Email Deliverability Audit: The 2026 Cold Email Checklist

The short version: An email deliverability audit is a structured check of everything that decides whether your cold emails reach the inbox: domain authentication (SPF, DKIM, DMARC), sender reputation, blocklist status, list quality, warmup, and actual inbox placement. Run a full audit before you scale, a quick version monthly, and a fresh one after any change to your sending setup. The point is to catch the problem that is quietly sending you to spam before it costs you a quarter of pipeline.

What is an email deliverability audit?

An email deliverability audit is a systematic review of the technical and reputational factors that control inbox placement. It goes beyond "are emails sending" to answer "are emails landing in the primary inbox for real people." A proper audit walks through authentication records, domain and IP reputation, blocklist listings, list hygiene, warmup status, content, and a live inbox placement test across Gmail, Outlook, and Yahoo. Each check either passes or surfaces a specific fix, so you finish with a prioritized list of what to repair, not a vague sense that deliverability is "probably fine."

Why should you audit deliverability before scaling cold email?

Because scaling multiplies whatever is already broken. If one inbox lands 70% of the time, ten inboxes sending the same way land 70% of the time across ten times the volume, so you burn ten domains instead of one. The global average inbox placement rate in 2026 is around 83%, which means even careful senders lose roughly one in six emails to spam before they fix anything. Auditing first is cheap; discovering a blocklist listing after you have blasted 10,000 prospects is not. Serious outbound teams treat the audit as the gate they pass before spending on more inboxes, list data, or a new cold email software seat.

What does an email deliverability audit checklist include?

A complete audit covers seven areas, roughly in the order below. Each one can sink deliverability on its own, so a pass on all seven is what "inbox-ready" actually means. The table is the fast reference; the sections after it explain the checks that need more than one line.

How do you check SPF, DKIM, and DMARC?

Send a test email to a checker or a Gmail account, open the message, and view the original or headers to confirm SPF, DKIM, and DMARC all show "pass." Since Google and Yahoo tightened their sender rules, every sending domain needs a valid SPF record listing your sending sources, a DKIM signature that verifies, and a DMARC record aligned with at least a p=none policy. A missing or failing record is the single most common reason cold email lands in spam, and it is also the fastest to fix. Our step-by-step guide on SPF, DKIM, and DMARC setup for cold email shows the exact records to publish.

How do you check if your domain is on a blocklist?

Query your sending domain and IP against the major blocklists, Spamhaus, Barracuda, and SORBS, using a multi-blocklist lookup tool. A single Spamhaus listing can cut inbox placement to near zero across every provider at once, so this check is non-negotiable before scaling. If you find a listing, stop sending, fix the cause (usually a dirty list, a volume spike, or a spam-trap hit), then request delisting through the blocklist's own process. Getting listed is a symptom, so treat the root cause too; our guide on email sender reputation covers what drives listings and how to rebuild trust.

How do you audit list quality?

Run your list through an email verification service and check the bounce rate on recent sends. A verified list bounces under 2%; a raw scraped list bounces 15 to 30% and will get you blocklisted fast. The audit also flags catch-all addresses that verifiers cannot fully confirm and the spam traps that hide in old, unverified data. Cleaning the list is often the highest-impact fix in the whole audit, because bad data poisons everything downstream. Our walkthrough on how to clean an email list covers the full process.

How do you run an inbox placement test?

Use a seed-list inbox placement test: send your campaign to a set of test addresses across Gmail, Outlook, Yahoo, and other providers, then see how many land in the primary inbox versus spam or the promotions tab. Above 90% to the primary inbox is good, above 95% is excellent, and below 80% signals a real problem that authentication or reputation is causing. A placement test is the only check that measures the actual outcome rather than a proxy for it, so it belongs at the end of every audit. See our guide on the inbox placement test for how to read the results.

How often should you run a deliverability audit?

Run a full audit quarterly, a quick check of authentication, reputation, and blocklists monthly, and an immediate audit after any major change. Changes that warrant a fresh audit include adding a sending domain, migrating email providers, a sudden volume spike, or a drop in reply rate. Deliverability is not a set-and-forget setting; reputation drifts, lists decay about 2% a month, and provider rules keep tightening, so a setup that passed six months ago can quietly slip. Building the audit into a monthly rhythm catches drift before it becomes a spam-folder crisis.

What are the most common problems a deliverability audit finds?

The recurring culprits are a small set. Missing or misaligned DMARC tops the list, followed by a dirty list bouncing above 2%, a warmup that was never set up or was switched off, per-inbox volume pushed past the safe range, and spammy content tripping filters. Less often the audit surfaces a blocklist listing or a shared-IP neighbor dragging down reputation. Almost every deliverability problem traces back to one of these, which is why a checklist beats guesswork: you check each in turn instead of tweaking subject lines and hoping. Once the setup passes, keep it passing by watching the same signals in your ongoing deliverability routine.

What to do after the audit

Fix the failures in order of impact: authentication first, then list hygiene, then warmup and volume, then content. Re-run the inbox placement test to confirm the fixes worked before you scale. If a domain came back badly burned, it is sometimes faster to retire it and warm a fresh one than to rehabilitate it. While a domain recovers, keep pipeline moving through a second channel: many teams route the same outreach through bulk WhatsApp messaging so prospecting does not stall, and route reply notifications and bounce reports through an email parser that turns them into structured data so nothing slips while inboxes are in flux. And because deliverability will always be a moving target, building an inbound channel with an AI SEO workflow means some of your pipeline arrives without any send at all.

A clean audit is what lets you scale with confidence. Once every check passes, connect your own SMTP and let ColdMailer handle warmup, personalization, and safe sending across every mailbox, so the deliverability you audited for holds as you grow.