Open main menu

Email Deliverability Audit Checklist: 10 Practical Checks

Use this email deliverability audit checklist to verify authentication, reputation, and list quality in 10 practical checks.

Thami BenjellounThami Benjelloun

•

Published on

•

Email Deliverability Audit Checklist: 10 Practical Checks

Table of Contents

Do not index
Do not index
An email deliverability audit checklist should verify authentication alignment, reputation, infrastructure, list quality, content, and engagement, but passing those checks doesn't guarantee inbox placement. Validity's 2025 benchmark recorded 84.8% inbox placement, 6.1% spam placement, and 9.1% missing mail, so roughly one in six messages failed to reach the visible inbox. Validity's 2025 benchmark report
Messages can be accepted by a receiving server and still land in spam, disappear into a filtered folder, or reach a mailbox location recipients rarely check. That creates the worst kind of revenue loss, campaigns appear to send successfully while engagement, conversions, and brand trust decline.
The following 12-check self-audit is designed for the first hour of an engagement. It covers five operational pillars and uses the same format throughout: a five-minute method, a pass criterion, and the consequence of failure. It can expose the obvious 20% of problems quickly. It won't replace raw-header analysis, historical reputation review, provider-specific testing, or investigation of how sending systems interact.
The five pillars are:
  • Authentication: SPF, DKIM, and DMARC presence and alignment
  • Reputation: blacklists and mailbox-provider signals
  • Infrastructure: PTR, FCrDNS, and sending-domain separation
  • List quality: bounces, verification cadence, and suppression rules
  • Content and engagement: spam triggers, complaints, and behavioral trends
A warmup plan, such as Lead Printer's warmup strategy, may matter when a new sending setup is being established, but warmup can't correct broken authentication, poor list acquisition, or sustained complaints.
Table of Contents
Authentication problems that make every other check harder1. Verify SPF presence and alignment2. Validate DKIM signatures and rotation3. Audit DMARC policy and alignmentReputation signals that reveal damage before open rates collapse4. Check blacklist status across major databases5. Review domain reputation in Postmaster ToolsInfrastructure checks that expose hidden sending risk6. Validate PTR records and FCrDNS7. Audit bounce rate and verification cadence8. Separate sending domains and third-party routersList quality determines whether authenticated mail is wanted9. Apply a sunset policy before engagement turns negativeContent and engagement checks that predict inbox visibility10. Scan content and headers for spam triggers11. Monitor complaint rate and engagement trend12. Measure visible mailbox placement, not just acceptance10-Point Email Deliverability Audit ComparisonWhat the checklist cannot seeFrequently asked questionsIs an email deliverability audit checklist enough to diagnose spam placement?What should be checked first?How often should the checklist be run?Does a passing delivery rate prove inbox placement?Can tools replace deliverability expertise?

Authentication problems that make every other check harder

Mailbox providers use SPF, DKIM, and DMARC to establish whether a message is authorized and whether the authenticated identity matches the visible From domain. Gmail and Yahoo's bulk-sender requirements now require SPF, DKIM, DMARC, and one-click unsubscribe for qualifying senders, making authentication a baseline control rather than an optional technical enhancement. The Gmail and Yahoo sender requirements also identify a 0.3% complaint threshold, with Gmail guidance aiming for under 0.1%.

1. Verify SPF presence and alignment

Five-minute method: Query the sending domain's TXT records, list every legitimate sending service, and compare the Return-Path domain with the From domain. A practical SPF checker can identify syntax problems, duplicate records, and missing authorization.
A valid example looks like this:
v=spf1 ip4:192.0.2.0 include:sendgrid.net include:mailwarm.io ~all
An aligned message might show:
Return-Path: sender@yourdomain.com From: noreply@yourdomain.com
A failure appears when the message uses:
Return-Path: sender@mail.yourdomain.com From: support@yourdomain.com
That subdomain relationship may not satisfy the alignment policy being applied. SPF also fails operationally when a team publishes multiple SPF records or forgets a CRM, transactional platform, or agency sender.
Pass criteria:
  • One valid SPF record exists for the relevant domain.
  • Every authorized sender is represented.
  • The Return-Path aligns with the From domain under the configured DMARC mode.
  • Unused services have been removed.
Fail meaning: Receiving systems can't reliably verify which infrastructure is authorized to send. The result can include more filtering, authentication failures in DMARC reports, bounces, and reputation damage that suppresses future campaigns.

