Email deliverability and consent playbook

Your domain reputation is the one asset a bad campaign week can take from the whole company, not just from marketing. Most deliverability advice is written by people who sell shared sending infrastructure. This playbook assumes the opposite setup: you send from your own Microsoft 365 mailboxes, the reputation is yours, and the numbers below are the ones that keep it.

1. Authenticate the domain

1. SPF: publish a record that authorises Microsoft 365 and any other sender you use. Keep it under 10 DNS lookups.
2. DKIM: enable signing for the domain in Microsoft 365 and publish both selector records. Verify a signed message before proceeding.
3. DMARC: start at p=none with aggregate reports going to a mailbox someone reads, review for two weeks, then move to quarantine, then reject. Bulk senders are expected to be beyond none.
4. Set up a subdomain for high-volume outreach if you want to isolate its reputation from transactional and person-to-person mail.
5. Publish a valid postal address and an unsubscribe route; both are mechanics as much as legal requirements.

2. Verify before you send

The single highest-yield action before any campaign is list verification, and the single most common mistake is dropping the results you do not understand.

• Verify the whole list within 30 days of sending, not once a year.
• Keep catch-all and unknown results. Large enterprises are frequently catch-all; dropping them removes exactly the accounts you want.
• Re-check employment for anything older than six months. On one aged list we tested, 22 percent had left their company and only 42 percent were confirmed good.
• Never auto-apply a suggested spelling correction to a corporate domain. Verification tools suggest consumer domains for corporate ones surprisingly often.

3. Warm up a new mailbox

4. Caps that defer rather than drop

A daily cap that drops messages loses them silently. A cap that defers pushes them to the next window and sends them later. Design for defer: the recipient still hears from you, and nobody has to reconcile a partial send.

5. Thresholds

Wire these to something that acts, not to a dashboard. A circuit breaker that pauses the campaign at the stop threshold is worth more than an alert at 3am.

6. Suppression design

• Two tiers. Hard bounces, complaints, full opt-outs, quarantines, invalid addresses, and departed contacts block every channel including a one-to-one reply. A marketing unsubscribe blocks automation but may still allow a reviewed personal reply.
• Strictest reason wins when several apply.
• Fail closed on an unrecognised reason. An unknown token must block, not pass.
• One way. No user action, no import, and no merge may clear a suppression. This is the rule that protects you when someone imports an old spreadsheet.
• Suppress on permanent failures only. A 4.x.x temporary failure is not a reason to delete a live prospect from your reachable universe.

7. After a spike

1. Pause every campaign from the affected mailbox and domain immediately.
2. Identify the segment. Complaint spikes are usually one list or one message, not a general decline.
3. Suppress the affected segment entirely rather than trying to salvage it.
4. Drop volume to the warm-up schedule for at least two weeks, sending only to engaged contacts.
5. Fix the cause in the process, not the campaign: where did the addresses come from, and which gate should have caught them?
6. Only resume cold volume after a clean streak of at least seven days.

8. The organisational part

Deliverability failures are usually organisational. The approval queue with no owner is the classic: a draft-for-review campaign whose drafts expire unapproved sends nothing, and then someone compensates by blasting the whole list at once. Give the queue a named owner and a same-day target, and the technical controls will hold.