Email Deliverability Audit Checklist for 2026

Mailbox providers have tightened enforcement across the board. Since April 2024, Google and Yahoo require both SPF and DKIM authentication on all sending domains and full DMARC alignment with at least a p=none policy for any sender pushing 5,000 plus emails per day, according to Google's official sender guidelines. Non compliant messages are now rejected with a 5.7.26 error rather than silently filtered to spam.

The 2026 Validity benchmark report puts Google at 87.2% inbox placement and Microsoft Outlook at just 75.6%, meaning the same campaign can land very differently depending on where your prospects sit. European inboxes reach 91% placement on average, while Asia Pacific lags at 78%. A deliverability audit is no longer optional for any outbound programme, and the thresholds that define acceptable performance have moved. Spam complaint rates above 0.1% now start damaging reputation, and anything above 0.3% triggers hard filtering at Gmail.

The cost of poor deliverability compounds quickly. If 20% of your emails never land, every hour of copywriting, list building and personalisation is effectively discounted by that same percentage. Leadriver campaigns that hit an 88% plus inbox placement rate produce roughly 2.3x the meetings per email sent compared to campaigns stuck at 70%, even when reply rates per delivered email are identical. Deliverability is the highest leverage fix for most outbound teams.

Authentication is the foundation. Without SPF, DKIM and DMARC correctly configured, nothing else in this checklist matters. Start by pulling your current DNS records using a public tool such as MXToolbox or dnschecker.org and verifying three things: that an SPF record exists, that DKIM is enabled with the correct selector for your sending platform, and that DMARC is published with an aligned policy.

SPF tells receiving servers which IPs and hostnames are permitted to send on behalf of your domain. A common failure is an SPF record that lists too many include: mechanisms and breaks the 10 DNS lookup limit, which causes PermError failures at the receiver. Use a tool such as DMARC Digests or EasyDMARC to check your lookup count. DKIM signs the message with a cryptographic key so receiving servers can verify it was not tampered with in transit. Your DKIM signature must align with the From header domain, not just the Return Path, for DMARC to pass. DMARC ties the two together and tells receivers what to do if authentication fails. A policy of p=quarantine or p=reject is required for strong deliverability, with p=none treated as the minimum bar for any bulk sender.

Bounce rate is the fastest way to destroy sending reputation. The universally accepted healthy bounce rate benchmark is below 2%, and email verification research shows most reputable senders now operate below 1%. Anything above 2% starts signalling to mailbox providers that you are sending to unverified or purchased lists, which will drop your reputation rapidly.

B2B sales and lead generation consistently record the highest bounce rates because purchased databases decay quickly. Business email addresses are deactivated as people change jobs, and staff turnover in B2B sectors runs 15% to 25% annually. A list built six months ago may already be 10% stale. Every campaign should start with a fresh verification pass using a real time verification provider. Skip this step and you will see bounce rates between 4% and 9% on older lists, which will push the sending domain into the spam folder across Outlook and Yahoo within two to three send days.

Mailbox providers evaluate reputation on a 30 day rolling window, which means a warmed domain can go cold quickly if sending stops or spikes. A new sending domain should begin with a warm up of 4 to 8 weeks, starting at 10 to 20 emails per day and doubling weekly if placement metrics stay clean. Mailgun's domain warmup guidance is one of the clearer public references on how to ramp correctly.

During warm up, every send should target your most engaged recipients first. Inboxes that open, reply and do not mark as spam send positive signals to receiving providers. Cold lists during warm up weeks one and two will torch a new domain. Leadriver's standard warm up is 30 days of warmup traffic through an automated tool (we use Instantly or Smartlead warmup pools), followed by 14 days of low volume sends to a qualified list of no more than 40 emails per day per inbox. After day 45 most domains can sustainably send 50 to 80 emails per day per inbox.

Blacklists are public databases of IPs and domains flagged for abuse. Being listed on even one major blacklist can cut delivery by 30% to 80% depending on the list and the receiving provider. Check Spamhaus, Barracuda, SORBS and Surriel at minimum, using a free aggregator that scans 50 plus lists at once. Any appearance on Spamhaus SBL or XBL requires immediate remediation because Gmail, Outlook and Yahoo all reference it.

Reputation scoring tools give a complementary picture. Google Postmaster Tools exposes your domain and IP reputation for Gmail specifically, with scores ranging from Bad to High. Microsoft SNDS provides similar data for Outlook and Hotmail. Both require setting up a verified account, which takes under an hour but most outbound teams skip. The absence of this data means you are flying blind on 60% plus of your B2B recipients.

Google treats spam complaint rates above 0.3% as a critical problem and rates above 0.1% already start dragging your reputation down. This is the single most sensitive metric in the entire deliverability stack because one marked as spam can carry more weight than thousands of clean sends. B2B cold email lists that include personal or generic addresses tend to see higher complaint rates than lists filtered to role verified business email only.

Reducing complaint rate is largely a list quality problem. Lists sourced through genuine intent (waitlists, downloads, event signups) complain at roughly 0.03%. Purchased lists complain at 0.2% to 0.5%. Cold outbound sits between the two at 0.05% to 0.15% when targeting is tight and the messaging is professional. Reducing any one of those by half is more valuable than any copy tweak.

Modern spam filters rely less on keyword based scoring than on engagement and sender reputation, but content still matters. Any email that looks like a promotional broadcast will land in the Gmail Promotions tab instead of the primary inbox, even if authentication passes. The Promotions tab reduces reply rate by roughly 60% because most B2B buyers do not check it. This is why plain text cold emails typically outperform HTML designed templates for outbound.

A safe content pattern is plain text, one link maximum, no images, no tracking pixels in the first email of a sequence. Tracking pixels specifically can push sends into Promotions on Gmail because Gmail uses pixel signatures as one input into tab classification. Some Leadriver campaigns run with open tracking disabled and see a 15% to 20% uplift in reply rate because more messages land in the primary inbox.

After completing steps one through six, run a placement test before scaling any campaign. A placement test sends a template to a seed list of 50 to 200 controlled inboxes across Gmail, Outlook, Yahoo and Apple Mail, then reports where each one landed: primary, promotions, spam or undelivered. This is the only way to know your real inbox placement number rather than relying on open rate, which is unreliable with tracking disabled.

Tools such as GlockApps, MailReach Spam Test and Unspam.email run these tests for under 50 dollars each. Aim for 80% plus placement into primary at Gmail and 75% plus at Outlook. Anything below those thresholds means at least one earlier step is broken, most commonly DMARC alignment or a cold domain that has not been warmed sufficiently. Run a placement test weekly during the first 60 days of a new domain, then monthly once stable.

Deliverability is not a one time setup. Reputation decays constantly and providers adjust filters quietly. The teams that stay above 85% inbox placement run a weekly deliverability review covering five metrics: bounce rate, spam complaint rate, DMARC pass rate, Google Postmaster reputation, and a placement test sample. This takes roughly 30 minutes per week and catches 90% of problems before they impact a live campaign.

Leadriver's own cadence is a 20 minute Monday morning check across every active sending domain, with any metric breach pausing sends on that domain until investigated. This has kept our average inbox placement at 88% across 2025 and 2026, comfortably above the Validity 2026 benchmark of 83.5%. The single biggest lesson across hundreds of campaigns is that sustained discipline beats clever infrastructure.