What Is a Cold Email Deliverability Audit?
A cold email deliverability audit is a step-by-step inspection of the entire sending stack because poor inbox placement is usually caused by multiple small failures, not one obvious error.
Most teams look at open rate first, but that is the wrong starting point in 2026. Opens are noisy, bot-inflated, and privacy-distorted. The cleaner signal is whether positive reply rate, bounce rate, and placement indicators changed after a domain, DNS, mailbox, or sending-tool change.
At OutboundPros we treat deliverability like systems debugging, not copy critique. If a campaign drops from 3.5% positive replies to 0.8%, we do not rewrite the sequence first. We check whether the domain is aligned, whether SPF and DKIM pass, whether the mailbox is over-sending, whether multiple tools are touching the same inbox, and whether the campaign pattern looks machine-generated.
The honest limitation is that no audit guarantees inbox placement. Microsoft and Google do not publish a full scoring model, and blacklist checks alone are not enough. But a disciplined audit usually shows where the avoidable damage is happening.
How Do You Know You Need a Deliverability Audit?
You need a deliverability audit when message performance breaks in a pattern that copy alone cannot explain because infrastructure issues usually show up as sudden degradation across campaigns.
The clearest trigger is a sharp drop in replies without a major list-quality change. If the same offer, same ICP, and same copy suddenly produce half the previous response, assume infrastructure before messaging. Another trigger is bounce rates rising above 4% to 5%, especially on previously stable inboxes.
Other signs are easy to miss:
- New domains were added in the last 30 days
- A VA or agency changed DNS records
- Mailboxes were connected to two sending tools at once
- Sending volume jumped from 25 per day to 80+ per day per inbox
- Tracking settings changed, especially link tracking or open tracking
- Google Workspace or Microsoft 365 started showing unusual send warnings
- Replies became mostly out-of-office and auto-replies with very few real humans
At OutboundPros we also watch for pattern mismatch between channels. If LinkedIn acceptance and reply rates stay normal but cold email collapses, that usually points to deliverability or list sanitation, not market fit.
How Should You Run the Audit in the Right Order?
The right audit order is domain, DNS, mailbox, sending system, and campaign behavior because each layer depends on the one before it.
Teams waste time when they start with templates or spam-word myths. If the root domain setup is wrong, no copy fix matters. If authentication is misaligned, warm mailboxes will still underperform. If inboxes are healthy but the sending tool rotates badly, infrastructure still loses.
This is the order we use at OutboundPros:
1. Confirm which domains are used for outbound and whether they are segmented from the main company domain.
2. Verify DNS records: SPF, DKIM, DMARC, MX, custom tracking domain if used.
3. Inspect each mailbox: provider, age, daily send volume, warm-up status, account warnings, forwarding, aliases.
4. Inspect sending tools: Smartlead, Instantly, Salesforge, Reachinbox, or native SMTP setup.
5. Inspect campaign behavior: ramp, personalization depth, list quality, follow-up spacing, links, images, and attachment use.
6. Compare before-and-after metrics around any recent change.
This order matters because it narrows the problem fast. In most audits, we can identify the primary failure point within 30 to 45 minutes, then use the next hour to map the secondary issues.
How Do You Audit Domains and DNS Records?
Domain and DNS auditing is the process of validating identity and alignment because mailbox providers score whether your sending setup looks legitimate before they care what the email says.
Start with domain architecture. For cold outbound, we prefer secondary or adjacent domains rather than the primary company domain. If the main site is companyname.com, an outbound domain might be companyname.co, trycompanyname.com, or getcompanyname.com, as long as it is brand-adjacent and not deceptive. We usually avoid exact typo domains that look scammy.
Then check the core records:
| Record | What to verify | Common failure |
|---|---|---|
| SPF | Includes the actual sending provider and stays under DNS lookup limits | Old providers left in, missing current provider |
| DKIM | Enabled for each mailbox provider and returning a valid public key | DKIM generated but not published correctly |
| DMARC | Published with alignment in mind, even if policy starts at p=none | No DMARC at all |
| MX | Points correctly to Google Workspace or Microsoft 365 | Wrong MX after migrations |
| Tracking domain | Custom domain configured if tracking is used | Shared tracking domain hurting reputation |
Two operator details matter here. First, we often find duplicate SPF logic created by multiple admins over time. SPF can pass in some cases and still be fragile because it is bloated or mismanaged. Second, many teams think DMARC is optional for cold email. In practice, missing DMARC is a trust leak and should be fixed.
