Email Deliverability Checklist: 15 Steps for 2026

Last month, a 12-person sales team using Smartlead came to me because their reply rates had cratered from 3.8% to 0.6% in three weeks. They'd changed nothing — same copy, same sequences, same ICP targeting.

I dug into their setup and found the problem in about ten minutes. They'd onboarded a new SDR who imported 4,000 contacts from an old Apollo export — data that was eight months stale. No verification. Bounce rate on that segment hit 9%. By the time they noticed, their three primary sending domains were flagged by Google, and every mailbox on those domains was landing in spam.

Three weeks of pipeline, gone. Two months of domain warming, wasted. All because one person skipped one step.

Deliverability is the hidden bottleneck for outbound. Most teams obsess over subject lines, personalization, and follow-up cadence — the visible stuff. But none of that matters if your emails are going to spam or bouncing before a human ever sees them. I've watched teams spend $10K/month on sending tools and SDR salaries while their deliverability infrastructure was rotten underneath.

This is the 15-step checklist I've refined over years of running go-to-market for B2B teams. It covers infrastructure, data quality, and sending hygiene — the three pillars that determine whether your emails reach the inbox or disappear into the void.

The 15-Step Deliverability Checklist

Step 1: Verify Your Email List Before Every Campaign

This is step one because it's the highest-leverage action you can take for deliverability. A verified list prevents the cascade of problems that everything else on this checklist tries to mitigate.

Every email address in your outbound list should pass real-time SMTP verification before it touches your sending infrastructure. Not "it was verified six months ago." Not "the database provider said it was valid." Verified now, before this specific campaign.

At LeadMagic, we run real-time email verification — syntax, MX records, SMTP handshake, disposable domain detection, and catch-all resolution — in under 200ms per address. The cost is a fraction of a cent per verification. The cost of skipping it is measured in burned domains and lost pipeline.

Practical rule: if a list is older than 30 days, re-verify. B2B contact data decays at ~3% per month. A 90-day-old list has ~10% invalid addresses lurking in it.

Step 2: Handle Catch-All Domains (Don't Skip Them, Resolve Them)

About 40% of enterprise domains are catch-all — the SMTP server accepts every address whether the mailbox exists or not. Traditional verifiers label these as "risky" or "unknown" and leave you guessing.

The common advice is "remove all catch-all addresses." That's safe but expensive — you're cutting 40% of your enterprise prospects.

The better approach: use catch-all verification to resolve those addresses to valid or invalid. LeadMagic resolves the majority of catch-all addresses definitively. Teams using our catch-all resolution recover 60–70% of their "risky" segment as verified-valid contacts, with bounce rates under 1% on resolved addresses.

If you're prospecting into enterprise accounts and skipping every catch-all domain, you're abandoning your highest-value segment.

Step 3: Remove Disposable and Temporary Addresses

Disposable email addresses (Mailinator, Guerrilla Mail, 10minutemail, Temp Mail) are fake by design. They exist for sign-up forms and disappear within hours. If they're in your outbound list, they came from form fills with fabricated data or from a purchased list that was never cleaned.

Beyond the bounce risk, sending to disposable addresses can trigger spam trap detection. Some anti-spam systems seed disposable-domain addresses into trap networks specifically to identify senders with poor list hygiene.

LeadMagic's verification automatically flags disposable domains. Remove every one of them, no exceptions.

Role-based addresses (info@, sales@, support@, admin@) are a softer version of the same problem. They're technically valid but they go to shared inboxes. Engagement rates are low, spam complaint rates are high, and they dilute your sending reputation. Remove them from cold outbound lists. Keep them only if you have a specific reason to contact that functional inbox.

Step 4: Warm Your Domains and Mailboxes Properly

New domains have zero reputation. ISPs don't know if you're a legitimate sender or a spammer. Domain warming is the process of building that reputation gradually, and there are no shortcuts.

The 4-week warming schedule I recommend:

• Week 1: 5–10 emails per day. Send to known contacts — colleagues, friends, existing customers. Get opens and replies.
• Week 2: 15–20 emails per day. Mix in some cold prospects, but keep the ratio tilted toward engaged contacts.
• Week 3: 25–35 emails per day. Start running real sequences at low volume.
• Week 4: 40–50 emails per day. Full campaign volume, but monitored closely.

