Most cold email deliverability problems trace back to 5 root causes: DNS misconfiguration, premature sending, domain reputation damage, warming issues, or provider blacklisting. This guide covers how to diagnose and fix each one. AI can now run the entire diagnostic tree in seconds: Winnr's Claude Code skills include 5 decision trees that encode the same reasoning experienced operators use.
The 5 Root Causes of Cold Email Deliverability Failures
Nearly every cold email deliverability problem maps to one of these five categories. Identifying which one you're dealing with is the first step to fixing it.
1. DNS Misconfiguration (SPF, DKIM, DMARC)
Symptoms: Emails rejected outright (bounces), emails consistently landing in spam across all recipients, authentication failures in email headers.
This is the most common cause and the easiest to fix. Missing or misconfigured SPF, DKIM, or DMARC records tell receiving mail servers that your emails can't be verified as legitimate. Most providers will either reject the email entirely or route it straight to spam.
2. Sending Before Warming Completes
Symptoms: Good deliverability for the first few emails, then rapid decline. Sudden spike in spam placement after the first day or two of outreach.
New mailboxes have zero reputation. Sending dozens of cold emails a day from a mailbox that's never sent anything before is one of the fastest ways to burn a domain. Email providers see a sudden burst of outbound volume from an unknown sender and flag it as suspicious.
3. Domain Reputation Damage
Symptoms: Gradual decline in inbox rates over days or weeks. All mailboxes on the same domain show similar decline. Warming metrics that were green turn yellow, then red.
Domain reputation is a cumulative score that major email providers (Gmail, Outlook, Yahoo) maintain for every sending domain. Once damaged, it affects every mailbox on that domain, not just the one that caused the problem.
4. Warming Stalled or Paused
Symptoms: No reputation being built. Health scores stuck at low values. Inbox rates not improving over time.
Warming works by gradually building a positive sending history. If warming is paused, misconfigured, or stalled due to technical issues, that reputation building stops. The mailbox sits idle, gaining nothing.
5. Provider or IP Blacklisting
Symptoms: Bulk rejection of emails (high bounce rates). Rejection messages mentioning specific blacklists. All mailboxes on the same server affected simultaneously.
If the IP address your emails originate from lands on a major blocklist (Spamhaus, Barracuda), receiving servers will reject emails before they even look at your content or authentication. This affects everyone sharing that IP.
DNS Troubleshooting: The Foundation of Deliverability
DNS authentication is the foundation of email deliverability. If your DNS records are wrong, nothing else matters. Warming, content and sending patterns won't save you. Start every troubleshooting session here.
SPF (Sender Policy Framework)
What it does: SPF tells receiving mail servers which IP addresses and servers are authorized to send email on behalf of your domain. It's published as a TXT record on your domain.
How to check: Look up the TXT records for your domain. You should see exactly one record starting with v=spf1.
dig TXT yourdomain.com +shortWhat it should look like:
v=spf1 include:_spf.yourprovider.com -allThe include (or ip4 entries) depends on who sends for the domain. On domains where Winnr manages DNS, the correct SPF record is created for you and ends in -all.
Common mistakes:
- Multiple SPF records: You can only have one SPF TXT record per domain. If you have two (e.g., one for Winnr and one for Google Workspace), they must be merged into a single record with multiple
include:directives. - Missing include: If your SPF record doesn't include your email infrastructure provider's sending servers, emails will fail SPF checks.
- Too many DNS lookups: SPF has a 10-lookup limit. Each
include:anda:directive counts. Exceeding this limit causes SPF to fail entirely. - Using
+allinstead of~allor-all: The+alldirective means "allow everyone to send as this domain", which defeats the purpose of SPF.
DKIM (DomainKeys Identified Mail)
What it does: DKIM adds a cryptographic signature to every outgoing email, proving it hasn't been tampered with in transit. The public key is published as a DNS record; the private key is held by your email server.
How to check: DKIM records are published at a specific selector subdomain. The selector depends on your provider.
dig TXT dkim._domainkey.yourdomain.com +shortCommon mistakes:
- Wrong selector: If your provider uses selector
dkimbut you published the record underdefault._domainkey, DKIM verification will fail. - CNAME vs TXT mismatch: Some providers expect a CNAME record pointing to their DKIM key server; others expect you to paste the full TXT value. Using the wrong type will cause silent failures.
- Missing record entirely: If the DKIM DNS record is missing, emails will be sent without a DKIM signature. Many providers treat unsigned emails as suspicious.
- Truncated key: DKIM public keys are long. Some DNS managers truncate values over 255 characters. If the key is cut off, verification fails.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
What it does: DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. It also enables reporting so you can see who's sending email as your domain.
