You wrote the perfect cold email. Great subject line, relevant offer, solid call to action. But none of it matters if the message lands in spam — or never arrives at all.

That's where an email deliverability checklist comes in. Not a vague list of "best practices," but a concrete, step-by-step system that covers every layer between clicking send and reaching the inbox.

A significant share of business emails never reach the primary inbox. For B2B outbound teams sending cold emails without proper infrastructure, inbox placement rates can be surprisingly low — and most teams don't even realize it.

This checklist covers 12 steps, organized in the order you should tackle them. Nail these, and you'll maximize your inbox placement rate.

1. Start With Clean Data

Most deliverability guides skip this step entirely. They jump straight to SPF records and warmup tools. But the single fastest way to wreck your sender reputation is sending to bad email addresses.

Hard bounces are deliverability poison. Gmail and Microsoft track your bounce rate at the domain level. Cross the 2% threshold and your entire domain gets throttled — not just the campaign that caused it.

Before you worry about anything else on this checklist:

• Verify every email address before adding it to any outbound sequence. Use an email verification API that checks syntax, MX records, and mailbox existence.

• Handle catch-all domains carefully. Catch-all domains accept all emails at the server level, so verification tools can't confirm individual addresses. Some verification providers — like FullEnrich, which runs triple verification across multiple providers — can validate up to 80% of catch-all emails. Use one that offers this level of verification depth.

• Never buy or scrape email lists. Purchased lists are loaded with spam traps, dead addresses, and people who never opted in. One campaign to a bad list can take months to recover from.

• Remove role-based addresses like info@, sales@, support@. These rarely belong to individual prospects and often trigger spam filters.

Data quality isn't a one-time task. It's the foundation everything else in this checklist sits on.

2. Authenticate Your Sending Domain

Email authentication tells inbox providers that you are who you claim to be. Without it, your emails look identical to phishing attempts — and get treated accordingly.

Three protocols matter. All three are mandatory in 2026.

SPF (Sender Policy Framework)

SPF tells receiving servers which IP addresses are authorized to send email on behalf of your domain. Add a TXT record to your DNS that includes every service you send from — your email platform, your outreach tool, your transactional email provider.

Watch the lookup limit. SPF allows a maximum of 10 DNS lookups. Exceed that, and the entire SPF check fails silently. If you use multiple sending services, audit your record regularly.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email you send. The receiving server checks this signature against a public key published in your DNS. If it matches, the email is verified as unaltered in transit.

Use 2048-bit keys for stronger security. Most email platforms generate DKIM keys automatically — you just need to publish the DNS record they provide.

DMARC (Domain-based Message Authentication)

DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. Start with p=none (monitor mode) to collect reports on who's sending email from your domain. Once you've confirmed all legitimate senders are authenticated, tighten to p=quarantine or p=reject.

Google, Yahoo, and Microsoft now require DMARC for bulk senders. Without it, your emails are far more likely to land in spam — especially at scale.

3. Use a Dedicated Sending Domain

Never send cold emails from your primary business domain. If a cold campaign damages your sender reputation, it drags down everything else — your CEO's investor emails, your support team's replies, your marketing newsletters.

Set up a separate cold email domain for outbound prospecting. Something like getcompany.com or trycompany.io. Set up SPF, DKIM, and DMARC on this domain too — it needs its own full authentication stack.

Use your primary domain for transactional emails (order confirmations, password resets) and internal communication. Keep it clean.

4. Warm Up New Domains and IPs

A brand-new domain has zero sending history. Inbox providers treat unknown senders as suspicious by default. If you start blasting 500 cold emails from a fresh domain on day one, you'll land in spam almost immediately.

Warmup means gradually building a positive sending history. Start by sending a small number of emails to engaged contacts, then increase volume slowly over 2–4 weeks. Email warmup tools automate this by generating realistic email activity — sends, opens, replies, and inbox moves — that signal to providers your domain is legitimate.

