Cold email deliverability: the pre-launch checklist (2026)

A cold email campaign breaks in two ways. Catastrophically, when the domain hits Spamhaus within hours and everything stops landing. Silently, when you hit "send" on 5,000 messages, the dashboard reports "delivered", and your reply rate is 0.4% because 70% of those deliveries are sitting in Junk. The first failure is visible. The second costs you a quarter of pipeline.

This is the pre-launch checklist we run before every cold campaign, split into five sections and one verification step. Seventeen items. If any are red, don't launch.

Section 1 — Domain and DNS (4 items)

1. SPF record published and resolving. TXT record at the apex of your sending domain listing every ESP, transactional service and mail server. Watch the 10-lookup ceiling — exceed it and SPF silently fails. End with ~all during rollout, tighten to -all once clean.
2. DKIM signing enabled with the correct selector. Every outbound message must carry a DKIM-Signature header that verifies against a published public key at selector._domainkey.sendingdomain.com. Send a test to check-auth@verifier.port25.com and read the reply.
3. DMARC published. Start at p=none with a rua reporting address, read reports for two weeks, move to p=quarantine. Gmail and Yahoo now require DMARC for bulk senders.
4. PTR / reverse DNS configured. Your sending IP's PTR record must match the hostname the server introduces itself as in the HELO. Missing rDNS is a silent kill-switch on Gmail — the message is accepted then filtered.

Section 2 — Sending infrastructure (4 items)

1. Dedicated sending domain, not your brand domain. Send cold outreach from yourbrand-mail.com or a sub-brand, not from the apex yourbrand.com that hosts marketing mail. A reputation hit on the cold-outreach domain must not poison transactional or marketing mail.
2. Domain warmed up 3+ weeks. 10–20 sends per day on week 1, doubling every few days through week 4. Engagement signals (replies, opens from engaged recipients) weigh more than volume. See the warm-up guide in related reading.
3. Tracking domain separate and aged. Your click-tracking CNAME should be its own subdomain with its own age and its own clean DNSBL record. Shared tracking domains from Lemlist, Instantly and Apollo are often flagged on Spamhaus DBL.
4. List-Unsubscribe header present. Both List-Unsubscribe (mailto + HTTPS) and List-Unsubscribe-Post headers on every message. Handle unsubscribes within 48 hours or Gmail stops honouring the header.

Section 3 — List hygiene (3 items)

1. List verified with NeverBounce, ZeroBounce or Kickbox. Run every address through a validation service within 30 days of sending. Remove everything marked invalid, risky or catch-all (treat catch-all with caution — send to the role sparingly).
2. No purchased lists. If the list was bought, it was already bought. Spam traps are seeded into every commercial list. One hit tanks reputation with an ISP for weeks.
3. Spam-trap check performed. Services like Zerobounce and Kickbox flag known traps. Beyond that, addresses that have not opened or clicked in 18+ months should be treated as possible recycled spam traps and removed.

Section 4 — Copy (3 items)

1. Personalisation tokens actually filled. Every {{first_name}}, {{company}}, {{role}} resolves for every recipient. A single unfilled token in a live campaign is visible and costs your reply rate more than any tuning fix gains.
2. No spam triggers. Run the template through SpamAssassin or Rspamd. Score above 5.0 is a red flag. Avoid ALL-CAPS subjects, repeated exclamation marks, the word "free" in the subject, money emoji.
3. Plain-text alt populated. Every HTML multipart message must include a full plain-text version. An empty or auto- generated one-liner is a spammer fingerprint.

Section 5 — Sending cadence (3 items)

1. Under 50 sends per day per inbox. Google Workspace and Microsoft 365 will accept more, but cold-outreach filters trigger on burst patterns above this threshold from new senders. Scale volume via rotation across multiple inboxes, not one inbox hammering.
2. Spread over hours. Send the day's volume over 6–8 business hours, not in a 10-minute burst at 09:00. Use jitter in your schedule — human senders don't hit "send" every 30 seconds on the dot.
3. Rotation configured. Multiple sending inboxes on multiple sending domains, distributed round-robin. Never send 100% of a campaign from one address.

Verification: placement test before launch

Before launching, send a seed test from the actual sending inbox to a placement tool's seed list. Expect 75%+ inbox on Gmail, 70%+ on Outlook, 60%+ on Mail.ru if your list is CIS-heavy. Any number well below these points to one of the seventeen items above failing silently.

Red flags that block launch

• SPF with more than 10 DNS lookups — SPF evaluates as Permerror.
• DMARC record with p=none for more than 6 months.
• Sending IP listed on Spamhaus ZEN, SORBS or Barracuda.
• Placement test shows inbox rate below 50% on Gmail.
• Bounce rate on the first 100 test sends above 3%.
• Complaint rate on past 30 days above 0.3%.

Any one of these is a stop. Fix, rerun the placement test, then launch.

Ongoing checks

• Weekly re-run of the placement test on each sending inbox.
• Monthly validation of the list.
• Quarterly audit of DNS — SPF includes accumulate, DMARC policies drift, tracking domains age out.
• Google Postmaster Tools review weekly if you send 100+/day to Gmail.

Frequently asked questions