Email Deliverability Checklist: 25 Checks Before You Send 2026

This email deliverability checklist covers the 25 checks to run before a cold email campaign goes out: SPF, DKIM, and DMARC records, domain age and warmup, per-inbox send limits, list verification, copy and link checks, tracking settings, and the metrics that tell you when to stop sending.

Most deliverability checklists are written for newsletters sent to opted-in subscribers. Cold outbound has no opt-in, no brand recognition, and a thinner margin for error, so this list adds the checks those guides skip: secondary domains, inbox send caps that include follow-ups, catch-all handling, custom tracking domains, and stop rules for live campaigns.

TL;DR

• Run checks 1 to 10 once per domain or inbox, checks 11 to 24 before every campaign, and check 25 every week while a campaign is live.
• Authentication: SPF, DKIM, and an aligned DMARC record on every sending domain. Outlook.com rejects non-compliant mail from senders above 5,000 a day with 550 5.7.515.
• Infrastructure: secondary domains only, 2 to 4 weeks of warmup, and 30 to 50 emails per inbox per day, follow-ups included.
• List quality: verify every address within 30 days of sending, handle catch-all and role addresses separately, and keep hard bounces under 2%.
• Copy and tracking: plain text, zero or one link, open tracking off on the first touch, and a custom tracking domain if you track clicks.
• Monitoring: Gmail spam rate under 0.1% (never 0.3%), Yahoo under 0.3%, and auto-pause rules for bounce and complaint spikes.

Why Cold Email Needs Its Own Checklist

Cold email deliverability is mostly decided before you hit send. Once a campaign goes out from an unwarmed domain to an unverified list, the damage to your email sender reputation lands within hours and takes weeks to undo.

Marketing checklists assume consent, engagement history, double opt-in, and sunset policies for inactive subscribers. Cold outbound runs on different inputs:

• No opt-in. Complaint rates climb fast when targeting is loose, because nobody asked to hear from you.
• Bought or built lists. Contacts come from databases and enrichment, so bounce risk is higher than on a signup form.
• Many inboxes and domains. Volume is spread across dozens of mailboxes, so one misconfigured domain can hide inside an otherwise healthy setup.
• Follow-ups multiply volume. A four-step sequence sends up to four emails per prospect, which is easy to forget when you set daily caps.

Every check below has a pass condition you can verify in a few minutes. If a check fails, fix it before launch rather than after the first bounce report.

What Gmail, Yahoo, and Outlook Require in 2026

Gmail, Yahoo, and Outlook.com all publish sender requirements, and the checklist is built to clear all three. The thresholds below come from Google's email sender guidelines, Yahoo's sender best practices, and Microsoft's Outlook requirements for high-volume senders.

Most cold email teams send far below 5,000 a day to any one provider. Treat these rules as the floor anyway. Filters judge smaller senders on the same signals, and every requirement on the list is cheap to meet.

The Email Deliverability Checklist at a Glance

Here is the full email deliverability checklist in one table. The "When" column tells you which checks are one-time setup and which repeat before every campaign.

DNS Authentication (Checks 1 to 5)

Authentication proves your mail really came from your domain. Without it, Gmail can reject messages with 550 5.7.26 and Outlook.com with 550 5.7.515, no matter how good the copy is. Run these five checks once per sending domain, and again whenever you change providers or add a new tool that sends on your behalf.

Check 1: SPF Record

Pass condition: the domain has exactly one SPF TXT record that includes every service sending as that domain and needs no more than 10 DNS lookups.

Two SPF records on one domain is a common failure, usually left behind when a team switches mail hosts. Receivers treat it as an error. The 10-lookup ceiling comes from RFC 7208, and each include: can pull in more lookups of its own. End the record with ~all or -all, never +all.

Check 2: DKIM Signing

Pass condition: DKIM signing is switched on in your mail host, the public key is published in DNS, and a test message shows dkim=pass for your own domain.

Publishing the DNS record is only half the job. In Google Workspace you also have to click "Start authentication" in the admin console, and teams often miss it. Use a 2048-bit key where your provider supports it. Our Gmail DKIM setup guide walks through the Workspace steps.