Key warmup rules:

• Start with 10–20 emails per day and ramp up gradually

• Send to engaged recipients first (people who have replied before)

• Keep warmup running even after you start real campaigns — it protects your reputation continuously

• Monitor bounce rates and spam complaints daily during warmup

5. Set Up a Custom Tracking Domain

Most outreach tools track opens and clicks by routing links through shared tracking domains. The problem: those shared domains get abused by other senders, and spam filters learn to flag them.

Set up a custom tracking domain (a subdomain of your sending domain, like track.getcompany.com). This isolates your tracking reputation and prevents your emails from being penalized for someone else's behavior.

Make sure your tracking domain uses HTTPS. Unencrypted tracking links are a red flag for modern spam filters.

6. Clean Your Email List Regularly

List hygiene isn't a launch-day task — it's ongoing maintenance. Email addresses decay over time. People change jobs, companies get acquired, domains expire. A list that was 95% valid six months ago might be 80% valid today.

Build these habits:

• Remove hard bounces immediately. Never retry an address that hard-bounced. Add it to your suppression list permanently.

• Treat repeated soft bounces as invalid. If an address soft-bounces 3+ times in a row, remove it.

• Re-verify your list every 90 days. Email addresses go stale faster than most teams expect.

• Maintain a master suppression list. Include all bounced addresses, unsubscribes, and spam complaints. Check every outbound email against this list before sending.

For a deeper dive on the tools and workflows that keep your list clean, see our guide to email deliverability tools.

7. Write Content That Passes Spam Filters

Authentication and list hygiene get your email to the server. Content determines whether it reaches the inbox or gets filtered.

Modern spam filters use machine learning — they don't just scan for trigger words. They analyze patterns, formatting, link density, and whether your email looks like something a real person would send.

Subject lines:

• Keep them short (3–7 words). Avoid ALL CAPS and excessive punctuation.

• Don't use clickbait or misleading language. The subject should match the content.

• Skip classic spam triggers: "free," "act now," "limited time," "congratulations."

• Check out our guide on cold email subject lines for formulas that work.

Email body:

• Keep it short and text-heavy. Avoid large images, fancy HTML templates, and embedded media.

• Minimize links — one or two maximum. Every additional link increases spam risk.

• Don't use URL shorteners (bit.ly, tinyurl). Use full, visible URLs on trusted domains.

• Include a plain text version alongside HTML.

• Personalize beyond first-name tokens. Reference the recipient's company, role, or recent activity.

Signatures:

• Send from a real person's name and email address — not info@ or noreply@.

• Skip image-heavy signatures with logos and banners. They trigger promotion and spam filters.

8. Follow Smart Sending Practices

How you send matters as much as what you send. Inbox providers track your sending patterns and flag anything that looks unnatural.

• Cap daily volume at 50–100 emails per inbox. Lower is better for deliverability. If you need higher volume, use multiple inboxes across different domains.

• Space emails throughout the day. Sending 100 emails in a 10-minute burst looks automated. Spreading them across business hours looks human.

• Keep volume consistent. Don't go from 20 emails a day to 200 overnight. Sudden spikes trigger throttling.

• Limit follow-ups to 2–3 per sequence. More follow-ups mean more spam complaints. Space them at least 3 days apart.

• Send on weekdays during business hours. Emails sent at 3 AM on a Sunday look suspicious to both filters and recipients.

For the full playbook on structuring your outbound approach, see our cold email strategies guide.

9. Include a Clear Unsubscribe Option

This sounds basic, but it's one of the most impactful items on this checklist. No unsubscribe link = more spam complaints. And spam complaints hurt your reputation far more than unsubscribes do.

Gmail and Yahoo now require a one-click unsubscribe mechanism for bulk senders. Even for cold outreach, including an easy opt-out reduces complaints and protects your domain.

Use a real, working link — not "reply STOP to unsubscribe." Process unsubscribe requests within 48 hours and add those addresses to your suppression list permanently.

10. Monitor Your Sender Reputation

Your sender reputation is a score that inbox providers assign to your domain and IP based on your sending history. A good reputation means inbox placement. A bad one means spam or silent drops.

Two reputations matter:

• Domain reputation — tracks your sending domain across all IPs. This is increasingly the primary signal Gmail uses.