Use a warming tool (Instantly has one built in, or standalone tools like Warmbox) and keep it running even after you start real campaigns. The warming traffic maintains a healthy engagement ratio that offsets the inevitable non-responses from cold outreach.

Critical mistake I see constantly: teams try to compress warming into 7–10 days. ISPs track velocity changes. Going from 0 to 50 emails/day in a week screams "compromised account" to Google's algorithms. Be patient. Four weeks of warming protects months of sending.

Step 5: Authenticate With SPF, DKIM, DMARC

These three DNS records are your email passport. Without them, ISPs have no way to verify that you're authorized to send email from your domain.

SPF (Sender Policy Framework): Lists the servers authorized to send email for your domain. If an email comes from a server not on the SPF record, ISPs flag it.

DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to every email. The receiving server verifies the signature against your public key in DNS. If it doesn't match, the email was tampered with in transit.

DMARC (Domain-based Message Authentication, Reporting, and Conformance): Tells receiving servers what to do when SPF or DKIM fails. Start with p=none (monitor only), then move to p=quarantine or p=reject once you've verified legitimate email is passing.

In 2026, these aren't optional. Google and Yahoo started requiring DMARC for bulk senders in 2024. Microsoft followed. If your authentication records aren't perfect, you're fighting deliverability with one hand tied behind your back.

Check your records with MXToolbox or use Google's Check MX tool. Fix any issues before you send a single cold email.

Step 6: Monitor Your Sender Reputation Score

Your sender reputation is a score that ISPs calculate based on your sending history — bounce rates, spam complaints, engagement rates, blacklist appearances. It determines whether your email goes to the inbox, spam, or gets blocked entirely.

Tools to monitor reputation:

• Google Postmaster Tools: Free and essential. Shows your domain reputation with Gmail/Google Workspace (Low, Medium, High). If it drops to "Low," your emails are going to spam for all Gmail users.
• Microsoft SNDS (Smart Network Data Services): Similar data for Outlook/Hotmail/Microsoft 365 domains.
• Sender Score by Validity: Scores your sending IP from 0–100. Below 70 is a red flag.

Check these weekly at minimum. If your Google Postmaster reputation drops from "High" to "Medium," investigate immediately — don't wait for it to hit "Low."

Step 7: Segment Your Sends by Engagement

Not every contact in your list deserves the same treatment. Segment by how they've engaged with previous campaigns:

• Active responders: People who've replied, clicked, or shown interest. Send to these freely.
• Opens, no reply: They're reading but not engaging. Adjust your messaging, don't increase volume.
• Never opened: After 3–4 attempts with no opens, move to a re-engagement sequence or remove. Continuing to send to non-openers tanks your engagement ratio, which ISPs use as a quality signal.

For cold outreach specifically, I structure sequences as 3–4 touches over 10–14 days. If there's zero engagement after the sequence completes, the contact gets removed from active outreach for at least 90 days.

Step 8: Use Dedicated Sending Domains for Cold Outreach

This is the rule I drill into every team I work with: never send cold email from your primary corporate domain.

If your cold outreach gets flagged as spam — and at scale, some of it will — you want that damage isolated to a sending domain, not your main business domain. Set up look-alike domains:

• Primary: company.com (never used for cold)
• Sending: getcompany.com, trycompany.io, companymail.com

Buy 3–5 sending domains, warm each independently, and distribute your volume across them. If one gets burned, you rotate it out for recovery and bring in a fresh domain. Your primary domain's reputation stays clean — your CEO's emails to investors still land in the inbox, your support team's replies still reach customers.

Budget: $10–15 per domain per year, $30–50/month per mailbox. Cheap insurance against a deliverability crisis that could shut down your entire outbound operation.

Step 9: Maintain a Consistent Sending Schedule

ISPs track your sending patterns. Irregular volume — 10 emails Monday, 500 emails Tuesday, 0 on Wednesday — looks suspicious. Spammers operate in bursts. Legitimate businesses send consistently.

Establish a daily sending cadence and stick to it. If your steady state is 200 emails per day across all mailboxes, keep it at 200 (±20%) every business day. Don't send nothing for a week and then blast 1,000 on Monday morning.

