Cold Email Deliverability Checklist: 15-Point Pre-Launch Audit

Most cold email campaigns fail before a single reply comes in — not because the copy is bad, but because the sender skipped the pre-launch checks that keep emails out of spam. In 2026, Google and Microsoft evaluate every cold email against authentication records, domain reputation, sending patterns, content signals, list quality, and infrastructure type. Fail any single check and your campaign is fighting uphill from the first send.

This checklist gives you 15 specific pass/fail checks to run before every campaign launch. Each has a concrete threshold — not "make sure your authentication is set up" but "SPF record includes your sending server's IP and passes validation." Run them in order. Fix failures before you send.

Section A: Authentication (Checks 1–3)

If authentication fails, nothing else matters. Google and Microsoft reject or spam-filter emails that can't prove they're from a legitimate sender. These 3 checks take 10 minutes and prevent 80% of first-campaign failures.

Check 1: SPF Record Is Passing

What it does: SPF tells inbox providers which servers are authorized to send email from your domain. Without it, your email looks like it could be spoofed.

How to test: Run your domain through MxToolbox SPF lookup or Google Admin Toolbox. The result should show "pass."

Pass: Your SPF record exists, includes your sending server's IP, and passes validation. Fail: SPF record missing, doesn't include your sending IP, or has more than 10 DNS lookups (the SPF lookup limit).

If failing: Add or correct the SPF record in your domain's DNS settings. This is a 5-minute fix that blocks your entire campaign if skipped. Full walkthrough in our SPF, DKIM, and DMARC setup guide.

Check 2: DKIM Record Is Passing

What it does: DKIM adds a cryptographic signature to every outgoing email, proving the message wasn't altered in transit.

How to test: Send a test email to a verification service or use MxToolbox DKIM lookup with your selector.

Pass: DKIM signature is present on outgoing emails and the public key in DNS matches. Fail: DKIM record missing, selector mismatch, or key length under 1024 bits.

If failing: Generate and publish the correct DKIM key in your DNS. Your sending server and DNS records must use the same selector and key pair.

Check 3: DMARC Policy Is Set to Quarantine or Reject

What it does: DMARC tells inbox providers what to do when SPF or DKIM fails. It's the enforcement layer.

How to test: Run a DMARC lookup on MxToolbox or check your DNS TXT records for _dmarc.yourdomain.com.

Pass: DMARC record exists with p=quarantine or p=reject. Fail: DMARC record missing or set to p=none.

Why p=none fails this audit: In 2026, p=none provides monitoring only — it doesn't instruct inbox providers to act on authentication failures. Google requires DMARC for senders above 5,000 emails/day, and both Google and Microsoft give better treatment to domains with enforcement policies. For the full reasoning, see DMARC for Cold Email: Why p=none Isn't Enough Anymore. For the latest requirements from the major inbox providers, read Bulk Sender Requirements 2026.

Section B: Warmup and Reputation (Checks 4–6)

Authentication proves you're legitimate. Warmup and reputation prove you're trustworthy. A brand-new domain with perfect authentication still goes to spam if it hasn't built sending history.

Check 4: Domain Is at Least 28 Days Old With Active Warmup

What it does: Inbox providers track domain age and sending history. A domain registered yesterday that starts sending 500 emails today is indistinguishable from spam.

How to test: Check your domain registration date and confirm warmup sending has been running consistently for at least 28 days.

Pass: Domain is 28+ days old and has completed a full volume ramp — starting at 5 emails/mailbox/day and graduating to full capacity with healthy signals throughout. Fail: Domain is under 28 days old, or warmup was started and stopped, or volume was ramped too aggressively.

If failing: Do not launch the cold campaign on this domain. Continue the warmup until the domain reaches full capacity with healthy signals. Skipping this step is the single most common reason agency domains get burned in the first month. Full protocol in our complete domain warmup guide. If you're unsure how long this should take in practice, see How Long Does Email Warmup Actually Take?.

Check 5: Google Postmaster Reputation Is High

What it does: Google Postmaster Tools shows your domain's reputation as seen by Google — the largest B2B inbox provider. This is the most authoritative signal of whether your emails will reach inboxes.

How to test: Log in to Google Postmaster Tools and check your domain reputation rating.

Pass: Domain reputation is "High." Fail: Domain reputation is "Medium," "Low," or "Bad."