Check 3: DMARC Record

Pass condition: a TXT record at _dmarc.yourdomain.com with at least p=none, a passing and aligned SPF or DKIM result, and an rua address that receives aggregate reports.

Alignment means the domain in your From address matches the domain that passed SPF or DKIM. A DKIM signature from your sequencer's domain passes DKIM but fails alignment. Start at p=none, read the reports for two weeks, then move to quarantine once every legitimate source passes.

Check 4: MX Records

Pass condition: the sending domain has MX records pointing to a working mailbox host, so replies, out-of-office messages, and bounce notices arrive.

A domain that sends but cannot receive looks like a throwaway sending domain, and it also means you miss replies, which are the whole point of cold email. If you set up a domain through a reseller, send a test email to it from a personal account and confirm it lands.

Check 5: Reverse DNS and TLS

Pass condition: every sending IP has a PTR record that resolves back to a hostname, that hostname resolves forward to the same IP, and mail is sent over TLS.

Google lists valid forward and reverse DNS and TLS as requirements for all senders. Google Workspace and Microsoft 365 handle both for you. Check this only if you send through your own mail server, a dedicated IP, or a cheap SMTP reseller, which is where missing PTR records usually show up.

Domain Setup, Age, and Warmup (Checks 6 to 10)

These checks protect the asset that carries your reputation: the sending domain. Most are one-time setup per domain or inbox, except the blocklist check, which you repeat before every campaign.

Check 6: Secondary Sending Domains

Pass condition: no cold email is sent from your primary company domain. Every cold inbox lives on a secondary domain, such as getacme.com or tryacme.com.

Domain reputation follows the domain everywhere. If a cold campaign burns a secondary domain, you retire it. If it burns your primary domain, invoices, support replies, and password resets start landing in spam too. Pick close variants of your brand on a .com where you can, and avoid long hyphenated names. Our guide to the best domain registrars for cold email covers where to buy them in bulk.

Check 7: Domain Age and Redirect

Pass condition: the domain was registered well before launch, ideally when you started warmup, and it redirects to your main website.

A domain registered yesterday has no history, and spam filters treat unknown domains with more suspicion than ones with a track record. Since warmup takes 2 to 4 weeks anyway, buying domains at the start of warmup covers domain age for free. Set a 301 redirect to your real site so any prospect who checks the domain sees a real company.

Check 8: Blocklist Status

Pass condition: your sending domain, any link or tracking domain, and any IP you control are clean on Spamhaus, Barracuda, URIBL, and SURBL.

Look up domains and IPs on the Spamhaus reputation checker before each campaign, plus any domain you plan to link to. Ignore SORBS results from older lookup tools: Proofpoint shut SORBS down in June 2024. If you find a listing, follow our IP blacklist removal guide before you send anything.

Check 9: Inbox Warmup

Pass condition: every inbox has completed 2 to 4 weeks of warmup before it sends real cold email.

New inboxes start at around 5 to 10 emails a day and add a few each day until they reach their target. Skipping warmup is the single fastest way to put a new domain in spam. Many teams keep warmup running at low volume after launch to keep positive engagement flowing. See the email domain warmup guide and the day-by-day email warmup schedule for the full ramp.

Check 10: Sender Identity

Pass condition: each inbox uses a real person's first and last name, the display name matches the signature, and the signature is plain text.

Generic senders like "Sales Team" read as bulk mail to people and filters. Add a profile photo to the account so Gmail shows a face next to the message, and keep the signature to name, title, company, and website. Image logos and social icons add remote content and links you do not need.

Inbox Limits and Sending Patterns (Checks 11 and 12)

Volume problems are the easiest deliverability failures to prevent and the hardest to notice, because each inbox looks fine until the domain as a whole tips over.

Check 11: Daily Send Cap

Pass condition: no inbox sends more than 30 to 50 emails a day, and that number includes follow-ups.

Follow-ups are where caps break. A campaign that adds 40 new prospects a day per inbox with a four-step sequence ends up sending far more than 40 emails a day by week two. Set the cap in your sequencer as total sends per inbox, not new contacts.

