Email deliverability checklist for business senders

Who this is for

This Email deliverability checklist for business senders is for teams that send marketing campaigns, sales follow-ups, invoices, password resets, or account notices from a company domain. If one shared inbox handles all of it, the rules still apply. A mailbox provider sees the domain and IP, not your team chart.

It fits founders, operations leads, IT admins, and marketers who own the sending setup but do not run a dedicated email team. You may send a few hundred messages a month or a few hundred thousand. The same basics decide whether mail lands in the inbox, spam, or nowhere.

It is not for consumer newsletter publishers with a full deliverability staff. It is a working checklist you can run against your DNS, your list sources, and your sending process.

Before you begin

Get access to the DNS zone for the domain you send from. You will need to add or edit TXT records, CNAME records, and sometimes a PTR record through your hosting provider. Confirm who can change those records before you start, because email authentication fails when DNS changes sit in a ticket queue.

List every system that sends email on your behalf: the marketing platform, the CRM, the billing system, the help desk, and any app that sends password resets. For each one, note the From address, the sending domain, and the vendor host. You cannot fix authentication for a sender you forgot.

Collect a recent sample of bounces and complaints, your current SPF, DKIM, and DMARC records, and a copy of your signup forms. Set up free monitoring where it is available, such as Google Postmaster Tools and Microsoft SNDS, and pick a DMARC report reader. If you have no baseline, start with one week of normal sending and save the reports.

The checklist

Work through this list in order. Authentication first, then list and consent, then content and monitoring. Changing content before fixing DNS is wasted effort, because a failed DMARC check can send the whole message to spam no matter how good the copy is.

Assign an owner and a date to each item. Some fixes take minutes in DNS. Others, like warming a new domain, take weeks and need a send calendar. Keep evidence: screenshots of DNS records, sample headers that show pass results, and a log of when you removed bounces.

• Send bulk campaigns from a dedicated subdomain you control, and keep transactional mail such as invoices and password resets on a separate subdomain.
• Publish an SPF record that lists only the hosts that actually send for that domain, and keep the record within the DNS lookup limit.
• Sign every outgoing message with DKIM, use a key length your provider supports, and rotate the key on a written schedule.
• Set a DMARC record at p=none with aggregate reporting first, confirm that legitimate mail passes alignment, then move to quarantine and reject.
• Set reverse DNS for each sending IP so the PTR record matches the HELO name, and make sure that hostname resolves forward and back.
• Add List-Unsubscribe and one-click unsubscribe headers to bulk mail, and route requests into the same suppression system your teams use.
• Remove hard bounces on the first failure, limit soft bounce retries, and suppress addresses that keep failing after the retry window.
• Keep one suppression list for unsubscribes, complaints, bounces, and legal holds, and check it before every send from every system.
• Record consent at the point of capture with the source, date, and page or form, and store that record with the contact.
• Warm a new domain or IP by sending to engaged recipients first, then increase volume in steps over a planned period.
• Test each campaign with seed inboxes and spam filters, and fix broken links, image-only messages, and subject lines that do not match the body.
• Watch Google Postmaster Tools, Microsoft SNDS, and DMARC reports for changes in delivery, reputation, and authentication.
• Check your sending domains and IPs against major blocklists on a schedule, and keep a record of delisting requests.
• Run a small test send before every major campaign and read the full headers to confirm SPF, DKIM, and DMARC pass.

What good looks like

A healthy setup shows pass results for SPF, DKIM, and DMARC on messages sent from every stream. The From domain aligns with the DKIM signing domain or the SPF domain. DMARC reports show steady sources you recognize, not a long tail of unknown senders.

Hard bounces are removed and do not return. Soft bounces are retried a few times and then suppressed. Complaints are rare, and every complaint is reviewed, because a complaint is a person telling you the message was unwanted. Unsubscribes and preference changes process without manual work.

The list grows through forms and imports with consent records. Purchased lists, appended addresses, and scraped emails stay out. Volume rises gradually on a new domain, and the team checks postmaster and blocklist data on a schedule instead of after a campaign fails.

What to do next

Start with a DNS audit. Fix SPF, DKIM, and DMARC in that order, then set DMARC to p=none with reporting so you can see who sends as you. Move to quarantine and reject only after the reports look clean and your known senders pass.

Then clean the list, build one suppression list that every system checks, and add a preference center that actually controls topics and frequency. Warm any new domain or IP with engaged recipients first, and keep transactional and marketing streams separate.

If you want the sending domain, forms, consent capture, sequences, and reporting built together, Cloudverg's Marketing automation build is a fixed price of $7,500 and takes 2 to 3 weeks, starting within 10 business days. It includes SPF, DKIM, and DMARC setup plus a test campaign checked with you. Compare that with fixing each piece in house or hiring a specialist.

Frequently asked questions