The Complete Cold Email Deliverability Checklist (2026)

Deliverability is the silent killer of cold email campaigns. You can have a perfect subject line, a compelling offer, and a rock-solid targeting list — and still see your emails vanish into spam folders. Not because your copy is bad, but because something in your technical setup or sending behavior triggered an algorithm.

This checklist covers every deliverability lever you actually control. Work through it before your first campaign and after every major list import.

Pre-Send Checklist: Domain & DNS Setup

These must be confirmed before you ever send a cold email from a new domain. Coming in hot on warmup without authentication is the fastest way to destroy a domain's reputation.

Email Authentication

• SPF record — Specifies which mail servers are allowed to send on behalf of your domain. Must include every IP or sending service you use (Postmark, SendGrid, your custom SMTP, etc.). Test with: nslookup -type=txt yourdomain.com
• DKIM record — Cryptographically signs your emails. Without it, Gmail's trust score drops automatically. See our full DKIM setup guide for step-by-step instructions.
• DMARC policy — Start with p=none to collect reports without affecting delivery. Once you're consistently passing SPF and DKIM, move to p=quarantine, then p=reject.
• MX records — Ensure your domain can receive mail. Even if you don't read replies manually, bounce notifications go somewhere — and undeliverable notification routing is a signal ESPs track.

Domain Warmup

• New domain? Wait at least 2–3 weeks after DNS setup before sending at volume. A brand-new domain with zero sending history will be flagged by default.
• Warmup volume schedule: Day 1–3: 10–20 emails/day. Day 4–7: 30–50. Day 8–14: 75–150. Day 15+: up to 300. Do not rush this — it compounds.
• Use the warmup domain for real replies — Set up a shared inbox on your warmup domain and reply from it so Google sees bidirectional engagement. Sending to yourself doesn't count as much as receiving and replying to real responses.
• Separate sending identity from warmup domain — Warm up a sub-domain (mail.yourdomain.com) while keeping your primary domain for transactional and marketing email. If the warmup domain gets flagged, you haven't burned the main one.

Sending Checklist: Volume, Schedule & Behavior

Authentication gets you in the door. Sending behavior determines whether you stay there.

Volume Controls

• Daily sending cap per domain: Start at 50–100 emails/day for the first two weeks, even if you have a list of 5,000. The goal is engagement signals before volume.
• Escalation ramp: No more than 2x daily volume increase week-over-week until you reach your target volume. Jumping from 100 to 1,000 in a day is a spam signal.
• Per-IP limits: If using custom SMTP, don't exceed 200 emails/hour per IP unless that IP has a strong reputation. Check your ESP's sending guidelines.
• List quality threshold: Never send to a list with more than 3% hard bounces. An old list with 8% bounces will poison your sending reputation for weeks.

Sending Schedule

• Spread sends across hours: Don't fire 500 emails at 9am. Divide volume across 8am–5pm in the recipient's timezone. Natural human sending behavior is a strong deliverability signal.
• Consistent send times: ESPs track whether you send at roughly the same times each day. Sporadic burst sends look like bot activity.
• Day-of-week patterns: B2B cold email performs best Tuesday–Thursday. Saturday and Sunday have lower complaint rates but also lower engagement — test for your audience.
• Pause after complaints: If you receive 3+ spam complaints in a 24-hour window, pause that campaign for at least 48 hours and investigate before resuming.

Personalization & Targeting

• Personalization ratio: Emails with dynamic first name and company-specific content see 30–50% better engagement. Generic blast copy triggers both user spam flags and algorithmic filtering.
• Removerole-based addresses: Emails sent to info@, admin@, or hr@ have dramatically lower open rates and higher complaint rates. Target named contacts where possible.
• Segment by industry and company size: Sending the same message to wildly different audiences signals low quality to inbox providers.

Content Checklist: What Triggered the Spam Filter

Content filters have gotten smarter, but the basics still matter. Here's what to audit in every email before it goes out.

Spam Trigger Words & Phrases

Avoid these patterns (they still fire filters even in 2026):

• Exclamation marks: More than 2 in a subject line increases spam probability significantly.
• ALL CAPS subject lines, especially short ones (e.g., "FREE" or "URGENT")
• Words associated with financial schemes: "double your", "make money fast", "earn $", "work from home"
• Overuse of "click here" or "buy now" — both signal low-value content
• Excessive emoji in subject lines — some ESPs still penalize this heavily
• Phrases that sound like bulk patterns: "As seen on", "Limited time offer", "Act now"

Link & URL Hygiene

• Link-to-text ratio: Keep hyperlinks below 15% of total email body text. A 200-word email with 4 links is fine; a 300-word email with 12 links is a red flag.
• Link destination: Avoid link shorteners (bit.ly, tinyurl) in cold email. They block most ESPs' link scanning. Use your own domain or well-known branded domains.
• URL patterns: Landing page URLs that look promotional (e.g., yourdomain.com/offer-2026) are fine; URLs with random characters or numeric-heavy patterns flag as suspicious.
• Text links vs. HTML buttons: Pure text links are lower-risk. HTML buttons with strong CTA language are fine when used sparingly.

