Cold Email Deliverability Checklist: 15 Things to Verify Before You Hit Send

Most deliverability disasters are not mysterious. They are the result of launching a campaign before three or four boring things were verified. A DKIM record that was pasted with a line break in it. A list bought six months ago and never re-verified. A brand-new domain sending 80 emails on day one. By the time you notice the reply rate is 0.3%, the domain has already been flagged and you are cleaning up instead of selling.

This is the pre-flight checklist. Fifteen checks, each with how to verify it and what a passing result looks like. Run it once per domain before your first campaign, and run the short version (items 8-15) before every new campaign after that. It takes about 40 minutes the first time and ten minutes thereafter.

{"h2":"Quick reference: the numbers that matter"}

Before the detail, here are the thresholds worth memorising. If any of these fail, stop and fix before sending.

{"table":{"headers":["Check","How to verify","Pass threshold"],"rows":[["SPF / DKIM / DMARC","Send to a Gmail account, view original","All three show PASS"],["Bounce rate (forecast)","Verification pass on the list","Under 2%, ideally under 1%"],["SpamAssassin score","Score the actual draft with merge fields filled","Below 3.0; aim under 2.0"],["Mailbox age before real sends","Warm-up log","14-21 days minimum"],["Daily volume per mailbox","Sequence sending limits","20-40/day mature, 5-10/day week one"],["Blocklist status","Spamhaus, SURBL, Barracuda lookups","Zero listings on domain and sending IP"],["Inbox placement (seed test)","Seed mailboxes across Gmail + Microsoft","80%+ primary inbox"],["Links per email","Read the draft","One, on your own domain"]]}}

{"h2":"1. Authentication actually passes on a live message"}

Do not trust your DNS panel. Send a real email from the sending mailbox to a Gmail address you control, open "Show original", and confirm SPF: PASS, DKIM: PASS, DMARC: PASS. A DKIM record can look perfect in a DNS checker and still fail because the key was truncated or the selector does not match what the mailbox signs with. If any line says NEUTRAL, SOFTFAIL, or NONE, you have work to do — the plain-English SPF, DKIM, and DMARC setup guide walks through each record.

{"h2":"2. DMARC policy is published and reports go somewhere"}

Start at p=none with a rua address so you can see what is being sent under your name, then tighten to quarantine once you have a week of clean reports. Cold email does not need p=reject to land, but having no DMARC record at all is now a visible negative signal at Google and Microsoft for bulk senders.

{"h2":"3. Tracking domain is custom, or tracking is off"}

If you use open or click tracking on a shared platform tracking domain, every link in your email points at a hostname thousands of other senders have already burned. Set a CNAME on your own sending domain, confirm it serves over HTTPS, and confirm the rewritten links in a test send resolve. If you cannot be bothered, turn open tracking off — pixel-based opens are largely noise now anyway thanks to prefetching and security scanners.

{"h2":"4. The sending domain looks like a real company"}

Open the domain in a browser. Is there a page? Does it have your company name, a logo, and a way to contact you? A domain with no website and no MX-visible history is the single easiest pattern for a filter to score down. Give every sending domain a one-page site that redirects or mirrors your main site, and set the MX records so it can actually receive replies.

{"h2":"5. Domain and IP are not on blocklists"}

Check the sending domain against Spamhaus DBL and SURBL, and the sending IP against Spamhaus ZEN and Barracuda. New domains are sometimes listed because of a previous owner. If you are sending through Gmail or Microsoft 365, the IP is shared and out of your hands, which is fine — that is the point of using your own provider infrastructure rather than a bulk relay.

{"h2":"6. Warm-up is genuinely finished, not \"mostly done\""}

A mailbox needs 14-21 days of gradual, real activity before it carries cold volume, and 30 days is safer for a brand-new domain. "Finished" means the mailbox has been sending and receiving replies at increasing volume, with messages moved out of spam and labelled in the workspace — not that a counter hit zero. Check the log, not the dashboard badge.

{"h2":"7. Daily volume per mailbox matches mailbox age"}

Week one after warm-up: 5-10 cold emails per mailbox per day. Week two to four: ramp to 20. Mature mailbox on an established domain: 30-40 is a sane ceiling. If your campaign maths requires 100 per mailbox, add mailboxes instead. Confirm the per-mailbox cap in the campaign settings before launch, not after.

