Email Deliverability Checklist

SPF names the servers allowed to send for your domain. Without it a receiver cannot tell your mail from a forgery, and past ten lookups the record fails outright.

Do this: Publish a TXT record at your domain root, then flatten or drop unused includes until you are inside the ten-lookup limit. Our SPF Generator builds the record for you.

DKIM adds a cryptographic signature proving the message left your infrastructure and was not altered in transit. Unsigned mail loses a trust signal every major provider looks for.

Do this: Turn DKIM on in each sending platform, publish the selector TXT record it gives you, and confirm the record resolves before you send.

DMARC tells receivers what to do when SPF and DKIM fail, and it is the only one of the three that reports back to you. Gmail and Yahoo now require it from bulk senders.

Do this: Start at p=none and read the aggregate reports for a few weeks, then move to p=quarantine once legitimate mail passes. Our DMARC Generator handles the syntax.

SPF authenticates the return-path, not the From header. If your platform uses its own bounce domain, SPF passes for them while your DMARC alignment quietly fails.

Do this: Configure a custom return-path in your sending platform — usually a CNAME such as bounce.yourdomain.com — so the envelope sender sits on your domain.

A domain that sends mail but cannot receive it looks disposable, and bounce and reply handling breaks when there is nowhere to deliver.

Do this: Point MX records at your mailbox provider for every sending domain, including the secondary domains used for outreach.

BIMI puts your logo beside your messages in Gmail and Yahoo, which lifts recognition. It also requires DMARC enforcement, so it doubles as proof your authentication is finished.

Do this: Publish your logo as an SVG Tiny PS file, add the BIMI TXT record, and obtain a VMC if you want it displayed in Gmail.

Reputation attaches to the domain, not to its owner. A domain previously used for spam arrives pre-damaged, and no amount of warmup clears a listing you did not create.

Do this: Look the domain up in the Internet Archive and on the major blocklists before you commit to it. If the history is bad, choose a different one.

A listing on Spamhaus, Barracuda or SORBS routes your mail to junk at thousands of receivers at once, and nothing bounces back to tell you.

Do this: Run the domain through a multi-blocklist lookup. If it appears, follow that list's own delisting process rather than waiting it out.

The IP is listed separately from the domain, and on a shared pool another sender's behaviour can get it listed without you doing anything wrong.

Do this: Get your sending IP from your provider, check it against the same blocklists, and escalate to the provider if a pool address is listed.

It is the only place Gmail tells you what it actually thinks of your domain — spam rate, domain reputation and authentication pass rates, straight from the receiver.

Do this: Add and verify your domain in Postmaster Tools with a DNS record, then check the spam-rate graph weekly.

Outlook and Hotmail are opaque about filtering, and SNDS is the one feed that shows complaint rates and spam-trap hits for your IPs.

Do this: Register your sending IPs in Smart Network Data Services and review the complaint-rate column after each campaign.

Volume from a domain registered days ago is the pattern filters associate with throwaway spam operations. Age alone buys you the benefit of the doubt.

Do this: Register the domain well ahead of the campaign and spend the waiting period on authentication and warmup rather than on sending.

Reputation services score your sending IP from real receiver data. A low score means you are already being filtered somewhere, whatever your content looks like.

Do this: Look your sending IP up on a reputation service. If the score is poor, treat list hygiene and volume ramping as the fix, not content edits.

On a shared pool you inherit every other sender's mistakes. A dedicated IP makes the reputation entirely yours, which cuts both ways and only pays off at steady volume.

Do this: Ask your provider which pool you are on. Move to a dedicated IP once you send enough to keep it warm, and vet the pool's reputation if you stay shared.

Receivers check that the sending IP resolves back to a hostname on your domain. A missing or generic PTR is grounds for outright rejection at many gateways.

Do this: Ask whoever controls the IP to publish a PTR record pointing at a hostname on your domain, and confirm the forward record matches.

Unencrypted mail can be read in transit, and Gmail flags it with a broken-padlock warning the recipient sees before reading a word.

Do this: Confirm opportunistic TLS is on at your sending platform, and publish an MTA-STS policy so receivers know to require it.

Repeatedly mailing addresses that do not exist is the clearest sign a list was scraped rather than earned, and one of the fastest ways to lose reputation.

Do this: Configure your platform to suppress hard-bounced addresses on the first failure, and never re-import them from the original source.

Gmail and Yahoo require it from bulk senders. Without it, recipients who want out reach for the spam button instead, and complaints cost far more than unsubscribes.

Do this: Enable the List-Unsubscribe and List-Unsubscribe-Post headers in your platform, then test the link from a real inbox.

A feedback loop is how you learn someone marked you as spam. Without one you keep mailing complainers and never find out why your rates are sliding.

