The email deliverability checklist for cold outreach, ranked

Most teams debugging a cold campaign that lands in spam start at the wrong layer. They rewrite the subject line, cut the copy in half, remove the link, and swap the tracking pixel. Meanwhile the real problem is a DKIM signature made by a vendor’s domain instead of yours, or a bounce rate that crept from 1% to 6% after a list purchase three weeks earlier. Email deliverability is a stack, and the layers have a strict order. A broken layer near the bottom hides every fix above it, so no amount of good copy will show an improvement until the foundation holds.

This checklist is ranked by that order. Each section covers one layer, the mechanism behind it, and the thresholds worth watching. Build it bottom-up, and diagnose it bottom-up too.

Why the order matters for email deliverability

Receiving servers make decisions in a sequence that roughly follows the layers. First they ask whether the message is authenticated and whether the sending domain has a history worth trusting. Then they look at the sending infrastructure and how recipients have behaved toward it. Only after that does content matter, and even then mostly as a secondary signal. Gmail, Microsoft and Yahoo have all published requirements for bulk senders that start with authentication, which tells you where they think the baseline is.

Content gets blamed first because it is the only layer you can see on screen. Infrastructure stays invisible until it breaks, and list quality shows up as a bounce report most people never open. That combination is the trap. A team with a 4% hard bounce rate and a DMARC setup that fails for half its mail will spend a month arguing about subject lines.

Layer 1: authentication is a gate, not a boost

Three DNS records do the work, and each answers a different question. If you want the record-by-record basics first, the SPF, DKIM and DMARC explainer covers them.

SPF tells receivers which servers may send mail for a domain. It is checked against the envelope sender, the Return-Path or MAIL FROM domain, which is usually not the address your recipient sees. SPF also has a hard limit of ten DNS lookups per evaluation under RFC 7208. Every include: in your record costs at least one lookup, and each included record can pull in more. Teams that stack a sending tool, a CRM and a helpdesk regularly blow past ten. When that happens, the check returns a permanent error and SPF fails for everything. Flattening the record, which means replacing includes with the IP addresses they resolve to, fixes the count, but you then have to repeat the work whenever a provider changes its IPs.

DKIM attaches a cryptographic signature to each message. The signing domain sits in the d= tag, and the public key is published under a selector, something like s1._domainkey.yourdomain.com. Use 2048-bit RSA keys. Plenty of older setups still run 1024-bit keys, which will often work but are weaker, and some providers have begun pushing senders toward the larger size.

DMARC is the record that matters most, because it is the one that ties the other two to what the recipient sees. It publishes a policy (p=none, p=quarantine or p=reject) and tells receivers what to do when mail fails. The rule is subtle. A message passes DMARC only when SPF or DKIM passes and aligns with the visible From domain. Alignment means the domain that passed is the same organizational domain as the one in the From header. A pass without alignment counts as a fail.

That distinction is where cold email setups quietly break. Consider the common version. A team sends through a sequencing tool. The tool signs DKIM with its own domain, d=sendtool.io, and its return path lives on sendtool.io too. SPF passes. DKIM passes. The From line reads you@yourcompany.com. DMARC fails, because neither passing domain aligns with yourcompany.com. Half of the team’s mail can fail this way for months, and nobody notices, because the sending tool’s dashboard says “authenticated” and it is technically telling the truth.

The fix is to configure a custom return path and a DKIM signing domain that you control, so both align with your From domain. Most sending platforms support this, and it usually means adding a handful of CNAME records. It is the single highest-leverage change in this checklist, and it costs an afternoon.

Once alignment holds, start your DMARC policy at p=none and read the aggregate reports for two to four weeks. Those XML reports arrive at the address in your rua= tag and list every server that sent mail claiming your domain, plus whether each one passed. You will usually find a forgotten marketing tool, an old helpdesk, or the payroll system sending mail as you. Fix those sources, then move to quarantine, and eventually to reject.

Layer 2: sending setup and volume

Once authentication is clean, the next question is how much trust your sending infrastructure has earned. Trust is measured per domain and per IP address, and every send draws it down a little.

Keep cold sending separate from company mail. Outreach generates more bounces and complaints than your billing emails, and a bad week on a shared domain can throttle the mail your customers depend on. A dedicated sending domain, or a subdomain with its own reputation, keeps that risk contained. If one campaign goes wrong, the damage stays in a box you can afford to lose.

Volume per mailbox matters because providers rate-limit by sender history. A brand-new mailbox that sends 200 messages on day one looks like a spam machine, and it gets treated like one. Warmup exists to build a record of normal, engaged sending before real campaigns start. It is not a score you can buy and forget. It is a way of making the first two weeks look like a person who sends mail to people who answer it.