2. Validate DKIM signatures and rotation

Five-minute method: Send a real test message to a controlled Gmail or Outlook mailbox, inspect the full headers, and confirm both the DKIM signature and the DNS public key. The header should resemble:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yourdomain.com; s=default; h=from:to:subject;
The selector in s=default identifies the DNS record that contains the public key:
v=DKIM1; k=rsa; p=MIGfMA0GCSq...[public key base64]
A valid signature proves that an authorized system signed the message and that protected content wasn't altered in transit. It doesn't, by itself, prove that recipients want the email. That distinction matters because authentication compliance and inbox visibility are different outcomes.
A practical rotation arrangement might use default as active, backup as staged, and an old selector as retired only after all sending systems have moved. A rushed rotation can invalidate messages still being generated by a legacy stream.
Pass criteria:
  • Every sending stream adds a valid DKIM signature.
  • The d= domain aligns with the From domain.
  • DNS contains the matching public key.
  • Old selectors remain available until queued or legacy traffic has stopped.
Fail meaning: A missing, invalid, or misaligned signature removes a major trust signal. Providers may filter the message, and DMARC reports may reveal configuration drift only after reputation has started to decline. Use the DKIM checker before and after DNS changes, then verify the Authentication-Results header on real mail.

3. Audit DMARC policy and alignment

Five-minute method: Query _dmarc.yourdomain.com, inspect the policy, and open recent aggregate reports. A record may look like:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; ruf=mailto:forensics@yourdomain.com; fo=1
DMARC passes when either aligned SPF or aligned DKIM passes. Alignment means the authenticated domain corresponds to the domain visible in the From address. A record's existence isn't enough. The policy mode, alignment behavior, reporting destination, and enforcement readiness all matter.
A sensible rollout starts with p=none while legitimate streams are identified, then moves toward p=quarantine or p=reject after reports show that authorized mail aligns. Gmail and Yahoo requirements specify at least p=none for qualifying bulk senders, but monitoring doesn't prevent spoofing. A 2026 DMARC dataset reported adoption at 52.1%, while more than half of those domains remained at p=none; another dataset in the same source reported enforcement across only 12.8% of scanned domains.
Pass criteria:
  • A DMARC record exists.
  • SPF or DKIM passes and aligns for every legitimate stream.
  • Aggregate reports reach a monitored destination.
  • The policy matches the organization's enforcement readiness.
Fail meaning: Spoofers can abuse the domain, legitimate mail can fail DMARC, and the team lacks visibility into unauthorized senders. A p=none policy can be appropriate during discovery, but it shouldn't be mistaken for protection.

Reputation signals that reveal damage before open rates collapse

Reputation isn't a single score. Gmail, Outlook, Yahoo, DNS blocklists, and individual receiving systems evaluate domain and IP history differently. A clean authentication setup can coexist with poor reputation when recipients complain, addresses bounce, or a shared infrastructure pool carries another sender's problems.

4. Check blacklist status across major databases

Five-minute method: List every outbound IP, tracking domain, and principal sending domain, then scan them against relevant real-time blocklists. Check services such as Spamhaus, Barracuda, and Proofpoint neutrally, because a listing's meaning depends on the specific list and the receiving provider's policy.
A result such as 192.0.2.100 listed on PBL requires context. Some lists describe policy or network configuration rather than malicious behavior. A domain listing after a complaint spike is more urgent than an isolated false positive involving a shared IP.
Pass criteria:
  • No material listing affects the IPs or domains used for important mail.
  • The team knows which lists each provider consults.
  • Alerts identify new listings quickly.
  • Delisting requests follow remediation, not merely denial.
Fail meaning: A listing can block, defer, or heavily filter mail at affected providers. Delisting without fixing the acquisition source, complaint pattern, or compromised account often produces a repeat listing. The immediate response should preserve logs, review bounce and complaint events, isolate the affected stream, and document the list's removal requirements.