Scale by adding inboxes, with 2 to 3 inboxes per secondary domain. Sending 1,000 emails a day takes roughly 25 warmed inboxes across 9 domains. Our roundup of the best email hosting for cold email compares mailbox costs at that scale.

Check 12: Sending Schedule

Pass condition: sends go out during business hours in the recipient's time zone, with randomized gaps between messages, a gradual ramp after warmup, and sequences that stop on reply.

Hundreds of emails leaving at 9:00 a.m. sharp look automated, because they are. Spread sends across the day with gaps of a few minutes, and raise per-inbox volume in steps over the first weeks rather than jumping straight to the cap. Confirm that "stop on reply" and "stop on bounce" are switched on, so nobody who already answered gets a follow-up.

List Verification and Quality (Checks 13 to 17)

List quality decides your bounce rate and much of your complaint rate. Hard bounces and spam traps come from stale or unverified data, and complaints come from contacts who should never have been on the list. These five checks run before every campaign.

SyncGTM covers this part of the checklist. SyncGTM email verification runs each address through a multi-provider waterfall at 0.1 credits per email and flags invalid, catch-all, and risky results, and its enrichment fills in current titles and company data so you can filter to your ICP before the list reaches a sequencer. Credit costs for every action are on the pricing page.

Check 13: Fresh Verification

Pass condition: every address in the campaign was verified within the last 30 days, and the expected hard bounce rate is under 2%.

B2B data decays as people change jobs and companies change mail systems. A list that was clean last quarter can bounce well above 2% today, and a hard bounce spike is one of the fastest ways to damage a cold domain. Verify immediately before upload, not when the list was built. If you see unknown-user bounces anyway, our guide to the 550 permanent failure error explains each code.

Check 14: Catch-All Handling

Pass condition: catch-all (accept-all) addresses are split into their own segment and either sent at low volume from one inbox or dropped.

A catch-all server accepts mail for any address at the domain, so a standard SMTP check cannot confirm whether the person exists. Some of those addresses are real and some bounce later or vanish into an unread inbox. Never mix them into your main send. Send them in small batches, watch the bounce rate, and stop the segment if it climbs.

Check 15: Role and Disposable Addresses

Pass condition: role addresses such as info@, sales@, and support@ and any disposable-domain addresses are removed.

Role addresses go to shared inboxes or distribution lists, so one email reaches several people who never asked for it, and any of them can click "Report spam." They also rarely produce replies. Cold email works one person at a time, so find the named decision-maker instead.

Check 16: Suppression List

Pass condition: the list has been checked against everyone who unsubscribed or asked not to be contacted, every past hard bounce, current customers, open deals, and anyone already in another live sequence.

Opt-outs collected in one tool are often missing from the next, and emailing someone who already asked you to stop is how complaints turn into blocklist reports. Keep a single suppression list, including domain-level blocks for customers and competitors, and import it into every sequencer you use.

Check 17: Targeting and Enrichment

Pass condition: every contact matches your ICP on title, company size, and industry, and their title and company are current.

Relevance is the best complaint prevention there is. A VP of Sales who actually runs outbound might ignore you; a contact who left the company eight months ago or never fit your ICP is far more likely to hit "Report spam." Enrich before you send to confirm current job, company size, and tech stack, and cut anyone who does not fit.

Copy and Link Checks (Checks 18 to 21)

Content matters less than infrastructure and list quality, but it is the last thing a filter reads before deciding. These checks keep the message itself from adding risk. For the full list of content triggers, read how to avoid spam filters with cold email.

Check 18: Plain-Text Copy

Pass condition: the email is short plain text with no attachments, no images, and no designed HTML template.

A cold email should look like a note from one person to another. Images, banners, and heavy HTML make it look like marketing mail and push it toward the Promotions tab. Gmail also clips messages larger than about 102KB, which hides your opt-out line. Our guide on how to avoid the Gmail Promotions tab covers the formatting details.

Check 19: Links

Pass condition: the first email has zero or one link, no URL shorteners, and every linked domain is clean on URIBL and SURBL.