How to check:
dig TXT _dmarc.yourdomain.com +shortRecommended policy for a dedicated cold email domain:
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.comA domain that exists only for cold email has one sender, so every legitimate message is aligned and p=reject carries no risk while blocking anyone spoofing the domain. Winnr sets p=reject by default on the domains it manages (see why Winnr uses DMARC p=reject). A domain with several senders, such as your main business domain, is different: start at p=none, read the aggregate reports until every source is aligned, then move to p=quarantine and p=reject.
Common mistakes:
- Jumping to
p=rejecttoo early on a shared domain: If a domain has other senders (a CRM, a helpdesk, Google Workspace) that aren't aligned with SPF/DKIM,p=rejectwill cause those emails to be rejected. On a shared domain, start withp=none. - No DMARC record at all: While not strictly required, having no DMARC record reduces your authentication profile. Providers like Gmail increasingly expect it.
- Wrong record location: DMARC must be published at
_dmarc.yourdomain.com, not at the root domain or any other subdomain.
MX Records
What they do: MX records tell other mail servers where to deliver incoming email for your domain. Without valid MX records, your domain can't receive replies, and some receiving servers check for MX records before accepting mail from a domain.
How to check:
dig MX yourdomain.com +shortWhy they matter for cold email: If a receiving server can't verify that your domain can accept replies, it's a signal that the domain exists only for sending, which is a spam indicator. Always have valid MX records pointing to a real mail server.
Before sending a single email from any domain, verify all four records:
- SPF: One TXT record at the root domain starting with
v=spf1, including your provider's sending servers, ending with~allor-all - DKIM: TXT or CNAME record at
[selector]._domainkey.yourdomain.comwith the correct public key or provider CNAME - DMARC: TXT record at
_dmarc.yourdomain.comwith at minimumv=DMARC1; p=none - MX: At least one MX record pointing to a valid mail server that can receive replies
Warming Metrics Interpretation: What the Numbers Mean
Warming dashboards show you numbers. Knowing what each one measures, and when to act on it, matters more than the numbers themselves. The definitions below are the ones Winnr's built-in email warming uses; other tools calculate their scores differently.
Health Score (0-100)
Winnr's health score is calculated from the share of a mailbox's warmup emails and replies that landed in spam over the last 14 days: health = 100 minus 2 × that spam rate. A mailbox with 10% of its warmup mail in spam scores 80.
- 80-100 (Good): Healthy. Ready for real sending once the warming period is over.
- 50-79 (Fair): Still building, or slipping. Keep warming and watch the trend.
- Below 50 (Needs attention): Something is wrong. Check DNS, blocklists and recent volume changes. Do not send cold outreach from this mailbox.
Inbox Rate
The share of the last 14 days' warmup emails that did not land in spam (promotions and other tabs count as not spam).
- 90% or higher: Good.
- 70% to 90%: Fair. Normal early on; concerning if it stays here after a couple of weeks.
- Below 70%: Poor. Check DNS health, blocklists and your ramp speed.
What these numbers do not tell you
Warming metrics measure spam placement inside the warming network, across whichever providers that network's mailboxes use. They are not inbox placement at Gmail, Microsoft, Outlook.com or Yahoo specifically. Use them to catch setup and reputation problems early, and run a seed placement test to the providers your prospects use before relying on a mailbox.
Daily Volume (Ramp-Up)
Warming starts at a few emails a day and climbs to the mailbox's daily target (up to 20 on Winnr) at the ramp speed you chose: Slow for brand-new domains, Normal by default, Fast for established domains. If volume stays flat for days while ramp-up is on, warming may be stalled or the mailbox may have a connection problem.
Before starting cold campaigns, aim for:
- At least 2 weeks of warming (4 on a brand-new domain)
- Health score Good (80 or higher) with a steady or rising trend
- Inbox rate 90% or higher
- A clean seed placement test at the providers your prospects use
Domain Reputation Recovery: Step-by-Step Protocol
If a domain's reputation is damaged (declining inbox rates, rising spam rates across multiple mailboxes), follow this recovery protocol. Acting quickly improves the odds of recovery.
Step 1: Pause All Sending and Warming (Immediately)
Stop all outbound email from every mailbox on the affected domain. This includes cold outreach campaigns and warming. Continuing to send while reputation is damaged only makes it worse.
Timeline: Do this within minutes of identifying the problem.
Step 2: Verify DNS Records
Rule out DNS misconfiguration as the cause. Check SPF, DKIM, DMARC, and MX records using the checklist above. If DNS is the root cause, fix it before proceeding. No amount of cooling down will help if your authentication is broken.
Timeline: 15-30 minutes to check and fix.
