The Cold Email Deliverability Checklist (2026)

Cold email deliverability comes down to a handful of controllable factors: authenticate your domain with SPF, DKIM and DMARC, warm every new inbox before sending, verify your list to keep bounces under about 3%, and strip spam-trigger words from your copy. Get those right and your email reaches the inbox instead of the spam folder.

Why does deliverability decide whether cold email works?

You cannot book a meeting from an inbox you never reached. Deliverability is the gate every other part of cold email depends on: targeting, copy and offer all count for nothing if the message lands in spam or gets blocked at the door. Mailbox providers like Google and Microsoft decide where your email goes based on signals you control, whether your domain is authenticated, whether your sending reputation is healthy, whether recipients engage or complain, and whether your list is clean. The painful part is that deliverability damage is slow to see and slow to undo: a burned domain does not send you a warning, it just quietly stops landing, and recovery takes far longer than the mistake took. That is why deliverability is a discipline you protect continuously, not a setting you configure once. The checklist below is the routine that keeps the gate open. Before you scale volume, grade a draft against the spam checker so copy is never the thing that buries you.

How do you authenticate a sending domain with SPF, DKIM and DMARC?

Authentication is how a mailbox provider confirms your email is really from you and not a spoofer. Three records do the work, and cold email needs all three set correctly before the first send. SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature that proves the message was not tampered with in transit. DMARC ties the two together, tells receivers what to do when a message fails, and gives you reporting on who is sending as your domain. Missing or misconfigured records are one of the most common reasons cold email silently fails, because an unauthenticated message is treated as suspicious before anyone reads a word of it. Set all three at the DNS level for every sending domain, then confirm they pass before warming begins.

How do you warm up a new domain and inbox?

A brand-new domain and inbox have no sending reputation, and blasting cold volume from day one is the fastest way to get filtered. Warm-up builds reputation gradually: you start with a small number of sends a day, often to engaged or seeded addresses that open and reply, and increase the volume slowly over a period that typically runs a few weeks before the inbox is ready for real campaigns. The goal is to teach mailbox providers that your domain sends wanted mail people actually interact with. Rushing this is a classic self-inflicted wound, because the reputation you skip building is the reputation that would have kept you out of spam later. Keep new sending domains separate from your primary business domain so a cold campaign can never threaten the address you run your company from, and stagger volume increases rather than jumping. Warm-up is not optional overhead, it is the foundation every later send stands on.

How do you keep your bounce rate under 3%?

Every hard bounce tells a mailbox provider you are sending to addresses that do not exist, which is exactly the pattern spammers show. Let bounces climb and your reputation drops for the whole domain, not just the bad addresses, and deliverability suffers for weeks. The standard bar is to keep your bounce rate under about 3%, and the way to hold that line is simple: verify every address before you send. Run each list through an email verifier to catch invalid, dead and risky addresses, and re-verify high-churn lists often because contacts change jobs constantly and an address that was valid last quarter may be dead now. A clean list of 500 real people beats a dirty list of 5,000 every time, because the dirty one does not just underperform, it damages the asset you send from. Verification is the single highest-leverage habit in deliverability, and it costs almost nothing compared to the reputation it protects. Catch-all and role-based addresses deserve extra caution too, because they raise risk without confirming a real recipient, so treat a verifier's warnings as reasons to trim the list rather than notes to ignore.

Which words and formatting trigger spam filters?

Content filters read your copy for the patterns spam tends to share. Words like free, guarantee, act now and risk-free, rows of exclamation marks, ALL CAPS subject lines, big mismatched fonts, and too many links in a short message all raise your spam score. Heavy HTML, embedded images and tracking-laden templates make it worse, because a plain, personal-looking email from one human to another is exactly what filters trust and what actually earns replies. The fix is to write like a person, not a marketer: short, specific, one clear ask, minimal formatting, and few or no links on the first touch. Run every sequence through a spam checker before it goes live, so a single trigger word is not what quietly costs you the reply your targeting earned. Good deliverability copy and good cold copy are the same thing, which is why grading it is a step, not an afterthought. See the wider copy discipline in cold email vs LinkedIn outreach.

What is the full cold email deliverability checklist?

Run this before every new domain goes live, and revisit it whenever reply rates dip. Work top to bottom, because each step gates the ones below it:

1. 1Buy separate sending domains, and never send cold mail from your primary business domain.
2. 2Set SPF, DKIM and DMARC records for every sending domain, then confirm all three pass.
3. 3Warm each new inbox gradually over a few weeks before any real campaign volume.
4. 4Verify every list with an email verifier and keep your bounce rate under about 3%.
5. 5Grade your copy with a spam checker and strip trigger words, ALL CAPS and heavy formatting.
6. 6Limit links, ideally none on the first touch, and keep emails short and plain.
7. 7Send at a steady, human daily volume per inbox rather than blasting.
8. 8Monitor bounces, spam complaints and replies weekly, and pause a domain the moment its numbers slip.

Deliverability is not a setting you configure once. It is a habit that protects the only asset that matters: a domain that still lands.

Miss the routine and the best list and sharpest copy in the world never get read. If you would rather not run this discipline yourself, a partner who verifies every list and grades every sequence before it sends is what keeps a program healthy at scale, the same standard behind 7 reasons your outbound is not booking meetings and the complete B2B outbound guide. See how we run it in Provena's outreach system.