Cold Email Deliverability Checklist 2026 — Before You Send Your First Campaign

Deliverability is the infrastructure problem that kills cold email campaigns before they start. A campaign that is perfectly targeted, well-written, and compliantly structured can still achieve 8% open rates instead of 22% if the underlying sending infrastructure has authentication failures, a cold domain, or a dirty list. This checklist covers every technical and operational variable to verify before launching any B2B cold email campaign.

Domain Authentication — SPF, DKIM, DMARC

SPF (Sender Policy Framework): tells receiving mail servers which IP addresses are authorised to send email on behalf of your domain. Incorrect or missing SPF causes your email to fail authentication checks and land in spam. Verify: run your sending domain through MXToolbox SPF checker. Result should show 'SPF Pass' for all IPs in your sending chain.

DKIM (DomainKeys Identified Mail): adds a cryptographic signature to every outbound email. Every major cold email platform generates a DKIM key pair — you add the public key to your DNS as a TXT record. Verify: MXToolbox DKIM checker with your selector and sending domain. Result should show 'DKIM Valid'.

DMARC (Domain-based Message Authentication, Reporting, and Conformance): ties SPF and DKIM together. For cold email, start with p=none (monitoring mode). Missing DMARC is an increasing spam signal. Custom tracking domain: use a custom subdomain (e.g., track.yourdomain.com) pointed to your sending platform — shared tracking domains accumulate poor reputation from other senders on the platform.

Domain Warm-Up Protocol

A new domain must be warmed up before campaign launch. Sending high volumes from a cold domain immediately generates spam signals that damage sender reputation, often permanently. Warm-up schedule: Days 1-7: 5-10 emails per day to known, engaged contacts. Days 8-14: 20-30 emails per day, mix of warm contacts and initial campaign contacts. Days 15-21: 50-80 emails per day. Days 22-30: 100-150 emails per day. After day 30: ramp to full campaign volume over the following 2-4 weeks.

Automated warm-up tools (Instantly.ai warm-up, Lemwarm, Smartlead warm-up) accelerate this process by simulating engagement signals across a network of real accounts. Use automated warm-up as a supplement to natural warm-up, not a replacement. The best warm-up is a domain that has been sending normal business email for 60+ days before cold campaign launch.

List Hygiene Before Launch

Email validation: run every list through an email validation service (NeverBounce, ZeroBounce, or BriteVerify) before importing to your sending platform. Even a list purchased from a provider with 95%+ SMTP verification rate should be validated before use — verification timing differences can mean 3-5% of addresses have become invalid. Target: under 3% hard bounce rate after validation.

Role address removal: remove all role-based email addresses before sending: info@, hello@, support@, sales@, contact@, admin@, team@. Role addresses are almost never your decision-maker. They generate spam complaints at higher rates than individual addresses.

Spam trap check: reputable email validation services include spam trap detection. Spam traps are addresses maintained by anti-spam organisations solely to catch senders with poor list hygiene. Sending to a spam trap blacklists your sending domain.

Sending Configuration

Daily volume limits: even on a warmed domain, do not send more than 200-300 cold emails per day per sending domain in the first month. If you need to send 1,000+ emails per day, use multiple warmed sending domains in rotation (inbox rotation).

Send window: configure your platform to deliver emails during business hours in the recipient's time zone (8am-5pm local time). Emails delivered at 3am local time are a spam signal — most modern sending platforms have time-zone-aware delivery, enable it.

Unsubscribe handling: confirm your sending platform automatically adds unsubscribes to a suppression list and prevents future sends. The suppression list should be global (applies to all campaigns from your account) — a suppressed contact should never receive any future campaign from you regardless of list origin.

Pre-Launch Testing Protocol

Before launching any campaign, send test emails to accounts on every major email provider your target audience uses. At minimum: Gmail/Google Workspace, Microsoft 365/Outlook, and at least one Proofpoint-protected enterprise domain if targeting large corporations. Check each test email arrives in inbox (not spam or promotions), renders correctly on desktop and mobile, and all links including unsubscribe function correctly.

Use Mail-Tester.com or GlockApps for a pre-launch deliverability score — both simulate spam filter evaluation. Aim for 9/10 or above on Mail-Tester before launching. Common issues: missing DMARC, SPF alignment failures, image-heavy content triggering promotional filters, spam trigger words in subject or body. Final checklist: confirm your sending domain and IP are not on major blacklists before launch — use MXToolbox Blacklist Check. Any blacklist hit requires resolution before the campaign goes live.