SPF, DKIM, and DMARC aren't enough — here's what actually controls the inbox

If you've ever fought a deliverability problem, you've been told to fix your SPF, DKIM, and DMARC records. Good advice — but incomplete. Founders set all three up perfectly and still watch half their emails miss the inbox. Here's why, and what to do instead.

What each record actually does

• SPF (Sender Policy Framework): lists which servers are allowed to send mail for your domain.
• DKIM (DomainKeys Identified Mail): cryptographically signs your mail so receivers can verify it wasn't tampered with.
• DMARC: tells receivers what to do when SPF or DKIM fail, and where to send reports.

Notice what every one of these has in common: they're about authentication and authorization. They answer the question "is this sender allowed to send from this domain?" They say nothing about whether the recipient actually wants the email.

Why authentication alone leaves you in Promotions

Mailbox providers assume that any automated sender can pass authentication — because spammers do too. So once you've cleared the authentication bar, the provider moves on to the question that really decides placement: do real humans engage with this mail? With no engagement history, a perfectly authenticated welcome email still looks like exactly the kind of one-way bulk message that belongs in Promotions.

Engagement is the real ranking signal

Think of authentication as getting into the building and engagement as earning a seat at the table. The engagement signals that matter most, roughly in order of strength:

• Replies — the strongest, because they prove genuine two-way conversation.
• Moving a message from spam to the inbox, or marking it 'not spam'.
• Adding the sender to contacts.
• Consistent opens and clicks from real recipients over time.

Why replies win

A reply is nearly impossible to manufacture at scale, so providers weight it heavily. One reply from a new user does more for your sender reputation than thousands of opens. And unlike most engagement signals, you can directly and ethically ask for a reply — which makes it the most actionable lever a founder has.

Turning the theory into a system

The practical move is to request a reply at the moment of maximum intent: right after signup. Keep SPF, DKIM, and DMARC in place — they're the foundation — then layer engagement on top by nudging every new user to reply once. ReplyBoost does this automatically: bring your own provider, write one honest nudge, and let the replies compound your reputation over time.