The cold email deliverability checklist for 2026

Landing in the inbox is the product of authentication, infrastructure, list quality, content and sending behaviour. Weakness in any one of them undermines the rest, which is why "we set up SPF and it still goes to spam" is such a common complaint - SPF was necessary and nowhere near sufficient.

This is the sequence we work through before any batch of inboxes is handed over, arranged so the cheapest checks come first. The reasoning behind each item, and the numbers, are in our cold email deliverability guide; this page is the list.

1. Authentication

• SPF published, one record only, ending in -all rather than ~all.
• SPF within the ten DNS lookup limit, rechecked after every change.
• DKIM CNAMEs published and signing actually enabled in the admin portal.
• DMARC published, starting at p=none with a monitored rua address.
• Alignment confirmed - SPF or DKIM passing against the From domain, not just against the platform.
• A test message sent to a mailbox you control, with received headers read to confirm all three pass.

The last item is the one people skip. A record existing is not evidence it works. Our free DNS records checker covers the first four in one query if you would rather not read dig output across a batch of domains, and the DNS checker shows the MX routing behind them.

2. Domain and inbox setup

• Cold mail on dedicated sending domains, never the primary.
• Sending domains redirecting to your main site rather than resolving to nothing.
• Domain history checked against blocklists before purchase.
• Registration for more than a single year.
• Inbox volume planned as mailbox count times three on Microsoft, not a few mailboxes sending at their ceiling.
• Every mailbox given a real display name, signature and profile photo.

The profile details matter more than they appear to. An empty mailbox with no display name and no signature is a weak signal on its own and a compounding one alongside everything else a filter is weighing.

3. Warmup

• Two to four weeks of ramp before real prospect volume.
• Warmup pool kept running alongside live sending, not switched off at launch.
• Volume increased gradually rather than stepped up in one jump.
• Placement tested to seed mailboxes on the platforms your list actually uses.

4. List hygiene

The best-configured infrastructure in the world will not survive a bad list. Bounces and complaints are the two fastest routes to a damaged domain, and both are list problems rather than infrastructure problems.

• Every address verified before sending; bounce rate held under 3%.
• Role addresses removed - info@, sales@, support@, admin@.
• Catch-all domains treated with caution; they verify as valid and often are not.
• Suppression list respected across every campaign and every mailbox.
• Anyone who asked not to be contacted removed permanently, not just from one sequence.

5. Content

• Genuine personalisation beyond a merge field in the first line.
• Meaningful variation between messages rather than one template sent a thousand times.
• Plain text or very light HTML; heavy formatting reads as marketing.
• Minimal links, ideally one, and no link shorteners.
• No tracking pixel if you can do without it - open tracking increasingly hurts more than it informs.
• Short. Under 150 words outperforms and reads as a person writing rather than a campaign.
• A real unsubscribe route, honoured immediately.

Copy quality is judged only after the message arrives, so treat it as a separate problem from placement - the template structures here cover what a first message should contain. Link shorteners deserve a specific mention. They are heavily used in phishing, filters know it, and a shortened link in a cold email is a straightforward negative signal for no benefit.

6. Sending behaviour

• Random intervals between sends rather than a fixed cadence.
• Sending confined to working hours in the recipient timezone.
• No weekend sending unless your audience genuinely works weekends.
• Volume consistent day to day; no sudden spikes.
• Replies handled by a person, promptly.

7. Monitoring

A sharp fall in reply rate with no change to copy or list is usually a placement problem rather than a messaging one. The deliverability guide walks through diagnosing a drop by its shape, and the blacklist checker rules out a listing in one query. Treat it as the first symptom of a deliverability issue and test placement before rewriting anything.

Where this leaves you

Sections one and two are infrastructure, they are the ones that fail silently, and they are what we handle: Microsoft 365 inboxes with SPF, DKIM and DMARC configured and verified before handover, 100 inboxes on one domain for $30 a month, live in 24 to 48 hours.

Sections four through six are yours, and no infrastructure provider can do them for you. A perfectly authenticated domain sending an unverified list a thousand identical messages will still fail. The infrastructure removes one class of problem so the remaining ones are about your list and your writing.