• IP reputation — tracks the specific IP address you send from. Matters more for dedicated IP setups.

Monitor both regularly using tools like Google Postmaster Tools, Sender Score, and MxToolbox. Check blacklists weekly — a single listing on Spamhaus or Barracuda can tank your deliverability overnight.

If you're unsure whether you need help with monitoring, our guide on email deliverability best practices covers the full monitoring stack.

11. Track the Right Metrics

You can't fix what you don't measure. Here are the metrics that actually tell you whether your deliverability is healthy:

• Bounce rate: Keep below 2%. Above 5% is an emergency.

• Spam complaint rate: Keep below 0.1%. Google starts throttling above 0.3%.

• Inbox placement rate: Percentage of emails that reach the primary inbox (not just "delivered"). Target the highest rate your domain can achieve.

• Open rate: Useful directionally, but less reliable since Apple's Mail Privacy Protection inflates numbers. Use clicks and replies as secondary signals.

• Reply rate: The clearest signal that real humans are engaging with your emails. Positive engagement improves inbox placement over time.

Review these metrics daily during campaign launches and weekly for ongoing sends. Set up alerts for sudden drops — deliverability problems compound fast.

12. Stay Compliant With Email Regulations

Compliance isn't just legal protection — it directly affects deliverability. Inbox providers favor senders who follow the rules.

• CAN-SPAM (US): Include your physical address, don't use misleading subject lines, honor opt-out requests within 10 business days.

• GDPR (EU): Requires legitimate interest or consent for B2B email. Document your legal basis for each contact.

• Google/Yahoo 2024+ requirements: SPF, DKIM, and DMARC authentication. One-click unsubscribe. Spam complaint rate below 0.3%. These are enforced, not optional.

Non-compliance doesn't just risk fines. It signals to inbox providers that you're not a trustworthy sender — and they adjust your placement accordingly.

Your Quick Pre-Send Checklist

Before you launch any email campaign, run through this quick sanity check:

1. Are all email addresses verified within the last 90 days?

2. Is your sending domain authenticated with SPF, DKIM, and DMARC?

3. Are you sending from a dedicated cold email domain (not your primary)?

4. Has the domain been warmed up for at least 2 weeks?

5. Is your daily send volume within 50–100 per inbox?

6. Does the email have a clear, working unsubscribe link?

7. Is the content clean — minimal links, no URL shorteners, no image-heavy formatting?

8. Are you spacing sends throughout the day?

9. Are hard bounces, unsubscribes, and complaint addresses on your suppression list?

10. Have you checked your domain against major blacklists?

If any answer is "no," fix it before you hit send. Each item on this list represents a failure mode that can damage your reputation for weeks.

What to Do When Deliverability Drops

Even with everything in place, deliverability can dip. Here's how to diagnose and recover:

Check your bounce rate first. A sudden spike in bounces usually means bad data entered your list. Pause sending, re-verify the list, and remove all invalid addresses before resuming.

Check blacklists. Use MxToolbox to scan major blacklists. If you're listed, most have a delisting process — but it takes time. Identify what triggered the listing (usually a spam trap hit or complaint spike) and fix the root cause.

Review spam complaints. If complaints are rising, your content or targeting is off. You're either reaching the wrong people or your messaging feels too aggressive. Tighten your audience and tone down the pitch.

Slow down sending volume. If inbox providers are throttling you, reduce volume by 50–75% and rebuild gradually. This mimics the warmup process and shows providers you've corrected course.

Consider professional help. If deliverability stays low after troubleshooting, an email deliverability consultant can audit your infrastructure and identify issues you might be missing.

Build the Foundation, Then Send

Email deliverability isn't a set-it-and-forget-it task. It's an ongoing discipline — verify your data, authenticate your domains, warm up gradually, write clean content, monitor your metrics, and fix issues fast.

The teams that treat deliverability as infrastructure (not an afterthought) are the ones consistently booking meetings from cold outreach. The ones who skip steps end up wondering why their open rates are in single digits.

Start at the top of this checklist, work through it step by step, and keep it running as a regular operating rhythm. Your inbox placement — and your pipeline — will thank you.