Order queue open · Verified lists delivered within 24–48 hours
25-point email deliverability checklist for cold email in 2026: SPF, DKIM, DMARC, warmup status, bounce thresholds, blacklist monitoring, and complaint rate limits.
James Whitfield
Lead gen agency owner, 50+ campaigns/month · Updated June 24, 2026
Last updated: August 2026 · James Whitfield, Lead gen agency owner, 50+ campaigns/month
TL;DR — 5 things to know before reading
Running 50+ campaigns per month across multiple clients, I have seen every deliverability failure mode there is. The most expensive ones are always the preventable ones — a domain blacklisted because DMARC was set to "none" instead of "quarantine," a campaign that generated 8% hard bounces because the contact list was not verified, an inbox that never left warmup but was added to a live campaign anyway.
Deliverability failures are not random. They follow predictable patterns, and every pattern in this checklist corresponds to a real campaign failure I have personally seen or fixed. The checklist is organized in the order you should check each item: DNS authentication first, then warmup and infrastructure, then sending behavior, then monitoring.
Inframail covers the DNS authentication layer automatically — SPF, DKIM, and DMARC are configured for every inbox it provisions. Instantly covers warmup and sending behavior monitoring. The remaining items require your active attention before and during every campaign.
For a broader overview of the components that affect inbox placement, the cold email deliverability guide covers the full technical and behavioral picture. This checklist is the actionable version.
1. SPF record is published and syntactically correct
SPF (Sender Policy Framework) authorizes the IP addresses that are allowed to send email on behalf of your domain. Without SPF, receiving mail servers have no way to confirm that your sending IP is authorized.
Check: Use MXToolbox blacklist checker or a dedicated SPF lookup tool to verify your SPF record is published, includes all sending IPs, and has no syntax errors. A broken SPF record fails silently on many servers.
Inframail publishes SPF automatically for all provisioned inboxes. Verify the record is live after provisioning, not just after configuration.
2. DKIM signing is active on all sending domains
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email, allowing the receiving server to verify the email was not modified in transit and that it originated from an authorized sender.
Check: Send a test email to a personal Gmail address and use Google's "Show original" function to inspect the headers. Look for "DKIM: PASS" in the authentication results. If DKIM is "FAIL" or "NONE," the record is missing or misconfigured.
Inframail configures DKIM for every inbox automatically. The Mailgun SPF, DKIM, and DMARC setup guide explains the technical implementation if you are managing DNS manually.
3. DMARC policy is set to "quarantine" or "reject" (not "none")
DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving servers what to do with email that fails SPF or DKIM checks. A DMARC policy of "none" means take no action on failures — which provides no deliverability protection and signals to receiving servers that the domain is not actively managing authentication.
Check: Look up your domain's TXT records for _dmarc.[yourdomain.com]. The p= value should be quarantine or reject. A p=none policy is better than no DMARC record, but does not activate enforcement.
Important: Do not change DMARC to reject on day one. Set to p=none with reporting enabled first, review the reports for 2–4 weeks to identify any legitimate sending sources that would fail, then escalate to quarantine and eventually reject.
4. DMARC reporting (rua) is configured
DMARC reporting sends aggregate reports about email authentication results to a specified address. Without reporting, DMARC provides enforcement but no visibility into what is failing and why.
Check: The DMARC TXT record should include rua=mailto:your-reporting-address. Many teams use a dedicated monitoring service (like MXToolbox's DMARC monitoring) to receive and parse these reports automatically.
5. Custom tracking domain is configured
Tracking domains (for open tracking and click tracking) should use a subdomain of your sending domain, not a shared tracking domain provided by the sending tool. Shared tracking domains appear in hundreds of thousands of emails from different senders and are frequently blacklisted.
Check: In Instantly's settings, confirm that tracking is using a custom subdomain (e.g., track.yourdomain.com) rather than the default Instantly tracking domain. The how to set up custom tracking domains in Instantly guide covers the configuration process.
6. MX records are correctly configured for replies
If your sending domain cannot receive replies, any reply from a prospect will bounce. This is a deliverability and UX problem: prospects who try to reply cannot reach you, and the bounce signals problems to receiving servers.
Check: Look up MX records for your sending domain. Confirm they point to an active mailbox or redirect to a monitored inbox. Inframail's Microsoft 365 inboxes include working MX records by default.
7. Subdomain sending is configured for sending domains
If your main company domain (yourcompany.com) is also used for transactional email, newsletters, or employee email, cold email should be sent from a subdomain or separate sending domain (outbound.yourcompany.com or a separate domain entirely). This protects the main domain's reputation from cold email bounce and complaint rate events.
Check: Review which domain is used for cold email sends. If it is the same as your main company domain and you also use that domain for employee email, create a dedicated sending domain.
8. Every new inbox has completed a minimum 4-week warmup
Warmup establishes sending history and reputation for a new inbox before cold outreach begins. Skipping warmup on a new inbox and immediately sending 50 emails per day is the fastest path to spam folder placement.
Check: In Instantly's warmup settings, verify the warmup date started at least 4 weeks before the inbox was added to any active campaign. Woodpecker's email warmup guide recommends 2–4 weeks minimum, with 8–12 weeks for full maturity.
