to enforcement first. BIMI is dessert.

List quality and sending reputation

Authentication gets you accepted. List quality keeps you in the inbox. They feed the same signal stack, so you don’t get to do one and skip the other.

Purchased lists are how you discover spam traps you didn’t know existed. Single opt-in with a clear value exchange, or double opt-in, are the only acquisition methods that don’t eventually torch you. Validity’s 2025 benchmark data showed roughly 39% of email marketers rarely or never clean their lists – which is a big part of why the global IPR sits at 83% instead of 95%+.

A few non-negotiables:

• Bounce management. Hard bounces auto-suppress. Soft bounces get retried, then suppressed after three consecutive fails. Verification services – NeverBounce, ZeroBounce, Kickbox, Prospeo – catch invalid addresses before send.
• Engagement-based segmentation. This is the single biggest deliverability lift available to most programs, full stop. The course producers and small e-commerce clients I work with routinely have 30 – 50% of their list sitting in the “hasn’t engaged in six months” bucket. Run one to three sweep emails for the holdouts, then suppress the rest. It usually adds several points to IPR within a month.
• Domain warming. New domains, or ones dormant 90+ days, ramp gradually – something like 50 sends/day for three days, doubling every 3 – 5 days, watching soft bounces and complaints at each level. MailReach and Warmy automate this for cold-outreach senders. For marketing programs, the right move is usually to ramp through your most engaged subscribers first.
• Subdomain strategy. Marketing and transactional on different subdomains. A reputation hit on marketing.yourbrand.com shouldn’t be able to tank the password resets on transactional.yourbrand.com. Set it up early. Don’t argue about it.
• IP strategy. Most senders belong on a shared IP pool unless they’re consistently doing 100,000+ a month. Dedicated IPs need volume to hold reputation – a dedicated IP pushing 5,000 emails a week loses reputation faster than a shared one, which feels backwards until you remember the algorithm wants signal it can actually read.

Tools for tracking and optimizing deliverability at the inbox-placement layer

Picking the right tool for your tier is half of tracking and optimizing deliverability properly. Most senders are running an enterprise tool on a mid-tier program, or no tool at all on a program that desperately needs the mid-tier. Here’s what I actually use.

Free / no-cost monitoring

• Google Postmaster Tools v2 – the compliance-focused dashboard that became the default in October 2025 when Google retired v1. It swapped the old Reputation scores (High/Medium/Low/Bad) for a binary Compliance Status (Pass/Fail), which sounds like a downgrade and is actually more honest. Single most important free tool for anyone with meaningful Gmail volume. Setup is a TXT record. Do it today if you haven’t.
• Microsoft SNDS – free, IP-based, and gives you less data than Google’s tool by an order of magnitude. Worth setting up if you have Microsoft volume. Don’t expect much.
• Yahoo Sender Hub – the only way to get real complaint data out of Yahoo properties.
• Mail-Tester.com – a 0 – 10 score with a breakdown of authentication, content, and blocklist status. Great pre-send sanity check. Not a substitute for placement testing.

Mid-tier – inbox placement testing

• GlockApps at $59/month for the entry tier is the sweet spot. 70+ seed addresses across Gmail (personal and Workspace), Outlook.com, Microsoft 365, Yahoo, AOL, and corporate servers, with a primary/promotions/spam/missing breakdown per provider. The UI is dated. The data is solid. (Seed-list results can swing 5 – 15% between runs, so read trends, not single tests.)
• Litmus Email Analytics + Spam Testing bundles rendering checks with spam-filter testing. The natural pick if you’re already paying for Litmus.

Enterprise

• Validity Everest – the deepest seedlist coverage and the vendor relationships that matter when you need to escalate a placement issue directly with Gmail or Microsoft. Expensive. Worth it if you genuinely need it.
• Folderly at roughly $96 – $120/inbox per month (their 2026 plans have crept up, so check the current page) runs AI-driven content analysis and tracks effective inbox placement for the Gemini layer. Worth it for high-volume B2B. Wildly expensive otherwise – and the “99% inbox placement” marketing line is true for some senders in some segments, not a reasonable target for a general marketing program.

