6 Ways to Reduce Your Email Bounce Rate (and Keep Hitting the Inbox)

Say your app has 4,000 signups and 100 of the addresses are bad: a few typos, a test account you forgot to delete, some bots that slipped past the form. That's still 97.5% real users. Sounds fine, right?

Mailbox providers see it differently. Amazon's deliverability guidance puts it bluntly: "When email receivers detect a high rate of hard bounces, they assume that you don't know your recipients well."[1] Bounces are how spammers look, because spammers guess addresses. A bouncy list pattern-matches you with them.

And here's the part most builders miss: the reputation absorbing that damage usually isn't your email tool's. It's your domain's. The same domain your team, your support inbox, and your password resets send from.

The fix comes down to six moves: run addresses through an email verification service, add a confirmation email flow to your app, offer social login, add a CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) to your signup form, send from a dedicated subdomain, and warm up your sending in small batches. First, a quick look at what actually counts against you.

What is a hard bounce?

A hard bounce is a permanent delivery failure: the address doesn't exist, the domain has no mail server, or the mailbox was deleted. Soft bounces are temporary problems, like a full mailbox or a server timeout, and they usually resolve on their own.

Hard bounces are the ones that count against you. Amazon SES (Simple Email Service) excludes soft bounces from its enforcement calculation entirely, and its advice for hard bounces is unambiguous: remove the address from your list immediately.[1][2]

Dreamlit handles that second part for you. Once an address hard bounces, it's automatically suppressed from future sends. But suppression only stops the second bounce. The first one already hit your record, which is why the rest of this guide is about never sending to bad addresses at all.

What bounce rate is acceptable in 2026?

Keep hard bounces under 2%. That's the long-standing convention for a healthy list. Enforcement kicks in well above it, and by then you're already in trouble:

Gmail and Yahoo don't publish a bounce threshold. Their hard lines are spam-complaint rates, but bounces feed the same domain reputation score, and Yahoo explicitly tells senders to remove invalid recipients promptly.[6]

One more thing these numbers hide: percentages get twitchy at low volume. If you send 150 emails and 4 bounce, you're at 2.7% off nearly nothing. Small senders should think in absolute bad addresses, not just the rate.

Why bounces put your whole domain at risk

Mailbox providers build reputation around your authenticated sending domain. Gmail's Postmaster Tools scores domain reputation on a four-tier scale from Bad to High, and mail from a low-reputation domain "is likely to be marked as spam."[7]

If you send product email from your root domain, that score is carrying everything: founder outreach, support replies, password resets, receipts, and your marketing blasts. All of it rides on your email program's worst day.

Reputation architecture

What a bounce spike hits: root domain vs. subdomain

Root domain vs. subdomain sending

Setup	What a bounce spike affects
Sending from the root domain (yourapp.com)	Everything: founder and team email, support replies, password resets, receipts, and marketing
Sending from a dedicated subdomain (mail.yourapp.com)	Only the subdomain's product and marketing email; the root domain's reputation is unaffected

M3AAWG (Messaging, Malware and Mobile Anti-Abuse Working Group), the industry body where mailbox providers and large senders set best practices, recommends assigning "a separate subdomain of the main domain name for each distinct sending purpose," keeping the main domain for the mail your business runs on.[8] Postmark describes subdomains as branches of a tree: the root controls their fate, but each one builds strength separately.[9]

The reason to care is that damage is asymmetric. A reputation drop takes minutes to earn, and Gmail's only published recovery commitment is that senders become eligible for mitigation after spam rates stay clean for 7 consecutive days.[10] Even then, "it can take some time for Gmail to adjust."[11] Nobody publishes a timeline for full recovery, which tells you something.

So before anything else: set up something like mail.yourapp.com for product and marketing email. The DNS setup is the same amount of work either way, and Dreamlit will verify a subdomain exactly like a root domain. It's a five-minute decision that caps your worst-case outcome.

Where do bad addresses come from?

