The Email Deliverability Audit: 31 Checks We Run Before a Single Send

An email deliverability audit is the boring hour that decides whether the next ninety days of outbound land in the inbox or the spam folder. We run one on every account before it sends a single message, because a domain that starts sending with a broken DKIM record or an unverified list does not recover its way to good placement. It digs the hole deeper with every send, and by the time the numbers look wrong, the reputation is already spent.

The audit below is the exact one our team works through. It is 31 checks across six areas, and none of them require a paid tool you do not already have. Most of the failures we find sit in the first two groups, where a five-minute DNS fix prevents a three-week reputation rebuild. Work top to bottom, because the later checks assume the earlier ones passed.

The Six Areas, at a Glance

Authentication and DNS

This group is where trust is granted or refused, and it is the group most often half-done. Existence is not the bar; alignment is what counts.

• SPF record present and valid, with the sending source authorized and under the ten-lookup limit that silently voids the record when exceeded.
• DKIM signing enabled on every sending domain, with a 2048-bit key where the provider allows it.
• DMARC published, at minimum p=none with a reporting address so you actually receive the data.
• DMARC alignment confirmed, meaning the visible From domain matches the authenticated domain. This is the check that catches senders who published all three records and still fail, and it is the single most predictive item on this list.
• PTR record (reverse DNS) set so the sending IP resolves back to a hostname.
• MX record valid on the sending domain, because a domain with no way to receive mail reads as disposable.

We wrote the setup walkthrough for this group in SPF, DKIM, and DMARC for cold email. If any of these six fail, stop and fix them before touching anything below.

Domain and Infrastructure

• Registration ownership verified in your name, not a vendor's account, so the reputation you build stays yours. We spelled out why this term outranks price in how to pick a deliverability agency.
• Separate sending domain in use, so a placement problem never touches your primary corporate domain.
• Domain age and history checked, because a freshly registered domain and a repurposed expired one carry different starting reputations.
• Blacklist status clean across the major RBLs before the first send.
• Custom tracking domain configured, rather than the shared tracking domain your tool ships with, which may already be flagged.
• Redirect from the sending domain to your primary site, so a curious recipient who types the bare domain lands somewhere real.

Inbox Setup and Warm-Up

• Inbox count matched to target volume, so no single mailbox is pushed past a safe daily send.
• Warm-up completed, not skipped, with a documented ramp before real campaigns begin. Our domain warm-up guide covers the schedule.
• Ramp schedule in place for the first weeks of live sending, rather than jumping to full volume on day one.
• Per-inbox daily cap set conservatively and enforced by the sending tool.
• Profile and signature filled in on each mailbox, because empty sender profiles read as automated.
• IMAP and reply handling connected, so replies and bounces are seen and acted on rather than piling up unread.

List and Targeting Hygiene

This group prevents more damage than any other, and it is the one most teams skip because it feels like admin. A warmed, perfectly authenticated domain can be torched in an afternoon by one unverified list with a cluster of dead addresses and a spam trap.

• Email verification run on the full list, with invalids removed before load.
• Catch-all handling decided deliberately, since catch-all domains hide unknown addresses that inflate risk.
• Spam-trap screening applied, because a single pristine trap hit can move reputation on its own.
• Role accounts removed (info@, sales@, support@), which complain and bounce at high rates.
• Suppression list applied, so past unsubscribes and hard bounces never receive another send.
• Duplicates and bad segments cleared, so the same person is not hit twice from two inboxes.

If you want the numbers that make this concrete, our cold email bounce rate benchmarks show where a healthy list sits and where the danger line falls.

Content and Sending Behavior

• Link count kept low, since a wall of tracked links is a classic filter trigger.
• Image-to-text ratio balanced, with plain, mostly-text messages preferred for cold sends.
• Unsubscribe or opt-out present and working, which lowers complaints and keeps you compliant.
• Spam-word scan run across subject and body for the obvious trigger terms.
• Plain-text version included alongside HTML so the message renders everywhere.
• Personalization tokens confirmed to render, because a visible {{firstName}} in a live send is both embarrassing and a spam signal.

Baseline Monitoring

• Google Postmaster Tools and Microsoft SNDS connected before the first send, so you have a reputation baseline to compare against the day something moves. An audit tells you the starting position. Monitoring tells you when it changes, which is a separate discipline we break down in email deliverability monitoring.

When to Run It, and How Often

Run the full audit before the first send on any new domain, without exception. Run it again the day placement dips, because the fastest path back is to re-check the same 31 items rather than guess. Between those, the recurring weekly work lives in our deliverability checklist, which is the maintenance routine this audit sets the baseline for.

The opinion we will defend: most deliverability problems are not mysteries, they are skipped audits. A domain that lands in spam almost always failed a check that took five minutes to catch and would have cost nothing to fix before sending. Running the audit is cheap, and rebuilding a burned reputation is not.

Where This Leaves You

Thirty-one checks sounds like a lot until you run it once and realize most take seconds and never fail again. The value is not the length of the list, it is the order: authentication before infrastructure, infrastructure before volume, list before content. Fix an early check and several later symptoms disappear on their own. Skip one and you spend three weeks rebuilding what a five-minute fix would have protected.

Want This Run For You Before You Send?

We run this exact audit on every domain inside our managed outbound system, then own the weekly monitoring that keeps placement where the audit put it. Every domain and inbox is registered in your name from day one.

Book your free discovery call →