5. Review domain reputation in Postmaster Tools

Five-minute method: Open Gmail Postmaster Tools and the relevant Microsoft sender dashboards, then compare domain reputation, authentication signals, complaint data, and warnings with the campaign calendar. The dashboard is most useful when the team can connect a reputation change to a list import, volume change, content shift, or infrastructure migration.
Mailbox-provider data should be segmented rather than averaged. Validity's benchmark found variation by provider, which is why Gmail, Yahoo, and Outlook testing belongs in an audit instead of relying on a single global number. Recent benchmark reporting also described sharper declines across Microsoft properties than at Gmail, reinforcing the need for provider-specific review.
Pass criteria:
  • The sending domain is verified in the relevant dashboards.
  • Reputation remains stable.
  • Authentication passes consistently across streams.
  • Complaint and delivery trends have an owner and review cadence.
Fail meaning: A falling provider reputation often precedes obvious campaign failure. Once users report spam placement, the domain may already have accumulated negative history. Teams should correlate provider data with raw headers, campaign segments, and sending volume rather than changing subject lines at random.

Infrastructure checks that expose hidden sending risk

Infrastructure problems are often invisible in marketing reports. A campaign can show an accepted status while receiving servers evaluate reverse DNS, domain consistency, routing, and the relationship between marketing and transactional streams.

6. Validate PTR records and FCrDNS

Five-minute method: Identify each dedicated outbound IP, perform a reverse lookup, and then resolve the returned hostname forward. A valid result might be:
192.0.2.100 PTR mail.yourdomain.com
The forward lookup for mail.yourdomain.com should return 192.0.2.100. That two-way match is forward-confirmed reverse DNS, or FCrDNS.
A broken result points to a generic provider hostname that doesn't resolve to the sending IP. A missing PTR record returns no hostname at all. Major email service providers often manage this automatically, but self-hosted, hybrid, and newly provisioned dedicated IP environments still need explicit verification.
Pass criteria:
  • Every dedicated sending IP has a PTR record.
  • The PTR hostname resolves back to the same IP.
  • The hostname is documented and consistent with the sending arrangement.
  • New IP onboarding includes a reverse-DNS check.
Fail meaning: Receiving systems have less evidence that the sender controls the infrastructure. That can increase filtering or delays, especially when list quality and complaint signals are already weak. The IP owner or hosting provider must correct PTR and FCrDNS. A message-level content change won't solve an infrastructure identity problem.

7. Audit bounce rate and verification cadence

Five-minute method: Export recent provider bounce data, separate hard and soft failures, and trace the worst sources back to signup forms, imports, purchased data, or old segments. The widely used benchmark is under 2% total bounce rate, with hard bounces ideally under 1%. The bounce-rate benchmark makes this a concrete reputation control rather than a vague list-hygiene preference.
A team might see a 1.5% rate and treat it as acceptable while ignoring a sudden rise from a previously stable baseline. That is why trend and source matter. Verification should occur at collection, during recurring list maintenance, and before reactivation or win-back activity.
Pass criteria:
  • Total bounce rate remains under the benchmark.
  • Hard bounces are suppressed immediately.
  • Signup validation catches obvious invalid addresses.
  • Verification cadence matches acquisition volume and list age.
Fail meaning: Repeated bounces tell mailbox providers that the sender doesn't control address quality. Filtering can worsen, and the business pays for failed sends while losing opportunities from unreachable prospects. A verification service can reduce obvious errors, but it won't justify sending to people who never consented or haven't engaged.

8. Separate sending domains and third-party routers

Five-minute method: Build a sender inventory showing each domain, subdomain, provider, IP range, stream, and authentication method. Compare the visible From address, DKIM signing domain, Return-Path, and third-party routing configuration.
A clean structure separates corporate identity from sending streams:
  • company.com for core corporate and selected transactional mail
  • mail.company.com for marketing campaigns
  • news.company.com for newsletters
An agency or API provider should send through delegated subdomains with its own aligned SPF and DKIM configuration. It shouldn't use the primary domain with infrastructure the domain owner hasn't authorized.
Pass criteria:
  • Every sender is documented.
  • Marketing and transactional streams have clear ownership.
  • Third parties use authenticated, aligned subdomains.
  • Provider changes trigger a DNS and header review.
Fail meaning: A complaint spike in one stream can contaminate a domain used for more valuable mail. Sender confusion also makes DMARC reports difficult to interpret. Teams handling cold email deliverability should be especially careful not to combine prospecting traffic with customer-critical transactional mail.