Almost nobody sets out to build a dirty list. It builds itself, one unverified signup at a time. When ZeroBounce processed over 11 billion addresses in 2025, only 62% came back valid.[12]

List quality

Only 62% of 11 billion checked addresses were valid

• Valid
• Catch-all
• Invalid
• Abuse, do-not-mail & unknown

Email verification results across 11 billion addresses, ZeroBounce 2025

Result	Share of addresses
Valid	62%
Catch-all (can't be confirmed)	9%
Invalid (would hard bounce)	23%
Abuse, do-not-mail, and unknown	6%

For a typical app signup form, the bad addresses arrive four ways:

• Typos. gamil.com, hotmail.con, yaho.com. Real users, wrong address, guaranteed hard bounce. When the startup Kicksend added a did-you-mean suggestion to its signup form, confirmation-email bounces dropped 50%. That experiment became mailcheck.js, which is still a drop-in fix today.[13]
• Disposable domains. Addresses from mailinator.com, guerrillamail.com, or temp-mail.org work for about ten minutes, then everything you send bounces. People use them to grab a free trial without hearing from you again.
• Bots. Automated traffic passed human traffic on the web in 2024, with bad bots alone at 37%, and fake account creation is one of their top jobs.[14] Bots don't bother inventing deliverable addresses.
• Your own test accounts. The [email protected] you typed during a late-night debugging session is still in the users table, and it will bounce every campaign you ever send.

None of these people will ever open an email. Every one of them still counts against your bounce rate.

How to stop bad addresses at signup

Now for the good stuff. The cheapest bounce is the one that never gets a row in your database, and four of the six fixes live right on your signup form. In rough order of impact:

1. Run addresses through an email verification service. Kickbox, NeverBounce, and ZeroBounce all answer the same questions about an address: does the domain exist, does the mailbox exist, is it a known disposable provider. Call the API from your signup form to catch bad addresses in real time, or run a one-time check over addresses you've already collected. Pricing runs roughly $4 to $10 per 1,000 checks, free tiers cover a pre-launch product, and blocking disposable domains comes built in, so you don't maintain the blocklist yourself.

2. Add a confirmation email flow to your app. Yahoo's sender guidance recommends confirmed opt-in outright: ask new signups to click a link, then flip a verified flag on your users table.[6] In Dreamlit this is one plain-English prompt to the Workflow Agent: "When a user signs up, send a confirmation email. When they click the button, mark their row as verified." An unclicked confirmation costs you one bounce. An unverified list emailed for a year costs you the domain.

3. Offer social login. A Google OAuth (Open Authorization) button hands you a real, pre-verified address. Across Auth0's platform, Google accounts for about 75% of all social logins, so one provider covers most of the value.[15]

4. Add a CAPTCHA. Cloudflare Turnstile and Google reCAPTCHA are free. When Cloudflare put invisible Turnstile on its own signup page, it blocked over a million automated signups with zero reported false positives and no drop in conversions.[16]

Then make the flag do the work: point your marketing and lifecycle workflows at verified users only. Since Dreamlit workflows read your database directly, that's a filter on the trigger, in plain English, not a list you export and scrub.

How to rescue a list you already have

Maybe you're reading this with 4,000 signups already sitting in your users table, collected before verification was turned on. You want to send a broadcast, and you have no idea how many of those addresses are real. Don't send to all of them and find out from the bounce report.

Here's the order of operations:

1. Bulk-verify the whole list. The same verification services take a CSV (comma-separated values) export. For a few dollars per thousand addresses, you'll get back valid, invalid, disposable, and catch-all buckets.
2. Discard all unverified addresses. Drop invalid and disposable addresses entirely. Treat catch-all addresses as a maybe pile: their servers accept everything, so they can't be confirmed without sending.
3. Move to your subdomain. If you're going to build reputation from scratch anyway, build it on mail.yourapp.com where a mistake stays contained.
4. Warm up in batches. Start with a few hundred sends to your most engaged users, the people who logged in recently. Check the results. Then double.

Domain warm-up

Release a small batch. Check. Then double.

Example warm-up batch schedule

Batch	Sends
Batch 1 (most engaged users)	250
Batch 2	500
Batch 3	1,000
Batch 4	2,000
Batch 5	4,000

The batch sizes matter less than the checkpoints. Postmark's warm-up rule is the one to tape to your monitor: "Never increase your volume until you've looked at your messages' performance."[9] Google warns that suddenly doubling your previous volume "could result in rate limiting or reputation drops."[5] Clean batch? Double it. Bounces or spam complaints? Stop, figure out which segment caused it, and clean again before the next release.

This is exactly what sandboxed workflows in Dreamlit are for. Publish your workflow sandboxed and emails queue up instead of sending. From the Analytics page you release a batch manually, watch its bounces and opens in the same view, and release the next one when the numbers earn it. No cron math, no exported segments, no guessing.

Expect the full ramp to take weeks, not days. Postmark estimates 3 to 6 weeks to dependable full-volume deliverability, and M3AAWG suggests planning for about 6.[8][9] A new subdomain starts with no history, and to a spam filter, unknown reads a lot like bad.