If failing: Do not launch a new campaign on a domain with Medium or lower reputation. Reduce volume on that domain to 10–20 emails/day and hold until reputation recovers. If reputation is "Bad" for 14+ consecutive days, retire the domain and replace it. For guidance on reading Postmaster data, see How to Read Google Postmaster Data for Cold Email.

Check 6: Volume Ramp Matches Warmup Stage

What it does: Verifies your daily sending volume isn't exceeding what your domain's warmup stage can support.

How to test: Compare your planned daily send volume against the warmup schedule.

Pass: Planned daily volume is at or below the limits for your current warmup stage. Fail: Planned volume exceeds the stage limits by any amount.

If failing: Reduce volume to match your warmup stage. There are no shortcuts here — exceeding warmup limits, even by 20%, signals to inbox providers that your sending is artificial. For the complete sending limits breakdown, see Cold Email Sending Limits: How Many Emails Per Domain Per Day.

Section C: Sending Setup (Checks 7–10)

These checks verify that your technical sending configuration won't trigger spam filters or damage your reputation once the campaign goes live.

Check 7: Domain Count Matches Volume Formula

What it does: Confirms you have enough domains to support your planned volume without overloading any single domain.

How to test: Apply the domain formula: Daily email volume ÷ 150 = domains needed.

This comes from: 75 emails per mailbox per day × 2 mailboxes per domain = 150 emails per domain per day (post-graduation).

Pass: You have at least as many graduated domains as the formula requires. Fail: You're planning to send more than 150 emails/day through any single domain.

If failing: Register and warm up additional domains before launching. Never overload a domain — the short-term volume gain isn't worth the long-term reputation damage. For the full calculator and agency-specific scenarios, see How Many Domains Do You Need for Cold Email?.

Check 8: Custom Tracking Domain Configured

What it does: When your sending tool tracks opens and clicks, it rewrites links through a tracking domain. If that tracking domain is shared (default on most platforms), it can trigger spam filters because the same tracking domain appears in emails from thousands of other senders.

How to test: Send a test email, inspect the links, and verify they use your custom tracking domain — not the sending tool's default.

Pass: All tracked links route through a domain you own (e.g., track.yourdomain.com). Fail: Links route through the sending tool's shared tracking domain.

If failing: Configure a custom tracking domain in your sending tool's settings. This is a one-time DNS setup. See Custom Tracking Domains: Why They Matter and How to Set Them Up.

Check 9: Sending Limits Are Configured Correctly

What it does: Prevents your sending tool from exceeding safe volume thresholds.

How to test: Open your sending tool's settings and verify:

• Per-mailbox daily limit is set to 75 or below (post-graduation)
• Sending is spread across business hours, not batched in bursts
• Delays between emails are at least 60–90 seconds

Pass: All limits match or fall below the thresholds in the warmup stage table above. Fail: Limits are set higher than your warmup stage allows, or sending is configured in bursts.

Check 10: Blacklist Check — All Sending IPs and Domains Clean

What it does: Confirms your sending IP and domains are not listed on any major blacklists before you launch.

How to test: Run your sending IP and all sending domains through MxToolbox Blacklist Check or Spamhaus.

Pass: Zero listings on Spamhaus, Barracuda, SURBL, or any other major blocklist. Fail: Any listing on any major blocklist.

If failing: Do not launch until you've resolved the listing. If it's your IP, contact your infrastructure provider. If it's your domain, submit a delisting request and investigate the cause. For the full recovery process, see Email Blacklist Recovery: Step-by-Step Delisting Guide.

Section D: List and Content (Checks 11–13)

The cleanest infrastructure in the world can't save a campaign sent to a bad list with spammy content. These checks are where operator discipline shows.

Check 11: Email List Verified — Projected Bounce Rate Under 2%

What it does: Ensures every address on your list is valid and deliverable before you send a single email.

How to test: Run your full list through an email verification service. Check the projected bounce rate in the results.

Pass: Projected bounce rate under 2%. Zero role-based addresses (info@, sales@, support@). Zero catch-all domains without additional validation. Fail: Projected bounce rate above 2%, or unverified addresses in the list.

If failing: Remove all invalid, risky, and role-based addresses. Re-verify. If your list source consistently produces above-2% bounce rates, change your list source — the cost of bad data is burned domains. For more on what bounce rate thresholds mean, see Cold Email Bounce Rates: What's Normal and When to Panic.

