Email Deliverability Checklist: 25 Checks Before You Launch

Deliverability problems are cheapest to fix before the first real message goes out. This checklist groups 25 checks into five areas. Work through it before launching a new domain, a new application, or a new sending provider, and again each time you change one of them.

DNS and domain (checks 1 to 5)

1. One SPF record only, ending in ~all or -all, within the 10-lookup limit.
2. DKIM key published at the correct selector, 2048-bit, and the sending system actually signs with it.
3. DMARC record published at _dmarc, with a report address that exists. Start with p=none if you have not mapped your senders (rollout plan).
4. MX records correct if the domain also receives mail, so replies and bounce messages have somewhere to go.
5. The domain is not brand new and blank. It has a website, contact details and a privacy page.

Authentication in practice (checks 6 to 10)

1. Send a test to Gmail and check the headers. SPF, DKIM and DMARC all show pass (how to check).
2. Alignment holds. The domain in d= and the envelope sender match the visible From domain.
3. Reverse DNS is valid for the sending IP, if you run your own server. Hosted services handle this.
4. TLS is on between your application and the mail service.
5. Test with Outlook.com and Yahoo too. Each provider reads authentication a little differently.

Content and structure (checks 11 to 16)

1. Both HTML and plain-text parts are present.
2. The From name is recognisable, such as "Acme Support", not a bare address.
3. The subject is honest and matches the message. No fake "Re:" or "urgent action required".
4. Link domains are consistent with the sending domain, and links are not shortened by public shorteners.
5. Images are balanced with text. No message that is a single image.
6. Size stays reasonable. Keep HTML under roughly 100 KB; Gmail clips larger messages.

Recipients and lists (checks 17 to 21)

1. Everyone opted in, and you can prove when and how.
2. No purchased or scraped lists. None.
3. Addresses are validated at sign-up, and new addresses confirmed by a verification email.
4. Bounces are suppressed automatically (bounce codes).
5. Unsubscribe is easy for marketing mail, including the one-click header. Transactional mail does not need it.

Sending behaviour and monitoring (checks 22 to 25)

1. Volume ramps gradually, following a warm-up plan.
2. Transactional and marketing mail use separate subdomains.
3. Postmaster tools are set up. Google Postmaster Tools for Gmail; Microsoft SNDS for Outlook.com.
4. Someone owns the replies. A real address receives replies, abuse@ and postmaster@ are monitored, and complaints trigger action.

How to score yourself

Items 1 to 7 are the gating ones. If any of them fails, stop there, because every other effort is wasted on unauthenticated mail.

Where deliverability checklists fall short

A checklist can reduce the chance of landing in spam, never remove it. Mailbox providers decide per recipient, and they weigh reputation, engagement and complaints that you only discover after you send. Treat the first weeks as a measurement period: watch complaint rates, bounce rates and the share of messages seen in the inbox with seed accounts you control. If you see trouble, return to why emails go to spam.

Using Mailions to tick the first items

For items 1 to 7, Mailions generates the SPF, DKIM and DMARC records for each domain, creates a dedicated DKIM key, and reads live public DNS to confirm each record. You can then create a test mailbox, send to Gmail and read the headers. Once the domain is verified you can send through the API or mailbox SMTP. To discuss a launch, get in touch.

Frequently asked questions

What bounce and complaint rates should I aim for?

Keep hard bounces under about 2% and the spam complaint rate under 0.1%, as shown in tools such as Google Postmaster Tools. Gmail's sender rules treat a spam rate of 0.3% or more as a problem. Inbox placement is hard to measure directly, so watch these signals.

What is the most important deliverability check?

Authentication. Publish SPF, sign every message with DKIM and add a DMARC record that aligns with your From address. Without these, many providers filter or reject mail however good the content is.

How often should I review deliverability?

Run the basics before every launch or change of provider, and watch bounce and complaint rates continuously, at least weekly. Repeat the full checklist after DNS changes, new sending tools, or a sudden drop in replies or clicks.