SaaS Email Deliverability

The worst deliverability incident in a SaaS company never starts in the marketing team’s reports. It starts with a support ticket that says the password reset email never arrived, then three more, then a spike in failed logins, and two days later somebody works out that a 40,000 recipient campaign sent on Tuesday moved the whole domain’s reputation and took the product mail with it. Activation stops. Nobody can sign up. The campaign performed fine.

Why SaaS has a deliverability problem most senders do not

An ecommerce brand sends marketing email and order confirmations. If the marketing suffers, revenue suffers. A SaaS company sends marketing email and mail that is load bearing for the product: verification links, password resets, invite emails, payment failure notices, alerts, digests, two factor codes. When reputation degrades, the product stops working for new users, and the damage lands on activation rather than on a campaign report.

That coupling is what makes the ordinary advice insufficient. Cleaning your list and writing better subject lines is fine, but it does not address the structural issue, which is that two entirely different mail classes with entirely different engagement profiles are sharing one reputation. A password reset gets opened by 95 percent of recipients within minutes. A product update newsletter gets opened by 22 percent of recipients, and a slice of them mark it as spam. Averaged together on one domain, the newsletter drags the reset down.

The split between those classes and how to treat them differently is covered in transactional vs marketing email. The rest of this page is the infrastructure that makes the split real rather than conceptual.

The subdomain architecture: three mail classes, three reputations

Mailbox providers assess reputation substantially at the subdomain level, which means subdomains are the cheapest isolation you can buy. Three streams, three subdomains, and the root domain kept clean for human mail.

The DNS side is short. For a marketing subdomain on a typical ESP you publish a TXT record for SPF, one or two CNAMEs for DKIM signing, and a DMARC record at the subdomain or inherit the organisational one:

news.yourdomain.com. TXT "v=spf1 include:sendgrid.net ~all"
s1._domainkey.news CNAME s1.domainkey.u123.wl.sendgrid.net
s2._domainkey.news CNAME s2.domainkey.u123.wl.sendgrid.net
_dmarc.news TXT "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=s"

Two constraints catch people. SPF allows a maximum of 10 DNS lookups before it fails, per RFC 7208, and stacking four vendor includes on one record blows past that quickly; a single subdomain per vendor avoids the problem entirely. And the visible From address has to align with the authenticated domain, so sending as hello@yourdomain.com while authenticating news.yourdomain.com fails DMARC alignment under strict settings. Send as hello@news.yourdomain.com or relax alignment deliberately, not by accident.

SPF, DKIM and DMARC, and the move from p=none to enforcement

Authentication is three records doing three jobs. SPF says which servers may send for your domain. DKIM cryptographically signs each message so tampering is detectable. DMARC tells receivers what to do when one of the first two fails, and asks them to report what they saw.

Two opinions worth stating. Get to p=reject rather than stopping at quarantine, because a SaaS domain that can be spoofed is a phishing surface aimed at your own customers, and support will eventually deal with the consequences. And treat BIMI as a later nicety: it needs DMARC at enforcement plus a verified mark certificate that costs over a thousand dollars a year, and the logo in the inbox is worth far less than the enforcement itself.

What Google and Yahoo have required since February 2024

Both providers introduced bulk sender requirements in February 2024 that apply to anyone sending more than 5,000 messages a day to personal Gmail or Yahoo accounts. Microsoft followed with comparable requirements for consumer Outlook addresses in May 2025. The rules are not guidance.

The one that catches SaaS teams is one click unsubscribe. RFC 8058 requires a header based unsubscribe that Gmail can action without the recipient visiting your site, and it is separate from the unsubscribe link in your footer. Most modern platforms set it automatically for marketing streams. Most homegrown product mailers do not set it at all, which is fine for genuinely transactional mail and a problem the moment a product digest crosses into promotional territory.

The 0.3 percent ceiling and why 0.1 percent is the number that matters

Google’s published threshold is 0.3 percent, and treating that as a target is the most common misreading in the whole specification. Filtering tightens long before the ceiling. Practitioners watching Postmaster Tools consistently report visible inbox placement damage in the 0.15 to 0.25 percent band, which is why the working target should be under 0.1 percent.

The arithmetic makes the risk concrete. On a 50,000 recipient send, 0.3 percent is 150 complaints. Fifty complaints, one tenth of one percent, is the line you actually manage to. A single reactivation campaign to a list nobody has mailed in eight months can produce that from a few thousand recipients on its own.