DMARC management

dmarcian, EasyDMARC, Valimail, PowerDMARC, Red Sift OnDMARC – all variations on the same theme. Parse aggregate reports, surface failures, walk you from p=none to p=quarantine to p=reject. Most have a free monitoring tier.

The honest version: most senders need Postmaster Tools v2, plus one paid tool (GlockApps if you only want placement, Litmus if you also want rendering), plus a free DMARC monitoring tier. The enterprise stack is real – for senders pulling enough revenue that a 2-point placement lift pays for the tool ten times over. That is not most senders.

How to instrument the email itself for placement

This is the part most placement guides skip, because the writers have never built an email at the HTML level. Authentication and reputation are necessary but not sufficient. The email itself now feeds straight into the placement decision.

HTML structure and accessibility actually matter for placement now

The Unspam finding bears repeating: 74% of tested emails had structural issues, and emails failing HTML checks showed measurably lower placement at Gmail and Outlook. Five years ago, broken markup meant a broken render. In 2026, the Gemini layer reads the HTML, and sloppy structure gets deprioritized.

So validate every template before it goes into production rotation. W3C validator. Tables with proper attributes. Images with alt text – for accessibility and for AI-readability when images don’t load. No unclosed tags. The hybrid table-based layout with media queries layered on top is still the right structure for cross-client work. Just keep it clean.

First-line content and the AI summary problem

Gmail’s Gemini layer summarizes the body for users on Apple Intelligence devices and, increasingly, in the Gmail web interface. The first 100 – 200 characters of the body are what gets pulled. “Hi {first_name}, hope you’re well” gets pulled. The actual offer does not. Lead with the value, not the greeting.

List-Unsubscribe and List-Unsubscribe-Post

Two headers, both required for promotional bulk mail to Gmail and Yahoo:

List-Unsubscribe: <mailto:[email protected]>, <https://yourdomain.com/unsub?...>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Plenty of ESPs include the first and skip the second. The second is the one Gmail specifically checks. Send a test to your own Gmail, hit “Show Original,” look at the raw headers. If the Post variant isn’t there, fix it. This one drives me up the wall – it’s a single line, and major platforms still ship without it in some default configs.

From, Reply-To, and Return-Path alignment

For DMARC alignment to pass, the From: domain has to match either the SPF domain (Return-Path) or the DKIM signing domain. Modern ESPs handle this automatically when the sending domain’s configured right. Custom setups – especially when an ESP sends from em1234.client-domain.com while From: shows client-domain.com – fail alignment in subtle ways the ESP dashboard won’t surface. Check the aggregate DMARC reports. They’ll tell you.

Don’t send marketing from a noreply@ address

Reply rate is a Gmail reputation signal, and noreply@ kills the signal at the source. Use a real, monitored Reply-To even if marketing replies aren’t a workflow you actively run. Forwarding to a human-monitored alias counts. (More on this in the engagement metrics piece – cross-link.)

Mobile-first, because mobile is now the engagement signal

Depending on whose dataset you trust, somewhere between 55% and 62% of email opens happen on mobile – Stripo puts eCommerce specifically near 55%, while broader cross-industry figures from Mailchimp and Litmus land closer to 62%. Either way it’s the majority and the line only goes up. Mobile rendering problems – text under 14px, buttons under 44px, layouts that collapse in iOS Mail or Gmail mobile – tank engagement, which feeds back into placement. The hybrid layout (percentage widths plus max-width on the wrapper, media queries layered for clients that support them) is the floor, not the ceiling.

Test in classic Outlook for Windows, because it isn’t dead yet

Microsoft is ending support for the classic desktop Outlook (the Word rendering engine) in October 2026, but as of mid-2026 a meaningful share of business users are still on it – the rollout of the new Outlook for Windows started reaching business users in January 2025 and the migration is mid-flight. If your bulletproof button doesn’t render in classic Outlook, you’re throwing away the highest-quality engagement signal you’ve got: clicks from corporate users on a mail client that MPP hasn’t contaminated. VML fallbacks, table-based buttons, the whole 2010-era toolkit is still relevant for another year.