Do this: Enrol your domain and IPs in the Yahoo, Microsoft and Comcast loops, and wire the reports into automatic suppression.

Open and click tracking rewrites your links through your platform's shared domain, which thousands of other senders also use and which regularly lands on blocklists.

Do this: Set up a subdomain such as track.yourdomain.com, point it at your platform, and switch tracking over to it.

A brand-new sender opening at full volume is the loudest spam pattern there is. Reputation is built by consistency over weeks, never by one large send.

Do this: Start around 20 to 50 messages a day and raise volume modestly every few days across two to four weeks. InboxWarm automates the ramp.

Every mailbox provider caps daily sends, and crossing the cap gets the account throttled or suspended mid-campaign.

Do this: Look up the published limit for your plan, set your platform's daily cap below it, and split large campaigns across more days or more mailboxes.

A thousand messages leaving in the same second is a machine signature. Human sending is uneven, and receivers rate-limit bursts regardless of content.

Do this: Enable send-time randomisation in your platform and spread the day's volume across working hours.

Replies are among the strongest positive signals a receiver can observe. A no-reply address throws that away and tells recipients you are not listening.

Do this: Send from a real, monitored address and route team replies into a shared inbox so nothing is missed.

Lists decay constantly as people change jobs. Stale addresses become bounces and spam traps, and traps in particular trigger immediate blocklisting.

Do this: Run the list through a verification service before every send and drop anything invalid, risky or role-based.

These streams carry different risk. If cold outreach damages the domain, it takes your password resets and receipts down with it.

Do this: Keep your primary domain for transactional mail only and run outreach from separate, dedicated domains.

The subject is scored for content risk and is the first thing a recipient judges. Hype words, capitals and stacked punctuation add risk with no upside.

Do this: Keep it under about 60 characters in ordinary sentence case, and run it through our Subject Line Tester before the campaign goes out.

A multipart message carrying both parts is what ordinary mail clients produce. HTML-only messages are disproportionately machine-generated, and filters weigh that.

Do this: Enable the plain-text part in your platform and read it once — auto-generated versions are often unusable.

Hiding copy inside a picture is a long-standing way to evade text-based filters, so filters treat image-heavy mail as suspicious by default. It also breaks for anyone with images switched off.

Do this: Write the message as text and use images only as support. Never send a single large graphic as the whole email.

Shorteners hide the real destination, which is exactly why phishing uses them and why filters distrust them. Shared shortener domains also carry other people's reputation.

Do this: Link to full URLs on your own domain. If you need short links, route them through a branded domain you control.

Genuinely personalized mail earns better placement, but a broken merge tag is worse than none — it announces the automation to the recipient.

Do this: Use merge fields in the subject and opening line, and always send yourself a live preview to confirm every token resolves.

Malformed markup is common in mail assembled by spam tooling, so filters score it. It also renders unpredictably across clients.

Do this: Build with your platform's editor or a tested email template, and validate any hand-written HTML before sending.

Link-heavy messages read as promotional or as phishing, and every extra domain you link to is another reputation you are borrowing.

Do this: Keep one clear call to action, and strip decorative footer and social links from cold outreach entirely.

Recognition is what earns the open on your second and third message, and receivers build reputation against the specific pairing of name and address.

Do this: Choose one From name and one address per campaign and leave them unchanged for its duration.

CAN-SPAM and its equivalents require a real mailing address in commercial mail. Leaving it out is both a legal exposure and a signal filters look for.

Do this: Add your registered address or a PO box to the footer template, alongside the unsubscribe link.

Reputation decays when sending patterns change. Warmup keeps a baseline of positive engagement underneath your campaigns instead of only around them.

Do this: Leave warmup running continuously on every outreach mailbox, including through the quiet periods between campaigns.

A seed test tells you where the message actually lands — primary, promotions or spam — before you spend the list finding out.

Do this: Send the final creative to a seed-test service and fix whatever it flags before launch. Our Spam Test reports placement across the major providers.

Reputation problems compound. A drop caught in week one is a small fix; the same drop found a month later has already cost you the domain.

Do this: Put a recurring ten-minute slot in the calendar to review your platform's dashboard and Google Postmaster Tools together.

Nothing tells you when you get listed. Without monitoring you find out from the silence, usually after weeks of it.

Do this: Register your domains and sending IPs with a monitoring service that emails you the moment a listing appears.

These are the two numbers receivers act on directly. Crossing either threshold pushes you toward the spam folder however good everything else is.

Do this: Check both after every campaign. Treat a high bounce rate as a list problem and a high complaint rate as a targeting or consent problem.

Scoring tools run your message through the same rule sets receivers use, so you see the content penalties before your recipients do.

Do this: Score every new template before its first send and fix the flagged rules. Our Spam Word Checker covers the copy side.