Klaviyo deliverability for Shopify stores: a 2026 inbox-placement audit

Carlos runs Argo Cycles, a $2.3M ARR cycling-parts brand on Shopify Plus. His Klaviyo deliverability score had drifted from 94 percent down to 67 percent over four months and nobody on the team had noticed until the Black Friday warm-up campaign opened at 11 percent instead of the usual 28. By the time he got us on the discovery call the reputation damage was three months deep, his domain was on a quiet provisional suppression at Gmail, and the team was scheduling a sender-domain migration. We talked him out of the migration. The damage was reversible. It just wasn’t fast.

What killed your sender reputation

Sender reputation is a number Gmail and Yahoo assign to your sending domain based on how recipients treat your mail. They don’t publish the formula. They give you a directional reading via Postmaster Tools and they update it on a fourteen-day rolling window. The number that broke Carlos breaks most accounts we audit the same way: slow drift on engagement, then a fast cliff when the algorithm decides you’ve crossed into “suspicious sender” territory.

Drivers are predictable. Send to a stale list and engagement falls. Engagement decline drops your inbox-placement score, which means fewer opens, more spam-folder deliveries, which compounds the decline next send. The loop runs for six to twelve weeks before founders notice.

Spam traps accelerate the cliff. A spam trap is an address an inbox provider plants on web pages specifically to catch senders scraping or buying lists. Hit one, your domain gets flagged. Hit five in a month, throttled. We audited a brand last spring whose welcome flow had been spraying a purchased “premium leads” list bought from a third party in 2022. The domain had collected seventeen spam-trap hits before the founder figured out the list was the problem.

The quiet third driver is Apple Mail Privacy Protection inflation. Apple opens every email on a hidden proxy regardless of whether the user actually opened it. Your dashboard reads sixty-five percent opens. The real human-open rate is closer to thirty.

The 2026 Gmail and Yahoo rules most merchants are still failing

Gmail and Yahoo updated their bulk-sender requirements in 2024 and quietly tightened them again in early 2026. The rules apply to any sender pushing over five thousand messages a day to Gmail or Yahoo addresses (most $1M-plus ARR Shopify brands clear this in a single Friday campaign), and they are non-negotiable.

The headline requirement is authentication. SPF, DKIM, and DMARC all need to pass on every message. SPF and DKIM most brands have. DMARC most have set to “p=none,” which lets failures through with a report instead of blocking them. Gmail wants a non-none policy. We set DMARC to “p=quarantine” with a small percentage on the first pass and ramp it to “p=reject” over a six-week observation window. Brands that jump straight to “p=reject” lock themselves out of their own subdomains for a week and panic.

Next is the one-click unsubscribe header. Klaviyo handles this on every campaign, but it has to be enabled at the account level. Worth confirming, because the default flipped in mid-2024 and some pre-2024 accounts never got migrated.

Then there’s the spam-rate threshold. Gmail wants under 0.10 percent complaints. Yahoo wants under 0.30. These are weekly rolling rates, not lifetime. Brands sail through for years and then breach the threshold once after a poorly-segmented promo, and the algorithm puts them on a three-month timeout no amount of authentication will fix.

The quiet fourth is sending from a subdomain, not the root domain. Use send.brand.com, not brand.com. Reputation lives at the subdomain level and isolating sending traffic protects your root domain’s transactional mail (order confirmations, password resets, support replies). Shopify’s sending-domain setup guide walks through the DNS records.

The 30-day sender-reputation reset

Reputation is repairable. The plan is boring and the timeline is non-negotiable. Roughly thirty days from the day you stop sending to the bad cohort to the day Gmail starts trusting you again.

Day one through seven, stop sending to everyone who hasn’t opened or clicked in 180 days. Don’t archive them. Suppress them with a Klaviyo suppression list. Volume drops, which feels wrong, and that is exactly the trade. Sending less mail to more engaged subscribers is the entire mechanism. Send to your top-30-percent engagement cohort only.

Day eight through fourteen, re-introduce the next engagement tier (60-day actives) and watch the open rate. If it holds above the cohort baseline, expand. If it doesn’t, hold the suppression for another seven days. Gmail rewards consistency, not volume.