Check 12: Email Content Passes Spam Filter Review

What it does: Confirms your email copy and formatting won't trigger content-based spam filters.

How to test: Review your email against these criteria:

Pass: All of the following are true:

• Email is plain text or near-plain text (95:5 text-to-HTML ratio minimum)
• Subject line has no ALL CAPS words, no exclamation marks, no misleading "Re:" or "Fwd:" prefixes
• Body contains 2 or fewer links, all using full URLs (no URL shorteners)
• No attachments of any kind
• No images or logos in the email body
• Email signature is text-only — no HTML banners, social icons, or marketing graphics
• Email reads like a 1-to-1 message, not a marketing blast

Fail: Any of the above criteria not met.

If failing: Strip the email down. For cold outreach in 2026, plain text wins. If you're unsure what specifically triggers filters, walk through our spam diagnostic flowchart.

Check 13: Unsubscribe and Compliance Elements Present

What it does: Ensures your email meets the 2026 sender requirements from Google and Microsoft.

How to test: Verify your email includes:

• A working unsubscribe link or clear opt-out mechanism
• A valid physical business address (can be in the signature)
• Accurate "From" name and email address (no misleading sender info)

Pass: All three elements present and functional. Fail: Any element missing.

If failing: Add the missing elements before sending. Google's 2026 bulk sender requirements make these mandatory — missing them risks penalties that go beyond a single campaign. For the full requirements, see Bulk Sender Requirements 2026.

Section E: Infrastructure and Monitoring (Checks 14–15)

These final checks determine whether your infrastructure can sustain deliverability over the life of the campaign — not just on launch day.

Check 14: Per-Client Isolation in Place

What it does: Ensures that if one client's campaign encounters problems, it doesn't affect your other clients' deliverability.

How to test: Answer honestly: if Client A's campaign triggers a spike in bounce rates or spam complaints tomorrow, will Client B's campaigns be affected?

Pass: Each client's sending runs on isolated infrastructure — separate server, separate IP, separate domains. A problem with one client cannot contaminate another. Fail: Multiple clients share the same IP, server, or sending pool.

If failing: For agencies managing 5+ clients, this is non-negotiable. Shared infrastructure between clients means you're one bad list away from a multi-client deliverability crisis. Read Client Isolation: Why Sharing Infrastructure Across Clients Is a Ticking Time Bomb for the full case. For infrastructure options that include per-client isolation, see Managed vs Self-Serve Email Infrastructure.

Check 15: Active Deliverability Monitoring in Place

What it does: Confirms you have a system — automated or manual — to catch deliverability degradation before it reaches your clients.

How to test: Answer honestly: if a domain's reputation dropped to "Low" on Google Postmaster at 2 AM tonight, how long would it take you to find out?

Pass: Automated monitoring checks bounce rates, blacklist status, and reputation signals at least every 24 hours. Alerts are configured. Response protocols are documented. Fail: You rely on manually checking tools, or you only investigate deliverability when a client complains about low reply rates.

If failing: At minimum, set up Google Postmaster Tools for every sending domain and check weekly. Set calendar reminders for blacklist scans. But the reality is that manual monitoring at scale is unsustainable — agencies managing 10+ domains need automated signal tracking. For what to monitor, how often, and what response thresholds to set, see Cold Email Deliverability Monitoring: What to Track, What to Ignore, and How to Automate It. For the specific signals that predict problems before they escalate, read The 7 Deliverability Signals That Actually Predict Inbox Placement.

The Quick-Reference Table

Automate the Hardest Checks

Checks 1–3 (authentication) are set-and-forget after initial configuration. Checks 11–12 (list and content) require manual review each campaign. But Checks 4–6, 10, 14, and 15 — the warmup, reputation, blacklist, isolation, and monitoring checks — are the ones that agencies struggle to run consistently across every domain and every client.

wizeMails automates all of them. The Signal Intelligence Engine monitors every domain every 15 minutes for bounce rate changes, blacklist appearances, Postmaster reputation shifts, and delivery signal degradation. The 28-day automated volume ramp handles Check 4 and 6 without manual intervention. Dedicated per-client infrastructure handles Check 14 by design. Learn more about how real-time monitoring prevents domain burns, or see the full picture of what agency-grade cold email infrastructure includes.

If you're evaluating whether your current setup can sustain these checks at scale, compare the top infrastructure providers for 2026 or go straight to pricing.