List quality determines whether authenticated mail is wanted

Authentication answers whether a sender is authorized. List quality answers whether recipients recognize and want the messages. Mailbox providers observe both, and a clean DNS configuration can't compensate for a list that generates persistent bounces, complaints, and disengagement.

9. Apply a sunset policy before engagement turns negative

Five-minute method: Segment the database by recent opens, clicks, replies, purchases, and other meaningful actions. Identify the inactive segment, review its acquisition source, and confirm that it has a re-engagement path followed by suppression.
A sunset policy doesn't require deleting every inactive contact immediately. It should define when regular campaigns stop, when a final permission or re-engagement message is sent, and when the address is suppressed from routine mail. The correct period depends on the business's purchase cycle and message purpose.
Pass criteria:
  • Hard bounces and complainers are suppressed.
  • Inactive recipients don't remain in every campaign by default.
  • Re-engagement has a defined endpoint.
  • Segments are reviewed by acquisition source and message type.
Fail meaning: Continuing to mail disengaged recipients increases the chance of complaints and weak engagement signals. That can lower inbox visibility for active recipients too, reducing conversions from the same campaign and weakening brand recognition. Suppression sacrifices some reachable addresses, but preserving a large inactive audience can cost more through reputation damage.

Content and engagement checks that predict inbox visibility

A message can pass SPF, DKIM, and DMARC and still look suspicious, arrive in an unexpected tab, or generate complaints. Content, sender recognition, frequency, unsubscribe friction, and engagement trends all influence whether recipients treat the message as wanted.

10. Scan content and headers for spam triggers

Five-minute method: Inspect the subject, preheader, From name, Reply-To address, body text, links, images, MIME structure, and unsubscribe mechanism. Send a real message to a test mailbox, then review the Authentication-Results header and the rendered message.
A poor example combines FREE MONEY NOW!!!, an all-caps body, and a dense collection of links. A cleaner alternative uses descriptive language, normal capitalization, a restrained link set, and a text explanation above the primary image. An image-only template also creates accessibility and trust problems, because recipients and filters see little meaningful text.
A From address such as noreply@yourdomain.com paired with Reply-To: sales@otherdomain.com can create sender confusion. If the mismatch is necessary, the reason should be clear to the recipient and consistent across campaigns.
Pass criteria:
  • Subject and body use clear, non-misleading language.
  • Links resolve to trusted destinations.
  • Text remains meaningful without images.
  • From, Reply-To, DKIM, and tracking domains are coherent.
  • Unsubscribe controls are visible and easy to use.
Fail meaning: Content signals can push authenticated mail into spam and provoke complaints. A pre-send review using spam trigger words can catch obvious issues, but a tool can't judge whether the audience expects the message or whether a sudden content change will alter engagement.

11. Monitor complaint rate and engagement trend

Five-minute method: Review complaints, unsubscribes, opens, clicks, replies, and conversions by provider, segment, campaign type, and send frequency. The practical expectation is to stay under 0.1% complaints, while Gmail and Yahoo requirements set 0.3% as the relevant enforcement threshold for qualifying bulk senders. Sender's explanation of the Gmail and Yahoo rules notes that Yahoo calculates spam rate using mail delivered to the inbox, so teams must understand what each reporting system counts.
A complaint rate of 0.08% may look acceptable in isolation, but an upward trend after a list import or frequency increase deserves attention. Engagement is a leading signal, while complaints often arrive after recipients have already lost interest.
Pass criteria:
  • Complaints remain under the practical benchmark.
  • Trends are reviewed by mailbox provider and campaign.
  • Unsubscribe and preference controls work immediately.
  • Falling engagement triggers segmentation or frequency changes.
Fail meaning: Complaints can accelerate reputation decline and increase filtering. Lower engagement also means fewer people see or act on paid acquisition, lifecycle, and promotional messages. The right response is usually to suppress or segment the affected audience, not to send more aggressively in an attempt to recover volume.

