A teardown of a problem, not a client story — no anonymised customer, no invented metrics.
Deliverability almost never breaks overnight. When someone tells me their open rates “suddenly dropped”, the drop is usually the moment they noticed a decline that started months earlier. By then several things have gone wrong in sequence, and untangling which one matters is the actual work.
The short version
- Authentication is usually 80% finished — which mailbox providers treat as unfinished.
- One enthusiastic import is often the trigger, but rarely the root cause.
- Nobody is monitoring, so the decline runs for months before it surfaces in a report.
- Recovery is slower than damage. This is the argument for checking before you have a problem.
The sequence
Stage 1 — authentication that is almost right
SPF exists but does not include every service that sends on your behalf. Or it includes so many that it exceeds the ten-lookup limit and fails silently. DKIM is configured for the main domain but not the sending subdomain. DMARC is either absent or sitting at p=none, which monitors but enforces nothing.
None of this causes an immediate problem. Mailbox providers treat authentication as one input among many, so a partially authenticated sender still gets delivered — until another signal turns negative. This stage can persist for years.
Stage 2 — reputation has no cushion
Because authentication is incomplete, your sending reputation is doing all the work on its own. A fully authenticated domain can absorb a bad week. A partially authenticated one cannot.
Stage 3 — the trigger
Usually an import. A list from an event, a purchased file, or a re-engagement blast to people who have not been mailed in two years. Spam complaints tick up, hard bounces spike, and a spam trap or two gets hit.
This is the event everyone blames — but a healthy sender survives it. The import exposed the problem; it did not create it.
Stage 4 — the quiet decline
Filtering does not announce itself. Mail moves to Promotions, then to spam, for progressively more recipients. Your platform still reports “delivered”, because delivered means accepted by the receiving server — not placed in an inbox. That distinction is why the dashboard looks fine while performance does not.
Stage 5 — someone notices
Typically because a colleague says they stopped getting the newsletter, or a campaign underperforms badly enough to warrant investigation. By this point the decline is months old and reputation recovery takes weeks of disciplined sending.
Why the dashboard hides it
Three measurement traps worth knowing:
- “Delivered” is not “inboxed.” It means the receiving server accepted the message. It says nothing about which folder.
- Open rates are unreliable now. Apple Mail Privacy Protection inflates opens for a large share of recipients, which can mask a real decline entirely.
- Aggregate rates hide per-provider collapse. Your overall open rate can look stable while your delivery to one major provider has fallen off a cliff. Segment by domain and the picture changes.
Check yours in about two minutes
- Run your sending domain through the Deliverability DNS Check. It queries SPF, DKIM and DMARC live, counts your SPF lookups against the limit, and flags a tracker CNAME that is not set up. It runs from your browser and stores nothing.
- Segment your last three campaigns by recipient domain and compare open rates across the major providers. A gap between them is the signal.
- Check whether DMARC is at
p=none. If so, you are collecting reports nobody reads — which is still better than nothing, but only just. - Find out when the last significant import happened, and what the source was.
I would rather you ran that DNS check and found nothing wrong than paid me to tell you the same thing.
What fixing it involves
Authentication first, because it is deterministic — either the records are right or they are not, and there is no ambiguity to argue about. That means completing SPF within the lookup limit, DKIM on the actual sending domain, and a staged DMARC rollout from p=none to quarantine once the reports show only legitimate senders.
Then list hygiene: suppression of long-term non-openers, bounce handling that actually removes addresses, and a policy for imports so the next event list does not undo the work.
Then monitoring — the piece almost always missing. DMARC reports going somewhere a human looks, and per-domain engagement tracked over time so the next decline is caught in week one rather than month six.
What this costs
The Express Health Check (A1, €900) covers authentication, domain setup and the obvious list-hygiene issues as part of its 40 checkpoints. If the repair is worth doing, the Deliverability Tune-Up (F3) completes authentication, stages the DMARC rollout, fixes suppression and sets up the monitoring. Fixed scope, fixed price.
Worth saying plainly: if your authentication is already complete and your decline has another cause, that changes the diagnosis and I will say so rather than sell you a tune-up you do not need.
The honest bit
Deliverability is the area where I most often find that the org did nothing wrong. Authentication standards tightened, Apple changed how opens are measured, and Google and Yahoo introduced bulk sender requirements — all while your setup stayed exactly as it was configured in 2019.
Standing still was enough to fall behind. That is not negligence, but it does mean the fix is overdue rather than optional.
Seeing this in your own org?
The first call is free: thirty minutes, no slides, and an honest read on what a fix would take. If it is not worth doing, you will hear that too.