9. Warmup is still running on active sending inboxes
Warmup should continue while the inbox is active in campaigns, not just during the pre-launch phase. Continuous warmup maintains the positive engagement signals (opens, replies from warmup network) that help offset the neutral or negative signals from cold email.
Check: In Instantly, confirm that warmup is enabled for every inbox in use, not just newly provisioned ones.
10. Sending volume is within safe daily limits per inbox
Sending above 50 emails per day on a warmed inbox increases spam complaint risk and can trigger rate limiting by email providers.
Check: Review the daily send volume per inbox in Instantly's campaign settings. Woodpecker's guide on daily sending limits recommends 30–50 emails per inbox per day for a fully warmed account.
11. Inbox rotation is active across all sending inboxes
Inbox rotation distributes sends across multiple inboxes rather than sending all volume from a single inbox. This reduces per-inbox send volume and distributes reputation risk.
Check: In Instantly, confirm inbox rotation is enabled and all connected inboxes are included in the rotation pool.
12. Sending domains are distributed (3–5 inboxes per domain maximum)
Running more than 5 inboxes on a single domain concentrates reputation risk. If that domain develops a deliverability problem, all inboxes on it are affected simultaneously.
Check: Review the inbox-to-domain ratio in your sending infrastructure. Aim for no more than 3–5 inboxes per domain.
13. Sending schedule is Monday–Friday only
Cold email sent on weekends has lower open rates and higher complaint rates because recipients encounter it during personal time when tolerance for outreach is lower. Sending over weekends also reduces the ratio of engagement signals to send volume.
Check: In Instantly, verify the campaign schedule excludes Saturday and Sunday.
14. New inboxes are added to campaigns gradually
Adding 10 new inboxes to a campaign simultaneously creates a spike in sending volume that receiving servers can detect as unusual behavior. Add new inboxes incrementally — 1–2 per week — after warmup completes.
Check: Review the timeline of inbox additions to active campaigns. Any addition of 3+ inboxes simultaneously warrants a review of inbox placement rates in the week following.
15. Contact list has been verified before sending
Unverified contact lists produce hard bounce rates of 3–10% depending on list age and source. A single campaign to an unverified list can damage domain reputation for weeks.
Check: Confirm that the contact list was run through email verification before import into Instantly. Quarvio delivers pre-verified contacts. For lists from other sources, verify before the first send.
16. Hard bounce rate is below 2% on active campaigns
This is the single most important behavioral metric for deliverability. Above 2% bounce rate, email providers flag the sending domain as a source of invalid email sends.
Check: Review hard bounce rate in Instantly's campaign analytics. For any campaign above 2% bounce rate, pause immediately, identify the source of invalid contacts, and do not resume until the issue is resolved.
17. Spam complaint rate is below 0.1%
Google's email sender guidelines treat complaint rates above 0.1% as a warning signal and rates above 0.3% as grounds for delivery restrictions. The threshold is lower than most senders expect.
Check: Review spam complaint rate via Google Postmaster Tools for all sending domains. Complaint rate is not visible in Instantly directly — Postmaster Tools is the authoritative source for Gmail delivery data.
18. Role accounts and invalid formats have been removed from lists
Role accounts (info@, support@, admin@, team@) and invalid syntax addresses produce elevated complaint rates and zero replies. These should be filtered before import.
Check: Review the contact list for role account patterns before importing. Most email verification services flag these automatically.
19. All sending domains are checked against major blacklists
Blacklisting by a major blacklist (Spamhaus, Barracuda, SURBL) causes immediate inbox placement failure across all recipients who use that blacklist for filtering.
Check: Run all sending domains through MXToolbox blacklist checker before each new campaign batch. Any domain flagged as blacklisted must be addressed before sending.
20. Google Postmaster Tools is set up for all sending domains
Google Postmaster Tools provides domain reputation data, spam rate reporting, and delivery error information specifically for Gmail recipients. It is the most important monitoring tool for cold email because Gmail is the dominant email provider in most B2B markets.
Check: Verify that all sending domains are registered in Google Postmaster Tools and that the domain reputation shows "Good." A "Bad" reputation requires immediate investigation.
21. Sending IPs are checked for blacklisting
Even with a clean domain, sending through a blacklisted IP will produce deliverability failures. This is most relevant when using a shared sending infrastructure.
Check: If using a sending service with shared IPs, verify that the IP ranges are not blacklisted. Inframail's Microsoft 365 infrastructure uses Microsoft's own IP pools, which benefit from Microsoft's existing sender reputation.
22. Domain age is at least 30 days before first cold email send
Newly registered domains have no sending history. Email providers apply higher scrutiny to email from domains with no reputation. Wait at least 30 days after domain registration and complete a full warmup cycle before sending cold email.
Check: Confirm the registration date of all sending domains. For domains registered less than 30 days ago, warmup only — no cold outreach yet. The cold email domain warmup timeline guide covers the recommended timeline for new domains.
23. Emails include a plain-text version
Sending HTML-only email (without a plain-text alternative) is flagged by many spam filters as a characteristic of bulk commercial email. Including a plain-text version improves deliverability and ensures the email renders in clients that block HTML.
