DEV Community

Dhiraj Chatpar
Dhiraj Chatpar

Posted on

Email Authentication Dkim Spf Dmarc - Updated 2026 Guide

#email #smtp #mta

Bounce Rate Reduction: The Complete Technical Guide for Email Engineers

Bounce rate is the silent killer of email deliverability. A rate above 2% gets you flagged. Above 5% gets you blocked. Most teams don't know they have a problem until their IP reputation is already damaged.

This guide covers every technical lever you can pull to keep bounces below 1%.

Hard Bounces vs Soft Bounces: What's Actually Happening

A hard bounce means the recipient address doesn't exist — permanently. This is poison for your sender reputation and must be handled within 24 hours.

A soft bounce is temporary — mailbox full, server busy, message too large. These accumulate too. A pattern of soft bounces on the same address signals a problem.

Rule: Hard bounces = immediate list removal. Soft bounces = 3 attempts over 5 days, then quarantine.

List Hygiene: The Foundation of Low Bounce Rates

Validate at Point of Capture

Never add an address to your list without first confirming it exists:

SMTP Dialog Check:
$ telnet mx.example.com 25
220 mx.example.com ESMTP
HELO yourserver.com
250 mx.example.com Hello yourserver.com
MAIL FROM:<verify@youserver.com>
250 OK
RCPT TO:<target@example.com>
250 OK  ← valid
Enter fullscreen mode Exit fullscreen mode

If you get 550 User unknown or 550 5.1.1 back, the address is dead.

Tools: smtp-user-enum, direct SMTP verification, or API services like ZeroBounce and AbstractAPI.

Re-validate Your Existing List Monthly

Your list decays ~22% per year even without adding new addresses. Run monthly hygiene checks:

  1. Flag addresses with no opens/clicks in 90 days for re-engagement
  2. Re-validate dead addresses via SMTP check before next send
  3. Remove anything that bounces twice consecutively

Role-Based Addresses Are Death

admin@, info@, postmaster@, sales@, support@ — these addresses are monitored by bots, often catch-all, and always high-bounce. Don't send to them unless you verified them specifically.

SPF, DKIM, and DMARC: Your Deliverability Shield

Misconfigured authentication is the #1 cause of unexpected bounces. Recipients' servers reject unauthenticated mail before it even reaches the inbox folder.

SPF (Sender Policy Framework)

SPF tells receiving servers which mail servers are allowed to send for your domain:

v=spf1 include:_spf.yourmailprovider.com ~all
Enter fullscreen mode Exit fullscreen mode

Too many mechanisms (+mx, +a, +ip4 pointing to your web server) creates SPF lookup failures. Hard limit: 10 DNS lookups per SPF record. Use include: chains wisely.

DKIM (DomainKeys Identified Mail)

DKIM attaches an encrypted signature to every message. The receiving server decrypts it using your public key published in DNS. If the signature doesn't match, the message is rejected.

KumoMTA DKIM setup:

dkim {
  sign = true
  selector = "mail"
  domain = "postmta.com"
  private_key = "/etc/kumomta/dkim/private.pem"
}
Enter fullscreen mode Exit fullscreen mode

Rotate keys every 90 days. Compromised DKIM = spoofed mail using your domain.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC ties SPF and DKIM together with a policy:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@postmta.com; pct=100
Enter fullscreen mode Exit fullscreen mode

Start with p=none (monitor only) for 2 weeks, read your DMARC reports, then move to p=quarantine and finally p=reject once you've confirmed everything authenticates correctly.

List Segmentation: Send to the Right Addresses

Sending the same message to your entire list is the fastest way to inflate your bounce rate. Different segments have different risk profiles:

High-risk segments (bounce rate 2-5%):

  • Addresses added more than 18 months ago with no recent open activity
  • Addresses collected via purchased or rented lists
  • B2B addresses at companies with high employee turnover

Low-risk segments (bounce rate < 0.5%):

  • Double opt-in subscribers
  • Addresses with opens/clicks in the last 30 days
  • Customer addresses (already verified at signup)

Golden rule: Always send new campaigns to your lowest-risk segment first. If you get >1% bounces, something is wrong — stop and investigate.

Sending Volume: The Velocity Trap

Bouncing more than 5% of a batch in a single session is a red flag, regardless of your overall list health. Receiving servers track bounce velocity, not just rate.

Safe sending velocity:

  • New IP: Start at 50-100 emails/hour for first 48 hours
  • Warming up: Double volume every 2-3 days IF bounce rate stays below 1%
  • Established IP: Cap daily growth at 20% until you reach target volume

KumoMTA rate limiting:

remote_queue "outbound" {
  concurrency = 200
  rate = "5000/hour"
}
Enter fullscreen mode Exit fullscreen mode

Feedback Loops: Know Before They Bounce

Most major mailbox providers (Gmail, Microsoft, Yahoo) support Feedback Loop (FBL) notifications. When a recipient marks your mail as spam, you get an abuse complaint and can immediately suppress that address.

Register for FBL:

  • Gmail/Google Workspace: Postmaster Tools (free, no signup needed — just publish DKIM/SPF correctly)
  • Microsoft SNDS: https://sendersupport.office.com/ — register your IPs
  • Yahoo: Requires contact with Yahoo's feedback loop service

KumoMTA FBL setup:

feedback_loop {
  enabled = true
  address = "fbl@postmta.com"
  auth_id = "your_auth_id"
}
Enter fullscreen mode Exit fullscreen mode

Monitoring: Set Up Bounce Alerts

Don't wait for your sender score to drop to discover you have a bounce problem. Set thresholds that trigger immediate action:

Metric Warning Critical
Hard bounce rate > 0.5% > 1%
Soft bounce rate > 3% > 5%
Unknown user rate > 1% > 2%

Create a monitoring dashboard tracking:

  • Bounce rate by campaign
  • Bounce rate by IP
  • Bounce rate by sending domain
  • Complaint rate (FBL)
  • IP reputation score (Sender Score, Google Postmaster)

The Bounce Recovery Checklist

If your IP is already damaged:

  1. Stop sending immediately — every bounce while warming further damages reputation
  2. Identify the bad list segment — is it a specific acquisition channel?
  3. Clean your list — remove all hard bounces, 6+ month inactive addresses
  4. Move to a new IP — your old IP is likely blacklisted
  5. Warm the new IP slowly — 48 hours at 50 emails/hour, then gradual ramp
  6. Segment aggressively — only send to verified, engaged addresses for first 30 days
  7. Monitor your reputation — Sender Score, Postmaster Tools, SNDS

Full reputation recovery takes 3-6 months of consistent clean sending.

Tools for Bounce Rate Management

  • ZeroBounce — Email verification API with 99% accuracy
  • AbstractAPI Email Validator — Bulk validation with spam trap detection
  • NeverBounce — Real-time validation with guaranteed accuracy SLA
  • MXToolbox — DNS and blacklist monitoring
  • Google Postmaster Tools — Free reputation data for Gmail recipients
  • Microsoft SNDS — Free IP reputation data for Outlook/Hotmail

Bottom line: Bounce rate is a list quality problem, not a sending problem. Every percentage point above 2% is lost revenue and a damaged sender reputation that takes months to rebuild.

This guide is part of the PostMTA Email Infrastructure Series. For SMTP relay configuration and MTA setup guides, see KumoMTA Setup Guide.

Top comments (0)