Inquiry Email Deliverability and Sending Domain Reputation: SPF/DKIM/DMARC Setup and Bounce Handling

Inquiry Email Deliverability: Setting Up SPF/DKIM/DMARC and Maintaining Sending Domain Reputation

Inquiry Email Deliverability and Sending Domain Reputation: SPF/DKIM/DMARC Setup and Bounce Handling

Bottom line first: If your reply to an inquiry lands in spam, even the best-written sales email might as well never have been sent. Miss any one of the three DNS records — SPF, DKIM, DMARC — and your inbox rate at major email providers drops below 80%. For a new domain, keep daily sends under 50 for the first two weeks; if the hard bounce rate exceeds 2%, stop sending immediately and investigate. Switch your DMARC policy through the three levels — none, quarantine, reject — and only upgrade once the pass rate holds steady above 95% during the observation period. Don’t jump straight to the strictest setting.

1. How Sending Domain Reputation Is Judged

A buyer leaves their email in your form, you send your reply, and it ends up in their spam folder. Your sales team has no idea — the email shows as “sent,” but the buyer never saw it.

Whether a message lands in spam at major email providers (Gmail, Outlook, Apple Mail) comes down not to keywords in the content but to your sending domain’s reputation score. That score is built from a few hard metrics:

Whether SPF passes, whether the DKIM signature is valid, whether DMARC is aligned, historical bounce rate, historical complaint rate, send volume, and recipient engagement.

The three DNS records are the foundation. SPF tells providers which IPs are allowed to send for your domain. DKIM adds a digital signature so the message can’t be tampered with in transit. DMARC ties the first two together and states how to handle mail that isn’t aligned. Only when all three are set up and aligned will email providers put your messages in the inbox.

Record	Role	Consequence if missing	How to check
SPF	Lists the IP ranges allowed to send	Mail sent from any unauthorized IP is flagged as forged	Look up the SPF record with MXToolbox
DKIM	Signs the message body to prevent tampering	The message is altered in transit or goes straight to spam	Check the email headers to see if the d= field matches
DMARC	States how to handle unaligned mail	The receiving side doesn’t know whether to reject it or send it to spam	Send reports to a designated mailbox and monitor them

Many independent stores use WordPress form plugins that call the PHP mail function directly to send notifications. That function doesn’t authenticate by default, so outgoing mail fails both SPF and DKIM. For this technical fix, see Form Delivery Reliability for Independent Stores. Replacing the default mail function with an SMTP plugin is the first step.

2. How to Set Up the Three Records: Thresholds and Criteria

Set them up in order: SPF first, then DKIM, then DMARC. Don’t configure all three at once — if something goes wrong, you won’t know which one caused it.

Write the SPF record as a single TXT entry:v=spf1 include:_spf.google.com include:sendgrid.net -all.

Ends with a hyphen -all means hard fail; mail from IPs not listed is rejected outright. Note that SPF lookups can’t exceed 10; too many includes will blow past the DNS lookup limit and Gmail will mark the record invalid.

DKIM uses your sending service (SendGrid, Mailgun, Google Workspace) to generate a key pair. You paste the public key into a TXT record in DNS, and the private key stays on the sending service to sign your mail.

Each sending channel (Google Workspace, marketing email platform, form SMTP) needs its own DKIM selector. They can’t share one.

DMARC policy	Role	Best-fit stage	Upgrade condition
p=none	Reports only, no rejection	Watch for 2 to 4 weeks before launch	Pass rate in reports ≥95%
p=quarantine	Unaligned mail goes to spam	After the observation period	Watch 2 more weeks with no legitimate mail blocked
p=reject	Unaligned mail is rejected outright	All channels verified	Turn on only after long-term stability

Many teams jump straight to setting DMARC to reject, then discover that the sending IPs of the third-party CRM, marketing email platform, and support ticketing system they use were never added to SPF, so all the notification emails from those systems get rejected by their own domain.

This is the most common failure. The right approach is to run p=none for two weeks first, collect reports from every sending channel, fix whatever is missing, then tighten step by step.

Sending domain reputation directly affects inquiry email open rates. Even when mail from a poor-reputation domain reaches the inbox, open rates drop noticeably. For benchmark data, see Inquiry email open rate benchmarks.

3. Bounce handling and sending volume pacing

There are two kinds of bounces: hard bounces (address doesn’t exist, domain doesn’t exist, recipient rejected) and soft bounces (mailbox full, temporarily away, recipient server temporarily refused). They need completely different handling.

Hard bounces must be removed from your sending list within 24 hours. Two consecutive hard bounces on the same address will significantly hurt your sending domain reputation. Don’t delete soft bounces right away, but do monitor them: three consecutive soft bounces on the same address should be treated as a hard bounce.

Bounce type	Test	Action	Monitoring threshold
Hard bounce	550 5.1.1 Address doesn’t exist	Remove from list within 24 hours	Hard bounce rate >2%: stop sending immediately
Soft bounce	451/452 Temporary rejection	Retry once after 24 hours	3 consecutive bounces on the same address: convert to hard bounce
Complaint bounce	Recipient marked it as spam	Delete from list permanently, immediately	Complaint rate >0.1%: trigger alert

Sending volume pacing matters more than many people think. A newly registered domain that sends 500 emails to customers on day one will be flagged by Gmail as a suspicious sender right away, because that behavior pattern looks exactly like a spam blaster.

The right pace is under 50 emails a day for the first two weeks, increasing 20% each week, ramping up to your steady daily volume over 4 to 6 weeks. Day-to-day volume shouldn’t fluctuate more than 50% from your usual level.

