The SaaS Founder's Guide to Email Deliverability

The SaaS Founder's Guide to Email Deliverability

If your SaaS sends emails (verification, password reset, welcome, billing) and they land in the spam folder, your customers miss critical messages. They cannot verify their account, they cannot reset their password, and they cannot receive their invoice. Email deliverability is not just a technical concern — it is a customer experience and revenue issue. This article is the founder's guide to ensuring your emails reach the inbox.

The direct answer is that email deliverability requires three DNS records (SPF, DKIM, DMARC), a reputable email service provider, and good sending practices (no spam content, consistent sending volume). For more on SaaS operations, see our article on how to handle SaaS user onboarding without losing customers.

The Three DNS Records

SPF (Sender Policy Framework)

SPF is a DNS record that lists the email servers authorized to send email on behalf of your domain. Without SPF, email providers (Gmail, Outlook) might reject your emails because they cannot verify the sender.

How to set up SPF:

Add a TXT record to your DNS:

Type: TXT
Name: @ (or myapp.com)
Value: v=spf1 include:_spf.google.com include:sendgrid.net ~all

The include statements list the email providers authorized to send email for your domain. Replace sendgrid.net with your actual email provider (e.g., resend.com, postmarkapp.com).

DKIM (DomainKeys Identified Mail)

DKIM is a DNS record that provides a cryptographic signature for your emails. Without DKIM, email providers cannot verify that the email was not tampered with in transit.

How to set up DKIM:

Your email provider (Resend, SendGrid, Postmark) will provide a DKIM record. Add it as a TXT record to your DNS:

Type: TXT
Name: [provider-specific]._domainkey.myapp.com
Value: [provider-specific DKIM value]

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC is a DNS record that tells email providers what to do if an email fails SPF or DKIM verification. Without DMARC, email providers might accept spoofed emails (from attackers pretending to be you).

How to set up DMARC:

Add a TXT record to your DNS:

Type: TXT
Name: _dmarc.myapp.com
Value: v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100

• p=quarantine tells email providers to send failing emails to the spam folder.
• p=reject tells email providers to reject failing emails entirely (use this once you are confident SPF and DKIM are working).
• rua=mailto:[email protected] sends reports to this email address.

Choose a Reputable Email Provider

Do not send emails from your own server (e.g., via nodemailer with SMTP). Use a reputable email service provider:

• Resend. Developer-friendly, generous free tier (3,000 emails/month), good deliverability.
• Postmark. Focused on transactional email, excellent deliverability, higher cost.
• SendGrid. Popular, good features, larger free tier (100 emails/day).

These providers maintain good sender reputations, handle bounces and complaints, and provide DKIM signing automatically.

For more on background jobs (including email sending), see our article on the SaaS founder's guide to background jobs.

Sending Practices

Even with SPF, DKIM, and DMARC, poor sending practices can land your emails in spam:

• Do not send spam content. Avoid spam-trigger words (e.g., "FREE," "CLICK HERE," "ACT NOW"), excessive capitalization, and too many links.

• Include a clear unsubscribe link. For marketing emails, include a one-click unsubscribe link. This is required by law (CAN-SPAM, GDPR).

• Send consistently. Do not send 10,000 emails one day and 0 the next. Ramp up gradually.

• Monitor bounces and complaints. If your bounce rate exceeds 5 percent or your complaint rate exceeds 0.1 percent, email providers might start sending your emails to spam. Remove bounced addresses from your list.

• Use a custom domain. Do not send from @gmail.com or @yahoo.com. Send from @myapp.com (which requires SPF, DKIM, and DMARC on your domain).

Transactional vs Marketing Email

Different types of email have different deliverability requirements:

• Transactional email (verification, password reset, billing). These are sent to users who expect them, so deliverability is high. Use a transactional email provider (Resend, Postmark).

• Marketing email (newsletter, promotions). These are sent to users who might not expect them, so deliverability is lower. Use a marketing email provider (Mailchimp, ConvertKit) and ensure users have opted in.

Do not mix transactional and marketing email in the same sending domain. Use separate subdomains (e.g., mail.myapp.com for marketing, app.myapp.com for transactional) to protect transactional deliverability.

Common Pitfalls and Troubleshooting

The first pitfall is not setting up SPF, DKIM, and DMARC. Without these records, email providers cannot verify your emails, which means they go to spam. The fix is to set up all three records.

The second pitfall is using a free email provider (Gmail, Yahoo) for sending. Free email providers are not designed for SaaS email, and their deliverability is poor. The fix is to use a reputable email service provider.

The third pitfall is sending from your own server. Self-hosted email has poor deliverability because the server's IP address does not have a good sender reputation. The fix is to use an email service provider.

The fourth pitfall is not monitoring bounces and complaints. If your bounce rate is high, email providers will send your emails to spam. The fix is to monitor bounces and remove bounced addresses.

The fifth pitfall is mixing transactional and marketing email. If marketing email gets flagged as spam, it can affect transactional email deliverability. The fix is to use separate subdomains.

