Email Deliverability Audit: A Practical Checklist

Overview

An email deliverability audit is a structured review of the signals that decide whether your mail is wanted, authenticated, and safe to keep sending. It is not a single inbox placement test or a quick SPF lookup. A useful audit looks at DNS records, domain alignment, list acquisition, engagement decay, bounce handling, complaint handling, unsubscribe paths, tracking domains, content, send cadence, and the workflow that turns problems into suppression or segmentation changes. The output should be a ranked action list: what to fix before the next send, what to monitor over the next 30 days, and what to change in the operating system so the same issue does not return.

Start with scope: stream, domain, provider, and audience

Begin by separating mail streams. Transactional account email, lifecycle onboarding, newsletters, cold outreach, product updates, and re-engagement campaigns should not be audited as one blended program. Each stream has a different consent model, frequency, complaint risk, and acceptable failure mode. A password reset failing is urgent; a newsletter with a tired segment should usually be paused before it creates reputation damage.

Document the sending domain, return-path/bounce domain, DKIM selector, DMARC domain, tracking domain, provider, dedicated or shared IP model, list source, average cadence, recent volume, and last 30-90 days of bounces, complaints, unsubscribes, clicks, replies, and provider-level trends. If you cannot answer those questions, the first audit finding is not technical: your email program lacks an inventory.

• Audit each email stream separately before combining conclusions
• Write down every domain and provider involved in delivery
• Split metrics by Gmail, Yahoo, Microsoft, business domains, and other major groups where possible
• Rank fixes by risk to the next send, not by what is easiest to check

Check authentication and alignment before judging content

Authentication is the baseline. Review SPF, DKIM, and DMARC for each sending domain and subdomain. SPF should include the systems that legitimately send for the domain without growing into an over-broad record. DKIM should be signing from the correct provider with active selectors. DMARC should exist, align with the visible From domain, and have reporting addresses you actually review. DMARC.org describes DMARC as building on SPF and DKIM to give domain owners policy and reporting; in practice, that reporting is what turns authentication from a checkbox into an operating loop.

Also inspect alignment. A message can technically pass SPF or DKIM while still looking suspicious if the visible From, return-path, DKIM d= domain, and tracking domain are inconsistent. Use a custom tracking domain when it fits your stack, keep branded sending domains recognizable, and test real messages instead of only checking DNS records. The audit question is not just 'do records exist?' It is 'does a real message authenticate and align the way mailbox providers expect?'

• Do not audit only DNS; audit the headers of actual delivered mail
• Look for broken DKIM selectors after provider migrations
• Treat unknown DMARC sources as investigation items before enforcement
• Keep tracking domains stable and branded where possible

1. Send a real message from each stream to test inboxes you control.
2. Open the message headers and confirm SPF, DKIM, and DMARC results.
3. Verify the visible From domain aligns with the authenticated organizational domain.
4. Check that bounce and tracking domains are branded, intentional, and still resolving.
5. Review DMARC aggregate reports for unauthorized sources before tightening policy.

Audit list quality with a consent and engagement lens

Most deliverability problems are list problems wearing a technical disguise. Segment the audience by acquisition source, opt-in path, age, last click, last purchase or product action, unsubscribe history, role-based addresses, verification status, and previous bounce or complaint signals. Purchased, scraped, appended, old imported, and unverified contacts deserve a higher risk rating than recent explicit opt-ins. Dormant subscribers deserve a re-engagement or sunset path, not unlimited newsletter volume.

Use engagement carefully. Opens are noisy because privacy proxies can inflate or hide them, so clicks, replies, conversions, logins, purchases, preference updates, and human support interactions should carry more weight. For B2B lists, review role addresses and shared mailboxes. Some role addresses are legitimate for receipts or support workflows; many are poor targets for marketing and cold outreach. The audit should turn those distinctions into send rules, not just notes in a spreadsheet.

