The cold email deliverability checklist (2026 edition)

Deliverability is not one setting. It is the sum of a dozen small decisions, and a single wrong one — a missing DKIM record, a purchased list, a tracking pixel on a plain-text message — can put every email you send into spam for weeks. This checklist is the order we work through when a client's campaign underperforms, and the order we'd set up a new one.

Where an item comes from a provider rule, the rule is linked. Where it comes from running campaigns, it says so.

1. Authentication — do this before anything else

Since February 2024, Gmail requires every sender to authenticate with SPF or DKIM, and requires senders of 5,000 or more messages a day to Gmail addresses to have SPF, DKIM and DMARC all in place, with the SPF or DKIM domain aligned to the From domain (Google's sender guidelines). Yahoo published matching requirements, and Microsoft announced equivalent rules for Outlook.com in 2025. In practice you should treat all three records as mandatory at any volume.

• SPF record on every sending domain that lists the servers allowed to send for it, ending ~all or -all. Stay under the 10-lookup limit — too many include: statements silently break SPF.
• DKIM signing enabled at your mailbox provider (Google Workspace, Microsoft 365, or your SMTP provider) with the public key published in DNS. Use 2048-bit keys where the provider offers them.
• DMARC record at _dmarc.yourdomain.com, at minimum v=DMARC1; p=none; rua=mailto:you@yourdomain.com so you receive reports, then move to p=quarantine once you've confirmed all legitimate mail passes.
• Alignment — the domain in your From address is the same domain (or a subdomain) that SPF and DKIM authenticate.
• Reverse DNS — the sending IP resolves to a hostname that resolves back to it. Your provider handles this for hosted mailboxes; check it if you run your own server or a dedicated IP.

Step-by-step records and how to check them are in SPF, DKIM and DMARC for cold email. In MailFleet the Domains tab on the Mailboxes page shows all three per domain and Final Review blocks a deploy while SPF or DKIM is missing.

2. Domain strategy

• Don't cold email from your primary domain. Reputation damage on yourcompany.com breaks your team's ordinary email. Use lookalike domains (yourcompany-hq.com, getyourcompany.com) that redirect to the main site.
• Age matters. A domain registered this week has no history. Register outreach domains well ahead of when you need them and warm them before use — see how to warm up a new email domain.
• Two to three mailboxes per domain, not ten. Reputation is tracked per domain as well as per mailbox; stacking many senders on one domain concentrates risk.
• Spread across providers if you send to a mixed audience — Google Workspace mailboxes to reach Google-hosted recipients, Microsoft 365 to reach Microsoft-hosted ones. Provider matching is a setting in MailFleet's campaign delivery tab.

3. Warmup — before and during

• Warm every new mailbox before its first cold send. A week minimum on an established domain; two to three on a new one.
• Keep warmup running. Reputation decays; a mailbox that only ever sends cold email looks like exactly what it is.
• Warm against real inboxes that engage back — opening, replying, rescuing from spam — not a pool of dead accounts. MailFleet's warmup network does this across every customer's mailboxes, free.
• Ramp, don't switch. 10–20 warmup emails a day in week one, rising to a steady 20–30.

4. Volume and pacing

The technical caps are far above what a cold-email mailbox should send. Google Workspace allows 2,000 messages and 3,000 external recipients a day per user (Gmail sending limits); Exchange Online allows 10,000 recipients a day and 30 messages a minute (Exchange Online limits). Reputation, not the cap, is the constraint.

• 20–50 cold emails per mailbox per day, and toward the low end on new or Microsoft-hosted mailboxes. Why the range is what it is: how many cold emails per day.
• Space them out. A gap of 15–30 minutes with jitter, never a burst at 9:00. MailFleet defaults to one every 20 minutes ±30%.
• Ramp new leads into a campaign — 50–100 new people a day rather than the whole list on launch, so a bad list reveals itself at 100 bounces, not 5,000.
• Send in business hours in the recipient's timezone. Mail arriving at 3 a.m. is read after the morning's real mail, if at all.
• Scale with mailboxes, not per-mailbox volume. If you need 1,000 emails a day, that is 30–40 mailboxes at 25–30 each, not 10 at 100.

5. List quality

Bounces are the fastest way to lose a domain. Gmail's guidance is to keep the spam rate reported in Postmaster Tools below 0.3% and ideally under 0.1%; bounce rates above about 2% are where receivers start to treat a sender as careless.

