Deliverability is the part of email infrastructure that gets the most attention from outside the engineering team and the least informed work inside it. The result is a long list of folk remedies, vendor talking points, and rules of thumb, with not enough operator experience separating the actually-useful from the placebo.
The state of inbox placement in 2026 is simpler than the dashboards suggest. Most of what determines whether a given message reaches the primary inbox is set by a small number of structural decisions made before any individual message goes out. The rest is execution discipline that is boring to maintain. Below is the operator view of what the levers actually are.
Authentication is the floor, not the ceiling
SPF, DKIM, and DMARC are necessary and not sufficient. The state of mail receiving in 2026 is that any sender without aligned DKIM and a published DMARC record is treated as suspicious by every meaningful receiver. If yours is not in order, fixing it is the highest-leverage hour you can spend.
The mistake teams make is treating authentication as the end of the work. A correctly authenticated message from a domain with a poor reputation still goes to spam. A correctly authenticated message from a shared IP that hosts a competitor in the wrong vertical can also go to spam. The authentication layer just makes the rest of the system legible to the receiver. Reputation lives one layer up.
A practical floor for any production sender includes alignment between the From domain and the DKIM signing domain, a DMARC policy at quarantine or stronger, BIMI configured on domains where the spend on a verified mark is justified, and active monitoring of DMARC aggregate reports for unauthorized senders. If you cannot answer the question "is anyone forging mail from our domain right now" in under a minute, the floor is unfinished.
Reputation is what receivers actually score
The major receivers (Gmail, Yahoo, Microsoft 365, Apple, the regional ESPs) all run sophisticated reputation models. They are not telling anyone exactly how those models work, but every operator who runs significant volume converges on the same shortlist of inputs.
The first input is engagement. Receivers track which of your messages get opened, replied to, marked as not-spam, marked as spam, deleted unread, and ignored. They aggregate that signal across recipients and time. Senders whose recipients consistently engage are believed to be wanted. Senders whose recipients consistently delete unread are believed to be unwanted, even if the unread messages are technically opted-in. This is the single biggest lever for most senders, and it almost never gets the attention it deserves because it requires touching the program rather than the plumbing.
The second input is consistency. Receivers reward senders that look like they always did. Sudden volume spikes, sudden domain changes, sudden geography changes, and sudden content changes all suppress placement. A sender that doubles its volume overnight is treated as a new sender for several weeks regardless of historical reputation. The implication for your team is that ramps and warm-ups are not optional, they are baked into how the receivers reason about you.
The third input is hygiene. Bouncing addresses, complaint rates, and dormant recipients all damage reputation. A dormant address that you keep mailing for nine months will eventually be repurposed by the receiver into a spam trap, which is the email equivalent of trying to have a conversation with someone who will report you. Aggressive list hygiene is not a courtesy to your audience, it is self-protection.
Streams matter more than people realize
The single most common mistake in deliverability is mixing transactional and marketing traffic on the same sending identity. Transactional traffic is generally engaged, expected, and short. Marketing traffic is generally unsolicited from the receiver's perspective, often skimmed, and frequently complained about. A receiver that sees both streams from the same sender averages the reputations.
The fix is to separate them at the IP level, the domain level, or both, and to keep the streams isolated end to end. Receipts from one identity, lifecycle from another, marketing from a third. The bookkeeping is annoying. The deliverability difference is large.
For senders running multiple products, the question of one identity per product or one shared identity is mostly a function of audience overlap. If your products share an audience, share the identity. If they do not, isolate the streams so a deliverability problem in one cannot drag the others down.
Content matters less than vendors say
The third-party content scorers and "spam word" lists are mostly outdated by years. Modern receivers do read content, and they will downrank obviously deceptive subject lines, broken HTML, mismatched preview text, and link-spamming. They are not running 2008-era keyword lists.
The content advice that still holds is mostly about clarity. Plain-text alternatives that match the HTML version. Single primary call to action per message. Real reply addresses that go to a real human. Clear unsubscribe links above the fold for marketing traffic. None of this is exotic.
The advice that does not hold is most of the content scoring tooling that promises to grade your message before send. The grades correlate weakly with placement and strongly with the vendor's own scoring rules.
Where to invest your hour
A pragmatic team has limited time to give to deliverability. The order of work that produces the highest return is roughly fixed.
Get authentication clean and monitored. Separate transactional and marketing onto distinct sending identities. Implement and respect a clear suppression and re-engagement policy. Set up monitoring for sudden volume changes, complaint rate, bounce rate, and DMARC aggregate trends, and route alerts to a real on-call. Then, and only then, start investing in content optimization.
Most senders never make it past the first three. That is fine. The first three are most of the work, and the senders who get them right place reliably even when the rest of the program is unimpressive.
The ones who skip them and chase content tweaks tend to spend years wondering why nothing they try moves the needle. The needle is somewhere else, and it has been the entire time.