Run this checklist every 30 days to catch deliverability issues before they become crises. It covers DNS authentication, blacklist status, warmup health, content analysis, sending patterns, and list hygiene. Most deliverability problems are preventable, and this audit catches them early.
Deliverability doesn't degrade overnight. It erodes gradually: a DNS record that changed, a blacklist listing you didn't notice, a warming setup that stopped running. By the time your reply rates drop, the damage is already done and recovery takes weeks.
The solution is a systematic audit. Running through a structured checklist on a regular cadence catches problems while they're still small. This guide gives you the complete self-check framework: every DNS record, blacklist source, warmup metric, content signal, sending pattern, and list hygiene practice you should verify on a monthly basis.
Each section includes a pass/fail checklist. Work through them in order. DNS issues compound into blacklist problems, which compound into deliverability collapse. Catching them upstream saves you from firefighting downstream.
1. DNS & Authentication Audit
DNS authentication is the foundation of deliverability. If your SPF, DKIM, or DMARC records are misconfigured, broken, or missing, nothing else in this checklist matters. Email providers will filter your messages regardless of how good your content is.
Run these checks on every sending domain:
- SPF record exists and passes validation: Verify your SPF record is published, includes all authorized sending IPs, and doesn't exceed the 10-lookup limit. Use
dig TXT yourdomain.comor an online SPF validator to confirm. A missing or broken SPF record is the single most common DNS failure. - DKIM signing active with 2048-bit key: Confirm DKIM signatures are being applied to outbound mail and that your key length is 2048 bits (not the legacy 1024-bit). Check the DKIM selector DNS record and verify signatures pass validation on recent sent emails.
- DMARC policy set to quarantine or reject: A DMARC policy of
p=noneprovides monitoring but no protection. Move top=quarantineat minimum, ideallyp=reject. Verify your DMARC record includes a reporting address (rua=) so you receive aggregate reports. - MX records configured and responding: Even on domains used only for sending, MX records should be configured and pointing to a live mail server. A domain with no working MX looks less like a real business domain, and replies to it have nowhere to go. Verify the MX target responds on port 25.
- No duplicate or conflicting DNS records: Check for multiple SPF records (only one is allowed per domain), conflicting MX entries, or stale DKIM selectors from previous providers. Duplicate SPF records cause authentication failures.
For a step-by-step DNS setup walkthrough, see our DNS setup checklist. Winnr configures SPF, DKIM, and DMARC automatically on every domain it hosts DNS for, along with the SMTP and IMAP mailboxes built for cold email, but you should still verify records haven't been accidentally modified if you manage DNS externally.
2. Blacklist Check
Blacklists (DNSBLs) are shared databases of IPs and domains identified as spam sources. A listing on a major one can hurt placement quickly. You can also be listed because of another sender on a shared IP, which is why shared pools need active management.
Check these sources monthly:
- MXToolbox blacklist check: Covers 100+ blacklists in a single query. Enter your sending domain and each sending IP. Pay particular attention to Spamhaus (including the DBL for domains) and Barracuda, which are widely used in filtering.
- Google Postmaster Tools: Free dashboard showing your domain reputation as seen by Gmail. Watch the spam rate: Google's sender guidelines say to keep it below 0.10% and never reach 0.30%. Postmaster Tools only shows data once a domain sends enough Gmail volume.
- Microsoft SNDS (Smart Network Data Services): Microsoft's equivalent of Postmaster Tools for Outlook/Hotmail/Office 365. Shows IP reputation, complaint rates and trap hits. You can only register IPs you control, so on shared sending infrastructure this is your provider's job.
If you find a listing: Don't panic. Most blacklists have self-service delisting processes. The critical step is identifying why you were listed (usually a spam trap hit or complaint spike) and fixing the root cause before requesting removal. Simply delisting without fixing the underlying issue leads to re-listing within days.
For a full recovery playbook, read our guide on recovering a burned domain.
3. Warmup Health Check
Email warmup builds sender reputation by exchanging emails with a network of real inboxes. But warmup isn't set-and-forget. Providers update their filters, and accounts can silently stop warming without anyone noticing.
Verify these on every sending account:
- Warmup still active on all sending accounts: Confirm every account shows active status. Accounts commonly stop after a password change or an IMAP connection error, and the failure is often silent. On Winnr's built-in email warming, a mailbox that can't connect shows the status Problem and a Reconnect option.
- Warmup emails landing in inbox (not spam): Check the inbox rate your warming tool reports. If warmup emails are landing in spam, treat it as an early warning for your real sends too. Remember that most warming metrics measure placement inside the warming network, not at a specific provider such as Gmail or Microsoft, so confirm important providers with a seed placement test.