Reading the data and reporting it without lying

A few principles I’d defend in a meeting:

• Pair every metric with another. IPR alone is misleading – read it next to delivery rate (the gap shows filter aggression) and complaint rate (the leading indicator of decline).
• Watch the slope, not the threshold. A complaint rate climbing month-over-month is more dangerous than a stable higher one.
• Compare to your own baseline, not a vendor blog. The “global average IPR is 83%” stat is dragged down by senders who skip authentication entirely. Your own program from 90 days ago is the right comparison.
• Segment by mailbox provider. A blended IPR of 85% can be hiding 95% Gmail and 60% Microsoft, and the fix for each is completely different. Postmaster Tools and SNDS report separately for a reason.
• Be honest about dispersion. A retail client at 86% isn’t broken just because B2B SaaS averages higher. They’re a retail client.

And build a one-page deliverability brief for clients who don’t want to read DMARC XML. Lead with the only question they’re really asking – did the email reach the inbox, yes/no/partially – then what changed, then what to fix this month. The technical detail goes in an appendix where it belongs.

A monitoring stack that doesn’t lie

The stack I actually run for recurring clients, in three tiers:

Small-business / course-producer (sub-50K subscribers, sub-$5K/month email revenue): Postmaster Tools v2, Mail-Tester for pre-send sanity checks, the ESP’s native deliverability dashboard, and a free DMARC monitoring tier on dmarcian. Total cost: zero. Time: about 30 minutes a week.

Mid-sized e-commerce / B2B SaaS (50K – 500K subscribers, $5K – $50K/month): the small-business stack plus GlockApps ($59/month) for monthly placement testing on key sends, a paid DMARC tier on EasyDMARC or dmarcian, and Litmus or Email on Acid for rendering. Total: roughly $150 – $300/month.

Enterprise (500K+ subscribers, $50K+/month): the mid-sized stack plus Validity Everest or Folderly for continuous monitoring, plus a deliverability consultant on retainer for the quarterly audit. Total: $1,500 – $5,000/month. At this tier the client has internal staff dedicated to it.

The point isn’t to maximize tools. Most senders are running an enterprise-tier list-cleaning service on a small-business program while skipping the $59/month placement test that would actually catch the problem. Move the budget around.

What the next 3 to 5 years will probably do to deliverability

This is the part where I’m supposed to crystal-ball confidently. Instead I’m going to be honest about how much of this is a guess.

Likely (high confidence)

• DMARC at p=quarantine or stronger becomes the bulk-sender baseline by 2027 or 2028. The current p=none floor is the warm-up phase; Gmail and Microsoft have both signaled it’s interim.
• Microsoft extends its sender requirements to enterprise (Microsoft 365) addresses. Currently consumer-only; the extension is publicly hinted and probably 2027.
• Effective inbox placement becomes a tracked metric in major monitoring tools. Folderly’s first; ESPs follow within 18 – 24 months.
• BIMI adoption climbs from ~4% toward 15 – 20% by 2028, pushed by CMC making the trademark requirement optional.
• Apple ships its own sender-requirements equivalent to the Gmail/Yahoo/Microsoft mandate. The MPP architecture is already there.
• AI-driven content evaluation becomes standard at Gmail, Outlook, and eventually Apple Mail.

Possible (lower confidence)

• p=reject becomes the actual enforcement baseline for high-volume senders, not just the recommended target.
• Postmaster Tools v3 surfaces effective inbox placement natively, ending the third-party dependency for that data.
• Brand-in-inbox standards (BIMI, Apple Branded Mail, Microsoft’s logo work) consolidate into one spec.
• Server-side click tracking hits its own privacy challenge, the way the open-tracking pixel did.
• Regulatory pressure on tracking expands – CNIL on pixel consent, ePrivacy in the EU.

