Email deliverability checklist for small businesses
Email delivery is a chain of identity, DNS, sending infrastructure, reputation, message quality, and recipient behaviour. A green “sent” message in a web application confirms very little about what happened after the sending server accepted the mail.
List every system that sends for the domain
Business mail may come from employee mailboxes, a website, WHMCS or another billing platform, a help desk, a CRM, a newsletter service, an ecommerce platform, or monitoring tools. Authentication cannot be correct until you know the legitimate senders.
Configure SPF, DKIM and DMARC deliberately
SPF identifies permitted sending infrastructure, DKIM provides a verifiable message signature, and DMARC evaluates alignment with the domain visible to the recipient. Build these records from the requirements of the actual sending systems rather than copying a generic example.
Check server identity and reverse DNS
If you send mail directly from your own server, make sure its public identity, forward DNS, reverse DNS, SMTP hostname, TLS, and sending configuration agree. Inconsistent identity is one of many signals receivers can use when evaluating mail.
Separate transactional and marketing behaviour
Password resets and invoices have different expectations from newsletters or bulk marketing. Keep lists permission-based, process bounces and complaints, and avoid allowing a compromised website to send unlimited mail through the same reputation path.
Test with real external providers
Send representative messages to major mailbox providers, inspect authentication results, verify links and reply paths, and watch whether failures are temporary, rejected, quarantined, or delivered to spam. Test website-generated mail separately from employee mailbox submission.
Authentication is necessary but not a guarantee
Passing SPF, DKIM and DMARC does not guarantee inbox placement. Reputation, content, list quality, complaint rates, engagement, sending patterns, and receiver policy also matter.