Email Deliverability for UK B2B: SPF, DKIM, DMARC and Warm-Up
SPF, DKIM and DMARC prove your cold email is really from you, and warm-up plus sensible sending windows keep it out of spam. Here is the plain-English UK B2B setup that gets you into the inbox.
Email deliverability for UK B2B comes down to two things: proving your email is genuinely from you (SPF, DKIM and DMARC), and building a sending reputation slowly (mailbox warm-up and sensible sending windows). Get the three authentication records right and warm the mailbox before you scale, and cold email lands in the inbox. Skip them and even a perfectly written message goes straight to spam, where nobody ever sees it.
This guide explains each part in plain English, shows you how to check your own domain in a couple of minutes, and sets out the warm-up and timing habits that keep UK B2B campaigns landing.
What is email deliverability, and why does it decide everything?
Deliverability is the percentage of your sent emails that actually reach the inbox, as opposed to the spam folder or a silent block. It is not the same as "delivery": a mailbox provider can accept your email (delivered) and then quietly file it under junk (not deliverable in any useful sense).
For cold outreach this is the whole game. You can have the sharpest subject line and the most relevant offer in the country, but if Microsoft 365 and Google decide your domain looks untrustworthy, none of it matters. Roughly speaking, three factors drive the decision:
- Authentication: can the receiving server prove this email really came from your domain? (SPF, DKIM, DMARC.)
- Reputation: does your sending domain and IP have a track record of wanted mail, or a spike of complaints and bounces? (Warm-up and list hygiene.)
- Engagement: do recipients open, reply and mark you "not spam", or delete and complain?
The first two are entirely within your control before you send a single message. Start there.
What are SPF, DKIM and DMARC?
These are three DNS records that together tell receiving mail servers "this email is legitimately from us". They are the modern equivalent of a letterhead, a signature and a policy for what to do with forgeries.
SPF (Sender Policy Framework)
SPF is a DNS record listing which servers are allowed to send email for your domain. When Google receives a message claiming to be from you, it checks whether the sending server appears on your SPF list. If it does not, that is a red flag. A typical SPF record for a business on Microsoft 365 or Google Workspace names those providers as authorised senders.
The common mistake: exceeding the 10 DNS lookup limit by stacking too many "include" statements, which silently breaks SPF. Keep it lean.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to every email you send. Your mail server signs the message with a private key, and the matching public key sits in your DNS. The receiver checks the signature to confirm the message was genuinely sent by you and was not altered in transit. DKIM is what proves the content is authentic, not just the route.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties SPF and DKIM together and tells receivers what to do when a message fails: do nothing (p=none), send it to spam (p=quarantine), or reject it outright (p=reject). It also sends you reports on who is sending mail using your domain, which is how you catch both misconfiguration and impersonation.
Start at p=none while you confirm your legitimate mail passes, then move to p=quarantine and eventually p=reject once you are confident. Cold outreach without a DMARC policy increasingly gets throttled by default, especially by Google.
Rule of thumb: SPF says who can send, DKIM proves it was not tampered with, and DMARC decides what happens when the first two fail. You need all three.
Tell us who you sell to. We find them, with a real email. 25 free leads, no card.
How to check your domain in two minutes
You do not need to read raw DNS to know where you stand. Run your sending domain through the free SPF/DKIM/DMARC checker, which reports on all three records and flags the common faults (missing DKIM selector, SPF lookup overflow, a DMARC policy still stuck on p=none). No signup required.
While you are at it, run any address you are about to email through the free email verifier so a bad list is not undermining a good setup. Bounces damage reputation faster than almost anything else.
Here is the order to work through it:
- Check SPF, DKIM and DMARC on your sending domain and fix anything that fails.
- Confirm your legitimate business mail (invoices, newsletters, replies) still passes after changes.
- Move DMARC from p=none to p=quarantine once you are confident.
- Verify your outreach list so you are not sending to dead addresses.
- Only then start warming the mailbox.
What is mailbox warm-up, and why does it matter?
Warm-up is the practice of ramping sending volume gradually from a new or cold mailbox instead of blasting hundreds of emails on day one. A brand new mailbox that suddenly sends 300 cold emails looks exactly like a compromised account, and providers treat it accordingly.
A sensible ramp starts at a handful of emails a day and increases over two to four weeks until you reach your target volume, letting your domain build a reputation for mail that gets opened and replied to rather than reported. In Leadistry, connect a Google or Microsoft mailbox and the warm-up handles the daily ramp for you: 5 emails on the first day, then 10, 15, 20, 25 and 30, moving up only after a day that actually sent. You do not have to nudge the numbers up by hand.
Two more habits protect the reputation you build:
- Sending windows: send during UK business hours, not at 3am. Mail that arrives when people are at their desks gets opened and engaged with, which is exactly the signal providers reward. Leadistry sends Monday to Friday, 09:00 to 17:00 UK time by default, and you can change both.
- Automatic bounce and unsubscribe handling: every hard bounce and opt-out is removed without you touching it, so a stale address never gets a second attempt.
- A plain look: a first email built like a newsletter, with a banner and several pictures, is more likely to be filed under Promotions. Your logo, pictures and a banner in a cold email covers what to keep, and how to put a video in a cold email shows how to add one without an attachment.
How deliverability fits a real UK B2B campaign
Authentication and warm-up are only worth it if the mail itself is wanted and clean. That means checked contacts rather than scraped guesses. Every lead Leadistry delivers comes with a business email that belongs to the company, at a domain that accepts mail, so you are not burning reputation on invalid addresses. If a first email still bounces, the lead is credited back.
On the sending side, emails go from your own mailbox (free on the trial for your first 25, then included on every paid plan from £29 a month): the first email, then two short follow-ups that stop the moment somebody replies. Two versions of your email can be tested side by side and are judged on replies, because nothing we send carries an open-tracking pixel. Opening a reply on the Desk drafts an answer for you to send.
The Mailbox page (Set up, then Mailbox) checks SPF, DKIM and DMARC on your domain, marks each one in place or not, and gives step-by-step fixes for Google or Microsoft; a personal Gmail address needs nothing set up. The Desk warns you if SPF and DKIM both fail, so if your records drift, you see it before it costs you replies.
If you are still assembling your target list, the same principles pair naturally with finding the right companies in the first place, whether that is recently incorporated UK companies or businesses filtered by SIC code. And because cold outreach in the UK sits under legitimate interest, it is worth reading our UK B2B data and GDPR compliance guide so your process is defensible end to end.
Frequently asked questions
Do I really need all three of SPF, DKIM and DMARC?
Yes. SPF and DKIM each prove part of the picture, and DMARC ties them together and tells receivers what to do on failure. Google and Microsoft increasingly require a DMARC policy for bulk and cold senders, so a domain with only SPF is running on borrowed time.
How long does mailbox warm-up take?
Reputation takes longer than any ramp: most guides talk about two to four weeks before a cold mailbox is fully trusted. There is no way to safely skip it, because reputation is built through a track record, not bought overnight. Leadistry's own ramp starts at 5 a day once you connect your mailbox and reaches 30 a day on the sixth day that actually sends.
Why does Leadistry not send at night to catch inboxes early?
Because mail that arrives during UK business hours gets opened and replied to while people are at their desks, and that engagement is exactly what mailbox providers reward. Sending overnight looks more like automated bulk mail and hurts your reputation.
How do I check whether my domain is set up correctly?
Run it through the free SPF/DKIM/DMARC checker, which reports all three records and flags common faults in a couple of minutes. Fix anything that fails, verify your list with the email verifier, then start a free trial to warm up and send.