Google’s formal bulk-sender requirements apply to senders who deliver more than 5,000 messages a day to Gmail addresses. Below that line the same principles hold, but nobody is checking your paperwork. Above it, the requirements are explicit: authentication, a low complaint rate, and one-click unsubscribe for marketing mail. Treat 5,000 a day as the point where you are held to the written rules, not the point where you start caring about them.

Spread sends across the day as well. Mailbox providers notice when every message from a sender lands at 9:00 a.m. sharp, and a steady, human-looking pattern tends to hold up better under scrutiny than a burst. Modest, consistent volume from several well-maintained mailboxes almost always beats one mailbox pushing the same total.

Layer 3: list quality, where most damage happens

If you want to know where most cold campaigns lose their reputation, look at the list. Bounces and spam traps do more quiet damage than anything in the copy, and they are the layer teams are least likely to inspect.

A hard bounce means the address doesn’t exist, or the domain can’t accept mail at all. The receiving server returns a permanent failure, often 550 5.1.1 for “user unknown.” Hard bounces are a direct sign that your list is stale or partly invented. Providers track the proportion of invalid addresses in a sender’s traffic, and a high proportion looks like one of two things: someone who guessed addresses without checking them, or someone who harvested them. Most experienced senders keep hard bounces under about 2% of sends. Above 5%, stop and find the cause before sending another batch.

Spam traps are worse, because you can’t see them coming. Pristine traps are addresses that no person ever used, planted on the web to catch scrapers. Recycled traps are old addresses that were abandoned and later reactivated by a provider, so they still accept mail and still count. Hitting either one tells the receiver that your list was collected without consent or hasn’t been maintained. You can’t fully avoid traps if you buy or scrape your lists, which is the practical argument for building targeted lists from sources you can explain.

Role accounts such as info@, sales@ and support@ are a smaller problem. They rarely reply, they are often watched by spam filters, and they get passed around a company until nobody owns them. Keep them out of personal sequences.

Catch-all domains accept mail for any local part, which means a verifier cannot tell a real mailbox from an invented one. Treat those addresses as their own tier with its own sending limits. The guide to finding and verifying addresses goes deeper on that, and the rule is simple: never let an unverified catch-all address share a batch with your best-verified contacts.

Layer 4: content and links that don’t look like a campaign

Content is the layer people overrate, and the reason is that spam-word lists have made it feel scientific. Individual words rarely sink a message on their own. The patterns around the words matter more: several links, heavy images, a tracking domain shared with thousands of other senders, or a message that is nothing but a button.

Plain text usually wins. A short message with one question and no tracking link gives a filter very little to classify, and it reads like a note from a person. If you use open tracking, remember that the tracking domain is shared infrastructure. Some senders route their pixels through domains other senders have abused, and those domains get blocklisted with them. Use your own tracking subdomain, or turn opens off. Given how unreliable opens have become, turning them off is the more honest choice for many teams anyway.

Links are a sharper issue. Each link adds a domain for the filter to classify. One link to your own website is ordinary. A shortener, a calendar link and a case-study PDF are three domains the receiver has never associated with you. Keep it to one link, and make sure that link’s domain matches the identity of your sending domain.

Unsubscribe mechanics matter more than most teams realize. For commercial email to US recipients, CAN-SPAM requires a working opt-out in the message. Separately, a List-Unsubscribe header with one-click support, defined in RFC 8058 and signaled with List-Unsubscribe-Post: List-Unsubscribe=One-Click, lets Gmail and Yahoo show a native unsubscribe button next to the sender name. A recipient who can leave in one tap is far less likely to press “report spam” instead. That matters because complaints, not unsubscribes, do the real damage. An unsubscribe is a clean outcome. A complaint is a reputation hit.

Layer 5: complaints and engagement

A spam complaint is a recipient pressing “report spam.” It is the most expensive signal you can generate, because one complaint costs more reputation than dozens of ignored emails. Complaint rate is complaints divided by delivered messages, and it is the number Google, Yahoo and Microsoft each publish guidance around.

Google asks senders to keep the spam rate below 0.1% and never let it reach 0.3%. Yahoo and Microsoft have set similar targets for high-volume senders. These are ceilings on the sender as a whole, not on individual campaigns, which means one aggressive sequence can damage a sending domain for weeks after it stops.

