Email Deliverability: Best Practices for Transactional Emails

If a password reset never arrives, users do not blame DNS. They blame your product. Deliverability is the gap between "we called the API" and "the message is in the inbox."

This guide covers the records and habits that keep transactional mail trusted: SPF, DKIM, DMARC, bounce handling, and content that does not trip filters.

Domain authentication first

SPF

SPF lists which servers may send mail for your domain. Add the TXT record OnePush shows in the dashboard for your sending domain. Keep a single SPF record. Multiple SPF TXT records break validation.

DKIM

DKIM signs messages so receivers can confirm they were not altered. OnePush publishes DKIM keys for your domain. Add the CNAME or TXT records exactly as shown. Wait for DNS to propagate before you judge results.

DMARC

DMARC tells receivers what to do when SPF or DKIM fail. Start with monitoring:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Move to p=quarantine or p=reject only after the report mailbox shows clean alignment. Jumping straight to reject on a messy setup will block legitimate mail.

Reputation habits that matter

Keep bounce rates low. Hard bounces (bad addresses) should be suppressed immediately. Soft bounces can retry, then suppress if they keep failing.

Separate noisy marketing traffic from transactional streams when you can. A newsletter complaint spike should not poison password-reset reputation.

Warm new domains gradually. Do not dump your full user base on day one from a fresh domain.

Watch spam complaint rates. Transactional mail should stay far below marketing thresholds. If complaints rise, check that users actually expected the message.

Content that helps inbox placement

• Clear From names users recognize
• Subjects that match the action ("Reset your password", not "Quick question")
• Working unsubscribe only where the message is optional marketing, not for pure auth mail
• Both HTML and a plain-text part when you send rich content
• Avoid URL shorteners and attachment-heavy blasts for auth flows

Monitor with logs and webhooks

Use dashboard email logs and delivery webhooks so you see bounces and complaints the same day. Our webhooks guide covers event handling. Analytics patterns live in the email analytics post.

OnePush-specific checklist

1. Verify the domain before production volume
2. Send with sk_ over POST /v1/send
3. Subscribe to bounce and complaint events
4. Keep Starter ($20/month) or Pro ($49/month) volume aligned with real traffic so you are not surprised by overages (pricing)

Bottom line

Authentication records get you in the game. List hygiene and expected content keep you there. Fix DNS first, then watch bounces like product bugs.