Cold email deliverability checklist: 30 checks, in the order to run them

The cold email deliverability checklist

Thirty checks in six groups, in the order to work through them. A failure early in the list makes everything after it unreliable, so do not skip ahead to copy.

Domains

1. Separate sending domains. Never send cold email from your main domain. Complaints are a cost of the channel, and they should land on a domain you can replace.
2. More than one domain. Spread mailboxes across several, so a problem on one does not stop the programme.
3. Close, properly registered names. Spelled close to your main domain so recipients recognise you, and registered through a normal registrar.
4. Time to warm, not just to configure. A new domain and mailbox need weeks before campaign volume. Plan the launch date around that.

Authentication

5. SPF on every sending domain. One SPF record per domain, listing every service that sends for it. Microsoft notes that more than 10 DNS lookups can make SPF fail.
6. DKIM signing on. Enabled in Google Workspace or Microsoft 365 for each domain, and in any sending tool that relays mail.
7. DMARC published. At least p=none, with a reporting address (rua) so you receive aggregate reports. Gmail, Yahoo and Outlook all require it for bulk senders.
8. From address aligned. The domain in the From header must match the SPF or DKIM domain. Check it for every tool that sends as you.
9. Forward and reverse DNS, and TLS. Gmail and Yahoo require valid DNS records for sending IPs, and Gmail requires TLS. Workspace and Microsoft 365 handle both; self-hosted sending does not.
10. Custom tracking domain. If your tool tracks links, use your own tracking domain so you do not share another sender’s reputation.

Mailboxes and volume

11. Licensed business mailboxes. Google Workspace or Microsoft 365, on domains you control and pay for in your own name.
12. Six to eight mailboxes to start. Across more than one domain. The count is your needed volume divided by a conservative per-mailbox rate, not a target.
13. Warm-up before campaigns. Several weeks of gradually increasing, engaged sending before a mailbox carries campaign volume.
14. Scale by adding mailboxes. Never by raising volume on one. Volume per mailbox is the most common self-inflicted deliverability problem.
15. A real From and Reply-To. Both must be valid addresses on the sending domain that can receive replies, which Microsoft recommends for high-volume senders.

The list

16. Verify every list. Before it enters a sequence, not once a quarter. Bounces damage a new domain faster than anything else.
17. Remove catch-all domains you cannot confirm. They accept everything at first and bounce later.
18. A suppression list. Opt-outs, existing customers and open opportunities, applied to every list automatically.
19. Re-verify old data. A list not verified in the last three months should be treated as unverified. Microsoft recommends cleaning lists monthly or quarterly.
20. Target before you send. A precise ICP produces fewer complaints. Spam reports are a targeting signal as much as a content one.

Content

21. Plain text. No images and no attachments in a first message.
22. One link at most in the first touch. And none if the email works without it.
23. Accurate subject lines. No fake reply or forward prefixes, and no deceptive headers.
24. An easy way to opt out. A clear line or link, honoured quickly. Yahoo asks bulk senders to honour unsubscribes within 2 days and to support one-click unsubscribe (RFC 8058). Add the header if your tool supports it.
25. Write for replies. Specific to the recipient and short enough to answer. Mailbox providers read engagement, so reply rate is a deliverability input.

Monitoring

26. Google Postmaster Tools on every sending domain. Check the spam rate weekly. Google asks for below 0.3%, ideally below 0.1%.
27. Read your DMARC reports. Aggregate reports show which services send as your domain and whether they pass alignment.
28. Bounce and reply rate per mailbox, weekly. Per mailbox, not per campaign, so a failing mailbox is visible on its own.
29. Ignore open rate. Apple Mail Privacy Protection has pre-fetched images since September 2021, so opens no longer measure reading.
30. Rest and rotate. Pull any mailbox that degrades, let it recover, and move DMARC from none to quarantine to reject gradually once every legitimate sender is aligned, as Microsoft advises.

Why do you need a separate cold email domain?

Never run cold outbound from your primary domain. Buy lookalike domains, set them up properly, and keep your main domain reserved for existing customers and inbound conversation. One bad campaign should never threaten your company email.

