Your Sender Reputation Is Written in DNS — And Yours Might Be Fibbing

Here's an unpopular opinion for a Friday: almost none of the UK small businesses that email me about landing in spam have a content problem. They have a DNS problem, and they've been rewriting subject lines for six months instead of reading their own headers.

The unsubscribe rate is fine. The open rate is fine when the mail arrives. The issue is that it frequently doesn't arrive, because a corporate gateway looked at the envelope, decided the sender was unverified, and quietly dropped the whole thing into Junk before a human ever saw it.

So let's be blunt about what inbox placement actually depends on in 2026, and then let's fix it.

Spam is a verdict, not a description

Filters don't decide whether your newsletter is spammy. They estimate whether you are who you say you are, whether you have a reputation worth trusting, and whether recipients engage. Authentication is the entry ticket to that conversation. Content is the argument you have after you're let in.

A domain that's nine months old, sends from a shared hosting IP, has a broken SPF include chain and publishes p=none is starting the conversation in handcuffs.

What SPF, DKIM and DMARC actually do

Forty seconds of theory, because it matters for the diagnosis:

• SPF lists the IPs allowed to send for a domain. It's checked against the envelope sender (the MAIL FROM), not the visible From: header.
• DKIM is a cryptographic signature over the message, keyed by a selector published in DNS. It proves the message wasn't altered in transit and identifies a signing domain (d=).
• DMARC ties the two together with alignment: at least one of SPF or DKIM must pass for a domain that matches the From: header. It also publishes a policy and reporting addresses.

The classic UK SME failure goes like this. You send through an ESP. SPF passes for the ESP's bounce domain. DKIM passes with d=sendgrid.net. Neither aligns with your From: of [email protected]. DMARC fails. The message is technically authenticated and completely unverified, which is the worst of both worlds.

The audit, step by step

Set aside an afternoon. You'll need DNS access and a test mailbox on Gmail, Outlook.com, Yahoo and — critically — a corporate Microsoft 365 tenant.

1. Inventory your senders. Newsletter platform, transactional provider, your CRM, the accounts system, and that one member of staff who still sends invoices from Outlook. Every one of them is a sending source with its own reputation.

2. Pull the records. dig TXT yourbusiness.co.uk, dig TXT _dmarc.yourbusiness.co.uk, and the DKIM selector your provider told you to publish. Check for exactly one SPF record — two is a hard fail, not a warning — and confirm the lookup count stays under ten once includes and redirects are expanded.

3. Check alignment in real headers, not in a checker tool. Send a seed message to each mailbox and read Authentication-Results. You want [dmarc](https://en.wikipedia.org/wiki/DMARC)=pass with header.from=yourbusiness.co.uk, not a pass against somebody else's domain.

4. Confirm the DKIM key. Selectors still running 1024-bit keys in 2026 are doing reputation damage for no reason. Rotate to 2048-bit and diarise an annual rotation.

5. Move bulk mail to a subdomain. Sending newsletters from news.yourbusiness.co.uk isolates marketing reputation from invoice and password-reset mail. If a campaign goes wrong, your receipts still arrive.

6. Add the boring transport records. MTA-STS and TLS-RPT take ten minutes and signal that you take transport seriously. DNSSEC if your registrar supports it.

7. Run the reputation checks. Google Postmaster Tools for domain and IP reputation, plus a pass through the major blocklists — Spamhaus first, and treat UCEPROTECT with the scepticism it has earned.

8. Look at the list itself. Hard bounces should be suppressed immediately. Complaint rate should sit under 0.1%, with 0.3% as the hard ceiling. Bulk senders need one-click unsubscribe via the List-Unsubscribe-Post header — the big providers have required it since 2024 and enforce it.

The p=none trap

Half the .co.uk domains I look at publish v=DMARC1; p=none; and consider the job done. That's monitoring, not protection. It tells you what's failing; it doesn't stop anyone spoofing you.

The sensible ramp is: publish p=none with a rua reporting address, read the reports for a fortnight, fix whatever legitimately fails, then move to p=quarantine with a small pct and step up to p=reject. Senders who skip the reporting step usually break their own invoice mail and panic.

BIMI, honestly assessed

BIMI gets oversold. It requires DMARC at enforcement, a Verified Mark Certificate (a real annual cost), and an SVG Tiny PS logo. Gmail and Apple Mail will render the logo; Outlook won't, for now. It's a brand-recognition play with a modest trust dividend, not a deliverability silver bullet. Publishing a BIMI record without the certificate does nothing at all.

How UK inboxes actually treat you

Consumer mailbox providers — BT, Sky, Virgin Media, TalkTalk — lean on their own reputation engines and increasingly mirror Gmail's bulk sender expectations. Corporate estates are stricter: Mimecast, Proofpoint and Barracuda gateways are unforgiving about new domains, unauthenticated bulk mail and shared IPs.

And there's a distinctly British wrinkle: a .co.uk domain with three months of history and no sending record reads as unknown, whereas the same volume from an established domain sails through. Warm up gradually, start with your most engaged segment, and don't buy a dedicated IP until you're sending enough to keep it warm.

The fix-order checklist

1. Delete duplicate SPF records; flatten or trim includes that blow the lookup limit.
2. Publish custom DKIM for every sending source so the signature aligns with your From: domain.
3. Publish DMARC with rua reporting and actually read it.
4. Move to p=quarantine, then p=reject.
5. Isolate bulk sending on a subdomain.
6. Clean the list: bounces, dead weight, never-opens from the last twelve months.
7. Add one-click unsubscribe and a visible preference centre.
8. Only then think about BIMI.

Run this before you rewrite another subject line. The content was probably fine all along.