Email Deliverability Audit

DNS records, list hygiene, engagement metrics, and reputation checks to keep your sender score above 90.

Deliverability is decided by three things: whether you are authenticated, whether people engage, and whether you are sending to addresses that should not be on your list. This audit walks all three in the order that matters, with the specific records, thresholds, and remediation steps. Run it before any large send and quarterly thereafter.

Reach for this when

Open rates have fallen without any change in content, which usually means placement changed rather than interest.
You are about to send to a list you have not mailed in months.
You are moving providers, adding a new sending domain, or warming a new IP.
Recipients at one particular provider report that your mail is landing in spam.

Authentication records

Non negotiable and entirely within your control. Every major mailbox provider now expects all three, and bulk senders are held to them strictly.

SPF: one record only for the domain, listing every service that sends on your behalf, ending in a hard or soft fail. More than one SPF record is a failure, and so is exceeding the ten lookup limit.
DKIM: enabled at the provider, with the public key published and the signature verifying on a real received message.
DMARC: a record published at _dmarc on the domain. Start at p=none with reporting addresses, read the reports, then move to quarantine and finally reject.
Alignment: the visible From domain must align with the SPF and DKIM domains. Authentication that passes without alignment does not satisfy DMARC.
A dedicated subdomain for marketing mail, so promotional reputation cannot damage transactional or human mail.
Optional but useful once DMARC is at enforcement: BIMI, with a verified mark certificate, which surfaces your logo in supporting clients.

Infrastructure and identity

Where the mail comes from, and whether that origin looks consistent and legitimate to a receiving system.

Reverse DNS resolves for the sending IP and matches the sending domain.
A consistent From name and From address. Rotating sender identities resets whatever reputation you had built.
Reply to is a monitored mailbox. Unmonitored reply addresses are treated as a negative signal and are also just bad practice.
Custom tracking and click domain configured on your own subdomain, rather than the provider's shared domain.
Check the sending domain and IP against the major public blocklists, and follow the delisting process if listed.
If you are on a dedicated IP, warm it: start with your most engaged recipients and increase volume gradually over several weeks.

List hygiene

The single largest controllable factor. Providers infer wanted mail from behaviour, and a list padded with dead addresses reliably degrades placement for everyone else on it.

Confirmed opt in for every address, with the source and timestamp stored on the record.
No purchased, scraped, rented, or appended lists, ever. One send to a purchased list can undo a year of reputation.
Hard bounces suppressed immediately and permanently, with no manual re adding.
Soft bounces suppressed after three to five consecutive failures.
Role addresses reviewed: info, sales, admin, and similar mailboxes convert poorly and complain disproportionately.
Validate the list before any send to addresses collected more than six months ago.
Never re engage a list that has been dormant for over a year in a single send. Segment it and send in small batches to the most recently active first.

Engagement thresholds

Working thresholds for a marketing list, used as triggers to act rather than as scores to celebrate. Note that open rate is now an unreliable measure on its own because of privacy protection features, so weight clicks more heavily.

Click rate is the metric to trust. Track it per segment and per campaign type over time and act on the trend, not on a single send.
Complaint rate should stay below one in a thousand. Above that, pause and diagnose before sending again.
Hard bounce rate above two percent on a send means the list source is the problem, not the message.
Unsubscribe rate that spikes on one campaign is a content and frequency signal. A steady rise across campaigns is a list quality signal.
Segment by last engagement: active in 90 days, 90 to 180 days, 180 to 365 days, and dormant. Send frequency should fall with each tier.
Sunset dormant subscribers. Removing people who never open protects delivery to the people who do.

Content and structure checks

Content matters less than authentication and engagement, but a handful of habits reliably trigger filtering.

A visible, one click unsubscribe link plus the list unsubscribe header enabled at the provider.
A physical postal address in the footer, as required by law in most jurisdictions.
A real text version of every email, not an autogenerated dump of the HTML.
A reasonable balance of text and images. An email that is one large image is a classic spam pattern.
Links that point to your own domains, with no link shorteners and no domains with poor reputation.
Subject lines that describe the contents accurately. Deceptive subject lines produce complaints, and complaints are what actually hurt.

Monitoring and remediation

Deliverability is a maintained state, not a fixed one. Set up the feedback loops now, while nothing is wrong.

Read DMARC aggregate reports monthly, or use a tool that summarises them. They reveal every service sending as you, including ones you forgot about.
Register for feedback loops with the major providers so complaints flow back into automatic suppression.
Seed test inboxes across the major consumer and business providers and check placement on important sends.
Track delivery metrics by provider. Problems are almost always provider specific and averaging hides them.
If placement drops: pause the broad sends, mail only your most engaged segment for two to three weeks, then widen again slowly.
Document every change with a date, so a future recovery can be traced to what actually worked.

How to use it

Start with authentication. Check SPF, DKIM, DMARC, and alignment on a message you actually received, using the full headers.
Publish DMARC at p=none with reporting first, read a month of reports, and only then tighten the policy.
Run the hygiene block next and suppress everything that should be suppressed before your next campaign, not after.
Build the engagement tiers as saved segments so frequency rules can be applied automatically.
Send your next campaign to the most engaged tier only, and compare placement and click rate against the previous broad send.
Put a quarterly audit on the calendar with a named owner, and rerun the whole list before any annual or seasonal peak.

Common mistakes

Publishing more than one SPF record for a domain, which invalidates authentication entirely and is very easy to do when adding a second sending service.
Trying to reactivate a long dormant list with a single large send, which produces a complaint spike and can damage placement for the whole domain.
Judging deliverability by open rate alone, which privacy features have made unreliable, instead of by clicks, complaints, and provider level delivery.
Treating deliverability as a one time fix rather than a maintained state, so the same problems return two quarters later.