The cold email deliverability checklist: 18 checks before every send

Deliverability is not one thing. It is five small groups of decisions that compound: what your domain says about you, what your mailbox has done lately, who is on the list, what the message looks like to a filter, and how you behave once you start sending. Most teams fix one group and wonder why replies still fall. This checklist covers all five, with a plain rule for each and a note on what breaks if you skip it.

1. Domain: what receivers can verify about you

1. SPF is published and includes every sender

One v=spf1 record per domain listing every service that sends as you — your mailbox provider, your transactional tool, your CRM. Keep it under the ten-lookup limit; a record that exceeds it fails silently. Skip it and Gmail treats your mail as unauthenticated, which for bulk senders is a hard fail.

2. DKIM signs every outbound message

Your provider gives you a selector and a public key to publish as a TXT record. Check that outgoing mail actually carries a DKIM-Signature header and that it passes on receipt. A 2048-bit key is standard; if your DNS host truncates long records, use a shorter key or split the record — an unpublished key is worse than a short one.

3. DMARC exists, and it is aligned

Publish _dmarc with at least p=none and a reporting address. Alignment matters more than policy: the domain in the From header must match the SPF or DKIM domain. See which DMARC policy to run for cold email and how to move up safely.

4. The sending domain is old enough

Receivers distrust domains under about thirty days old. If you must use a fresh domain, ramp it slowly (section 5) and do not put it on the same footing as a domain with a year of history. Never send cold email from your primary company domain if you can avoid it — a blocklisting there stops invoices, support and hiring mail too.

5. A custom tracking domain, if you track at all

Open and click tracking rewrites links through a tracking host. If that host is shared with thousands of other senders, their reputation becomes yours. Use a subdomain you control, or turn tracking off for cold email — reply rate is the metric that matters anyway.

2. Mailbox: what you have done lately

6. Bounce rate under 2%

Hard bounces tell receivers your list was not verified. Above 2% on any mailbox, stop, re-verify, and remove everything that bounced. Above 5% you are already being throttled.

7. Complaint rate under 0.3% — aim for 0.1%

Google's bulk-sender rule sets the ceiling at 0.3%; sustained rates above 0.1% already cost you inbox placement. Complaints come from relevance and volume, not from copy. Fewer, better-targeted sends is the only durable fix.

8. Daily volume matches the mailbox's history

A mailbox that sent twelve emails yesterday and four hundred today looks compromised. Caps should grow gradually and be per mailbox, with a hard ceiling that nobody can raise past what the reputation supports. This is the single rule most sequencers let you break.

9. Not on a blocklist

Check the sending IP and domain against Spamhaus, Barracuda and the major DNSBLs before a campaign and daily during one. A listing is a stop signal, not a warning.

3. List: who you are sending to

10. Every address verified before it enters a sequence

Syntax, MX record, mailbox existence, catch-all detection. Catch-all domains accept everything and bounce later; treat them as risky and send lower volume to them.

11. Suppression is global and honoured everywhere

Unsubscribes, bounces, complaints and “not interested” replies must suppress the contact across every sequence, every mailbox and every user in the workspace — not just the one campaign they came from.

12. Contact pressure is limited

No person should receive touches from two of your sequences in the same week, and no company should be hit by ten of your reps at once. A global pressure limit is the difference between outreach and a complaint.

13. Role and free-mail addresses are handled deliberately

info@, sales@ and personal Gmail addresses convert poorly and complain readily. Exclude them by default; include them only with a reason.

4. Message: what a filter sees

14. Plain text, or HTML with a text part and few links

Cold email should read like a person wrote it: one or two links at most, no images, no tracking pixels if you can help it, a real signature. Under about thirty words there is nothing to judge but the links; over roughly 250, replies fall regardless.

15. One-click unsubscribe header

List-Unsubscribe and List-Unsubscribe-Post (RFC 8058), honoured within two days. Required for bulk senders and a good idea for everyone — a visible way out is cheaper than a complaint.

16. No spam-trigger structure

Not words — structure. All-caps subject lines, exclamation marks, URL shorteners, mismatched link text, attachments on a first touch, and “Re:” on a message that is not a reply. Filters learned these patterns long ago. The 16 structural rules are worth reading once.

5. Behaviour: how you send

17. Recipient-local send windows

Send in the recipient's working hours, on their working days, spaced out rather than in a burst at 09:00. It looks human, it replies better, and it keeps per-minute volume flat.

18. Sequences stop on a real reply

Nothing damages reputation like a follow-up to someone who already said yes — or no. Out-of-office replies should not stop a sequence; every other reply should, immediately, across the whole thread.

Putting it together

Most of these checks are measurable, which means they can be enforced rather than remembered. Quotarider's guardrail scores reputation, history, contact pressure, compliance and timing before each send and can delay, skip or pause a step when a check fails — and raising your daily cap cannot override it. Whether you use it or run the list by hand, the order is the same: fix the domain, protect the mailbox, clean the list, simplify the message, then behave.