Email Deliverability Audit: The Checklist That Finds Why a Client's Mail Is in Spam

A client forwards the campaign report: opens down by half since the last send, and their sales team says prospects never got it.

You’ve checked their SPF record and sent a test to your own Gmail, and both looked fine.

One test to a mailbox that already trusts you says nothing about what Gmail and Outlook decide for the rest of the list, and SPF is one record out of the dozens of things that put mail in spam.

The next 15 minutes walk you through the audit checklist, category by category, in the order that finds the cause fastest.

If you’re reading this with a client’s report open and a call in an hour, you’re in the right place.

Run a free audit → — paste your email headers and see every failing check, with the fix for each. No account.

When to Run an Email Deliverability Audit

TL;DR: Run the audit quarterly as standard practice, and immediately before any major sending event, list expansion, or ESP migration. Reactive auditing — waiting until open rates drop — misses chronic issues that erode inbox rate gradually over months.

Most teams only audit when something is visibly broken — open rates have dropped, a campaign performed unusually poorly, or a customer complained they didn’t receive a message. That reactive approach misses chronic issues that erode inbox rate slowly over time.

Run a full audit in these situations:

• Before migrating to a new ESP or sending infrastructure
• Before any major list expansion (adding a new acquisition source)
• Quarterly as a standard operational practice
• When open rates drop 20%+ from your historical baseline
• When bounce rates exceed 2% on a campaign
• After any sending pause of 60+ days
• Before a high-stakes campaign (product launch, Black Friday, etc.)

Category 1: SPF, DKIM and DMARC

TL;DR: SPF, DKIM, and DMARC are the non-negotiable foundation — all three must be configured, aligned, and passing. Mailbox providers will filter or reject mail that fails DMARC regardless of your list quality or how they score your domain.

These three records are the foundation. No amount of list quality or engagement work makes up for a failing record — mailbox providers filter or reject mail that fails DMARC regardless of how healthy your domain otherwise looks.

• SPF record exists and is valid: Run dig TXT yourdomain.com and verify an SPF record is present. Confirm it covers all sending sources (ESP, CRM, transactional service). Ensure the record does not exceed 10 DNS lookups (a common SPF failure mode).
• DKIM is configured on all sending streams: Verify DKIM signatures are present in email headers. Check that the public key in DNS matches the private key your ESP is signing with. Ensure your DKIM key is at least 2048-bit (1024-bit keys are increasingly rejected).
• DMARC record exists with at least p=none: Check dig TXT _dmarc.yourdomain.com. If you have no DMARC record, add one immediately — even v=DMARC1; p=none; rua=mailto:reports@yourdomain.com starts giving you aggregate report data.
• DMARC alignment is passing: Both SPF and DKIM must align with the From: domain. A common failure: your ESP sends from your domain but their SPF record only covers their own infrastructure.
• DMARC policy is at p=quarantine or p=reject: A p=none policy provides zero protection against phishing using your domain. Escalate to p=quarantine after confirming all legitimate mail is DMARC-passing.
• DMARC reports are being received and reviewed: Aggregate reports (RUA) show you which sends are failing SPF and DKIM. If you’re not reading them, you’re flying blind.
• BIMI record (if applicable): Brand Indicators for Message Identification shows your logo in supporting email clients. Requires a verified DMARC record at p=quarantine or p=reject plus a VMC certificate for full Gmail support.

For the full setup walkthrough, see DMARC, DKIM and SPF: how to set up all three.

Category 2: Domain and IP Health

TL;DR: Gmail and Outlook score your IP and your domain separately. Check both via Google Postmaster Tools, Outlook SNDS, and major RBL services like Spamhaus. Sustained complaint rates above 0.10% at Gmail and any Spamhaus SBL or ZEN listing require immediate remediation.

SPF, DKIM and DMARC tell providers your mail is legitimate. Your domain’s health tells them whether it’s wanted. Check both the IP and the domain across every surface that scores them.

• Check Google Postmaster Tools domain reputation: Log in and verify your domain is registered. Check the Domain Reputation section — target “High” status. If showing “Bad” or “Low,” treat it as a critical incident.
• Check Outlook SNDS for your sending IPs: Verify complaint rate and trap hit data. A red status in SNDS means Outlook is actively filtering your mail.
• Run a blacklist check across major RBLs: Check Spamhaus (SBL, XBL, ZEN, DBL), Barracuda, SORBS, and SpamCop at minimum. A listing on Spamhaus SBL or ZEN is a critical finding requiring immediate action.
• Check your complaint rate via feedback loops: Register for Gmail FBL (via Postmaster Tools), Yahoo FBL, and Outlook JMRP if not already enrolled. Review complaint rates per campaign — sustained rates above 0.10% at Gmail are a threshold violation.
• Check Validity Sender Score (if on dedicated IP): Scores below 70 warrant investigation; scores below 50 indicate serious problems.
• Review bounce rate trends across the past 90 days: Bounce rates above 2% consistently indicate list hygiene problems. Segment by bounce type (hard vs. soft) and by acquisition source.

Category 3: List Health Audit

TL;DR: List health is measured by hard bounce rate (keep below 0.5%), spam complaint rate (keep below 0.05%), and the share of subscribers who are actively engaging. Hard-bounced addresses must be permanently suppressed, and subscribers inactive for 180+ days should be removed from core sending or routed to a re-engagement flow.

Your list is a direct input to how providers score your domain. Audit it rigorously.

