Cold email deliverability checklist
Check four things before a cold email goes out: the sending domain authenticates with SPF, DKIM and DMARC; every address was verified recently; the mailbox is warmed and paced; and the message is plain enough to pass content filters. Deliverability is decided by those four, not by a single tool.
Updated October 26, 2026
Start with the domain, not the copy
Most deliverability problems are decided before anyone reads the email. If the sending domain has no SPF record, a DKIM key that does not match the signing selector, or a DMARC policy that contradicts the return path, receiving servers treat the message with suspicion no matter how good the writing is. Authenticate first, then write.
Use a domain you control and that you are willing to keep for a year or more. Subdomains such as mail.yourdomain.com are common for outreach because they isolate reputation from the main site. What matters is consistency: the domain in the From header, the domain that SPF authorises and the domain that DKIM signs should all belong to you.
- SPF record lists every server that may send for the domain, and nothing else.
- DKIM selector is published and the key length is at least 2048 bits.
- DMARC record exists with a reporting address so failures are visible.
- A return-path or bounce domain exists and resolves.
If any of those records are missing, work through the SPF, DKIM and DMARC setup walkthrough before sending anything.
Check the list the day you send, not the month you built it
A list decays. People change jobs, mailboxes are abandoned, catch-all domains answer everything and then reject. A verified list from six weeks ago is not a verified list today. Re-check syntax, domain mail routing and known disposable providers as close to the send as your workflow allows.
The cheapest correction is subtraction. Removing a handful of invalid addresses costs nothing; sending to them costs sender reputation. When a verification pass returns a mix of valid, risky and unknown results, treat unknown as unsendable until a second check resolves it. Never let a large campaign absorb an uncertain tail just to keep the numbers round.
- Every recipient has a syntactically valid address and a resolvable domain.
- Disposable and role addresses are excluded unless you have a reason to keep them.
- Unknown results are held back, not silently included.
- Suppression list is applied at import time, not after the first complaint.
There is a longer procedure for verifying a cold email list if you are importing thousands of rows.
Pace the mailbox like a person, not a firehose
Volume is the easiest signal for a receiving server to notice. A brand-new mailbox that emits 2,000 messages in an hour is not behaving like a human, and it will be throttled, filtered or blocked. A warmed mailbox sending at intervals of thirty to sixty seconds looks like ordinary correspondence and gives you time to read replies.
Pacing also determines how much you can actually send. At one message per minute a single mailbox tops out around 1,400 to 2,800 per day depending on the interval you choose. Reaching higher volume means running more mailboxes in parallel, each on its own campaign, not squeezing a single mailbox harder.
If you need more parallel capacity, start with inbox-ready SMTP accounts rather than raising the speed on a mailbox you already have.
Keep the message boring in the technical sense
Receiving filters are unimpressed by design. A single image banner, a tracking pixel wrapped around a URL shortener, five links and an attachment is a shape that resembles bulk mail. Plain text with one link, or no link at all in the first message, passes more easily and usually gets more replies anyway.
Write the first email as if a colleague were sending it: short, specific, no countdown, no promise of results. HTML is fine when it is simple, but avoid CSS that hides text, absolute positioning, or a layout that collapses without images.
- No visible tracking pixel in the first contact; open rates are unreliable anyway.
- One call to action, expressed as a question rather than a button.
- No shortened links, no redirect chains, no attachment on the first message.
- Plain-text alternative present for every HTML message.
Watch the first hour, then the first day
After a batch starts, the useful signals arrive quickly: hard bounces, deferrals, complaints and replies. A bounce rate that climbs during the first hundred messages means the list or the domain has a problem that will not improve with volume. Stop, inspect, and only restart after the cause is understood.
Worked example: a sender starts at 40 messages an hour. Twenty minutes in, nine of sixty addresses bounce with a domain-level 550. The addresses were valid syntactically, but the domain stopped accepting mail. Pausing, removing that domain and resuming at the same pace saved the rest of the campaign and produced no complaints.
Pre-send checks and the failure each one prevents
| Check | Pass condition | What fails without it |
|---|---|---|
| SPF, DKIM, DMARC | All present and aligned | Authentication failures, spam placement |
| Recipient verification | Recent pass, unknown addresses held | Hard bounces that damage reputation |
| Mailbox warm-up | Steady low volume for days, not minutes | Throttling or a provider block |
| Spacing | 30 to 60 seconds between messages | Burst pattern that looks automated |
| Message shape | One link or none, plain-text alternative | Content-filter rejection |
| Suppression list | Applied before the first send | Complaints and unsubscribe problems |
A pass on all six does not guarantee inbox placement. It removes the failures you control.
What this checklist will not do
Be clear about the boundary before buying anything.
- It cannot guarantee inbox placement. Receiving providers decide that with signals you cannot see.
- It cannot repair a domain that has already been blocklisted; blocklist removal is a separate process.
- It cannot make a purchased list safe. If consent is absent, authentication will not fix the complaint rate.
- It cannot replace legal review for GDPR, CAN-SPAM or local rules in the countries you contact.
Frequently asked questions
How long should a domain be warmed before the first cold email?
Long enough that the mailbox has a sending history and no provider warnings. In practice that means several days of low, steady volume rather than a fixed hour count, and a first cold batch well below the eventual pace.
Is a subdomain better than the main domain for outreach?
A subdomain separates outreach reputation from the reputation your transactional and support mail depends on. It is not automatically more deliverable; it is a containment choice.
Do I need a separate domain per campaign?
No. One authenticated domain can carry many campaigns as long as each mailbox is paced and the volume matches its warm-up. Separate domains help when a specific offer has a high complaint risk.
How many emails can one mailbox send per day?
At one message per minute the ceiling is about 1,440 per day, and 30-second spacing doubles that. The practical limit is usually the provider's daily cap and the mailbox's health, not the arithmetic.
Ready to run a campaign? Compare published plans or create a free account. Trials cannot send until a paid plan is active.