An email deliverability checklist is a fixed set of checks you run before, during and after every campaign, so your messages reach the inbox and not the spam folder. The core of it is simple: authenticate your sending domain with SPF, DKIM and DMARC, send only to people who agreed to hear from you, ramp volume up gradually, keep the message clean and honest, and watch bounces and complaints once it has gone out.
Below, we have grouped the checks into the order you would actually work through them. Tick them off for a new domain, a new email platform, or simply before a big send you cannot afford to get wrong.
Deliverability is not one setting. Mailbox providers decide where a message goes using your domain and IP reputation, whether the message authenticates, how recipients behave, and what the message contains. That is why a checklist works better than a single tip: a failure at any layer can undo the rest.
We have split it into five stages. Work through them in order the first time. After that, the first two stages become occasional audits, and the last three become routine for each campaign.
Authentication proves that the mail claiming to come from your domain really does. It also lets receiving servers judge you on more than the IP address you happen to be sending from. Spamhaus explains that authentication protocols allow receivers to trust more data than the connecting IP when making reputation and filtering decisions.
SPF is a DNS TXT record listing the servers and services allowed to send for your domain. Include every platform that sends in your name: your newsletter tool, your CRM, your invoicing system and your website’s contact forms. Spamhaus’s sender guidelines say to keep SPF lookups within 10, which is easy to exceed when you stack several third-party services.
DKIM adds a cryptographic signature to each message. The same Spamhaus guidance calls for valid signatures using keys of at least 1024 bits. Most platforms give you a record to paste into DNS; if yours supplies a longer key, use it.
DMARC tells receivers what to do when SPF and DKIM fail to align with your visible From domain, and sends you reports. Spamhaus recommends an enforcement policy and a reporting (RUA) address. If you are new to DMARC, start by collecting reports, read them for a few weeks to find legitimate senders you forgot, and then tighten the policy.
Do not trust that a record is live because you saved it. Spamhaus suggests checking records with dig, the command-line DNS lookup tool. Many email platforms also have a built-in domain checker, which is fine as a second opinion.
The Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) recommends in its August 2026 Sender Best Common Practices that DNS records are checked when an account is set up and again from time to time. It also advises evaluating mail at send time to confirm it passes authentication, and taking corrective action if failure looks likely.
If you want a plain-English explanation of why this matters commercially, this piece on email trust metrics covers how authentication and message validation feed into the trust receivers place in your domain.
Sending from a free webmail address through a marketing platform undermines authentication and looks unprofessional. Send from an address on your own domain, such as news@yourcompany.co.uk, and authenticate that domain.
A perfectly authenticated email sent to the wrong people still lands in spam. List quality is where most deliverability problems actually begin.
Spamhaus recommends confirmed opt-in, where a subscriber clicks a link in a confirmation email before joining. Postmark’s broadcast sending guide also recommends adding CAPTCHA and double opt-in to sign-up forms to improve list quality. A CAPTCHA stops bots from filling your list with fake or hijacked addresses, which can create spam traps and bounce spikes.
Purchased lists contain people who never heard of you, plus addresses that exist purely to catch senders. Spamhaus says plainly not to buy or rent lists. The short-term reach is never worth the reputation damage.
If you import contacts from an old CRM, a trade show, or a previous platform, Emailit’s best-practice documentation recommends verifying them before the first send. Old data decays: people change jobs and abandon mailboxes.
Someone who has bought from you has not automatically agreed to marketing. Klaviyo’s help centre notes this and advises keeping separate lists for customers and subscribers. Transactional messages such as receipts and password resets belong in a different stream from promotions.
A hard bounce means the address does not exist: remove it immediately. For soft bounces (full mailbox, temporary fault), Spamhaus advises investigating or removing addresses after 3 to 5 consecutive bounces, and keeping your overall bounce rate below 5%. M3AAWG adds that you must be able to receive and process bounce notifications at the same rate and volume as you send.
Spamhaus recommends using bounce, feedback-loop and engagement data to keep lists current. Where a provider offers a feedback loop, remove anyone who complains straight away. Consider a sunset policy for people who have not opened or clicked for a long period: try one re-engagement email, then stop.
Every marketing email needs an unsubscribe route that is easy to find and works. M3AAWG lists an easy-to-find unsubscribe mechanism as part of its pre-send review. Process requests promptly and never email someone who has opted out.
Reputation is attached to your domain and, where you have a dedicated one, your IP address. A new one has none, which receivers treat with caution.
Most small and medium-sized businesses sending modest volumes do well on their platform’s shared IP pools. A dedicated IP gives you control, but also full responsibility for the reputation attached to it, and it needs consistent volume to stay warm.
Postmark suggests using separate subdomains for transactional and broadcast email so a problem with a promotional campaign does not drag down password resets and order confirmations. For example, send receipts from one subdomain and newsletters from another.
M3AAWG suggests considering an average of six weeks for warm-up. Start with low, consistent volumes, increase gradually, and send first to your most engaged contacts. Monitor your SMTP logs for deferrals and bounce spikes as you go.
A sensible pattern looks like this:
These are illustrative steps, not fixed numbers: your own bounce and deferral data should set the pace.
Spamhaus advises against sending the whole daily volume in one burst at the start of an hour, and recommends spreading it through the day. M3AAWG likewise says abrupt spikes are often flagged by filters. If you normally send 2,000 emails a month and suddenly send 50,000, expect trouble.