Day fifteen through twenty-one, add the next tier (90-day actives), keep the campaign cadence steady, no big promotional pushes. The reset only works if the load on the domain stays flat. Founders almost always want to “test” the recovery with a Black Friday warm-up campaign in week three. Don’t. The first re-engagement send to your full list inside the reset window will undo the prior two weeks.

Day twenty-two through thirty, the full list comes back online if the staged tiers held. Run a sunset flow on anyone still inactive after the tier expansion. The flow gives them one last chance to re-engage and removes the unresponsive ones permanently.

Carlos’s reset took thirty-four days because we slipped two days at the eight-to-fourteen window when his open rate didn’t hold. Deliverability rebuilt from 67 to 89 in the same window and stuck at 89 for six weeks after. We didn’t push higher. The diminishing returns above 88 aren’t worth the volume sacrifice on a brand his size.

List hygiene: suppression, sunset, validation at the form

Suppression lists are how you tell Klaviyo never to send to a profile regardless of which campaign or flow targets them. They sit below the segment layer and they override flow logic. Every healthy account has at least four standing suppression lists: hard bounces, soft bounces over a threshold, complainers, and the over-180-day inactives.

Sunset flows are the maintenance layer. They run on a fourteen-day cadence, sweep the active list for inactivity, prompt the subscriber with a “we’re about to remove you” message, and remove them automatically if there’s no engagement inside seven days. The most-skipped flow in Klaviyo and the one most directly tied to deliverability recovery.

NeverBounce and Mail Ward sit upstream. They validate addresses at the form-submission moment, before Klaviyo ever sees them. Cost is roughly half a cent per validation. We turn them on for every account sending above 250K emails a month, because the cost-benefit math is obvious by month two.

The validation step matters more than the cleanup step, because a list that never accepts an undeliverable address doesn’t need a quarterly cleanse. We’ve migrated three brands from “quarterly cleanse” to “validate at form” and watched bounce rate drop from 0.7 to 0.08 percent. Cheaper than the migration founders kept asking about.

Authentication: SPF, DKIM, DMARC, BIMI

SPF tells the receiving server which IPs are allowed to send mail for your domain. Klaviyo gives you the SPF record to publish. Most engineers paste it once and never think about it again. Worth re-checking once a year, because if another vendor (Mailchimp, a transactional sender, Google Workspace) got added to the record, the entry needs to consolidate or one will start failing.

DKIM signs each outbound message with a cryptographic key so the receiver can verify the message wasn’t tampered with. Klaviyo generates the key pair and gives you the public key to publish as a DNS record. Standard, mostly automatic.

DMARC is the policy layer. Start at “p=quarantine” with a small percentage, ramp to “p=reject.” Send the aggregate reports to a third-party DMARC monitor (Postmark, dmarcian, or one of three others) so you can see who is spoofing your domain in real time.

BIMI is optional. It puts your brand logo next to your message in supporting inbox clients. Requires DMARC at “p=quarantine” or stricter, a Verified Mark Certificate from a CA, and an SVG logo at a specific path. Conversion lift is real but small (two to four percent on open rate from supported clients). We recommend it as a year-two project, not a launch-week project.

Smart Sending and throttling without killing revenue

Smart Sending caps the same subscriber at one message per sixteen hours by default. The cap keeps unsubscribe rates and complaint rates in check, both direct inputs into your reputation score.

The trade is that some triggered flows get queued past their intended send time. The fix is segmentation, not disabling Smart Sending. Build a “campaign-eligible” segment and a “flow-priority” segment. Promotional campaigns send to campaign-eligible. Cart, checkout, and post-purchase flows always send to flow-priority without the cap.

Klaviyo’s throttle controls let you cap sends per minute on a large campaign. Cap at twenty thousand per minute for accounts under $10M ARR. Beyond that the inbox providers throttle anyway and messages back up in Klaviyo’s queue, which inflates the open-rate window and breaks analytics.