• Score list sources before scoring subject lines
• Use clicks, replies, and product actions as stronger signals than opens
• Create a sunset policy for chronic non-engagers
• Make suppression win over every campaign, segment, and automation

Trace complaints, bounces, and unsubscribes end to end

A deliverability audit should prove that negative signals change future sending. Hard bounces should enter suppression. Repeated soft bounces should be retried within a defined limit and then paused. Spam complaints should suppress the recipient immediately. Unsubscribes should be honored quickly and should override every segment. Google bulk sender guidance emphasizes authenticated mail, low spam rates, and easy unsubscribe; Yahoo sender guidance similarly points senders toward low complaints and good list practices. Those are operating requirements, not copywriting tips.

Map the full path from provider event to your database. If a webhook lands but the next campaign can still send to the same complained contact, the audit found a workflow bug. If human 'remove me' replies live in a sales inbox and never reach suppression, the program is depending on memory. For teams using Mailbase, this is where the workflow layer matters: analytics, reply inbox triage, suppression/compliance controls, and scheduled campaign checks should all agree on who is safe to email.

• Follow negative signals all the way into future send eligibility
• Test suppression logic with real or staging events
• Route human negative replies into the same operating process as automated complaints
• Review complaint and bounce rates by provider, source, and campaign

Review content and cadence after the infrastructure passes

Content still matters, but it should be audited after authentication and audience quality. Review whether the sender name is recognizable, the subject line matches the body, the first screen explains why the recipient is getting the message, the unsubscribe link is visible, and the message avoids deceptive urgency. Check HTML weight, broken links, image-only layouts, missing plain-text parts, and link redirects. A clean message can still struggle if it goes to the wrong list; a risky message can turn a marginal list into a complaint spike.

Cadence is part of content quality. Sudden volume jumps, repeated blasts to unengaged segments, and overlapping automations can make wanted mail look unwanted. Compare the send calendar to recipient-level frequency. If a customer can receive onboarding, product updates, sales nurture, newsletter, and re-engagement emails in the same week, the audit should recommend frequency caps and stream coordination before more creative testing.

• Make the reason for the email obvious without scrolling
• Keep unsubscribe and preference links easy to find
• Coordinate lifecycle and marketing calendars
• Treat content tests as useful only after list and auth issues are controlled

1. Check sender name and From address recognition.
2. Confirm the subject line and preview text match the message body.
3. Test HTML, plain text, links, images, and mobile rendering.
4. Look for image-only or link-heavy patterns that reduce trust.
5. Review recipient-level frequency across every automation and campaign.

Turn the audit into a 30-day operating plan

The final deliverable should not be a wall of screenshots. Create a short plan with owners, severity, due dates, and a retest method. Severity one items block or limit the next send: missing authentication, broken unsubscribe, complaint suppression failure, unknown high-risk source, or a sudden provider-specific complaint spike. Severity two items improve the next month: tracking domain cleanup, DMARC report review, segmentation hygiene, role-address rules, and cadence caps. Severity three items are ongoing improvements: template cleanup, naming conventions, seed testing, reporting dashboards, and quarterly list-health reviews.

Schedule a follow-up audit after the fixes ship. Deliverability is a system, not a certificate. The teams that improve fastest are the teams that make the audit repeatable: every campaign has preflight checks, every negative event updates eligibility, every domain change triggers a header test, and every list source has a measured downstream complaint and engagement profile.

• Assign owners to DNS, data, content, analytics, and suppression fixes
• Retest with real messages after each infrastructure change
• Keep a pre-send checklist for high-risk campaigns
• Repeat the audit after migrations, list imports, domain changes, or complaint spikes

Common Mistakes

• Skipping SPF, DKIM, and DMARC, or assuming they're a one-time setup.
• Sending real volume from a brand-new, un-warmed domain.
• Reusing a stale list without re-verifying, so bounces spike.
• Ignoring complaint rate until a single bad campaign sinks the domain.

Sources & Further Reading

Official docs for current setup details, pricing, and API behavior — verify specifics there, since they change.

Related guides

More on email deliverability audit and the surrounding deliverability workflow:

FAQ

Related reading