Metric	Healthy Range	Warning Zone	Critical
Hard bounce rate (per send)	< 0.5%	0.5–2%	> 2%
Spam complaint rate	< 0.05%	0.05–0.10%	> 0.10%
Unsubscribe rate (per send)	< 0.2%	0.2–0.5%	> 0.5%
Open rate trend (90-day)	Stable or rising	Declining 10–20%	Declining >20%
Active subscribers (opened in 90 days)	> 30% of list	15–30%	< 15%

• Identify and remove all hard-bounced addresses: These must never be re-mailed. Verify your ESP is automatically suppressing them.
• Segment by engagement recency: Flag all subscribers who haven’t opened in 180+ days. Do not include them in core campaigns — route them to a re-engagement flow or suppress.
• Audit acquisition sources for each list segment: High bounce rates or complaint rates often trace to a specific source (co-registration, content download, webinar list, etc.). Identifying the source is the fix.
• Run the list through an email verification service: Tools like NeverBounce, ZeroBounce, or BriteVerify catch invalid, role-based, and disposable addresses that inflate your bounce rate.
• Confirm double opt-in is in place (or document why it isn’t): Double opt-in mechanically prevents typos and fake submissions. If you’re on single opt-in, accept that your list requires more aggressive ongoing hygiene.

Category 4: Content and Technical Audit

TL;DR: Content issues — poor image-to-text ratio, blacklisted links, missing one-click unsubscribe — can trigger spam filters independently of your DNS records and domain health. Test every email against a spam filter checker before sending, and verify the List-Unsubscribe header is present and RFC 8058 compliant.

• Test emails in a spam filter checker: Tools like Mail-Tester or GlockApps score your email against common spam rules. Identify and fix any triggers before sending to your full list.
• Check link reputation: Every link in your email must resolve cleanly. Use a URL reputation checker to verify none of your links point to blacklisted domains. Shortened URLs are a common red flag for filters.
• Check image-to-text ratio: Emails that are all images with no text content are a classic spam signal. Maintain at least a 60/40 text-to-image ratio.
• Verify your unsubscribe link is functional and one-click compliant: Gmail and Yahoo’s 2024 requirements mandate one-click unsubscribe (RFC 8058) for bulk senders. Verify the List-Unsubscribe header is present and functional.
• Check sending domain alignment in headers: The From: address, Reply-To:, and message header domain should be consistent. Mismatches are spam signals.
• Review subject line and preheader: Excessive caps, multiple exclamation marks, and known spam trigger words in subject lines push mail into spam.

Category 5: Infrastructure Audit

TL;DR: Infrastructure factors — PTR records, TLS encryption, and IP pool segmentation — are evaluated by receiving servers on every message but are invisible to most senders. Transactional and marketing mail must run on separate IP pools so a complaint spike in one stream cannot contaminate the other.

• Verify reverse DNS (PTR record) for dedicated IPs: Your sending IP’s PTR record should resolve to your sending domain or your ESP’s domain. A missing or generic PTR record is a spam signal for many providers.
• Confirm TLS encryption is in place: All email should be transmitted over TLS. Most major ESPs handle this, but verify it in email headers.
• Review sending IP pool setup: If you’re on dedicated IPs, confirm you have appropriate separation between transactional and marketing mail streams. Never mix them — a spam event in marketing should never contaminate transactional delivery.
• Check MX records for your sending domain: Your sending domain should have MX records capable of receiving bounces and replies. A domain with no MX records looks suspicious to receiving servers.

How InboxStack Brain Runs This Audit Every Day

TL;DR: InboxStack Brain replaces the quarterly manual audit with a daily check across SPF, DKIM and DMARC, blacklists, complaint rates, bounce trends, and where mail lands — and alerts you the moment something changes, so you fix a small problem before it becomes a crisis.

Run a Continuous Audit, Not a Quarterly Snapshot

InboxStack Brain runs the equivalent of this full audit on your sending infrastructure every day — not just when you remember to check. Brain checks SPF, DKIM and DMARC status, blacklist presence, complaint rates, bounce trends, inbox placement, and engagement health in real time, surfacing findings with severity ratings and specific remediation steps.

When an issue is detected — a DMARC failure, a new blacklist listing, a spike in complaints — Brain alerts you immediately with the cause attached, so you’re fixing a small problem, not managing a crisis. For teams without a dedicated email engineer, Brain functions as that expert layer running continuously in the background.

More on how InboxStack Brain works.

Frequently Asked Questions

How often should I run the audit?

A full manual audit should be run quarterly at minimum. For high-volume senders (>500K/month), monthly audits are advisable. Between manual audits, a tool like InboxStack Brain that watches continuously replaces the need to run manual checks — issues surface as they emerge rather than being discovered weeks later.

What’s the most important part of the audit?

SPF, DKIM and DMARC are the foundation — a broken record creates problems that no amount of list hygiene or content work can fix. After those, list health (specifically complaint rate and bounce rate trends) is the most impactful area. Most spam-folder problems trace to one of these two categories.

Can I run this audit myself or do I need a specialist?

The technical checks on this page are executable without specialized expertise — most require only browser access to postmaster tools and DNS lookup tools. However, interpreting DMARC aggregate reports, diagnosing provider-specific filtering patterns, and correlating signals across data sources does require experience. Tools like InboxStack Brain provide the interpretive layer that would otherwise require a specialist.

What should I fix first if my audit turns up multiple issues?

Prioritize in this order: (1) failing SPF/DKIM/DMARC — fix these immediately; (2) active blacklist listings — request removal after identifying and fixing the cause; (3) complaint rate violations — pause or suppress affected segments; (4) hard bounce rate — clean your list; (5) engagement and content issues — these are important but rarely put mail in spam on their own.

How do I know if my emails are going to spam vs. the inbox?

Your ESP’s open rate is an unreliable proxy for where mail lands — it conflates inbox placement with whether recipients choose to open. For accurate data, run a seed test (GlockApps, Mailtrap, or 250ok) to send to instrumented addresses at major providers and see where mail actually lands. InboxStack Brain watches where mail lands as part of the same daily check.