A counterintuitive truth: sending more email doesn’t mean a better reputation — it can actually hurt it. Mailbox providers care about “steady engagement from real recipients,” not how much you blast out at once. Many sales teams see low deliverability on follow-up emails

not because the content is bad, but because they sent the same template to 500 people in one afternoon and tripped the frequency controls. For guidance on pacing your follow-up emails, see Inquiry Email Follow-Up Sequence.

4. Common Misconfigurations and a Self-Check List

Mistake	What teams do	What actually happens	The right way
Two SPF TXT records	Adding a new record without deleting the old one	The receiver reads the first and ignores the second	Keep only one SPF record per domain
DKIM not aligned	Sending from info@ but DKIM signs the newsletter subdomain	DMARC fails alignment, email lands in spam	Match the sending domain with the DKIM d= field
Jumping straight to DMARC reject	Setting the strictest policy on day one	Your own notification emails all get blocked	Start at none, watch for two weeks, then escalate step by step
Ignoring bounce logs	Not removing addresses after a bounce	The next send keeps costing you reputation points	Check bounce logs daily, clear hard bounces within 24h
Sharing one sending domain	Using the same domain for marketing and customer replies	Marketing bounces drag down your transactional replies	Use the main domain for customer replies, a subdomain for marketing

The last mistake is the most hidden: putting marketing email and customer reply email on the same sending domain. Marketing email naturally has higher bounce and complaint rates, and once that domain’s reputation drops, your official replies to customers land in spam too.

The right approach is to use your main domain (e.g. yourdomain.com) for everyday customer replies and a separate subdomain (e.g. mail.yourdomain.com) for marketing. The two reputations stay independent.

Monitoring sending domain reputation should be part of your routine site checks, alongside uptime alerts. For this part, see Monitoring system for standalone sites. Spam inquiry filtering is another angle — the quality of inquiries you receive also needs control, see Spam inquiry filtering.

FAQ

Do SPF, DKIM, and DMARC all have to be configured together?

We recommend configuring all three together; missing any one will affect deliverability. SPF only validates the sending IP, DKIM only validates the email signature, and DMARC ties the two together and declares a policy. With SPF but no DKIM, email can be tampered with in transit; with the first two but no DMARC, receivers don’t know how to handle unaligned mail. Configure all three and your inbox placement with major providers stays above 95%.

How many emails can a new domain send per day on its first send?

For the first two weeks, keep a newly registered domain under 50 emails per day. From week three, increase by about 20% per week, ramping up to your steady daily volume over 4 to 6 weeks. Day-to-day volume shouldn’t fluctuate more than 50% from your norm. Send a few hundred on day one and Gmail and Outlook will treat you like a spam blaster — and once sending domain reputation is damaged, the repair cycle takes weeks.

How do you tell hard bounces from soft bounces and handle them differently?

A hard bounce means the mailbox doesn’t exist, the domain doesn’t exist, or the recipient has permanently blocked you. The error code is usually 550, and you must remove the address from your send list within 24 hours. A soft bounce means the inbox is full or the server is temporarily busy, with error codes usually 451 or 452. Just retry once after 24 hours. Three soft bounces in a row from the same address should be treated as a hard bounce. If your hard bounce rate exceeds 2%, stop sending immediately and investigate.

Can I set my DMARC policy to reject from the start?

Not recommended. Setting it to reject right away will likely block your own legitimate sending channels too. For example, if the IPs for your CRM notifications, customer service ticketing system, and email marketing platform aren’t added to SPF in advance, the emails they send will be rejected by your own DMARC policy. The correct order is to start with p=none and observe for 2 to 4 weeks, collect all reports and fill in every legitimate channel, then switch to quarantine once your pass rate holds steady above 95%, and only switch to reject at the very end.

Can customer reply emails and marketing emails use the same sending domain?

Not recommended. Marketing emails naturally have higher bounce and complaint rates. Once the marketing channel drags down your domain reputation, your formal replies to customers will end up in spam too. The right approach is to use your main domain yourdomain.com for everyday customer replies and a separate subdomain mail.yourdomain.com for marketing newsletters, so the DNS records and reputations of the two stay independent and don’t affect each other.

How do I check whether my emails land in the inbox or the spam folder?

Send yourself a test email using a deliverability testing tool, such as Mail-Tester or Gmail’s native “Show original” feature. Check the Authentication-Results field in the email header. You need all three: spf=pass, dkim=pass, and dmarc=pass. If any one of them is fail or none, that email is at risk of going to spam. At the same time, set up a DMARC report mailbox and receive a summary report once a week. That will catch long-term problems better than a single test.

Final thoughts

Email deliverability for inquiry emails is fundamentally part of your independent site’s technical infrastructure. It’s not something your sales team can fix by writing better copy. Your sales team might spend three days polishing a follow-up email, only for it to never appear in the buyer’s inbox, wiping out all that effort.

Three steps to implement: First, set up all three records, SPF, DKIM, and DMARC, and run with p=none for two weeks to observe the reports. Then, work hard bounce cleanup and sending volume pacing into your daily operations: delete hard bounces within 24 hours,

and keep new domains under 50 emails per day for the first two weeks. Finally, separate your customer reply domain from your marketing domain, so marketing channel reputation problems don’t drag down your formal inquiry replies.

One line worth remembering: inquiry email deliverability isn’t written, it’s built through DNS records and sending rhythm. Get all three records in place, clean bounces promptly, and keep your sending volume steady, and buyers will see you in their inbox.