12. Measure visible mailbox placement, not just acceptance

Five-minute method: Compare provider delivery events with seed-mailbox tests and real recipient signals. Check Gmail, Outlook, and Yahoo separately, inspect whether mail reaches the inbox or another visible mailbox location, and compare results with open and click trends.
Delivery rate is not the same as inbox placement. A 2025 report found that only 12% of respondents knew delivery rate means acceptance into any folder, not necessarily the inbox. Mailjet's deliverability takeaways also reported that only 60% of emails reached a visible mailbox location when Gmail's Promotions and Updates tabs were counted.
Pass criteria:
  • The team distinguishes accepted mail from visible mailbox placement.
  • Testing includes major providers.
  • Results are segmented by stream, domain, and campaign.
  • Engagement trends are interpreted alongside placement evidence.
Fail meaning: A dashboard can show successful delivery while recipients never notice the message. That creates false confidence, delays remediation, and hides lost conversions. Sender recognition, consistent content, placement, and recipient behavior must be evaluated together.

10-Point Email Deliverability Audit Comparison

Item
Implementation complexity
Resource requirements
Expected outcomes
Ideal use cases
Key advantages
Verify SPF Record Presence and Alignment
Low–Medium, DNS edits and syntax checks
DNS access, SPF checker, list of authorized senders
SPF pass rates improve; reduced spoofing risk
Initial authentication setup; multi-service senders
Fast impact, required by providers, foundation for DMARC
Validate DKIM Signatures and Key Rotation
Medium, key management and DNS publishing
Secure private key storage, DNS TXT/CNAME, DKIM testing tools
Cryptographic proof of authorship; tamper protection
High-volume senders, third-party relay use, long-term auth
Independent of IP reputation; enables DMARC enforcement
Audit DMARC Policy Configuration and Alignment
Medium–High, policy tuning and report analysis
DMARC DNS record, report parser/service, SPF/DKIM alignment work
Centralized visibility, policy-based enforcement, spoof protection
Brand protection, phased enforcement of senders
Industry standard for enforcement; actionable aggregate reports
Check Blacklist Status Across Major Databases
Low, scanning and triage
RBL scanner, monitoring/alerting, incident response plan
Identifies blocking listings and delisting actions
Post-incident triage; sudden delivery failures
Rapid detection of critical blocks; clear remediation paths
Review Domain Reputation in Postmaster Tools
Medium, account setup and ongoing review
Domain verification, Postmaster dashboards, analyst time
Provider-specific reputation scores, auth and complaint metrics
Ongoing reputation monitoring for Gmail/Outlook sends
Direct mailbox-provider signals; early warning of decline
Validate PTR Records and Reverse DNS (FCrDNS)
Low–Medium, provider coordination required
ISP/hosting cooperation, reverse DNS lookup tools
Confirms IP ownership; baseline reputation signal met
Self-hosted or dedicated IP senders
Quick check trusted by ISPs; complements SPF/DKIM/DMARC
Audit Bounce Rate and Email Verification Cadence
Low–Medium, measurement and cleanup workflows
Mail provider reports, verification service, list hygiene process
Lower bounce rates, improved deliverability and reputation
List maintenance, large sends, onboarding flows
Directly improves reputation; measurable benchmark (<2%)
Analyze Spam Complaint Rate and Engagement Trends
Medium, analytics and segmentation
Reporting tools, segmenting, content review process
Detects content/frequency issues; actionable engagement insights
Content optimization, preventing inbox placement decline
Predictive signal for reputation; drives targeted fixes
Scan Content and Headers for Spam Triggers
Low, template QA and automated scans
Spam-word checker, HTML/MIME validator, copy review
Fewer content-based filter hits; better inbox placement
Pre-send QA, campaign testing
Low-cost prevention; fixes are often simple and immediate
Verify Sending Domain Separation and Third-Party Router Configuration
High, DNS design and cross-vendor coordination
DNS management, documentation, provider onboarding/testing
Isolates reputation, prevents cross-contamination, clearer auth
Organizations with multiple senders or agencies
Segments reputation, faster remediation, safer third-party use

