Cold Email Deliverability Checklist: SPF, DKIM, DMARC

Your message can be well written and perfectly targeted, and still never be read. If it lands in spam, nobody sees it.

Deliverability is the set of things that decide where your email lands. Here is a cold email deliverability checklist you can work through before you send.

Why does cold email deliverability matter?

Because mailbox providers protect their users. Gmail, Yahoo and others filter aggressively, and they judge senders by authentication, complaints, bounces and engagement. A poor reputation sends everything to spam, including your normal email if you share a domain.

Google publishes its expectations in its email sender guidelines and an accompanying FAQ. Yahoo publishes its sender requirements. Read both before you send.

Checklist item 1: use a separate domain

Do not send cold email from your main domain. Register one or more domains for outbound, close to your brand, and set up mailboxes on them. That way, any damage to reputation stays contained.

Redirect the domains to your main site, and give them a simple, professional presence.

Checklist item 2: set up SPF

SPF tells receivers which servers may send mail for your domain. It is defined in RFC 7208. You publish a DNS record that lists your sending services, and receivers check it. Keep the record accurate and avoid listing more services than you need.

Checklist item 3: set up DKIM

DKIM adds a digital signature to each message, so receivers can check that it was not altered and that your domain authorised it. It is defined in RFC 6376. Your email provider will give you the keys and the DNS records to publish.

Checklist item 4: set up DMARC

DMARC ties SPF and DKIM together and tells receivers what to do when checks fail. It is defined in RFC 7489. Start with a monitoring policy, review the reports and move to stricter policies as you gain confidence. Make sure the domain in the From address aligns with the domains that pass SPF and DKIM.

Checklist item 5: make unsubscribing easy

Include a clear opt-out in every message. For bulk senders, Google and Yahoo expect one-click unsubscribe, described in RFC 8058. Honour opt-outs promptly and keep a suppression list. In the United States, the FTC’s CAN-SPAM guide for business requires a working opt-out and says commercial email rules apply to business-to-business messages too.

Checklist item 6: warm up gradually

New mailboxes have no reputation. Start with a small number of messages per day, mostly to people likely to reply, and increase slowly over weeks. Spread volume across several mailboxes and domains instead of pushing one hard.

Watch the signals as you go: bounces, replies and complaints. If they worsen, slow down.

Checklist item 7: verify and clean your list

Bad data is the fastest way to damage a domain. Verify every address, remove role-based and risky addresses, and remove bounces at once. Source contacts carefully, record where each came from and respect opt-outs.

Send only to people for whom your message is relevant. Relevance lowers complaints, and complaints are what mailbox providers watch most closely.

Checklist item 8: keep complaints very low

Google’s guidelines say senders should keep their spam rate, as reported in Postmaster Tools, low, and avoid reaching 0.30 percent. Check the current page for exact figures, because they can change. Treat any rise as an early warning: pause, review the list and message and fix the cause.

Checklist item 9: write messages that behave

Short, plain and relevant. Avoid misleading subject lines, heavy images, large attachments and link shorteners. Include your real name and a way to contact you. Do not use tricks to disguise who you are.

Industry groups publish guidance on good sending practice, for example the Messaging, Malware and Mobile Anti-Abuse Working Group.

Checklist item 10: monitor and review

Check Postmaster Tools, bounce rates, reply rates and complaints weekly. Run a periodic test of authentication. Keep notes on what you change and what happens. If results fall, pause before you damage the domain.

What mistakes damage deliverability fastest?

Sending to unverified lists. Ramping volume too quickly. Using one domain for everything. Ignoring opt-outs. And writing messages that look like mass mail.

Another is ignoring the signals. A rise in bounces or complaints is the earliest warning you will get. Pause, fix and restart gently.

How do you test before a full send?

Send a small batch to a seed list of mailboxes you control across several providers, and check where each message lands. Look at the headers to confirm that SPF, DKIM and DMARC pass and that the From domain aligns. Check links and images, and view the message on a phone.

Repeat the test whenever you change the sending service, the template or the DNS records. A few minutes of testing is cheaper than a week of recovering from a poor first impression.

What should a monthly review cover?

Look at the trend in bounces, complaints, replies and positive replies by domain and mailbox. Review the list sources and remove any that perform poorly. Check that opt-outs are being honoured everywhere, and that DNS records have not changed. Write down what you changed and what happened, so that the next review starts from facts.

How do you recover a damaged domain?

Stop sending cold email from it. Fix authentication and clean your list. Reduce volume dramatically when you restart, and send only to engaged contacts. Monitor reputation for several weeks. If damage is severe, consider retiring the domain and starting again with better practice.

Recovery takes time, so prevention is worth the effort.

What should you do first?

Check your DNS records for SPF, DKIM and DMARC. Fix anything that fails. Set up a separate outbound domain if you have not. Then verify your list and start with low volume.

For related reading, see cold email for B2B SaaS, outbound lead generation agency vs hiring SDRs and how Indian SaaS companies run outbound. See also our cold email and outbound service and our page for B2B SaaS, or book a free pipeline diagnostic.