• Verify before you send. Every address should have been checked against its mail server recently. Catch-all domains accept anything and cannot be confirmed — send to them in smaller proportions.
• Never send to role addresses (info@, sales@, admin@) in cold campaigns, and drop free-mail addresses unless your buyers genuinely use them.
• Deduplicate across every campaign so nobody gets two sequences at once.
• Keep a blocklist of unsubscribes, complaints, bounces and competitors, enforced at import time, not just at send time.
• Stop on a hard bounce, retry on a soft one. A 5.1.x "no such user" is permanent; a reputation or policy rejection is not, and treating it as permanent throws away good addresses. MailFleet does this distinction automatically and pauses a campaign whose failure rate climbs.

6. The message itself

• Plain text. Not "looks like plain text" — actual text/plain, or a minimal HTML part that mirrors it. Tracking pixels, images and heavy formatting are the strongest content signals filters have.
• Short. Under 100 words for a first email. Long messages to strangers are marketing; short ones are correspondence.
• One link at most, and not a tracked link on the first email if you can avoid it. If you must track clicks, do it on your own domain, not a shared one — see custom tracking domains.
• No attachments in cold email, ever.
• Vary the wording. Spintax ({Hi|Hey|Hello}) and per-lead personalisation mean no two messages are byte-identical, which is what bulk filters key on.
• A real signature with a name and a company. Not a banner, not a logo image.
• Avoid the obvious trigger vocabulary — "free", "guarantee", "act now", all-caps, multiple exclamation marks — less because filters are naive about words and more because that vocabulary marks the message as a pitch.

7. Compliance headers

• One-click unsubscribe. Gmail and Yahoo require bulk senders to include the RFC 8058 List-Unsubscribe and List-Unsubscribe-Post headers and to honour requests within two days. MailFleet adds the headers to every send and hosts the confirmation page.
• A visible opt-out line in the body. It costs nothing and it lowers complaint rates, which is what actually protects the domain.
• A physical address or a real reply path where your jurisdiction requires it (CAN-SPAM in the US requires a valid postal address; GDPR governs the lawful basis for contacting EU residents at all).

8. Monitoring

• Google Postmaster Tools for every sending domain — domain reputation, spam rate, authentication results. It is free and it is the only view Gmail gives you.
• Bounce rate per domain, daily. MailFleet's Deliverability page shows the last seven days of sends against bounces per domain, split into bad addresses and policy blocks, flagged Watch from 4% bounced (or 1.5% policy blocks) and Critical from 8% (or 3%), with a Pause button that holds that domain's mailboxes out of rotation while it recovers.
• Placement tests on a sample of your own seed inboxes (a Gmail, an Outlook, a Yahoo) before launch and whenever you change copy.
• Reply rate, not open rate. With Apple's Mail Privacy Protection and Gmail's image proxying, opens are unreliable. Replies are the number that can't be faked, and a campaign with a healthy reply rate and no complaints is a campaign with good deliverability.

9. When something goes wrong

Placement drops usually announce themselves as a sudden fall in reply rate with no change in copy. In order:

1. Check authentication hasn't broken — a DNS change, an expired DKIM key, a new sending service not added to SPF.
2. Check bounce rate per domain. Above 2–4% on a domain, stop sending from it.
3. Check Postmaster Tools for a spam-rate spike or a reputation downgrade.
4. Cut volume by half on the affected mailboxes and keep warmup running. Reputation recovers over one to three weeks of clean behaviour, not overnight.
5. If a domain is badly burned, retire it from cold outreach. It is cheaper than the weeks of recovery.

The short version

Authenticate everything; use lookalike domains; warm before and during; 20–50 a day per mailbox with gaps; verified lists and a blocklist; plain text, short, one link at most; unsubscribe headers on every send; watch bounces and Postmaster Tools; scale with mailboxes. Nothing on this list is exotic. The teams whose cold email works are simply the ones who do all of it, every time.

FAQ

What bounce rate is acceptable for cold email?

Under 2%. Between 2% and 4% you should pause and clean the list; above 4% a domain's reputation is already being damaged.

Do I need DMARC for cold email?

If you send 5,000 or more messages a day to Gmail addresses, Gmail requires it. Below that it is still strongly advisable — it is a two-minute DNS record and it protects your domain from spoofing.

Should I use open tracking in cold email?

Only when you need the data and only from your own tracking domain. A tracking pixel makes the message HTML, which is a stronger spam signal than the information is usually worth; reply rate is the better metric anyway.

How many mailboxes do I need?

Divide your target daily volume by 25–30. A thousand emails a day is roughly 35–40 warmed mailboxes across a dozen or so domains.