Two operational rules follow. Send the warmest segments first in any large campaign, because early positive engagement signals shape how the rest of the send is treated. And put a hard stop in the workflow: if complaints cross 0.1 percent during a send, pause the remaining batches rather than finishing and analysing afterwards. Bounce and complaint hygiene like this is what actually moves sender reputation, far more than copy or send time.

Warming a new sending domain without torching it

A brand new subdomain has no reputation, which providers treat as suspicious rather than neutral. Volume ramps slowly and engagement quality matters more than the numbers.

Four to six weeks is the realistic schedule for a marketing subdomain. Transactional streams warm considerably faster because the engagement is extreme: verification emails are opened almost universally within minutes, and that signal builds reputation quickly. This is why moving product mail to its own subdomain is low risk and moving marketing is the part that needs patience.

If you are migrating an existing programme rather than starting fresh, run both domains in parallel for two to three weeks, shifting a rising percentage of traffic, instead of cutting over on a Monday. And do not warm on a dedicated IP unless you can sustain the volume: below roughly 100,000 messages a month, a shared IP pool at a reputable ESP with clean domain hygiene beats a dedicated IP that goes quiet for six days between sends.

The monitoring stack that tells you before support does

Three sources, checked on different cadences, cover almost everything.

The synthetic transactional test is the one that separates a SaaS deliverability programme from a generic one. Password reset inbox placement is a production dependency, and a Gmail filtering change that pushes it to spam is an incident, not a marketing metric. Wire it to the same alerting as your uptime monitor and give it an owner in engineering.

Postmaster Tools has a real limitation worth knowing: it only reports on personal Gmail traffic, needs a few thousand daily messages to a domain before charts populate, and shows nothing at all about Microsoft 365 corporate tenants, which is where most B2B SaaS mail actually lands. Fill that gap with seed testing and with your own engagement data, since a sudden drop in open rate from one recipient domain is usually filtering, not disinterest.

What this costs and what it does not fix

Budget a week of an engineer’s time for the DNS and authentication work, plus a month of calendar time for the DMARC ramp, plus whatever your ESP charges. Tooling is modest: DMARC report parsing runs from free to about $200 a month at small scale, seed testing around $50 to $150 a month, and Postmaster Tools costs nothing. The expensive part is attention, and the reason it gets skipped is that nothing appears broken until it is badly broken.

Be clear about the limits. Perfect authentication does not get bad mail delivered. If your onboarding sequence sends six emails in four days to people who signed up for a free tool and never returned, complaints will rise no matter how clean the DNS is. Deliverability infrastructure protects good sending practice; it cannot substitute for it, which is why the behavioural targeting behind a behavioral email trigger matters as much as the records.

Corporate filtering is the other blind spot. Mimecast, Proofpoint and Microsoft Defender make decisions on grounds that have little to do with SPF and DKIM, including link reputation, attachment policy and internal allowlists. B2B SaaS mail lands in those environments constantly and neither Postmaster Tools nor Gmail seed tests will tell you what happened. When a large customer reports missing notifications, the answer is usually their security gateway, and the fix is asking their IT team to allowlist your sending domain.

And none of this applies cleanly to cold outbound, which operates under different constraints on separate infrastructure. That is its own discipline, covered in outbound email infrastructure and deliverability. Keep it off the domain that sends your dunning email and your password resets, permanently.

The order to do this in

Do it in this sequence, because each step depends on the one before it and doing them out of order wastes the warmup.

Split the streams first. Move product mail to its own subdomain this week, and marketing to a second subdomain over the following month with a proper warmup. Authenticate everything with SPF and DKIM as you go, publish DMARC at p=none the same day, and read the aggregate reports before touching the policy. Get to p=reject within a quarter.

Then set the operating rules: one click unsubscribe on every marketing stream, a suppression list that no system can bypass, dormant segments excluded by default, and a hard pause at 0.1 percent complaints. The compliance side of that, including consent records and regional requirements, is laid out in the SaaS email compliance checklist.

Finally, measure what the inbox is worth to you. Inbox placement is upstream of every activation number in the programme, and the relationship between delivered lifecycle mail and conversion is quantified in the trial conversion and email study. The rest of the sequences that depend on all this plumbing sit in the SaaS email marketing hub, including the upgrade flows in freemium to paid upgrade emails, and none of them work if the mail does not arrive.