The cold email deliverability checklist

Cold email deliverability is decided before the first message is written. Authentication, sending infrastructure and warmup are settled in that order, and each step has a standard or a provider rule behind it rather than an opinion. This checklist runs in send order and every check has a free tool that performs it.

Key facts

SPF must resolve in 10 DNS lookups or fewer. Exceeding it is a permerror, and a permerror is treated as no SPF at all (RFC 7208).
DMARC only passes if SPF or DKIM passes and aligns with the From domain (RFC 7489). Alignment is the part most broken setups miss.
Gmail requires SPF, DKIM and DMARC from senders of 5,000+ messages a day, and a spam rate reported in Postmaster Tools below 0.30%.
Two to three inboxes per domain, roughly 30 sends per inbox per day, and four to six weeks of warmup before real volume.
Nothing on this list fixes a bad list or a bad message. It only decides whether either gets read.

Why the order matters

Most deliverability advice is a pile of tips. The order is the useful part, because each stage depends on the one before it. Warming an inbox on a domain with a broken SPF record teaches mailbox providers that a misconfigured sender is sending more mail. Buying more inboxes to raise volume when placement is already poor multiplies the problem rather than solving it. Work down the list, and stop at the first thing that fails.

Stage 1: authentication

Authentication proves a domain authorised the mail. It is the only stage that is pass or fail rather than a matter of degree, which makes it the cheapest thing to get right and the most expensive to get wrong.

1. SPF exists and resolves inside the lookup limit

SPF is a DNS TXT record listing which servers may send for a domain, defined in RFC 7208. It must evaluate within ten DNS-querying mechanisms. include, a, mx, ptr, exists and redirect each spend one; ip4, ip6 and all spend none. Go past ten and the result is a permerror, which receivers treat as though no SPF record existed.

The SPF checker returns the record, counts the lookups against the limit and names every mechanism.

2. DKIM is signing, and the public key is published

DKIM signs selected headers and the body with a private key, and the matching public key is published in DNS at selector._domainkey.example.com, defined in RFC 6376. Unlike SPF it survives forwarding, because the signature travels with the message rather than depending on the connecting server.

The DKIM checker looks up a selector and confirms a valid key is published.

3. DMARC is published, and alignment actually passes

DMARC tells receivers what to do with mail that fails authentication, and where to send reports. The record sits at _dmarc.example.com with a policy of none, quarantine or reject, defined in RFC 7489.

The part that catches people is alignment. DMARC passes only if SPF or DKIM passes and the domain that passed matches the From domain the recipient sees. A setup can have valid SPF, valid DKIM and still fail DMARC because neither aligns. Start at p=none and read the reports before tightening.

The DMARC checker returns the policy and flags the common misconfigurations.

4. The bulk sender rules are met

Gmail requires senders of 5,000 or more messages a day to set up SPF and DKIM, publish a DMARC record (a policy of none is accepted), support one-click unsubscribe on marketing and subscribed mail, and keep the spam rate reported in Postmaster Tools below 0.30%. Google recommends staying below 0.10% and never reaching 0.30%.

These thresholds are per sending domain, which is one of the reasons cold email is sent from separate domains rather than the one carrying customer mail.

Stage 2: sending infrastructure

5. Sending domains are separate from the main domain

Cold email is sent from domains registered for the purpose, which redirect to the real site. This is a standing GrowthPal infrastructure rule applied on every engagement and documented in the Passionfruit and Tracerrr case studies. The reasoning is blunt: a blocklisting that lands on a throwaway sending domain is an inconvenience, and the same event on the domain carrying invoices and support is a business problem.

6. The inbox count comes from the volume, not the other way round

Capacity is arithmetic. Target sending volume sets the number of inboxes, and inboxes set the number of domains at two to three per domain. A GrowthPal engagement typically runs around 110 inboxes across 40 to 50 sending domains.

Two to three per domain is deliberate concentration control: when a domain has a bad week, everything on it pauses together, so a smaller number per domain means one problem costs a slice of capacity rather than the campaign. The inbox calculator does the conversion.

7. MX records are readable before you send

MX records name the servers that accept mail for a domain, with the lowest priority number tried first, defined in RFC 5321. They govern mail a domain receives rather than mail it sends, so they authorise nothing on the outbound side. They are still worth reading: the MX tells you which mailbox provider will filter the message, and Google, Microsoft and Proofpoint behave differently.

The MX checker lists the hosts by priority.