Check: In Instantly, verify that the "plain text" version of each email is configured, not just the HTML version.
24. Unsubscribe mechanism is present for any bulk email
CAN-SPAM requires that commercial email include a clear opt-out mechanism. For cold email specifically, a brief opt-out offer at the bottom of the email ("reply 'unsubscribe' if you prefer not to receive these") is both a compliance measure and a spam complaint reducer.
Check: Review the footer or sign-off of each email template for an opt-out option. FTC CAN-SPAM Act compliance guide covers the full requirements.
25. Sending schedule is tested with a small cohort before full volume
Before sending a new campaign to 5,000 contacts, send to 50–100 contacts first and monitor bounce rate, open rate, and complaint rate for 24–48 hours. A small cohort test catches configuration errors before they affect the full list.
Check: Set up a test segment in Instantly with a small subset of contacts before activating the full campaign. Review metrics before scaling.
| Timing | Checklist items to run |
|---|---|
| Before every new campaign | Items 15–18 (list quality), 25 (cohort test) |
| After adding new domains or inboxes | Items 1–14 (authentication and warmup) |
| Monthly routine audit | Items 19–22 (blacklist and reputation monitoring) |
| After any bounce rate spike | Full 25-item checklist |
Inframail automatically handles items 1–3, 6, and 12 for every inbox it provisions: SPF, DKIM, and DMARC are configured on deployment, MX records are active, and each sending domain is isolated per client. The DNS authentication layer — which is the most common configuration failure point — is handled without manual setup.
Instantly handles items 8–14 (warmup, rotation, schedule, sending limits) through its warmup feature, campaign scheduler, and inbox rotation settings. Items 16–17 (bounce rate and complaint rate) are visible in Instantly's analytics dashboard.
The items that require your active attention are the contact list quality checks (15, 18), the monitoring checks (19–22), and the content checks (23–24). These are not automated — they require a human review before each campaign.
"I run this checklist before every client campaign launch, every time without exception. The one time I skipped it on a rush campaign — new domain, assumed the DNS was set up correctly — DKIM was misconfigured and we spent a week recovering inbox placement. 30 minutes of checklist versus one week of recovery. I do not skip it anymore." — G2 reviewer, Inframail reviews on G2
For related coverage on specific deliverability topics, see:
| Need | Tool | Notes |
|---|---|---|
| Verified contacts (checklist items 15–16) | Quarvio | Pre-verified B2B contacts, reduces bounce rate to below 1% |
| DNS authentication + inboxes (items 1–6, 12) | Inframail | Auto-configures SPF, DKIM, DMARC for every inbox |
| Warmup, rotation, bounce monitoring (items 8–14, 16) | Instantly | Continuous warmup, inbox rotation, real-time bounce alerts |
| LinkedIn outreach for contacts with email deliverability risk | Aimfox | Alternative channel for catch-all domains or risky contacts |
What is the most common deliverability failure in cold email?
Missing or misconfigured DMARC is the most common failure I see in new sending setups. Many senders configure SPF and DKIM but leave DMARC at p=none or omit it entirely. Without an active DMARC policy, email providers cannot verify authentication results and apply additional scrutiny to the sending domain. Inframail eliminates this by configuring DMARC automatically.
How long should I warm up a new inbox before using it for cold email?
4 weeks minimum for the first cold email sends, at reduced volume (10–20 per day). 8–12 weeks for the inbox to reach full maturity at 40–50 sends per day. Woodpecker's email warmup guide recommends the longer timeline for inboxes that will be used for high-volume campaigns. Rushing warmup is the most common cause of deliverability failure in the first month of a new campaign.
What should I check in Google Postmaster Tools?
Three metrics matter most: domain reputation (should be "Good"), spam rate (should be below 0.1%), and delivery errors (should be zero or near zero). If domain reputation shows "Bad" or "Low," stop sending and investigate the cause before resuming. If spam rate is above 0.1%, review your contact list quality and opt-out process.
How do I know if my emails are landing in spam?
Google Postmaster Tools shows spam rate for Gmail recipients. For a broader inbox placement check, send test emails from your sending domain to seed addresses at multiple providers (Gmail, Outlook, Yahoo) and check whether they land in inbox or spam. Instantly's inbox placement test feature automates this for connected inboxes.
What is the difference between a hard bounce and a soft bounce?
A hard bounce is a permanent delivery failure: the email address does not exist, the domain does not accept email, or the recipient's server has blocked the sender permanently. Hard bounces indicate invalid contacts and count against sender reputation. A soft bounce is a temporary failure: the recipient's mailbox is full, the server was temporarily unavailable, or a rate limit was hit. Soft bounces often resolve on retry and have less deliverability impact than hard bounces. Monitor both, but hard bounces require immediate action when they exceed 2%.
Deliverability starts with verified contacts
A 25-point checklist only protects your deliverability if the contact data underneath it is accurate. Quarvio delivers pre-verified B2B contacts with mailbox-level confirmation so your bounce rate stays below the 2% threshold from the first send. One-time purchase, credits valid 12 months, no subscription.