How do you set up SPF, DKIM and DMARC for cold email?

• SPF authorises which servers may send for your domain
• DKIM signs your mail so receivers can verify it was not altered
• DMARC tells receivers what to do when the first two fail
• Custom tracking domain so link tracking does not inherit a shared reputation

Missing any of these makes the rest of your effort close to irrelevant.

This stopped being optional. Since 1 February 2024, Google requires bulk senders of 5,000 or more messages a day to Gmail to authenticate with SPF and DKIM, publish a DMARC record (an enforcement policy of none is accepted), align the From: header domain with either the SPF or DKIM domain, and keep the spam rate reported in Postmaster Tools below 0.30% (Google). Marketing and subscription mail must also carry one-click unsubscribe. Below those thresholds you are not throttled, you are filtered.

What do Gmail, Yahoo and Outlook require from bulk senders?

All three major providers publish their requirements. Below the stated thresholds you are filtered or refused outright, regardless of how good the copy is.

Two things follow from that table. The bar is now the same everywhere, so there is no provider you can afford to configure for and no provider you can ignore. And Microsoft's move from filtering to rejection is the direction of travel: failing authentication increasingly means the message is refused rather than quietly buried.

The standards themselves settle most configuration questions: SPF is RFC 7208, DKIM is RFC 6376 and DMARC is RFC 7489. Every configuration argument you will have with a vendor is settled in one of those three documents.

Setting it up: the exact records

Checks 5 to 8 in practice. Every record goes in DNS at your domain registrar, once for each sending domain.

Google Workspace

• SPF. A TXT record on the domain with v=spf1 include:_spf.google.com ~all, per Google’s SPF guide.
• DKIM. In the Admin console, go to Apps, Google Workspace, Gmail, then Authenticate email. Generate a 2048-bit key with the default selector google, add the TXT record it shows you, then click Start authentication. Google notes it can take up to 48 hours to start working (Google’s DKIM guide).

Microsoft 365

• SPF. A TXT record with v=spf1 include:spf.protection.outlook.com -all. Microsoft recommends -all because DMARC can then act on mail that fails (Microsoft’s SPF guide).
• DKIM. Two CNAME records, selector1._domainkey and selector2._domainkey, with the values the Microsoft Defender portal gives you for your domain, then turn DKIM signing on (Microsoft’s DKIM guide).

Your sending tool

If a sequencer such as Instantly or Lemlist sends through its own servers, add its include: to the same SPF record rather than creating a second one, and complete its custom domain authentication so DKIM signs with your domain. If it sends through your Workspace or Microsoft 365 mailboxes, the records above already cover it.

DMARC, then tighten it

Add a TXT record at _dmarc.yourdomain.com. Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, so receivers send you reports without acting on failures. Google and Microsoft both advise moving gradually from none to quarantine to reject, using the pct tag to apply the stricter policy to a share of mail first (Google’s DMARC guide).

Three SPF mistakes that cause silent failures

• Two SPF records on one domain. SPF returns a permanent error. Merge them into one.
• More than 10 DNS lookups. Each include:, a, mx, exists and redirect counts, including lookups nested inside includes. IP addresses do not.
• Syntax slips. A trailing full stop after a domain, an equals sign instead of a colon, or a space after include: all break the record.

To check the result, send a test message to a Gmail address and open Show original. SPF, DKIM and DMARC should each show PASS.

How do you know if your spam rate is too high?

You measure it rather than infer it. Google Postmaster Tools reports the spam rate for your authenticated domain, and it is the number Gmail actually acts on. The published threshold is 0.30%, so treat anything approaching 0.10% as a signal to slow down rather than a margin to spend.

Reply rate and open rate will not warn you in time. Both are lagging, both are contaminated by filtering itself, and by the time either has visibly dropped the domain reputation that caused it has been degrading for weeks. Check the spam rate weekly, per sending domain, in the same review where campaign performance is looked at.

This is also the discipline behind every outbound engine described on this site. The build for NuVista AI put domains, inboxes and authentication in place before a single sequence went live, because the alternative is burning a domain and discovering it a month later.