What the checklist cannot see

These 12 checks establish baseline hygiene across five pillars. Authentication confirms that sending systems are authorized and aligned. Reputation checks expose blocklists and provider warnings. Infrastructure verifies reverse DNS and stream separation. List quality controls bounces and disengagement. Content and engagement reveal whether recipients recognize, want, and act on the messages.
A pass doesn't guarantee inbox placement. Validity's global benchmark recorded 9.1% missing mail, and provider variation means a global average can conceal a serious Outlook or Yahoo problem. Another 2025 benchmark described global inbox placement at roughly 83.5%, with the missing category remaining material. The benchmark reporting supports a practical conclusion: deliverability is a moving operating condition, not a DNS installation project.
A professional review adds evidence that a first-hour checklist cannot reliably interpret:
  • Raw-header and SMTP analysis: Headers reveal which system signed, routed, filtered, or rewrote the message. SMTP responses distinguish temporary deferrals from permanent policy blocks.
  • Provider segmentation: Gmail, Outlook, and Yahoo may treat the same campaign differently. A blended dashboard can hide the provider responsible for lost visibility.
  • Historical review: Volume changes, pauses, list imports, complaint spikes, and infrastructure migrations need to be mapped against reputation movement.
  • DMARC report interpretation: Aggregate reports identify unauthorized sources, alignment failures, and streams that a DNS-only review misses.
  • Campaign diagnosis: Subject, content, frequency, audience, and routing changes must be correlated with complaints and engagement.
  • Controlled remediation: Fixes need sequencing. Changing five variables at once makes it impossible to know which intervention helped or created a new problem.
  • Follow-up monitoring: A corrected record can pass a syntax test while production traffic continues failing through a different sender or provider.
Operational cadence matters. Review authentication and blacklist status after DNS or infrastructure changes. Review bounces and complaints weekly. Inspect engagement and provider reputation trends regularly. Reassess the full checklist at least quarterly, and repeat it after a major sending-system, domain, audience, or volume change.
MailAdept combines AI agents with human experts for subscription-based deliverability consulting, but it doesn't guarantee inbox placement. The value of expert review is not a promise of a particular folder. It's the ability to connect technical evidence, provider behavior, historical reputation, and commercial impact before a small configuration error becomes a sustained revenue problem.
Still facing deliverability issues? Get a free deliverability audit.

Frequently asked questions

Is an email deliverability audit checklist enough to diagnose spam placement?

It's enough to find common failures in authentication, infrastructure, reputation, list quality, content, and engagement. It isn't enough to explain every provider-specific filtering decision, because that requires headers, historical data, segmentation, and placement testing.

What should be checked first?

Start with SPF, DKIM, and DMARC alignment, then review active blacklist listings, complaints, and bounces. Broken authentication and active reputation problems can affect delivery before content refinements make a meaningful difference.

How often should the checklist be run?

Authentication and blacklist checks should follow DNS or infrastructure changes. Bounces and complaints should be reviewed weekly, while the complete checklist should be reassessed at least quarterly or after a major sending change.

Does a passing delivery rate prove inbox placement?

No. Delivery generally means a receiving system accepted the message, not that it reached the inbox or a visible mailbox location. Seed testing, provider segmentation, headers, and engagement trends provide a more useful picture.

Can tools replace deliverability expertise?

Tools can validate records, identify obvious blocklist entries, and surface trends. They can't consistently interpret provider-specific behavior, correlate multiple sending systems, or design controlled remediation without operational context.
MailAdept combines AI agents with human deliverability experts to review authentication, routing, reputation, list quality, provider behavior, and ongoing monitoring. Teams that want this 12-check self-audit connected to raw data and practical remediation can visit Mailadept to discuss a deliverability program built around their sending environment.

Fix Your Email Deliverability Before It Costs You Revenue

Get expert insights on why your emails go to spam and how to consistently reach the inbox.

Get a Free Deliverability Audit
Thami Benjelloun

CEO Mailwarm, email deliverability expert.