Filters score the domains inside your email body as well as the one in your From address. Public shorteners share their domain with every spammer who used them. Link to a domain you own, make sure the visible text matches the real destination, and save calendar links and case studies for the follow-up after someone replies.

Check 20: Merge Fields

Pass condition: you have previewed at least ten random rows and every variable renders correctly, with a fallback value for any field that can be empty.

An email that opens with "Hi {{first_name}}," or mentions "ACME HOLDINGS LLC" in all caps tells the reader it was automated, and it draws complaints. Check capitalization, empty company fields, and any spintax that can render nonsense. Clean the company names in your list before upload, not in the template.

Check 21: Opt-Out and Legal Basics

Pass condition: every email gives the recipient a clear way to opt out, opt-outs are honored quickly, and you meet the rules for every country you send to.

For one-to-one cold outreach, a plain line works: "Not the right person? Reply and I will not follow up." Bulk marketing mail to Gmail and Yahoo also needs a one-click List-Unsubscribe header. In the US, the FTC's CAN-SPAM compliance guide requires commercial email to include a valid physical postal address and to honor opt-out requests within 10 business days. Rules in the EU, UK, and Canada are stricter, so check with counsel before you send there.

Tracking Settings (Checks 22 and 23)

Tracking settings are easy to leave on by default and easy to forget. Both checks take a minute in your sequencer settings.

Check 22: Open Tracking

Pass condition: open tracking is off on the first email of every sequence, at minimum.

Open tracking inserts a remote image into every message, which makes a one-to-one email look more like marketing mail. Apple Mail Privacy Protection also preloads images, so open rates are inflated and tell you less than they used to. Measure replies and positive replies instead.

Check 23: Custom Tracking Domain

Pass condition: if open or click tracking stays on, every sending domain has its own tracking subdomain set up with a CNAME record in your sequencer.

Without one, every tracked link and pixel points to your tool's shared tracking host, so your emails carry the reputation of thousands of other senders. Read our custom tracking domain guide for the DNS setup in each major cold email tool.

Testing and Monitoring (Checks 24 and 25)

The last two checks confirm that everything above actually works. One runs before launch; the other runs for as long as the campaign is live.

Check 24: Pre-Send Test

Pass condition: your real email, sent from your real sending inbox, scores well under the SpamAssassin threshold of 5.0 and lands mostly in the primary inbox on a seed-list placement test.

Send the final copy to mail-tester to see which SpamAssassin rules fire and whether SPF, DKIM, and DMARC pass, and aim for a score of 2.0 or lower. Then run a seed test across Gmail, Outlook, and Yahoo mailboxes, because a good spam score does not guarantee inbox placement. Our email deliverability test guide compares the free tools, and the SpamAssassin score guide explains how to fix each rule.

Check 25: Live Monitoring and Stop Rules

Pass condition: Google Postmaster Tools is connected for every sending domain, someone reviews bounces, complaints, and replies every week, and your sequencer auto-pauses an inbox when bounces spike.

In Postmaster Tools, watch the compliance status and the user-reported spam rate. Google is retiring the old domain and IP reputation dashboards, so those are no longer the signals to rely on. Read your bounce codes too: a 5.1.1 is a bad address, while any 5.7.x code points at authentication or policy. The thresholds in the next section tell you when to stop.

When to Pause a Campaign

Pause the affected inbox or campaign as soon as any metric below crosses its line, then work back through the checklist to find the cause. Catching a problem in the first day costs a week of lower volume; ignoring it for a month can cost the domain.

If a domain stays in spam after you fix the cause, follow the recovery plan in our sender reputation guide: pause, fix authentication, re-verify the list, delist, and re-warm at a fraction of your old volume.

Conclusion

Cold email deliverability comes down to a short list of things you can verify before launch: authenticated domains, warmed secondary inboxes with sensible caps, a verified and well-targeted list, plain copy with few links, sensible tracking settings, and clear stop rules once the campaign is live.

Run checks 1 to 10 once per domain or inbox, checks 11 to 24 before every campaign, and check 25 every week. Most failures show up in the list-quality checks, which are also the fastest to fix.

Ready to clear checks 13 to 17? Try SyncGTM free and verify and enrich every contact before your next campaign goes out.