- Warmup volume around 20/day per account: Winnr's warming defaults to 20 warmup emails per day, which is also its maximum. Keep total daily volume (warmup plus cold sends) at about 50 or less per mailbox.
- Warmup health trending up or steady: on Winnr, a health score of 80 or more is Good, 50 to 79 is Fair and below 50 needs attention. A falling score is the cue to check DNS, blocklists and recent volume changes.
- Coverage of the providers you care about checked: a warming network's provider mix may include few Outlook.com, Hotmail or Yahoo addresses. If those matter to you, run a seed placement test there before relying on a mailbox.
For a detailed comparison of warmup approaches, see our guide to built-in warming vs sequencer warmup pools vs standalone warmup tools.
4. Content Analysis
Content filters have become sophisticated enough to detect cold email patterns even when authentication is perfect. The goal is to make every outbound message look like a genuine one-to-one email from a real person, because that's exactly what email providers reward.
Review your current email templates against these criteria:
- Plain text format (no HTML templates): Cold emails should be plain text. HTML templates with styled headers, images, and footers scream "marketing email" to spam filters. Even basic HTML formatting (bold, colors, font changes) increases filtering risk. The most successful cold emails look identical to what you'd type in Gmail.
- No tracking pixels or link wrapping: Open-tracking pixels and click-tracking redirects add signals that filters associate with bulk mail, and shared tracking domains carry other senders' reputation. Turn tracking off, or use a custom tracking domain on your own sending domain.
- No spam trigger words: Avoid overused sales language: "guaranteed," "act now," "limited time," "free trial," "schedule a call." These phrases alone won't send you to spam, but they compound with other signals. Write like you're emailing a colleague, not writing ad copy.
- Spintax variations active: Every email in a campaign should be unique. Use spintax (text rotation syntax) to vary greetings, opening lines, value propositions, and sign-offs. Sending identical emails across hundreds of recipients is a strong spam pattern. For a deep dive, see our spintax guide.
- Links minimal (0 to 1 per email): each link in a cold email is another thing for filters to evaluate. Zero links is safest. If you must include a link, limit it to one and use your own domain (not a shortened URL or tracking redirect).
- Emails kept short: a few sentences that a busy person can read in seconds. Long, template-heavy emails get skimmed and look more like marketing mail.
5. Sending Pattern Audit
Email providers track sending patterns across days, weeks, and months. Sudden volume changes, unnatural timing distributions, and mechanical consistency are all signals that distinguish bulk senders from legitimate business email users.
Check these patterns weekly:
- Volume per mailbox about 50/day or less, including warming: keep cold sends to 10 to 20 per mailbox per day (15 is a sensible default) and let warming make up the rest. Scale by adding mailboxes and domains, not by pushing each mailbox harder. Read our sending limits guide for provider-specific thresholds.
- Sends distributed across business hours: Emails should go out between 8am and 6pm in the recipient's timezone, with natural variation. Sending a mailbox's whole day in a 15-minute burst at 3am is an obvious automation signal. Use randomized delays between sends and spread volume across the full business day.
- No volume spikes vs previous week: Compare this week's daily send volume to last week's. A sudden jump (for example from 10 to 30 cold emails per mailbox per day) draws provider scrutiny. If you need more volume, ramp up gradually or add mailboxes.
- Weekend/holiday schedules appropriate: Legitimate business email volume drops on weekends and holidays. If your automation sends the same volume seven days a week, it looks automated. Reduce or pause sends on weekends unless your audience is in an industry where weekend email is normal.
- Account rotation working correctly: If you're using multiple accounts, verify the rotation logic is distributing sends evenly. A common failure mode is one account handling 80% of volume while others sit idle, which overloads the active account and wastes the reputation of the idle ones.
6. List Hygiene Audit
Your sending list is only as good as the data in it. Bad addresses cause bounces, spam traps destroy reputation, and stale contacts generate complaints. List hygiene isn't glamorous, but it fixes a large share of deliverability problems.
- All addresses verified before sending: Run every new list through an email verification service before importing. Verification catches invalid addresses, disposable emails, and known spam traps. The cost is negligible compared to the reputation damage from sending to bad addresses.
- Bounce rate under 2% (ideally under 1%): Track your hard bounce rate per campaign. If any campaign exceeds 2%, pause sending from that list and re-verify. Sustained high bounce rates can lead to blocks that affect every mailbox on the domain.
- Unsubscribes processed immediately: When someone replies asking to be removed (or clicks an unsubscribe link), process it within minutes, not days. Delayed unsubscribe processing leads to spam complaints, which are far more damaging to reputation than unsubscribes.
