Short answer. Transactional email (confirmations, password resets, receipts) must reach near 100%. The key is to separate it from marketing: a dedicated subdomain or IP, correct SPF/DKIM/DMARC, a clean list, and monitoring of your mail infrastructure. Mix transactional with promo traffic and you risk dragging critical mail into spam on the back of campaign reputation.
Separate the streams
- Transactional stream —
mail.example.comor a subdomaint.example.com; - Marketing stream — a separate subdomain
news.example.com; - this way campaign reputation does not affect password and receipt delivery.
A transactional email is awaited right now. A delay or a spam landing is a direct hit to the product, not to marketing.
Baseline authentication
- SPF — list the servers allowed to send for the domain;
- DKIM — sign messages with a private key;
- DMARC — set a policy and collect RUA reports.
example.com. IN TXT "v=spf1 include:_spf.your-esp.com -all"
sel._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3..."
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"Content and format
- clean HTML, no heavy attachments or suspicious links;
- a clear subject without CAPS or spam triggers;
- a correct
List-Unsubscribewhere appropriate; - a consistent
From:aligned with the DKIM domain.
Deliverability checklist
| Factor | Target |
|---|---|
| SPF | pass, aligned |
| DKIM | pass, aligned |
| DMARC | quarantine/reject |
| Hard bounce | < 2% |
| MX availability | 99.9%+ |
| Blocklists | none |
Delivery speed
Transactional mail is not queued behind campaigns. It must go out instantly. If your SMTP relay stalls or is down, the user does not get a code in seconds — and that shows up as 4xx codes.
Where enterno helps
/email-check validates SPF/DKIM/DMARC and alignment for your transactional subdomain. MX-lookup and an SMTP test confirm the relay accepts connections. /monitors puts the mail server under continuous watch: ports 25/465/587, blacklist checks, multi-region RU/EU/US, and alerts to Telegram/Slack/email/webhook. Free includes 10 monitors. enterno does not send your mail — we diagnose the infrastructure you send through.
FAQ
Do I need a dedicated IP for transactional mail?
At high volume, yes; at low volume a dedicated subdomain on the shared ESP pool is enough.
Which DMARC policy should I set?
At least quarantine, targeting reject after a safe migration.
Why does transactional mail go to spam?
Often from mixing with promo traffic or failed SPF/DKIM alignment.
Should I warm up a transactional subdomain?
Yes, if it is a new domain/IP — see warming up a domain.
Next: check authentication, read domain warm-up and set up mail-server monitoring.