Transactional Email Deliverability: Why Your Receipts Land in Spam
Receipts that land in spam cost more than missed marketing emails — they break the product.
A marketing email in spam is a missed open. A transactional email in spam is a broken product — the user can't reset their password, can't find their receipt, can't confirm their booking. Since Google and Yahoo's February 2024 sender requirements, the rules for landing in the inbox got stricter for everyone. Here are the seven checks that decide it.
1. SPF that actually authorizes your sender
Your SPF record must explicitly include the sending service (Resend, Postmark, SendGrid, SES). One TXT record at the apex, under 10 DNS lookups, no syntax errors. Validate with an SPF checker, not by reading the record.
2. DKIM signed by the sending domain
DKIM proves the email wasn't tampered with in transit. Every transactional provider gives you a CNAME or TXT record to publish. The signing domain (d= in the DKIM-Signature header) must match the From: domain or you fail DMARC alignment.
3. DMARC published — and not at p=none forever
Google and Yahoo require a DMARC record for any sender over 5,000 messages/day, and recommend it for everyone. Start at p=none with rua= reporting to a monitoring service, watch the reports for 2–4 weeks, then move to p=quarantine and finally p=reject once you've fixed all alignment issues.
4. Dedicated sending subdomain
Send transactional from mail.yourdomain.com or send.yourdomain.com — never from the apex. This isolates reputation: a marketing problem on send.yourdomain.com won't poison receipts going out from txn.yourdomain.com.
5. One-click unsubscribe — even on transactional
Strict transactional (password resets, receipts) is exempt, but anything that mixes in a 'you might also like' block is borderline marketing and needs a List-Unsubscribe header with the RFC 8058 one-click POST variant. Gmail penalizes senders without it.
6. Warm up new sending domains
A brand new domain sending 50,000 emails on day 1 gets graylisted by every major provider. Ramp volume gradually over 2–4 weeks: 50/day → 200/day → 1,000/day → 5,000/day. Modern transactional providers handle this automatically if you let them.
7. Honor bounces and complaints immediately
A 0.3% complaint rate is the line at Gmail. Above that, your sender reputation collapses. Suppress hard bounces forever and complaints permanently — never retry. Most providers expose a suppression list; use the API to keep it synced with your user database.
Frequently asked questions
Why are my receipts going to spam even though SPF and DKIM pass?
Almost always DMARC alignment failure. The From: domain doesn't match the DKIM signing domain or the SPF return-path. Check the message source for 'dmarc=fail' and align the signing domain.
Do I need a separate sending service for transactional vs marketing?
Not strictly, but use separate subdomains at minimum. Most teams end up with two providers because marketing platforms aren't tuned for low-latency transactional delivery, and transactional providers don't have campaign tooling.
How long does it take to fix a damaged sender reputation?
2–6 weeks of clean sending behavior. There's no shortcut — providers update reputation slowly on purpose to prevent gaming.