Cold email deliverability checklist before your first send
Run this checklist before any cold campaign: authenticate the sending domain with SPF, DKIM and DMARC, use a mailbox on a domain you control, remove invalid and duplicate addresses, send a small first batch, and stop sequences on replies or hard bounces. Deliverability is decided before a single message leaves, mostly by authentication, list quality and sending pace.
Authentication is the part you can prove
SPF, DKIM and DMARC are not marketing advice; they are records a receiving server can check in milliseconds. SPF lists the servers allowed to send for the domain. DKIM signs each message so a receiver can confirm it was not altered. DMARC tells the receiver what to do when either check fails, and gives you reports when they do.
If you send through a third-party SMTP provider, the provider signs with DKIM on your behalf, and the SPF record must include their sending hosts. Copying a record from another provider is the most common way a new sending domain lands in spam on day one.
List quality beats clever copy
A message sent to an address that does not exist costs you twice: the bounce damages reputation, and the hard bounce tells the receiver your list was not verified. Remove invalid syntax, dead domains, role addresses you do not need, and duplicates before the first send. If you buy or assemble a list from public sources, verify it first, then keep the verified subset.
A verifier can catch syntax, missing mail exchangers, disposable domains and addresses a mail server refuses. It cannot prove that a person reads the mailbox or that they consented to hear from you. Treat verification as hygiene, not as permission.
Pace the first batch like a stranger
A new domain that suddenly sends hundreds of messages looks identical to a compromised one. Start with a small batch to real recipients who could plausibly reply, watch what comes back, then move the volume up. Keep one mailbox per campaign so a single sender's reputation is not smeared across every offer you run.
Reply handling matters as much as sending. If someone replies asking to stop, the next message in the sequence is the one that gets you reported. Stop the sequence on any reply, and honour opt-outs immediately.
What to fix first when you only have one afternoon
Work in the order that a receiving server works. Authentication first, because a broken record fails every message no matter how good the list is. Then list hygiene, because bounces are the fastest way to lose the reputation you just fixed. Then pacing and content, which take longer to show an effect and are impossible to judge while the first two are wrong.
If you change all four at once and placement improves, you will not know which change mattered, and you will not be able to repeat it on the next campaign. Change one layer per week and keep a short note of what you sent, to whom, and what came back. That note is the only reliable record you will have.
The last thing to touch is volume. It is also the thing most teams reach for first, because sending more feels like progress. A domain that sends less and gets replies is in a better position than one that sends more and gets filtered.
What each check tells you, and what it cannot tell you
| Check | What it proves | What it does not prove |
|---|---|---|
| SPF pass | The sending IP is allowed for the domain | That the message is wanted |
| DKIM pass | The message was signed and not altered in transit | That the sender is reputable |
| DMARC pass | SPF or DKIM aligned with the visible From domain | Inbox placement |
| Mailbox verification | The address syntax and domain accept mail | That a person reads it |
| Small first batch | The path works for real recipients | That later volume stays safe |
Placement also depends on content, recipient engagement history and the receiving provider. No checklist guarantees an inbox.
Pre-send checklist
- Sending domain authenticated with SPF, DKIM and DMARC
- Mailbox credentials tested with a real login, not just saved
- List deduplicated and invalid addresses removed
- Verification run on the addresses you intend to send to
- Subject line and first line say who you are and why you wrote
- Unsubscribe or stop instruction that a person can act on
- First batch small, with one mailbox per campaign
- Reply and bounce handling reviewed before volume increases
A worked example, with hypothetical numbers
Suppose a studio wants to contact 400 independent venue owners. The first draft sends to all 400 on day one from a domain registered the previous week. Treat that as a test you expect to fail: the domain has no history, and 400 cold messages on day one is a pattern receivers recognise.
The calmer version sends 40 first, from one authenticated mailbox, to venues that publish a booking address. The team reads what comes back, fixes the two bounced addresses, then sends the next 60 the following day and stops any sequence the moment someone replies. Nothing here is a trick; it is the difference between a domain that accumulates a sending history and one that earns a complaint in its first week.
- 1.Day 1: authenticate the domain and verify the first 40 addresses.
- 2.Day 1: send 40 and watch replies, bounces and complaints.
- 3.Day 2: remove what bounced, fix the wording that got no replies.
- 4.Day 3 onward: increase in small steps while replies stay clean.
What this will not do
- No checklist guarantees inbox placement; filters weigh engagement and history you cannot control.
- Verification checks a domain and address, not consent or interest.
- A clean setup will not rescue an offer nobody wants.
Questions people ask about this
Can I use a free mailbox for cold email?
You can send from any mailbox, but free consumer mailboxes limit daily volume and share reputation with millions of other senders. A mailbox on a domain you control, authenticated properly, is easier to diagnose when something goes wrong.
How long should warming a new domain take?
There is no fixed number. Increase volume only while replies and bounces stay clean, and expect the first week to be small. A domain that sends a little, consistently, is easier to reason about than one that spikes.
Does a verified email mean I can email it?
No. Verification is a technical check on the address and domain. Consent, lawful basis and local rules are separate, and they are your responsibility as the sender.
What should I do when a message bounces?
A hard bounce is permanent: remove the address and do not retry. A soft bounce may be temporary, so retry once later; if it repeats, remove it and stop treating that contact as reachable.
Is it better to fix content or infrastructure first?
Infrastructure. Authentication and list quality decide whether your message is even considered, so changing copy while a record is failing hides the result rather than improving it.