TL;DR — Quick answer
Email deliverability is whether your emails reach the inbox, and in South Africa it goes hand in hand with POPIA compliance. Authenticate your sending domain with SPF, DKIM and DMARC, build your list on consent, honour unsubscribe requests promptly, and remove unengaged contacts to keep a clean list. POPIA has been in force since July 2021 and is enforced by the Information Regulator. Get these basics right and your emails land where they belong, legally. This is general guidance and not legal advice.
Key takeaways
- Deliverability is whether your email reaches the inbox, not just whether it was sent
- Domain authentication with SPF, DKIM and DMARC is the single biggest deliverability lever
- A consented, regularly cleaned list both protects deliverability and supports POPIA compliance
- POPIA has been in force since July 2021 and is enforced by the Information Regulator
- Honour opt-outs promptly and keep clear records of consent
- Sender reputation is earned over time through engagement and lost quickly through complaints
Inbox providers like Gmail and Outlook are stricter than ever about what they let through. Meanwhile POPIA sets the rules for how you may contact people in South Africa. The good news is that doing right by your subscribers satisfies both: a clean, consented list reaches the inbox and keeps you compliant. Here is how it fits together.
What is email deliverability?
Email deliverability is whether your emails actually reach the inbox, as opposed to being blocked or sent to spam. Sending an email is not the same as it being delivered and seen. Inbox providers assess every message against signals like authentication, sender reputation and recipient engagement, then decide where it lands. Poor deliverability means your audience never sees your work, no matter how good it is.
For South African senders, deliverability is often the hidden reason a campaign underperforms. Open rates look low not because the subject line failed, but because half the emails never reached an inbox to be opened.
How do you authenticate your sending domain?
Authenticate your domain by setting up SPF, DKIM and DMARC records in your DNS, which prove your emails are genuinely from you. SPF lists the servers allowed to send on your behalf. DKIM adds a cryptographic signature that confirms the message was not tampered with. DMARC tells inbox providers what to do if a message fails those checks, and gives you reporting. Together they are the single biggest lever for inbox placement.
Most platforms provide the exact records to add, and your domain host applies them. It is a one-time setup that pays off on every send thereafter. Skipping it is the most common deliverability mistake we see among South African businesses.
Why does list hygiene matter so much?
List hygiene matters because inbox providers judge you on engagement: emailing people who never open or who marked you as spam drags down placement for everyone on your list. Regularly remove or suppress contacts who have not engaged in several months, clean out invalid addresses, and never re-import old lists wholesale. A smaller, engaged list outperforms a large, stale one on both deliverability and revenue.
Hygiene also supports POPIA. Keeping only contacts who want to hear from you, and acting on opt-outs, is exactly what the law expects and what inbox providers reward.
What are the POPIA essentials for email?
POPIA requires a lawful basis to email people, usually consent, a clear identification of who you are, and an easy way to opt out of every message. POPIA has been in force since July 2021 and is enforced by the Information Regulator. In practice this means building your list on permission, keeping records of how consent was given, linking to a current privacy policy, and honouring unsubscribe requests promptly.
Avoid buying or scraping lists, and do not email people who have opted out. These principles protect both your compliance position and your sender reputation. This is general guidance and not legal advice; for high-risk or contractual questions, consult a qualified advisor.
How do you build and protect sender reputation?
Sender reputation is earned over time through consistent sending, strong engagement and low complaint rates, and it is lost quickly through spam complaints and high bounces. Warm up a new sending domain gradually rather than blasting your whole list on day one. Send to engaged people first, keep complaint rates low by only emailing those who opted in, and maintain a steady cadence so providers learn to trust you.
Monitor your bounce rate and complaint rate after every send. A sudden spike is an early warning to pause and check your list quality before lasting damage is done.
What is the deliverability and POPIA checklist?
The essentials are: authenticate with SPF, DKIM and DMARC; build the list on consent; include an easy opt-out; clean the list regularly; and monitor reputation signals. Add a current privacy policy, keep consent records, and warm up new domains. Run through this list before any major campaign. Each item supports both inbox placement and POPIA compliance, which is why they belong together.
Treat deliverability and compliance as ongoing practices, not one-time tasks. The brands that reach the inbox reliably in South Africa are the ones that respect their subscribers and the rules at every send.
Reaching the inbox and staying compliant are two sides of the same coin. Authenticate your domain, keep a consented and clean list, honour opt-outs, and protect your reputation. Do that, and your email programme is both effective and on the right side of POPIA.
Frequently asked questions
What is email deliverability?
Email deliverability is whether your emails actually reach the inbox rather than being blocked or sent to spam. Sending an email is not the same as it being delivered and seen. Inbox providers assess each message against signals like domain authentication, sender reputation and recipient engagement, then decide where it lands. Poor deliverability is a common hidden reason campaigns underperform.
How do I improve email deliverability in South Africa?
Improve deliverability by authenticating your sending domain with SPF, DKIM and DMARC, building your list on consent, removing unengaged contacts regularly, and maintaining a steady sending cadence. Warm up new sending domains gradually and monitor bounce and complaint rates after every send. Authentication is the single biggest lever for inbox placement.
What does POPIA require for email marketing?
POPIA requires a lawful basis to email people, usually consent, clear identification of who you are, and an easy opt-out in every message. It has been in force since July 2021 and is enforced by the Information Regulator. Build your list on permission, keep consent records, link to a current privacy policy and honour unsubscribes promptly. This is general guidance and not legal advice.
What are SPF, DKIM and DMARC?
SPF, DKIM and DMARC are email authentication standards set in your domain DNS that prove your emails are genuinely from you. SPF lists the servers allowed to send on your behalf, DKIM adds a signature confirming the message was not altered, and DMARC tells inbox providers how to handle failures and provides reporting. Together they are the biggest driver of inbox placement.
Why are my emails going to spam?
Emails commonly land in spam because the sending domain is not authenticated, the list contains unengaged or invalid addresses, or the sender reputation is weak. Fixes include setting up SPF, DKIM and DMARC, cleaning your list, only emailing people who opted in, and building reputation through consistent, engaged sending. Sudden bounce or complaint spikes are early warnings to investigate.