If you need to increase volume, ramp gradually — no more than 20% increase per week. The same warming logic applies to established domains, not just new ones.

Step 10: Clean Your Bounce List After Every Campaign

After every campaign, export your bounces and process them:

• Hard bounces: Add to a permanent suppression list. These addresses are dead. Never send to them again.
• Repeat soft bounces: If an address soft-bounces twice in a row, add it to the suppression list. Something is wrong.
• One-time soft bounces: Keep them in your list but flag for re-verification before the next campaign.

This sounds tedious. It is. But the alternative is carrying dead weight that drags down your bounce rate on every subsequent campaign. Most sending tools (Smartlead, Instantly, Apollo) let you export bounce data. Build the habit of cleaning after every campaign, not before the next one.

For teams running high volume, use LeadMagic's CSV enrichment to re-verify your entire contact database monthly. Batch upload, get results in minutes, filter out the decay.

Step 11: Rotate Sending Accounts and Mailboxes

Don't pour all your volume through one mailbox. Even at 50 emails per day (a conservative limit), a single mailbox hitting the same prospects from the same address can trigger pattern detection.

Set up multiple mailboxes per sending domain — typically 2–3 inboxes per domain. Distribute your daily volume across all of them. This reduces per-mailbox volume, provides redundancy if one mailbox gets flagged, and makes your sending pattern look more organic to ISPs.

Example setup for 200 emails/day:

• 4 sending domains × 2 mailboxes each = 8 mailboxes
• 200 ÷ 8 = 25 emails per mailbox per day
• Well under the 50/day threshold that most experts recommend

Step 12: Check Blacklists Regularly

Email blacklists are shared databases of domains and IP addresses identified as spam sources. If your sending domain or IP appears on a major blacklist (Spamhaus, SORBS, Barracuda), your deliverability will crater overnight.

Weekly checks at minimum. Use MXToolbox's blacklist checker — it queries 50+ blacklists in one scan. If you find yourself listed:

1. Identify the cause (almost always a bounce rate spike or spam complaints)
2. Fix the underlying issue (clean your list, pause problematic campaigns)
3. Submit delisting requests to each blacklist
4. Monitor for re-listing

Some blacklists (like Spamhaus) auto-delist after the offending behavior stops. Others require manual delisting requests. Either way, the longer you stay listed, the more damage accumulates. Check often.

Step 13: Use Plain-Text or Minimal HTML

Spam filters are trained on millions of spam emails, and most spam is image-heavy HTML with lots of links, bold text, and flashy formatting. The more your email looks like marketing collateral, the more likely it is to trigger filters.

For cold outbound, I recommend:

• Plain-text only or minimal HTML (basic formatting, no images)
• One link maximum in the body (your CTA or calendar link)
• No link shorteners (bit.ly, t.ly are heavily associated with spam)
• No tracking pixels if possible (or use a custom tracking domain that's properly authenticated)
• No attachments in first touch — ever

Your cold email should look like a normal email one human would send to another. Because that's exactly what ISPs are optimized to deliver.

Step 14: Remove Unengaged Contacts After 90 Days

This is the list hygiene step that most teams resist because it means shrinking their list. But a smaller list of engaged contacts delivers better results than a bloated list of people who've never opened your emails.

If a contact has received 6+ emails from you across multiple sequences over 90+ days and has never opened, clicked, or replied — they're not interested, they're not seeing your emails, or the address is dead but passing verification (common with catch-all domains that silently drop messages).

Remove these contacts from active outreach. You can re-add them to a re-engagement sequence in 6 months with a completely different approach, but continuing to send to zero-engagement contacts actively damages your sender reputation.

Every ISP tracks engagement as a reputation signal. Your ratio of engaged-to-unengaged recipients directly affects inbox placement. Pruning the unengaged improves deliverability for the contacts who are actually reading your emails.

Step 15: Monitor Inbox Placement Rates

Delivery rate and inbox placement rate are not the same thing. Delivery rate measures whether the email was accepted by the receiving server (not bounced). Inbox placement measures whether it landed in the primary inbox vs. spam.

You can have a 98% delivery rate and 40% inbox placement — meaning more than half your "delivered" emails are sitting in spam folders where nobody sees them.