The other dial is send-time optimization. Klaviyo’s STO model picks the per-subscriber best send time inside a window you define. Use it on campaigns to engaged segments only. On disengaged segments the model has too little signal and the recommendations regress to a single bucket. STO on cold list segments adds nothing.

The monitoring stack we install

Two dashboards plus one alert.

Google’s Postmaster Tools gives you the actual inbox-placement, spam-rate, and reputation reading at Gmail. Set it up once, verify the sending domain with a TXT record, and the dashboard populates inside seventy-two hours. The single most underused free tool in email marketing and the only authoritative signal you have on what Gmail thinks of your domain. Yahoo Sender Hub does the same on the Yahoo side, ten minutes to enable.

The second dashboard is Klaviyo’s Deliverability Hub, which surfaces per-campaign placement, bounce rate, and complaint rate at the account level. Combined with Postmaster Tools you have both an external (provider-side) and an internal (Klaviyo-side) read.

The alert is the part most accounts skip. Wire a Klaviyo webhook to Slack on any campaign where the open rate falls below 60 percent of the trailing-thirty-day average. That single alert catches reputation drift in the first or second send instead of the third month. Carlos didn’t have it. If he had, we’d have caught the slide at week three, not week sixteen.

What we keep telling clients

The reflex when deliverability breaks is to migrate the sending domain or switch ESPs. Both are expensive, slow, and usually unnecessary. Reputation is repairable on roughly a thirty-day timeline if you stop fighting the algorithm and run the reset cleanly. Migration is the last resort, not the first.

The brands we work with that have the cleanest deliverability are not the ones with the prettiest emails. They are the ones running the strictest list hygiene. Validate at the form, suppress aggressively, sunset on a fourteen-day cycle, send to your engaged tier first, expand only when the open rate holds. Boring. And it just works.

So when the founder calls and the agency is recommending a sender-domain migration, the first question to ask is what the suppression hygiene looked like for the prior ninety days. Nine times out of ten the answer is “we don’t have a sunset flow” and the migration would have rebuilt the same problem on the new domain inside six months.

Carlos kept his sending domain. We ran the thirty-day reset, set up Postmaster Tools and the open-rate alert, switched DMARC from “p=none” to “p=quarantine” at twenty-five percent and ramped it to “p=reject” over five weeks, and shipped a sunset flow on a fourteen-day cadence. The deliverability score rebuilt to 89 inside the reset and is sitting at 91 four months later. Black Friday opened at 31 percent on the full list, three points above his trailing-year average.

He wrote zero new copy.

Questions we get every week

How do I know if I have a deliverability problem or just a campaign-level open-rate problem? Compare the open rate of the affected campaign to the open rate of your transactional emails (order confirmations) from the same week. If transactional is also down, you have a deliverability problem. If transactional is fine and marketing campaigns are tanking, the issue is segmentation or content, not reputation. Postmaster Tools will confirm the deliverability read inside three to seven days.

Is it worth migrating to a dedicated IP? Almost never for brands under $5M ARR. Klaviyo’s shared IP pool is well-warmed and well-managed. A dedicated IP requires you to warm it from scratch, which means six to eight weeks of constrained sending, and a small brand doesn’t send enough volume to maintain a dedicated IP’s reputation anyway. Above $10M ARR the math starts to make sense.

Should I run my marketing email and transactional email through the same sending domain? No. Send transactional from a separate subdomain (receipts.brand.com or notifications.brand.com) so that marketing-list reputation damage doesn’t bleed into order confirmations. Shopify can route transactional through its own infrastructure if you prefer.

How long after the reset can I run a real promotional push? Two weeks past day thirty, minimum. Run a single mid-size campaign in week six to a 60-day engaged segment, watch Postmaster Tools, and only then plan the full-list promotional push. The reputation gain from the reset is real but new and the algorithm is still calibrating.

Want help running the 30-day reset and getting Postmaster Tools, DMARC, and your sunset flow live before your next major campaign? Talk to us at monkeyman.agency/contact and we’ll spend two weeks pulling your sender setup apart, then hand you a monitoring dashboard you can defend at the next board meeting.