Cold Email Deliverability Checklist

Cold email deliverability is not one setting. It is roughly a dozen independent conditions, any one of which can send an otherwise good campaign to spam. The useful thing about that is it makes deliverability a checklist rather than a mystery.

Work through these twelve points before your next launch. Most take under ten minutes each.

Foundation: domain and infrastructure

1. Send from a separate domain, never your primary

Register a lookalike domain for outbound — getyourcompany.com or yourcompany.io alongside yourcompany.com. If a campaign generates complaints, the damage is contained to a domain you can retire, rather than the one your invoices and support replies depend on.

Run two or three outbound domains and spread inboxes across them so a single domain problem does not halt all outreach.

2. Age the domain before sending

Register at least 4–6 weeks before your first campaign, and put a real page on it — filters check whether the domain resolves to actual content. A domain registered yesterday, with no website, sending outbound mail, is the clearest possible spam signature.

3. Configure a custom tracking domain

Open and click tracking rewrites your links through a tracking host. If that host is your platform's shared domain, you inherit the reputation of every other sender using it — including the bad ones. Set up a subdomain such as track.yourdomain.com with its own CNAME. Alternatively, disable open tracking entirely; it is unreliable now anyway, and removing tracking pixels reduces spam-filter triggers.

Authentication

4. Publish SPF, and keep it under 10 lookups

One v=spf1 record, all legitimate senders included, ending in -all once verified. Two SPF records is a hard failure. Exceeding 10 DNS lookups is also a hard failure — count your include: mechanisms.

5. Enable DKIM and confirm it is actually signing

Generating a DKIM key is not the same as switching signing on. In Google Workspace you must click "Start authentication" after publishing the record; in Microsoft 365 you must toggle DKIM on per domain after creating both CNAMEs. Verify by reading the Authentication-Results header of a test message — it must read dkim=pass.

6. Publish DMARC and progress past p=none

Start at p=none with a rua reporting address, review reports for two to four weeks, then move to quarantine and finally reject. A permanent p=none gives you reporting but no protection and no deliverability benefit. Full detail in our SPF, DKIM and DMARC guide.

Reputation

7. Warm up every inbox, and never stop

Three to four weeks of automated warm-up before real sending, then keep warm-up running permanently underneath live campaigns. Reputation decays when positive engagement stops. See how email warmup works for the full ramp schedule.

8. Check your domain and IP against blocklists

Before launch, check Spamhaus, Barracuda and SORBS. A listing explains an otherwise inexplicable collapse in placement. If you are listed, identify the cause before requesting delisting — relisting after a failed fix is much harder to reverse.

List quality

9. Verify every address, every time

Bounce rate is the fastest way to destroy a domain. Above 3% is a warning; above 5% providers begin filtering aggressively. Run every list through verification immediately before sending — not when you built the list, because B2B addresses decay at roughly 2% per month as people change jobs.

Remove catch-all domains, role accounts (info@, sales@, support@) and anything flagged risky. A smaller clean list outperforms a larger dirty one on every metric.

10. Never buy a list

Purchased lists carry spam traps — addresses that exist only to catch senders who did not collect their own data. A single pristine trap hit can blocklist your domain outright. Build lists from your own research and enrichment.

Volume and content

11. Keep per-inbox volume low and ramp gradually

Cap each mailbox at 30–50 sends per day. To send more, add inboxes rather than raising per-inbox volume. Spread sends across business hours with randomised intervals — 40 emails going out in one 60-second burst is a machine signature. Increase total volume by no more than 20–30% week over week.

12. Write copy that does not look like bulk mail

• Plain text, or close to it. Heavy HTML, multiple images and big styled buttons read as marketing. Person-to-person email is plain.

• Balanced text-to-link ratio. One link per message is plenty; three or more raises suspicion.

• No attachments in a first-touch cold email.

• Honest subject lines — no fake Re: or Fwd: prefixes. They damage trust and violate several jurisdictions' rules.

• Vary the content. Use spintax or template variants so hundreds of messages are not byte-identical.

• Short. Under 125 words tends to outperform, and gives filters less to object to.

• Genuine unsubscribe. A one-line opt-out honoured immediately reduces spam complaints, which matter far more to reputation than the handful of opt-outs it produces.

Monitoring after launch

The checklist does not end at send. Watch four numbers continuously:

MetricHealthyInvestigateStop sending Bounce rateUnder 2%2–5%Above 5% Spam complaint rateUnder 0.1%0.1–0.3%Above 0.3% Reply rateAbove 3%1–3%Under 1% — placement is likely the cause Inbox placement (seed test)Above 90%70–90%Under 70%

Maintain a seed list — your own addresses across Gmail, Outlook, Yahoo and a corporate Microsoft 365 tenant — and include it in every campaign. It is the only way to see placement directly rather than inferring it from opens.

What to do when deliverability drops

In order, because the cheapest checks are also the most common causes:

1. Pause sending. Continuing to send into a reputation problem deepens it.

2. Check authentication. A DNS change, expired key or new sending platform silently breaking DKIM is the single most frequent cause of a sudden drop.

3. Check blocklists. Quick, and immediately explanatory if positive.

4. Review the last campaign's bounce and complaint rates. A bad list segment usually shows up here.

5. Re-run a seed test to establish current placement per provider — the problem is often isolated to Microsoft or Google rather than universal.

6. Return to warm-up only for one to two weeks, then resume at half your previous volume.

Automating the checklist

Most of these twelve points are checks a platform can run for you. AlienMail validates SPF, DKIM, DMARC and tracking-domain configuration when you connect a mailbox, runs free unlimited warm-up on every inbox, verifies lists before send, rotates volume across mailboxes automatically, and tracks per-inbox health so a degrading mailbox is pulled before it damages the domain.

See the deliverability suite, or book a walkthrough.

Frequently asked questions

Why are my cold emails going to spam?

In order of frequency: DKIM not actually signing, no warm-up on a new domain, bounce rate above 5% from an unverified list, per-inbox volume too high, and a shared tracking domain. Work down the checklist above.

How do I test cold email deliverability?

Send to a seed list of your own addresses across Gmail, Outlook, Yahoo and a corporate Microsoft 365 tenant, and record where each message lands. Supplement with a seed-test service for broader coverage.

What is a good inbox placement rate?

Above 90% into the primary inbox. Between 70% and 90% signals a reputation issue worth investigating; below 70% means stop and diagnose before sending further.

How long does it take to recover from a deliverability drop?

If caught early and the cause is fixed, two to four weeks of warm-up-only sending typically restores placement. Domains with blocklist history or repeated complaint spikes may not fully recover.