Step 3: Wait 72 Hours (Cool-Down Period)
Email providers need time to stop associating your domain with negative signals. A 72-hour cool-down period with zero outbound email lets the most recent negative data age out of real-time reputation calculations.
Timeline: 3 full days of no sending.
Step 4: Re-Enable Warming with Conservative Settings
After the cool-down, re-enable warming with the most conservative settings available:
- Daily limit: 5 emails per day (not the default)
- Ramp-up: Enabled, at Slow speed (let volume increase gradually)
You're essentially starting the warming process from scratch, but now the domain has some history (both good and bad) that you're trying to rehabilitate.
Timeline: 5 minutes to configure.
Step 5: Monitor Daily for 7 Days
Check warming metrics every day during the first week of re-warming. You're looking for:
- Health score trending upward (even slowly)
- Inbox rate stabilizing above 70%
- Fewer warmup emails landing in spam each day
If metrics continue to decline during this period, move to Step 6.
Timeline: 7 days of daily monitoring.
Step 6: Decide Whether to Continue Recovery or Retire the Domain
After 14 days of conservative re-warming, evaluate the results:
- Improving: Health score rising steadily toward Good (80+), inbox rate climbing toward 90%. Continue warming for another 7 days before resuming outreach at low volume.
- Flat or declining: Health score stuck in Needs attention (below 50) or inbox rate still below 70%. The domain reputation is likely too damaged to be worth saving. Retire this domain and replace it with a new one.
Timeline: Decision point at day 14 after re-warming started.
How AI Changes Deliverability Troubleshooting
Troubleshooting cold email deliverability has historically been a manual, time-consuming process that requires expertise across DNS, email authentication, warming strategy, and provider-specific quirks.
Manual Troubleshooting
The traditional process looks like this:
- Log into your warming dashboard and check metrics for each mailbox
- Open a DNS lookup tool and check SPF, DKIM, DMARC, and MX records one by one
- Cross-reference warming metrics across multiple mailboxes to identify domain-level patterns
- Check blacklist databases manually
- Search forums and docs for your specific error patterns
- Formulate a fix and hope you diagnosed correctly
Doing this by hand is slow for one domain and impractical across dozens.
AI-Powered Troubleshooting
With Winnr's Claude Code skills, the entire diagnostic process is a single command:
/winnr troubleshoot domain.comThe AI runs the full diagnostic tree in seconds:
- Checks all DNS records (SPF, DKIM, DMARC, MX) in parallel
- Pulls warming metrics for every mailbox on the domain
- Identifies patterns across mailboxes (domain-level vs. mailbox-level issues)
- Checks for blacklisting and provider-specific issues
- Returns a prioritized list of issues with specific fix instructions
The diagnostic decision trees in Winnr's troubleshooting skills encode the same reasoning that experienced email infrastructure operators use. There are 5 decision trees covering: DNS configuration, Warming health, Deliverability patterns, Provisioning issues, and Sending failures. Each tree follows the same if-this-then-that logic a human expert would, but runs in seconds instead of minutes.
Common Scenarios and Fixes: Quick Reference
When you need a fast answer, use this reference table to map symptoms to causes and fixes:
| Symptom | Likely Cause | Fix | Timeline |
|---|---|---|---|
| Emails going to spam for all recipients | Missing SPF or DKIM records | Add the missing DNS records and wait for propagation | Minutes to 48 hours |
| Inbox rate gradually dropping | Domain reputation damage | Pause all sending, cool down 72 hours, re-warm conservatively | 2-3 weeks |
| Warming not progressing past day 7 | Settings too aggressive or stalled | Reduce daily limit to 5, enable ramp-up, check for errors | 1-2 weeks |
| Mailbox creation failing | Domain DNS not fully propagated | Wait for DNS propagation to complete; verify MX records | 15-60 minutes |
| All mailboxes on one server declining | Server IP blacklisted | Check blacklists; contact provider for IP remediation | Varies (days to weeks) |
| Emails bouncing with 550 errors | SPF hard fail or DMARC reject | Fix the SPF record and DKIM so the mail aligns; check for an unaligned extra sender | 1-24 hours |
| Good warming but poor campaign results | Content triggering spam filters | Review email content for spam trigger words, links, and formatting | Immediate |
Prevention Checklist: Avoid Problems Before They Start
The best deliverability troubleshooting is the kind you never have to do. Follow this checklist to prevent the most common issues:
- Verify all 4 DNS records before sending. Check SPF, DKIM, DMARC, and MX on every domain before enabling warming or sending a single email. This alone prevents the most common deliverability failure.
- Warm for at least 2 weeks before starting campaigns (4 on a brand-new domain). Sending too early is one of the most common causes of deliverability problems.