Spamhaus notes that domains registered in the last 24 hours are listed as Zero Reputation Domains, and those under 30 days old are treated with suspicion. Register your sending domain well ahead of your first campaign, and do not launch a campaign from a domain you bought last week.
M3AAWG includes reviewing sending limits in its pre-send practices. Know your platform’s daily and hourly caps, and make sure your plan matches your list size so a large send is not throttled mid-way.
Content matters less than authentication and list quality, but it can still tip a borderline message into spam, and it determines whether recipients engage or complain.
Use a recognisable From name, a reply-to address that is monitored, and a subject line that honestly reflects what is inside. Avoid misleading promises, shouting in capitals and gimmicky formatting. If you want to sharpen the tone of your messages, our guide to email etiquette for professionals is a good companion.
Postmark points out that testing is the best way to catch obvious professional errors such as typos and broken links, which hurt credibility and engagement. Send a test to several mailbox providers, click every link, and view the message on desktop and mobile. Also include a plain-text version alongside the HTML one.
Every link should point to a page that works and sits on a domain with a good reputation. Avoid link shorteners in marketing email, and make sure the landing page is secure and loads quickly. If it is a while since you looked at the site you are sending people to, a website audit checklist will help you spot broken pages before your subscribers do.
Beyond the visible unsubscribe link, marketing mail sent through an API or SMTP should carry list-unsubscribe headers. Emailit’s documentation says the header URL should accept a POST so a person can unsubscribe in one step without further screens. Most mainstream email platforms add this for you; if you send through your own server, check it yourself.
Apollo’s deliverability guidance lists the pre-send essentials neatly: domain authentication, working mailbox connections, correct sender signatures and limits, verified recipients, relevant content and an unsubscribe link. Run through those one more time before a big send.
In the UK, the Information Commissioner’s Office states that you must not send marketing emails to individuals without specific consent, with a limited exception, the “soft opt-in”, for your own previous customers. For the soft opt-in, you must have offered a simple way to opt out when you collected their details and in every message. The ICO also says you can email companies, though keeping a do-not-email list for those that object is good practice.
Because we work with clients in several countries, remember that this is UK law and other markets have their own rules. If you send abroad, check the local regime for each audience. Our guide to GDPR compliance for websites is a useful starting point for the wider data-protection picture.
A send is not finished when it leaves the platform. The first hours tell you whether you have a problem.
Adobe’s deliverability best-practice guide points to bounce rates, open and click metrics, complaint rates and unsubscribe spikes as the signals to monitor. Treat opens with care, as privacy features on some mail apps inflate them; clicks, complaints and bounces are more reliable.
Apollo advises that if inbox-placement tests raise concerns, you should use the diagnostic results to choose specific fixes, not make broad changes to your whole sending set-up. Changing everything at once makes it impossible to know what worked.
Most deliverability trouble we see is not a mystery. It is a website, a CRM, a newsletter tool and a booking form all sending email in the company’s name, with nobody owning the DNS records behind them. That is why we treat email as part of the wider digital estate, not a separate marketing task. The sign-up form on your website decides list quality. The hosting and DNS decide whether your records stay correct. The landing page decides whether people click or complain. When those pieces are designed and maintained together, deliverability becomes a routine check and not an emergency. That joined-up approach, across web development, hosting, support and digital marketing, is what we aim to give our clients. Rob
Most deliverability trouble we see is not a mystery. It is a website, a CRM, a newsletter tool and a booking form all sending email in the company’s name, with nobody owning the DNS records behind them.
That is why we treat email as part of the wider digital estate, not a separate marketing task. The sign-up form on your website decides list quality. The hosting and DNS decide whether your records stay correct. The landing page decides whether people click or complain.
When those pieces are designed and maintained together, deliverability becomes a routine check and not an emergency. That joined-up approach, across web development, hosting, support and digital marketing, is what we aim to give our clients.
Rob
Email performance depends on the website behind it: secure forms with spam protection, fast landing pages, correctly managed DNS and hosting, and a clear plan for what you send and why. We build and support all of these for businesses, from website design and development to hosting and IT infrastructure management and digital marketing.
If you would like a joined-up view of your sign-up forms, landing pages and campaigns, take a look at our services, explore the Brainiac Business Platform, or get in touch for a conversation. For the strategy side, our overview of email marketing for businesses is a sensible next read.
Run the authentication and list-hygiene stages as an audit whenever you add a new sending tool or domain, and at regular intervals otherwise, since M3AAWG recommends re-checking DNS records periodically. Run the content and monitoring stages for every campaign. A short pre-send routine takes minutes once the habit is set.
Yes, they do different jobs and work best as a set. SPF lists who may send, DKIM signs the message, and DMARC tells receivers what to do when checks fail and reports back to you. Spamhaus’s guidance calls for all three, with DMARC set to an enforcement policy and a reporting address.
M3AAWG suggests considering an average of around six weeks. Start small, send to your most engaged contacts first, increase gradually and watch for deferrals and bounce spikes. If problems appear, slow down instead of pushing through.
Under UK rules, the ICO describes a limited soft opt-in for previous customers who bought something similar from you and were given a simple way to opt out at the time and in every message. Anyone else needs specific consent. If you are unsure whether your list qualifies, take advice from a data-protection professional.
Book a Demo
Forgotten Password
Get your free SEO guide
Thank you, please check your email
Sign into Brainiac Media
Please sign-in using your email address and password.
Forget your Password?
no worries, click here to reset your password.