· 7 min read · deliverability
Most deliverability problems are not mysteries. They are a missing DNS record, a mailbox that started too early, or a list nobody checked.
This is the checklist we work through for every campaign, in the order we run it. The order matters: each step assumes the one before it is done. If you want the background on why inbox providers became stricter, read what changed in cold email deliverability in 2026.
1. A separate sending domain
Cold email never goes out from your primary domain. That domain carries your invoices and proposals, and a bad week of outreach should not touch them.
Register a few domains close to your brand and send only from those. We explain how to pick the names, how many to buy and how to forward them in lookalike domains for cold email.
Done looks like: every cold email in the campaign has a From address on a domain that is not your main one.
2. SPF on every sending domain
SPF is a TXT record that lists the servers allowed to send for a domain. Publish exactly one SPF record per domain, include only the provider you actually send through, and end it with -all or ~all.
v=spf1 include:_spf.google.com -all
Done looks like: one SPF record, no duplicates, and a pass when you send a test message to a mailbox you control and read the headers.
3. DKIM on every sending domain
DKIM signs each message so the receiver can check it came from you and was not changed on the way. Generate the key in Google Workspace or Microsoft 365, publish the record, then switch signing on. Forgetting that last step is a common miss.
Done looks like: test messages show dkim=pass, signed with the sending domain itself rather than the provider's default domain.
4. DMARC, with a policy that moves forward
DMARC tells receivers what to do when SPF or DKIM fail, and it sends you reports so you can see it happening. It also checks alignment: the domain in the From address has to match the domain that passed SPF or DKIM.
The policy has three settings, and the usual progression runs in this order:
p=nonecollects reports and changes nothing. It is the safe start on a domain that already sends mail you cannot fully account for.p=quarantineasks receivers to send failing mail to spam. On a fresh sending domain, where nothing else sends, we start here.p=rejectasks receivers to refuse failing mail. Move to it once the reports have been clean for a few weeks.
Route the rua reports to an inbox someone reads.
Done looks like: a DMARC record on every sending domain, reports arriving, and no unexplained failures in them.
5. Mailboxes set up like a person uses them
Each mailbox should look like a real colleague: a real first and last name, a plain signature, and a reply-to that reaches someone.
We put three mailboxes on each domain, so a problem on one address never carries the whole campaign. The full arithmetic is in how many mailboxes and domains you need for 10,000 emails.
Done looks like: every mailbox has a name, signature, profile and a working reply path, and every reply ends up in one inbox you read.
6. Warmup before any cold sends
A new mailbox has no history, and filters treat mail without history as suspect. Warmup gives it one: a slow ramp of real conversations that get opened, answered and rescued from spam. Our ramp runs for 14 days, from 5 emails a day to 40, and the reasons it cannot be shortened are in email warmup explained.
Start warmup only after steps 2 to 4 pass. Warming a domain that fails authentication builds reputation for the wrong thing.
Done looks like: 14 days of warmup completed, and a placement test on Gmail and Outlook that lands in the inbox. If it does not, we wait.
7. A daily volume cap per mailbox
Once warm, each mailbox sends 30 cold emails a day, spread across the working day rather than in one burst. That is the number we plan around because it looks like an ordinary person, and it leaves headroom below the 40 a mailbox reaches at the end of warmup. We go through where that number comes from in how many cold emails per day per mailbox is safe.
Done looks like: a hard daily cap set in the sending tool for every mailbox, follow-ups included in it, and random spacing between sends.
8. A verified list and a low bounce rate
Bounces are one of the clearest signs that a sender never checked who they were writing to. Verify every address before it enters the campaign, remove role addresses such as info@ and sales@, and drop anything the verifier marks as risky or unknown.
We plan around keeping bounces under 2 percent and treat anything above that as a reason to pause and recheck the list. Every lead in our lead sourcing is checked by two verification providers before it reaches your list.
Done looks like: a list where every address passed verification within the last few days.
9. Content and links that do not look like a campaign
Filters read the message too. Keep each email short and plain text. Leave out images and attachments, and avoid tracking pixels in the first email if you can. Use at most one link, and none in the first email is better. Link shorteners and links to domains with a poor history hurt placement.
Done looks like: plain-text emails, no attachments, at most one link pointing at your own domain, and a different first line for every lead.
10. An opt-out you honour the same day
Google and Yahoo require one-click unsubscribe for bulk marketing mail. One-to-one B2B outreach is a different case, but the principle holds: anyone who wants to stop hearing from you should be able to say so easily. A plain line such as "If this is not relevant, reply and I will not write again" works, and so does a list-unsubscribe header if your tool supports it.
When someone opts out, remove them from every mailbox and every future campaign, the same day.
Done looks like: an opt-out line in every email and a suppression list shared across all mailboxes.
11. Monitoring while the campaign runs
Deliverability is not a setup task you finish. During sending, check every day: bounce rate per mailbox, spam complaints, DMARC report failures, mailboxes that have been rate-limited or locked, and placement on a seed test every week or so.
Google's spam-rate ceiling for bulk senders is 0.3 percent, and it recommends staying under 0.1 percent. If one mailbox slips, rest it: pause its cold sends, keep it in warmup, and let the others carry the volume. This daily watch is what launch and monitoring covers for the 28 days of sending.
Done looks like: a daily check written down somewhere, and a clear rule for when a mailbox pauses.
The checklist on one page
- Cold email sends only from separate sending domains
- One SPF record per domain, passing
- DKIM signing switched on and aligned with the From domain
- DMARC published, reports read, policy moving from quarantine toward reject
- Named mailboxes with signatures and a working reply path
- 14 days of warmup and a clean placement test before launch
- 30 emails per mailbox per day, follow-ups included
- Every address verified, bounces planned under 2 percent
- Short plain-text emails with at most one link
- An opt-out in every email, honoured the same day
- Daily monitoring and a rule for pausing a mailbox
Doing all of this, in order, on four domains and twelve mailboxes is about two weeks of careful work. That is the work our domain and mailbox setup and email warmup services exist to do. If you would rather hand the whole list over, start a Launch campaign for $199 and we run every item on it before day 16.