- Send 10 to 20 cold emails per mailbox per day (15 is a good default). Keep total sending, cold plus warming, at about 50 a day or less per mailbox. Scale by adding mailboxes and domains, not by pushing more through each one.
- Run deliverability health checks weekly. Don't wait for problems to become visible in campaign metrics. Check warming health scores and inbox rates at least weekly. With Winnr, this is a single command:
/winnr health. - Keep 3-5 mailboxes per domain. Distributing send volume across multiple mailboxes reduces the risk of any single mailbox being flagged. If one mailbox has issues, the others on the same domain provide cover while you investigate.
- Never send cold outreach from your primary brand domain. Use separate domains for cold outreach. If a cold email domain gets burned, your main business email (support@, sales@, invoices@) is unaffected.
- Monitor blocklists proactively. Don't wait for bounces to discover your IP or domain is listed. Regular checks catch problems before they impact campaigns.
- Rotate domains before they show decline. If you're sending at high volume, plan to rotate in fresh domains regularly rather than pushing existing ones past their limits.
Frequently Asked Questions
How long does DNS propagation take for cold email domains?
Most DNS changes propagate within 15 to 60 minutes for new records. However, if you're changing existing records (especially lowering TTLs), propagation can take up to 24-48 hours depending on cached records at receiving mail servers. For new domains set up through Winnr, MX, SPF, and DKIM records are typically active within 30 minutes since the records are created fresh with no cached values to expire.
Can a burned domain reputation recover?
Sometimes, but not always. If the damage is recent and limited (say you sent too aggressively for a few days), the recovery protocol above (pause, cool down, re-warm) works well. Success depends on the severity of the damage and how long the domain was sending with poor metrics. If inbox rates don't improve after 14 days of careful re-warming, the domain should be retired and replaced. New domains are cheap; fighting a permanently damaged reputation is expensive in time and lost opportunities.
What inbox rate is good enough to start sending cold emails?
Target an inbox rate of 90% or higher in your warming metrics, with a health score of 80 or more, before starting cold outreach. Between 70% and 90% is fair: keep warming and watch the trend. Below 70% means the mailbox needs more warming or has underlying issues that must be resolved first. These thresholds apply to warming metrics, which measure placement inside the warming network, so confirm with a seed placement test at the providers your prospects use.
Should I use p=reject in my DMARC policy for cold email?
On a dedicated cold email domain, yes. It has a single sender, so all legitimate mail is aligned and p=reject only stops impersonators. Winnr sets it by default on the domains it manages. On a domain with several senders, such as your main business domain, start with p=none, confirm from the aggregate reports that every source passes SPF or DKIM with alignment, then move to p=quarantine and finally p=reject. A premature p=reject on a shared domain causes your own unaligned mail to be rejected.
How many emails per day is safe per mailbox for cold outreach?
10 to 20 cold emails per mailbox per day, with 15 as a sensible default, once warming is complete. Keep total sending (cold plus warming) at about 50 a day or less per mailbox. Going beyond that raises the risk of spam filtering even on well-warmed mailboxes. To send more, add mailboxes and domains rather than pushing more volume through each one.
How does AI troubleshoot cold email deliverability differently?
Manual troubleshooting requires checking DNS records one by one, logging into dashboards, cross-referencing metrics across mailboxes, and searching forums for answers. AI-powered troubleshooting runs the entire diagnostic decision tree in seconds, checking DNS, warming status, reputation signals, and blacklists in parallel, then returning a prioritized list of issues with specific fix instructions. Winnr's Claude Code skills include 5 diagnostic decision trees (DNS, Warming, Deliverability, Provisioning, Sending) that encode the same reasoning experienced operators use.
Automate Your Deliverability Monitoring
Stop checking DNS records by hand and scrolling through warming dashboards. Winnr's AI-native tools handle the diagnosis so you can focus on the fix:
- Claude Code Skills: 5 diagnostic decision trees for DNS, warming, deliverability, provisioning and sending issues
- MCP Server: 55 tools for managing domains, mailboxes, warming and inbox from an AI assistant
- Email Warming: built-in warming at $0.60 per mailbox per month, with a 14-day health score per mailbox
- Pricing: Startup is $69/mo for 50 mailboxes, Enterprise $189/mo for 200, billed monthly
Related Reading
- Cold Email DNS Setup Checklist: step-by-step DNS configuration for SPF, DKIM, DMARC and MX records
- How to Recover a Burned Domain Reputation: recovery playbook with timelines and decision points
- Cold Email Deliverability Audit Checklist: a periodic check of authentication, reputation and sending patterns
- Cold Email Best Practices: sending limits, authentication and content
- Winnr MCP Server: AI Email Infrastructure: how to connect AI assistants to your email infrastructure
- Getting Started with Cold Email: domains, mailboxes and warming from scratch