Plain Text vs. HTML

• For cold email, lean toward HTML that mimics plain text — clean layout, single-column, minimal imagery, no complex table structures.
• Image-to-text ratio: Emails that are 60%+ images get filtered. Include enough body text that the email still looks legitimate with images disabled.
• Trackable pixels vs. link tracking: Open-tracking pixels are nearly universal and acceptable. URL-based tracking (which rewrites all your links through a redirect) is flagged more often — use a reputable ESP with good link reputation.

Monitoring Checklist: Metrics That Predict Problems

Deliverability isn't a one-time fix — it's an ongoing process. Track these metrics daily for the first two weeks of any new campaign.

Bounce Rates

• Hard bounce rate: Should stay below 2%. Above 3% and most ESPs will throttle or suspend your account. Above 5% and your domain reputation is at risk.
• Soft bounce rate: Should stay below 1%. Repeated soft bounces on the same address (mailbox full, server busy) will eventually hard bounce.
• Remove hard bounces immediately — most ESPs auto-suppress them, but verify. Sending to a known-bad address is the fastest way to damage your reputation.

Spam Complaint Rate

• Complaint rate threshold: Below 0.1% is safe. Above 0.3% triggers ISP-level filtering for many major providers (Gmail, Microsoft). Above 0.5% and you're in serious trouble.
• Postmark / your ESP will alert you — set up webhook notifications for spam complaints so you can immediately suppress that address and pause the campaign that generated it.
• Address the root cause — if you suddenly get a spike in complaints, stop sending immediately, audit your list quality, and identify which segment triggered it.

Blacklist Checks

• Check your sending IP and domain weekly — use tools like MXToolbox Blacklist Check or Google's Postmaster Tools (free for any domain with sufficient volume).
• Trigger for blacklist checks: Run a check whenever bounce rates spike, open rates drop unexpectedly, or you receive complaints. Don't wait for the scheduled weekly check.
• Common blacklists to monitor: Spamhaus (SBL/XBL), SORBS, UCEPROTECT, Barracuda. Being on any of these is severe; Spamhaus in particular will destroy your deliverability for days or weeks.
• Recovery: If you're blacklisted, stop sending immediately, fix the root cause (usually a compromised account, malware on a server, or an extremely high complaint rate), then submit delist requests with documentation of the fix.

Bot Detection: The Silent Open Rate Inflation Problem

Here's something most cold email tools don't tell you: your open rates are probably inflated by 20–60%. Here's why.

Security scanners at major enterprises (banks, law firms, Fortune 500 companies) automatically open every inbound email to scan for malware, phishing, and malicious attachments. These scans generate a server-side open event that gets reported back to your email platform — indistinguishable from a human opening your email in their inbox.

So when you see a 45% open rate, some portion of those "opens" are actually security bots scanning your email — not real engagement. This matters for several reasons:

• Engagement signals used for spam scoring. Gmail and Outlook track engagement metrics (opens, clicks, replies) to determine whether your emails are wanted. Bot-inflated open rates tell the algorithm your emails are "engaging" even when zero humans opened them.
• Reply rate becomes your real signal. Bots don't reply. If your open rate is 40% but reply rate is 1.5%, you have a bot problem, not a content problem.
• Gmail classifies based on actual engagement. Gmail's AI looks at actual user interactions, not reported open events. So your inflated open metrics won't protect you from the spam folder — only real engagement will.

What to look for: If your open rate is consistently 10–20 points higher than your reply rate warrants, you likely have bot-inflated opens. If your open rate is 35%+ with a reply rate under 1%, you're almost certainly dealing with security scanner opens.

How to filter it: OutboundHQ's bot detection analyzes open patterns across millions of emails to identify which opens were generated by security scanners vs. real humans. We strip bot-opens from your metrics so you see what your actual engagement looks like — and your campaigns aren't steered by false signals.

Your Deliverability Audit: Before vs. After

Use this table to score your current setup. Each "No" is a gap that will eventually hurt your deliverability.

Check	Yes	No
SPF record configured and includes all sending sources	☑	☐
DKIM record verified and passing	☑	☐
DMARC record published (even at p=none)	☑	☐
Domain warmup completed (14+ days)	☑	☐
Hard bounce rate below 2%	☑	☐
Spam complaint rate below 0.1%	☑	☐
Not on any email blacklists	☑	☐
No more than 2 exclamation marks in any subject line	☑	☐
Link-to-text ratio below 15%	☑	☐
Sending volume ramped (not burst-sent on day one)	☑	☐

Count your checkmarks. Below 8/10 and you have meaningful deliverability risk. Below 5/10 and you should fix your setup before sending at any scale.

---

Deliverability isn't a one-time setup — it's a discipline. Run through this checklist every time you add a new sending domain or launch a new campaign. The 30 minutes it takes will save you from rebuilding a domain reputation from scratch.

For the technical setup details on DKIM, see our full DKIM setup guide. For a comparison of how OutboundHQ stacks up against other cold email platforms on deliverability, see OutboundHQ vs Instantly or browse the full list of Instantly alternatives. Or start free and let the platform handle it.