Two situations call for an audit: you are about to launch, or something has stopped working and nobody knows why.
The same list covers both, but the order matters. Work top to bottom and stop when you find something broken, because a single failure upstream produces symptoms that look like a dozen problems downstream. Teams that jump straight to rewriting copy have usually skipped an authentication error.
Infrastructure (1–8)
1. Sending domains are separate from your primary company domain. 2. Domains are registered in an account you control, not a vendor’s or agency’s. 3. No more than five mailboxes per domain. Three is better. 4. Every mailbox has completed at least three weeks of warmup. 5. Warmup is still running alongside live sending, not switched off at launch. 6. Daily volume per mailbox is within a safe ceiling for your provider, and consistent across weekdays rather than bursty. 7. Sender rotation is enabled, so no single mailbox carries the whole campaign. 8. You know which IP model you are on — shared pool or dedicated — and it matches your volume.
Authentication and DNS (9–16)
9. SPF record present on every sending domain. 10. SPF is within the ten-lookup limit. (This one fails silently and is extremely common.) 11. DKIM configured, 2048-bit. 12. DMARC published, with a reporting address that someone actually reads. 13. MX records correct, so replies arrive. 14. Custom tracking domain, not the platform’s shared one. 15. Tracking domain has valid SSL and auto-renewal. 16. All of the above verified by a check, not assumed because setup said it succeeded. Run a domain health check per domain.
List quality (17–24)
17. Every address verified within the last 30 days. 18. Catch-all domains identified and either excluded or segmented separately. 19. Role addresses removed — info@, sales@, support@, admin@. 20. Suppression list loaded: unsubscribes, past do-not-contact requests, current customers. 21. Existing customers and open opportunities excluded. 22. Competitors excluded. 23. Deduplicated across campaigns, so one person is not enrolled twice. 24. List matches your written ICP, rather than being everything the filter returned.
Sequence structure (25–31)
25. A reply on any channel stops every remaining step. 26. Total touches capped, across all campaigns rather than per campaign. 27. Sending window set to the recipient’s timezone, not yours. 28. Intervals between touches are irregular rather than a fixed cadence. 29. Every merge field has a fallback. Test by deliberately sending to a record with missing data. 30. Unsubscribe mechanism present and functional. 31. Conditional branches behave correctly — test one lead through each path before launching.
Copy (32–36)
32. Subject lines are short, lowercase-ish and look like internal mail rather than marketing. 33. No images in the first touch, and no attachments at all. 34. One link maximum in the first email, ideally none. 35. The first line is about them, not about you. Rewrite anything that opens with “I”. 36. Message reads plausibly if the personalisation failed — the fallback version should still make sense.
Measurement (37–40)
37. Inbox placement tested before launch, with per-provider results. 38. Bounce rate monitored with a hard stop at 3%. 39. Complaint rate monitored with a hard stop at 0.1%. 40. A segment performance floor set, so a non-responding segment pauses rather than completing its run.
If something has broken, work it in this order
Do not change several variables at once. You will fix it and not know which change did it, and the same problem will recur.
First, DNS. Has anything changed? Records get edited and break quietly. Items 9 to 16.
Second, placement. Run a test. Is it every provider or one? A single-provider problem points somewhere very different from a universal one.
Third, bounces. Above 3% means the list is the cause and no amount of infrastructure work will help.
Fourth, complaints. Above 0.1% means targeting or copy, and targeting is more likely.
Fifth, volume. Did sending jump recently? A sudden increase reads as a compromised account.
Sixth, and only sixth, copy. By the time you get here you will usually have already found it.
The five that catch most problems
If you only run five checks:
- SPF lookup count (item 10). Fails silently, extremely common, easy to miss.
- Warmup duration (item 4). Almost always compressed to hit a launch date.
- Suppression list loaded (item 20). The most embarrassing omission on the list.
- Merge field fallbacks (item 29). One broken variable at scale is visible and permanent.
- Placement tested (item 37). Without it you do not know whether anything else matters.
Before every launch
A shorter version, five minutes:
- Placement test on the sending domains
- Bounce rate on the list from verification
- Suppression list loaded and current
- One test lead pushed through the full sequence, including branches
- A deliberately empty merge field, to confirm fallbacks hold
That catches most of what goes wrong, and it takes less time than explaining afterwards why 4,000 emails went out addressed to “Hi ,”.
Next: the deliverability guide, or which deliverability tools do what.
Frequently asked questions
What should a cold email audit cover?
Infrastructure and warmup, authentication and DNS, list quality and suppression, sequence structure, copy, and measurement thresholds. Work in that order, because a failure upstream produces symptoms that look like several separate problems.
Why are my cold emails going to spam?
Check in order: DNS records for recent changes, an inbox placement test by provider, bounce rate above 3%, complaint rate above 0.1%, and any recent jump in volume. Copy is the last thing to examine, not the first.
How often should I audit a cold email setup?
Fully before each new campaign or infrastructure change, and the five-item pre-launch version every time you launch. Authentication is worth re-checking monthly since records get edited.
What is the most commonly missed item?
The SPF ten-lookup limit. It fails silently, it is easy to exceed when adding sending services, and it produces spam placement that looks like a content problem.