- Catch-all domains identified and handled: Catch-all domains accept email to any address, which means verification services can't confirm whether a specific mailbox exists. These addresses have higher bounce rates over time as catch-all configurations change. Flag them in your CRM and monitor their bounce rates separately.
- No purchased or scraped lists in use: Purchased lists are the fastest path to deliverability ruin. They contain spam traps, outdated addresses, and people who never consented to receive your email. If any team member has imported a purchased list, quarantine those contacts immediately and verify each one individually.
7. Key Metrics Dashboard
Track these metrics monthly and compare them with the thresholds below. They are working rules of thumb, except the spam rate row, which comes from Google's sender guidelines. If a metric enters the Warning zone, investigate. If it hits Critical, pause sending and audit before continuing.
| Metric | Healthy | Warning | Critical |
|---|---|---|---|
| Bounce rate | <1% | 1-3% | >3% |
| Spam rate (Postmaster Tools) | <0.10% | 0.10-0.30% | ≥0.30% |
| Reply rate | >3% | 1-3% | <1% |
| Spam placement | <5% | 5-15% | >15% |
| Warmup inbox rate | >90% | 70-90% | <70% |
Reading the table: A bounce rate under 1% means your list is clean. A spam rate under 0.10% keeps you inside Gmail's guidance. Reply rates above 3% show your messaging resonates. Spam placement under 5% (from seed tests) means authentication and content are passing filters. A warmup inbox rate above 90% says your mailboxes are behaving well inside the warming network. Open rates are left out on purpose: privacy features and image proxies make them unreliable.
When several metrics enter the Warning zone at once, treat it as Critical. Compounding issues get worse faster than isolated ones. To see how many mailboxes and domains a healthy per-mailbox volume implies for your target send count, use the cold email calculator.
8. Recommended Audit Schedule
Not every check needs to happen at the same frequency. Some metrics shift daily, while others are stable for months. Here's the cadence that balances thoroughness with practicality:
Daily (2 minutes)
- Check bounce rates on yesterday's sends
- Verify warmup is active and inbox placement is healthy
- Review any provider notifications or account warnings
Weekly (10 minutes)
- Review reply and bounce rates by campaign and account
- Check sending volume distribution across accounts
- Verify no single account is overloaded
- Process any pending unsubscribes
Monthly (30-45 minutes)
- Run the full audit: all sections above, start to finish
- Check MXToolbox blacklists for all sending domains and IPs
- Review Google Postmaster Tools and Microsoft SNDS dashboards
- Verify DNS records haven't changed or expired
- Re-verify any list segments with rising bounce rates
- Update the metrics dashboard table with this month's numbers
Quarterly (1 hour)
- Deep DNS review: check every sending domain's SPF, DKIM, and DMARC records
- Comprehensive blacklist scan across all monitoring services
- Run seed placement tests at the providers your prospects use
- Review and update email copy for freshness and compliance
- Audit account rotation strategy and domain portfolio health
Set calendar reminders for each cadence. The monthly audit is the most important, because it catches the slow-burn issues that daily checks miss.
Frequently Asked Questions
How often should I audit my cold email deliverability?
Run the full audit monthly. Check bounce rates and warmup health daily (it takes two minutes). Review reply rates and sending patterns weekly. The monthly cadence matters because some issues, like a gradual decline in domain reputation, don't show obvious symptoms until they've compounded into a real problem. A quarterly deep dive on DNS and blacklists catches the rare edge cases that monthly checks might miss.
What's the most important metric to monitor?
Warmup inbox rate is the earliest warning. When warmup emails start landing in spam, check your setup before your real emails follow. Bounce rate is a close second because high bounces damage reputation quickly. Reply rates are lagging indicators: by the time they drop, the problem has been active for days or weeks. Warming metrics measure placement inside the warming network, so confirm important providers with a seed placement test.
Can I automate deliverability monitoring?
Partially. Warming dashboards, including Winnr's, show a health score and inbox rate for warmup mail, which covers the most important daily check. Google Postmaster Tools and Microsoft SNDS show reputation data you can check on a schedule. MXToolbox offers scheduled blacklist monitoring with email alerts. What you can't fully automate is the content audit, the sending pattern review, and the list hygiene assessment. Those require human judgment. The recommended approach is to automate the data collection (dashboards and alerts) and spend your manual audit time on interpretation and action.
Related guides: Start with our DNS setup checklist if you're configuring infrastructure from scratch. Read the cold email best practices guide for a broader strategy overview. Compare built-in warming, sequencer warmup pools and standalone tools. If you're already in trouble, see our burned domain recovery guide or the deliverability troubleshooting guide.