How to keep your list clean going forward

A clean list doesn't stay clean. People change jobs and abandon inboxes; ZeroBounce's year-over-year data puts list decay at 22% to 28% annually.[12] Three habits keep you ahead of it:

• Make unsubscribing effortless. One-click unsubscribe is a Gmail and Yahoo requirement for bulk senders, honored within two days.[5][6] Microsoft added its own authentication requirements for high-volume senders in May 2025, so the era of optional hygiene is over.[17]
• Sunset the unengaged. Yahoo is direct about this: sending to users who aren't reading "will harm your delivery metrics and reputation."[6] Gmail suggests unsubscribing recipients who don't open your messages.[5] M3AAWG's spam-trap guidance treats 12 months of inactivity as the outer limit, because abandoned addresses get recycled into traps.[18]
• Watch the scoreboard. Google Postmaster Tools is free and shows your actual domain reputation and spam rate. Dreamlit's analytics show bounces and opens per workflow, so a bad segment surfaces after one batch instead of one quarter.

The boring work is the growth work

Nobody starts an app excited about bounce management. But deliverability compounds quietly in both directions: every verified signup makes your next send safer, and every ignored bounce makes it riskier. The builders who treat their sender reputation like uptime get to actually reach the users they worked so hard to sign up.

If you'd rather not assemble the pieces yourself, Dreamlit gives you the workflow layer on top of your own database: confirmation flows in plain English, sandboxed batch releases, automatic bounce suppression, and per-workflow deliverability analytics. It's free to get started and takes about a minute to connect.

---

References

1. Amazon SES: Metrics for success
2. Amazon SES: Reputation metrics messages
3. Postmark: Servers FAQ
4. Twilio SendGrid: Bounce and block classifications
5. Google: Email sender guidelines
6. Yahoo: Sender best practices
7. Google Postmaster Tools: Reputation dashboards
8. M3AAWG: Sending Domains Best Common Practices
9. Postmark: How to warm up a domain
10. Google: Email sender guidelines FAQ
11. Google: Top 10 Gmail sender issues
12. ZeroBounce: Email List Decay Report
13. Kicksend: How we decreased sign-up confirmation email bounces by 50%
14. Imperva: 2025 Bad Bot Report
15. Okta/Auth0: Going deep with social login
16. Cloudflare: Turnstile general availability
17. Microsoft: Outlook.com requirements for high-volume senders
18. M3AAWG: Help! I Hit a Spam Trap!

Last validated: August 12, 2026. Provider thresholds and requirements change; check the linked primary sources before relying on a specific number.

---

Frequently asked questions

What is a good email bounce rate?

Keep hard bounces under 2%. Enforcement starts higher: Amazon SES reviews accounts at 5% and can pause them at 10%, Postmark requires under 10%, and Dreamlit asks senders to stay under 4%. Treat 2% as the health line, not the limit.

What's the difference between a hard bounce and a soft bounce?

A hard bounce is a permanent failure: the address or domain doesn't exist. A soft bounce is temporary, like a full mailbox or a server timeout. Hard bounces are the ones that damage sender reputation, and Amazon SES excludes soft bounces from its enforcement math entirely.

Do email bounces hurt my domain reputation?

Yes. Mailbox providers score the reputation of your authenticated sending domain, and a high hard-bounce rate signals a low-quality or guessed list. Gmail's Postmaster Tools rates domain reputation from Bad to High, and a damaged rating affects everything sent from that domain.

Should I send marketing email from my root domain?

No. M3AAWG, the industry body for mailbox providers and senders, recommends a dedicated subdomain for each sending purpose, such as mail.yourapp.com for product and marketing email. That way a bad sending day can't drag down the domain your team's regular email depends on.

How do I safely email a list of users who never verified their addresses?

Run the list through a verification service first and remove invalid, disposable, and catch-all addresses. Then send in small batches starting with your most engaged users, check bounce and open rates after each batch, and only increase volume when the numbers come back clean.

How long does it take to warm up a sending domain?

Postmark estimates 3 to 6 weeks to an established reputation at full volume, and M3AAWG suggests planning for about 6 weeks. Starting small, targeting engaged users first, and increasing volume gradually shortens the risky period.

Does Dreamlit stop me from re-emailing bounced addresses?

Yes. When an address hard bounces, Dreamlit automatically suppresses it across future sends, so one bad address can't keep hurting your reputation. You still want to stop bad addresses at signup, since every first bounce still counts against you.