{"h2":"8. The list was verified in the last 30 days"}

Verification decays. A list verified in March and sent in June will bounce 3-5% because people changed jobs. Re-verify before every launch and remove anything that comes back invalid, unknown, or disposable. Target under 1% hard bounces; over 2% and Google starts treating you as a list-quality problem. Details in why you should verify every lead before you send.

{"h2":"9. Role accounts and catch-alls are handled deliberately"}

Strip info@, support@, sales@, abuse@, and postmaster@ — they are complaint magnets and rarely convert. Catch-all domains accept everything, so verification tells you nothing; either exclude them or cap them at a small share of the campaign so a bad guess does not dominate your bounce number.

{"h2":"10. Suppression list is applied across every campaign"}

Anyone who unsubscribed, bounced, replied negatively, or is already an open opportunity in your CRM should be blocked at the workspace level, not per campaign. Re-emailing an unsubscribe is the fastest way to earn a spam complaint from someone who already told you no.

{"h2":"11. Unsubscribe works and the footer is honest"}

Include a plain opt-out line and a List-Unsubscribe header with one-click support. Click it in a test send and confirm the address is actually suppressed. Include a real physical address. CAN-SPAM specifics are covered in is cold email legal in the United States, and if you touch EU or UK contacts the bar is higher.

{"h2":"12. Spam-score the finished draft, not a template"}

Run the rendered email — merge fields filled, links live, signature attached — through SpamAssassin. Under 3.0 is acceptable, under 2.0 is good. Common point-scorers you can fix in two minutes: all-caps subject lines, "guarantee" and "risk-free", a giant image with almost no text, HTML that is 80% markup, and more than one exclamation mark.

{"h2":"13. Links, images, and attachments are minimal"}

One link per email, on your own domain. No URL shorteners — they inherit reputation from everything else shortened on that service. No attachments in step one, ever. No tracking pixel if you are relying on opens for nothing useful. A plain-text-looking email with a single link is the most reliably delivered shape of cold email there is.

{"h2":"14. Merge fields render correctly, including fallbacks"}

Preview at least 20 rows, and deliberately preview rows with missing data. "Hi ," and "I saw that {{company}} is hiring" are campaign-killers that no deliverability setting can rescue. Set fallbacks for every variable and check capitalisation — "Hi JOHN" from a badly cased CSV looks exactly as automated as it is.

{"h2":"15. Run a seed inbox-placement test before the real launch"}

Send the finished sequence to a set of seed mailboxes covering Gmail, Outlook/Microsoft 365, and at least one corporate filter, then record where each landed: primary, promotions, or spam. Delivery reports will tell you a message was accepted; only a placement test tells you whether a human will see it. Aim for 80%+ primary inbox. If Microsoft is sending you to Junk while Gmail is fine, that is a domain reputation and content issue, not a list issue — the difference is explained in deliverability vs. inbox placement.

{"h2":"After launch: what to watch in the first 48 hours"}

{"ul":["Hard bounce rate in the first 100 sends. Over 3%, pause the campaign and re-verify.","Spam complaints. Anything above 0.1% means stop, not slow down.","Reply rate shape. A campaign that delivers but gets zero replies in 300 sends is usually landing in a folder nobody reads.","Per-mailbox divergence. If one of five mailboxes has half the reply rate of the others, its reputation is the problem, not your copy."]}

{"h2":"Where Sendvanta automates the checklist"}

Most of the fifteen checks above are things you can do manually with a DNS lookup, a verification tool, and a spreadsheet — and for a single domain, that is fine. It stops being fine at five domains and twenty mailboxes. Sendvanta runs the recurring parts continuously: SpamAssassin scoring on drafts before send, seed-mailbox inbox-placement tests, layered health scoring across mailbox, domain, DKIM and IP with automatic slow-down or pause when a threshold is crossed, warm-up using real labelled messages inside your own workspace, and suppression plus one-click unsubscribe on by default. You connect your own Gmail, Microsoft 365, or SMTP mailboxes — nothing is proxied through shared IPs. See features for the specifics, or start on the free plan at $0 with 1,000 active leads and 3,000 emails a month and run the checklist against a real campaign before you pay anything.

The checklist is not glamorous. But a founder who runs it before every launch will out-send a team of five who skip it, because they will still have a domain in month six.