Coin flips

• Whether Gmail rolls back any part of the Gemini layer under advertiser pushback. The deprioritization is hurting brands that can’t get into Primary, and there’s already noise about it.
• Whether Microsoft consumer placement recovers, gets worse, or holds. The trajectory is bad and the public explanation is thin.
• Whether agentic email becomes a real category by 2028, and what that does to engagement-based placement – if the AI is replying for the user, is that a positive signal or noise? I don’t know. Nobody does, yet.

The through-line: the deliverability stack that survives the next five years is the one built on real authentication, real list quality, real engagement, and real measurement at all three layers. Anything tied to one mailbox provider’s specific policy will get reshuffled. The fundamentals won’t.

A 7-day plan for tracking and optimizing deliverability

A week of unglamorous work that pays for itself by the end of the next quarter.

1. Day 1 – Confirm SPF, DKIM, and DMARC are set up and aligned. Send a test to your own Gmail, hit “Show Original,” verify all three pass. If DMARC is missing, publish a p=none record before close of business.
2. Day 2 – Set up Google Postmaster Tools v2. Verify your sending domain. Drop a calendar reminder for a weekly check.
3. Day 3 – Pull the last 90 days of campaign data and compare ESP-reported delivery rate to a real placement test on a recent send (GlockApps or similar). Note the gap. That gap is the size of your problem.
4. Day 4 – Audit your List-Unsubscribe and List-Unsubscribe-Post headers. Confirm both are present and the unsubscribe works in one click.
5. Day 5 – Pull your inactive count (no engagement in 90+ days). Over 30%? Build a re-engagement flow. Over 50%? Suppress the dead weight directly – the placement gain beats the list-size hit.
6. Day 6 – Split transactional and marketing onto different subdomains if they aren’t already. Update DNS, update ESP routing, verify with a test send.
7. Day 7 – Build a one-page dashboard with the four metrics that matter (delivery rate, IPR, complaint rate, DMARC pass rate) and share it. Set a monthly review cadence.

FAQ

What’s the difference between delivery rate and inbox placement rate? Delivery rate is the ESP-reported “the receiving server accepted my email” number, which can quietly include spam-folder placement. IPR is the percentage that actually reached the inbox – the one that matters.

Do I need DMARC at p=reject for Gmail and Microsoft to deliver my email? No. p=none satisfies the bulk-sender requirement. p=reject is required for full BIMI eligibility and is the strongest brand-protection level, but it isn’t a deliverability requirement on its own.

What spam complaint rate should I aim for? Gmail’s published ceiling is 0.3%. Aim for under 0.1% as a healthy baseline, and watch the slope – a rate climbing month-over-month is more dangerous than a stable higher one.

What’s the actual difference between Google Postmaster Tools v1 and v2? v2 retired the old Reputation scores (High/Medium/Low/Bad) in favor of a binary Compliance Status (Pass/Fail), and Google sunset v1 in October 2025. The underlying data is similar; the framing shifted from nuance to enforcement.

What’s a good inbox placement rate for marketing email in 2026? 90%+ is healthy, 95%+ is excellent, anything below 80% means something’s broken. The global average sits around 83%, but that’s dragged down by senders who skip authentication.

Do I need to warm up a new sending domain even if my IP is shared? Yes. Domain reputation is separate from IP reputation. New domains need to ramp gradually for several weeks before sending at full volume.

What’s the difference between BIMI VMC and CMC? A VMC requires a registered trademark and lights up your logo plus a blue checkmark in Gmail. A CMC needs the logo to have been publicly used for 12+ months and shows the logo without the checkmark. CMC is cheaper and the lower bar for brands without a trademark.

Closing

Deliverability used to be a checklist – configure SPF, configure DKIM, send carefully, wait. In 2026 it’s three layers, three signal stacks, and three sets of tools. The senders who came out ahead through the February 2024 mandate, the May 2025 Microsoft enforcement, and the November 2025 Gmail rejection rollout are the ones who treated deliverability as something to track continuously. The ones who survive the next five years – through whatever Apple does next, whatever Gmail does after Gemini, whatever the regulators do to tracking – will be the ones who built monitoring instead of one-time projects. Pick the layer, pick the tool, pick the cadence. Then close the laptop and go ship something that earns the inbox.