Common Pitfalls and Troubleshooting

When working with the saas founder's guide to email deliverability, several common pitfalls can undermine effectiveness. The first is over-automation. Automating everything sounds appealing, but some tasks require human judgment. The fix is to automate repetitive tasks (monitoring, diagnosis, deployment) while keeping humans in the loop for decisions that affect customers, billing, or security. The second is not testing changes before applying them. Whether it is a configuration change, a code change, or an infrastructure change, untested changes can break production. The fix is to always test in staging before applying to production, and to have a rollback plan. The third is not monitoring the automation itself. If your automated system goes down, you are flying blind. The fix is to monitor the automation system (e.g., with a dead man's switch) and to alert if it stops running. The fourth is not documenting the process. If the process is in your head, it does not exist for anyone else. The fix is to document the process in a runbook that anyone can follow. For more on documentation, see our article on how to build a deployment process your future team can inherit. The fifth is not reviewing regularly. Processes that work today might not work tomorrow (as the product grows, the traffic changes, the team changes). The fix is to review the process monthly and to adjust as needed.

Advanced Patterns and Best Practices

Beyond the basics of the saas founder's guide to email deliverability, several advanced patterns can improve outcomes. The first is incremental implementation. Rather than implementing everything at once, start with the minimum viable version and iterate. This reduces risk (smaller changes are easier to debug) and delivers value faster. The second is automation. Manual processes are error-prone and do not scale. The fix is to automate repetitive tasks (deployment, testing, monitoring) using CI/CD pipelines and automated tools. For more on CI/CD, see our article on how we built the CI/CD pipeline. The third is documentation. A process that is not documented does not exist for anyone else. The fix is to document processes in runbooks that anyone can follow. For more on documentation, see our article on how to build a deployment process your future team can inherit. The fourth is testing. Untested changes can break production. The fix is to write tests (unit, integration, end-to-end) and to run them in CI/CD before every deployment. For more on testing, see our article on the testing void. The fifth is continuous improvement. Processes that work today might not work tomorrow. The fix is to review processes regularly (monthly) and to adjust based on lessons learned from incidents, feedback, and changing requirements.

When This Approach Is Not the Right Choice

While the saas founder's guide to email deliverability is a valuable practice, it is not always the right approach. For very small projects (hobby projects, prototypes), the overhead of implementing best practices might not be worth the effort. The fix is to implement the minimum viable version and to add more as the project grows. For teams with limited resources (solo founders, small teams), prioritizing features over infrastructure might be the right call in the short term. The fix is to implement the highest-impact practices first (security, backups) and to defer the rest until the team grows. For projects with strict compliance requirements (HIPAA, SOC 2), the standard approach might not be sufficient, and you might need to implement additional controls (audit logging, access reviews, penetration testing). The key is to match the approach to your project's stage, resources, and requirements. For more on prioritization, see our article on the production checklist before your SaaS takes its first customer. For more on compliance, see the SaaS founder's guide to compliance.

Additional Considerations and Best Practices

When working with the saas founder's guide to email deliverability, there are several additional considerations that can significantly impact your success. The first is the importance of starting simple and iterating. Many teams try to implement everything at once, which leads to complexity, bugs, and delayed launches. The fix is to start with the minimum viable version, verify it works, and then add features incrementally. This approach reduces risk, delivers value faster, and makes debugging easier because changes are smaller. The second consideration is the importance of documentation. A process that is not documented does not exist for anyone else on the team. Document your configuration, your deployment process, your rollback procedure, and your incident response plan. Use runbooks that anyone can follow, not just the person who set up the system. For more on documentation, see our article on how to build a deployment process your future team can inherit.

The third consideration is testing. Untested changes are the leading cause of production incidents. Before deploying any change, test it locally, test it in staging, and run your automated test suite. If you do not have automated tests, start by writing tests for your most critical paths (signup, login, payment). For more on testing, see our article on the testing void. The fourth consideration is monitoring. Without monitoring, you cannot detect issues until customers complain. Set up health checks, structured logging, metrics tracking, and alerts for error rate and response time. For more on monitoring, see our article on monitoring your SaaS without hiring a DevOps engineer.

The fifth consideration is security. Security is not optional when you are handling customer data and payment information. Ensure all secrets are in environment variables (never hardcoded), enforce HTTPS, set security headers, use rate limiting on auth endpoints, and hash passwords with bcrypt or argon2. For more on security, see our article on a practical security checklist for early-stage SaaS. The sixth consideration is backups and recovery. Your database should be backed up daily, backups should be stored off-site, and backup restore should be tested regularly. An untested backup is not a backup. For more on backups, see our article on how to rehearse a database restore before you need one.

The seventh consideration is cost management. Cloud costs can creep up over time, and without monitoring, they can exceed revenue. Track your monthly hosting cost, set a budget, and use fixed pricing (like Deployxa at $9/month for 15 apps) to avoid surprise bills. For more on cost management, see our article on how to estimate deployment costs for a small SaaS. The eighth consideration is team communication. When things go wrong, communication is as important as the fix. Set up a status page, communicate transparently during incidents, and publish post-mortems after. For more on communication, see our article on the SaaS founder's guide to status pages.

These considerations apply regardless of your specific technology stack, team size, or business model. By addressing each one systematically, you reduce the risk of outages, data loss, security breaches, and cost overruns, which protects your revenue and your customers' trust.

Conclusion: Set Up DNS, Use a Provider, Monitor

Email deliverability is a customer experience and revenue issue. By setting up SPF, DKIM, and DMARC, using a reputable email provider, and following good sending practices, you can ensure your emails reach the inbox. Do not let your verification, password reset, and billing emails land in spam — set up the DNS records and use a provider before launching.

Ready to improve your email deliverability? Set up SPF, DKIM, and DMARC on your domain, switch to a reputable email provider, and test your deliverability. For more, see how to handle SaaS user onboarding and the SaaS founder's guide to background jobs. Explore our free developer tools to speed up your workflow.