8. Nothing is on a blocklist before you start

A blacklist is a published list of IPs or domains that receivers query at delivery time. Listings come from spam traps, complaint volume, or sending from a range with poor history, and shared infrastructure means another sender's behavior can affect an address you happen to share.

The blacklist checker queries the major operators.

Stage 3: warmup

9. Four to six weeks before real volume

Warmup raises a new mailbox's sending volume gradually while generating opens and replies, so the ramp looks like a person rather than a switch being thrown. GrowthPal runs four to six weeks before a campaign carries real volume. The warmup planner produces the schedule.

10. Volume per inbox stays near 30 a day

Roughly 30 sends per inbox per day, inside a band of 20 to 40, is where GrowthPal operates. Pushing more through fewer inboxes is the most common way a technically correct setup still lands in spam: the authentication passes, and the pattern does not look like a person.

Stage 4: the list

11. The list is verified before the first send

A bounce is a message a receiving server refuses because the address does not exist. A high bounce rate tells a mailbox provider the sender is working from a list they did not build carefully, which is the behavior spam filters exist to catch. Because reputation attaches to the sending domain, one unverified campaign affects every later campaign on those domains.

The bounce rate calculator converts a list size and bounce count into a rate. GrowthPal works to under 2%.

12. Catch-all domains are a decision, not an error

Some domains accept mail for every address, so a verifier cannot confirm a specific mailbox exists. These return as risky or unknown rather than valid. Whether to send to them is a judgement about how much bounce risk a campaign can carry, not a configuration problem to fix. The term is defined as a catch-all domain in the glossary.

Stage 5: the message

13. No links, no pixels, no attachments in a first touch

A tracking pixel adds a third-party image request to every message and a tracked link adds a redirect. Both are signals filters weigh, and open rates have been unreliable since mailbox providers began pre-fetching images. GrowthPal tracks neither, which is why the measured unit on this site is the interested reply rather than an open.

14. Plain text, and a real unsubscribe path

Heavy HTML is not itself a deliverability failure, but it correlates with bulk mail and it is not needed for a message one person is sending another. Marketing and subscribed mail to Gmail must support one-click unsubscribe regardless.

Stage 6: after the first send

15. Watch the numbers daily, not weekly

Deliverability degrades gradually and then suddenly. The things worth watching daily are bounce rate, the spam rate in Postmaster Tools against that 0.30% ceiling, and reply volume per inbox rather than in aggregate, because a single bad domain hides inside a healthy total. The deliverability monitoring tools in the directory cover continuous placement testing, which the free checkers above deliberately do not.

Frequently asked questions

Does a correct setup guarantee inbox placement?

No. Authentication is necessary and not sufficient. A perfectly authenticated domain sending an unwanted message to a poorly built list still lands in spam, because filters weigh recipient behavior heavily. What a correct setup does is remove the failures that are entirely within your control, so that what remains is a message and list problem rather than a configuration one.

How long before a new domain can carry real volume?

Four to six weeks of warmup, on GrowthPal's schedule. The ramp cannot be usefully compressed, because the thing being established is a pattern over time rather than a threshold to cross. A domain sending its full intended volume in week one is the clearest signal available that it is not a person.

What is the single most common misconfiguration?

On the evidence of the checks above, SPF records that exceed the ten-lookup limit and DMARC that fails on alignment rather than on authentication. Both look fine to a human reading the record, and both are invisible until a receiver evaluates them. That is precisely why they are worth testing rather than reading.

Do these rules differ by mailbox provider?

The standards do not: SPF, DKIM and DMARC are the same everywhere. The enforcement does. Gmail publishes explicit bulk sender requirements with a numeric spam-rate ceiling; other providers publish less and enforce on their own terms. Reading a domain's MX record tells you which provider will judge the mail.

Sources

SPF, including the ten-lookup limit and permerror handling: RFC 7208. Read September 30, 2026.
DKIM signing and key publication: RFC 6376. Read September 30, 2026.
DMARC policy and alignment: RFC 7489. Read September 30, 2026.
MX records and priority: RFC 5321. Read September 30, 2026.
Gmail bulk sender requirements, including the 5,000 message threshold, the one-click unsubscribe requirement and the 0.30% spam rate ceiling: Google, Email sender guidelines. Read September 30, 2026.
Inboxes per domain, sends per inbox, warmup duration and bounce target: GrowthPal's own published figures. See how the numbers on this site are counted.

Published September 30, 2026. Provider requirements change; the Gmail figures above were read on September 30, 2026 and this page is reviewed every six months.