The fix for complaints is rarely more copy polish. It is narrower targeting, a clearer reason this particular person is hearing from you, and a visible way out. Complaint spikes usually trace to one segment, most often the broadest one, drawn from a list source with weak targeting. Split campaigns by segment and by list source so you can see where the complaints come from. If you can’t see it, you can’t fix it.

A worked example: the campaign that looked fine

Here is a composite of a pattern that shows up often. A team sends about 12,000 cold emails in a week from three mailboxes on one domain. Opens look healthy at around 45%, which sounds reassuring until you remember that Apple Mail’s privacy feature inflates open counts. Replies are weak, at about 0.6% of delivered mail. The team assumes the copy is the problem and starts rewriting.

Postmaster Tools tells a different story. On Monday, the spam rate for the domain reads 0.22%, and the domain reputation has slipped from “High” to “Medium.” The DMARC reports show a new source: a CRM’s bulk-send feature signing with its own domain, and failing alignment on roughly a third of the mail going to Gmail. The copy was never the main issue. The authentication failure was making a sizable share of mail look suspicious, and the broad segment was generating the complaints on top of it.

The fix took three steps. The team aligned the CRM’s signing domain, paused the broadest segment, and rebuilt the list from narrower sources. Within about two weeks, the complaint rate fell back under 0.1%, and reply rates recovered, with nothing about the copy changing. Notice the sequence: the diagnosis came from infrastructure data, and the copy was the last thing anyone touched.

Watch the three dashboards every week

You can’t manage what you can’t see, and three free sources cover most of what matters.

Google Postmaster Tools reports the reputation of your domain and IPs as Gmail sees them, along with the spam rate and authentication success. You verify your domain with a DNS record. Data appears only when you send enough Gmail volume, so low-volume senders will see gaps and should not read them as zeros.

Microsoft SNDS, the Smart Network Data Services portal, gives IP-level data for mail reaching Outlook and Hotmail, including complaint trends. You need to own the sending IPs to use it, which is one reason a dedicated sending setup pays off.

DMARC aggregate reports show every source sending on behalf of your domain and whether each one passed. Parsing the XML by hand is miserable, so use a report viewer. The two things to watch are a new source you don’t recognize and a drop in the pass rate.

Check all three weekly, in the same order each time. A ten-minute review catches most problems while they are still cheap to fix.

When placement drops: a diagnostic order

When inbox placement falls, resist the urge to change everything at once. Work the stack from the bottom, and make one change at a time so you can tell what worked.

1. Authentication. Check DMARC reports for a new failing source. A single new tool sending without alignment can explain a week of decline.
2. Domain and IP reputation. Look at Postmaster Tools and SNDS. A fall to “Low” means the cause sits upstream of your copy.
3. Bounces. Compare the hard bounce rate for the last seven days with the period before. A sudden jump usually traces to one list batch.
4. Complaints. Segment the complaint rate by campaign and by list source.
5. Content and volume. Only now look at copy, link count and any recent change in send volume.

This order feels slow, and that is the point. Teams that start with copy often spend a month polishing a message that was never reaching the inbox in the first place.

A checklist cannot promise placement. Mailbox providers adjust their filters without announcement, and a seed test of a few hundred inboxes gives you a noisy picture. What the checklist does is remove the failure modes that cost the most, in an order that makes each fix visible in the data. That is most of the job.

OutboundLeadPro handles the bottom of this stack for you, with DNS auto-fix for SPF, DKIM and DMARC and mailboxes that run warmup, so the lowest layers don’t depend on someone remembering to check them each quarter. The parts that stay yours are the list and the offer, and those are where most of the remaining gains live. You can see how the DNS and warmup side works, or start running outreach from your browser at OutboundLeadPro.

Keep reading

Playbook

Cold Email A/B Testing: Why Most Tests Prove Nothing

Cold email A/B testing is often too small to mean anything. Here is the sample-size math at real reply rates, and how to read the results.

Daniel Khoury September 19, 20263 min read

Playbook

How to avoid spam folder placement: 12 causes and fixes

Want to avoid spam folder placement? These 12 causes, from authentication to list quality to complaints, each come with a concrete fix you can check.

Daniel Khoury September 24, 20263 min read

Playbook

How to build a lead list that stays clean after the first send

Build a lead list around a real ICP, with stage gates that reject bad rows before they cause bounces and complaints. Includes a worked example.

Daniel Khoury October 7, 20263 min read

Explainer

SPF, DKIM and DMARC explained for cold email

The three email authentication records decide whether you reach the inbox — and most cold outreach fails because one is missing or wrong. Here's each one in plain English.

The OutboundLeadPro Team October 11, 20262 min read