Tools to monitor inbox placement:

• GlockApps: Sends test emails to seed addresses across major ISPs and reports where they land (inbox, spam, missing).
• Mail-Tester: Quick one-off test. Send an email to their test address, get a score.
• Google Postmaster Tools: Shows spam rate for Gmail specifically.

Run inbox placement tests before launching new campaigns, after changing sending infrastructure, and whenever you notice engagement drops that aren't explained by list quality.

Real-World Scenario: How We Fixed a Deliverability Crisis

Let me walk through the Smartlead team I mentioned at the top in more detail, because I've helped enough teams recover from this exact situation to recognize the pattern immediately.

The setup: 12-person SDR team, five sending domains, three mailboxes per domain, 750 cold emails per day via Smartlead. They'd been running successfully for four months — 3.8% reply rate, bounce rate under 1%, inbox placement above 92%.

What went wrong: A new SDR onboarded and imported 4,000 contacts from an eight-month-old Apollo export. No verification step. The SDR split these contacts across existing sequences, mixing stale data with their clean lists.

The cascade:

• Week 1: Bounce rate climbed from 0.8% to 3.2%. Nobody noticed — the SDR's metrics were buried in team averages.
• Week 2: Bounce rate hit 5.1%. Smartlead started throttling two mailboxes. Google Postmaster showed domain reputation dropping from "High" to "Medium."
• Week 3: Bounce rate hit 9% on the stale segment. Two sending domains flagged by Google. All mailboxes on those domains landing in spam. Team reply rate dropped from 3.8% to 0.6%.

The fix:

1. Immediately paused all campaigns on the flagged domains
2. Exported the entire contact database (28,000 contacts) and re-verified through LeadMagic — found 3,200 invalid addresses (11.4% of the total)
3. Removed all invalids and contacts with zero engagement over 90 days
4. Retired the two burned domains, registered two fresh replacements, started the 4-week warming process
5. Implemented a mandatory verification gate: no contacts enter sequences without passing LeadMagic verification first, enforced at the ops level (not left to individual SDRs)
6. Re-verified catch-all addresses using LeadMagic's catch-all validation — resolved 1,800 "risky" contacts, recovered 1,200 as valid, removed 600 as invalid

The results (after 6 weeks):

• Bounce rate: 0.3% (down from 9%)
• Reply rate: 4.1% (higher than their previous 3.8%, because inbox placement improved)
• No further domain reputation issues

Total cost of the verification that would've prevented the crisis: about $170 for 28,000 verifications (7,000 credits at LeadMagic's Essential rate). Total cost of the crisis itself: two months of compromised pipeline, two burned domains, and roughly $25K in lost deals from three weeks of near-zero reply rates.

The Infrastructure Stack I Recommend

For teams running serious outbound in 2026, here's the stack I recommend to every RevOps and sales leader I advise:

Email verification: LeadMagic — 99.5% accuracy, catch-all resolution, sub-200ms, pay-per-result from $59.99/month. Use the email finder for discovery and email verification for list cleaning.

Sending tool: Smartlead or Instantly — both handle multi-mailbox rotation, warming, and campaign management well.

List building: Clay for enrichment workflows, Apollo or LinkedIn Sales Navigator for prospecting. Pipe everything through LeadMagic verification before it enters your sending tool.

Authentication monitoring: Google Postmaster Tools + MXToolbox. Free and essential.

Inbox placement testing: GlockApps or similar seed-based testing. Run before every major campaign launch.

The entire stack costs under $500/month for most teams and protects tens of thousands of dollars in pipeline value.

The Bottom Line

Deliverability isn't sexy. It's DNS records, warming schedules, and bounce rate monitoring. But it's the foundation that makes everything else in outbound work. The best copy in the world is worthless if it lands in spam.

This checklist isn't theoretical. Every step comes from real situations I've worked through with sales teams — either helping them prevent problems by following it or cleaning up expensive crises caused by skipping steps.

Start with step 1 — verify your list — and work through the rest. If you do nothing else, verify every email before it touches your sending infrastructure and never send cold outreach from your primary domain. Those two steps alone will keep you ahead of 80% of outbound teams.

Ready to lock down your deliverability? Start with LeadMagic — 99.5% verification accuracy, catch-all resolution, and the cleanest data in outbound. From $59.99/month, pay only for results.