Cold Email Deliverability: The Checklist That Comes Before Copy

One: the sending domain has to vouch for itself

Three DNS records decide whether receivers can verify you. SPF lists the servers allowed to send for the domain. DKIM publishes the key that matched the signature on your message. DMARC tells receivers what to do when neither aligns with the visible From address, and it is also the record that makes reports possible.

The specific failure with bought mailboxes and third-party senders is alignment. A provider can pass SPF for its own domain while your From address fails DMARC, because the envelope and the header are different domains. The test is one message to a mailbox you control, then reading the authentication results line: you want pass verdicts naming your domain, not the provider's.

Use a subdomain for cold outreach rather than your main domain. If the subdomain's reputation is damaged, your invoice and support mail keep working, and you can retire the subdomain without renaming the business.

• SPF includes every sender you actually use, and no more.
• DKIM signs with a selector published on your own domain.
• DMARC exists in monitoring mode before you enforce anything.
• Cold outreach leaves from a subdomain, not the domain on your website.

Two: the list is either verified or it is the problem

Every address that never existed becomes a hard bounce, and hard bounces are one of the clearest signals that a list was not built with consent. Verification before sending is not optional at any real volume: it removes dead addresses, catches typos in domains, and flags the catch-all domains where you cannot know whether the mailbox exists.

Verification is not consent. A verified address belongs to a real mailbox, which tells you the message will be delivered somewhere; it says nothing about whether the recipient wants it. Those are two separate obligations, and confusing them is how a sender ends up with a technically clean list and a complaint rate that closes the account.

The other hygiene step is suppression. Anyone who has ever asked you to stop must be removed permanently, across every list, before the campaign is scheduled. A suppression list stored in a spreadsheet by one person is a future incident.

Three: volume and shape, not just totals

Receivers see timing. Two hundred messages spread over a working day look like a person working through a list. Two hundred in four minutes look like a script, and a script from a young domain is what filters are built to catch.

Warm-up is the gradual increase of volume to build a record of ordinary behaviour. It is not a trick and it cannot be compressed to fit a launch date: the constraint is the receiving side's confidence, which builds over weeks. If you must send sooner, send fewer messages to better-matched people and accept a smaller total.

Four: the message should look like a person wrote it to one person

Filters score patterns, and the patterns of bulk mail are well known: a single large image with minimal text, a link shortener, several links with no other content, an unsubscribe that is hidden or missing, and a subject line that makes a promise. Any one of these is survivable; all of them together push a message over the line.

Worked example: the same 600 contacts, two ways

A software studio has 600 contacts from a trade-show list. Attempt one: they send from the main domain, all 600 at once, with a one-line pitch and a shortened link. Hard bounces run high because the list was never verified, the shortened link and the single-image header add two more negative signals, and the domain's support mail starts arriving in spam folders the following week.

Attempt two, three weeks later, on a separate subdomain: they verify the list, drop the addresses that do not exist, split catch-alls into their own segment, and publish SPF, DKIM and DMARC before anything is sent. They send 40 messages on the first day to the best-matched contacts, then 60, then 80, spread across working hours, with a plain-text message, one real link, and an unsubscribe line anyone can find.

The second attempt reaches inboxes for most of the list and produces a handful of replies, which is the only outcome that mattered. Nothing about the second message was cleverer. The difference was that the domain could be verified, the list contained real mailboxes, and 600 messages did not arrive in one burst.

The four layers, what each one ruins, and how to test it

The pre-campaign checklist

• 1Sending subdomain created and separated from the main domain.
• 2SPF published, listing only the senders you actually use.
• 3DKIM enabled with a selector published on your own domain.
• 4DMARC published in monitoring mode, with a reporting address you read.
• 5One test message sent to a mailbox you own, headers confirming pass on your domain.
• 6List verified, with hard bounces removed rather than retried.
• 7Suppression list applied across every list, not just the one being sent.
• 8Volume matched to the age of the address, spread across hours.
• 9Unsubscribe path visible in the message and working from a real send.
• 10Replies routed to an inbox someone actually watches.