How long should you warm up a cold email mailbox?

New mailboxes need several weeks of gradually increasing, engaged sending before they carry campaign volume. After warmup, keep each mailbox conservative and add mailboxes to scale rather than pushing any single one harder. Volume per mailbox is the most common self inflicted deliverability wound.

Clean the list before you send

Bounce rate is a reputation signal. Verify every address, remove catch all domains you cannot confirm, and suppress anyone who already asked you to stop. A list that has not been verified in three months is not a list, it is a risk.

Write mail that behaves like mail

Plain text, no images, minimal links in the first message, and no attachments. Short and specific to the recipient. Spam filters increasingly measure engagement, so the strongest long term deliverability strategy is writing email people actually reply to, which is a targeting and messaging problem. See ICP, persona and messaging and AI toolstack setup.

Monitor and correct weekly

Track bounce rate, spam complaints, reply rate, and placement per mailbox. Pull any mailbox that degrades, let it recover, and rotate. Deliverability is a maintenance routine, not a one time setup. For what the published research says about which of these moves placement most, see the 2026 AI outbound benchmarks.

Deliverability decides whether any of this is read, but speed decides what happens next. An audit of 2,241 US companies found the average first response to an inbound lead took 42 hours and 23% never replied at all (Harvard Business Review, 2011). Landing in the inbox and then answering three days later wastes the work twice.

Why are my cold emails going to spam? A diagnosis table

Match the symptom to the most likely cause before changing anything.

What this looked like in practice

Shobhit Gupta has run outbound from Lemlist, Klenty and Instantly across teams at Locus, GoComet and Landmark Group, and the failure pattern is consistent. A team blames the copy, rewrites subject lines for a month, and never checks whether the sending domain was authenticated. The copy is the last thing to fix, because you cannot read a reply rate through a spam filter.

At Locus, the A/B tested cadences ran on Pardot and Salesforce Sequences, because the cold email tools common today were not yet capable of it. Reply rate held around 5%. Open rate ran between 40% and 50%, but that number stopped meaning anything once Apple Mail Privacy Protection began pre-fetching images in September 2021, which is why GrowthStack reports outbound in replies, not opens.

For NuVista AI, the domains, mailboxes and authentication were in place before a single sequence went live. The full build specification, from domain count to reply routing, is in cold email infrastructure setup, and the engagement that builds it is cold email infrastructure setup as a service.

Use the tool

References

• Oldroyd, J.B., McElheran, K. and Elkington, D. The Short Life of Online Sales Leads. Harvard Business Review, March 2011.
• Google. Email sender guidelines, bulk sender requirements. Effective 1 February 2024.
• Yahoo. Sender best practices and bulk sender requirements. 2024.
• Microsoft. Outlook.com requirements for high volume senders. Effective 5 May 2025.
• Kitterman, S. Sender Policy Framework (SPF), RFC 7208. IETF, 2014.
• Crocker, D., Hansen, T. and Kucherawy, M. DomainKeys Identified Mail (DKIM) Signatures, RFC 6376. IETF, 2011.
• Kucherawy, M. and Zwicky, E. Domain-based Message Authentication, Reporting and Conformance (DMARC), RFC 7489. IETF, 2015.
• Levine, J. and Herkert, T. Signaling One-Click Functionality for List Email Headers, RFC 8058. IETF, 2017.
• Google Workspace Admin Help. Set up SPF.
• Google Workspace Admin Help. Set up DKIM.
• Google Workspace Admin Help. Set up DMARC.
• Microsoft Learn. Set up SPF for your Microsoft 365 domain. Updated July 2026.
• Microsoft Learn. How to use DKIM for email in your custom domain. Updated August 2026.

Related reading

For what actually gets built before any of this runs, the domains, the mailbox count and the order of work, see cold email infrastructure setup.

• The lead generation engine this checklist sits inside
• ICP, persona and messaging frameworks
• AI toolstack setup and enablement
• Apollo vs ZoomInfo for your list source
• Instantly vs Lemlist for sending
• Get your setup reviewed