A simple standard we like is one sending provider per setup, clear SPF, active DKIM, DMARC published, and no unnecessary DNS clutter.
How Do You Audit Mailboxes and Sending Limits?
Mailbox auditing is checking whether each inbox can safely send at its current pace because even perfect DNS cannot save an overworked or poorly aged mailbox.
We look at mailbox age, provider, warm-up history, daily send count, and whether human activity exists in the account. A mailbox created 5 days ago sending 60 cold emails per day is a risk. A mailbox aged 6 to 8 weeks with light conversational history and a gradual ramp is far more stable.
These are practical thresholds we use most often:
- New mailbox under 14 days: 0 to 10 real outbound emails per day, mostly warm-up and manual usage
- Aged mailbox 2 to 6 weeks: 15 to 30 cold emails per day if setup is clean
- Stable mailbox 6+ weeks: 30 to 50 cold emails per day in most B2B environments
- Aggressive ceiling: 60 per day only when domain health, list quality, and reply handling are strong
At OutboundPros we rarely push beyond 40 to 50 per mailbox unless there is a strong reason. The marginal volume is usually not worth the reputation risk. We also check whether warm-up is still running during live campaigns and whether it is creating unnatural patterns. Warm-up is useful early, but endless warm-up across a crowded network is not a magic shield.
Also check for hidden collisions. We have seen the same mailbox connected to Smartlead, HubSpot, and a rep's manual Gmail workflow at once. That creates weird cadence, duplicate sends, and reputation noise.
How Do You Audit the Sending System and Tool Configuration?
Sending-system auditing is validating how the platform actually sends mail because configuration mistakes inside the tool can override otherwise healthy mailbox setup.
Look at the provider path first. Are you sending through Google Workspace, Microsoft 365, SMTP relays, or a third-party infrastructure layer? Then inspect campaign settings that affect reputation.
The main configuration checks are:
- Daily cap per mailbox and per campaign
- Randomization windows between sends
- Whether open tracking is on
- Whether link tracking is on
- Whether a custom tracking domain is used
- Bounce handling and unsubscribe logic
- Reply detection and thread continuation behavior
- Whether multiple workspaces share the same domains or inboxes
We usually recommend keeping links out of first-touch cold emails unless there is a strong reason. We also default to minimal tracking. At OutboundPros we have seen campaigns improve after disabling open tracking and removing unnecessary tracked links, especially on Microsoft-heavy target lists.
Another operator-level issue is sequence concurrency. If one inbox is enrolled in three campaigns targeting different segments, the pattern can still look robotic because the account sends all day with almost no natural pauses. Healthy daily volume is not just about total count. It is also about distribution.
How Do You Audit Campaign Behavior, List Quality, and Content Signals?
Campaign-behavior auditing is checking whether your outbound motion looks credible to providers and recipients because bad data and unnatural sending patterns create spam signals even on good infrastructure.
Start with list quality. If 10% of the list is catch-all, role-based, or stale, the infrastructure gets blamed for a data problem. We look at source, verification method, enrichment date, and segmentation logic. A clean list verified in the last 7 to 14 days is safer than a larger list touched months ago.
Then review the campaign pattern:
- First email length: 50 to 125 words is usually safer than 250+
- Personalization: real variable logic beats fake one-line compliments
- Follow-up count: 3 to 5 total emails is enough for most outbound
- Spacing: 2 to 4 business days is usually cleaner than daily chasing
- Images and attachments: avoid in cold outreach unless necessary
- Links: zero in first touch is still a strong default
Copy matters, but mostly as a filter against bad engagement. If the message gets ignored, deleted, or marked as spam at scale, future placement suffers. So we audit for promises that sound too broad, intros that feel auto-generated, and personalization that is visibly scraped.
An honest limitation: content-only fixes do not rescue broken authentication. But once setup is healthy, cleaner copy and tighter targeting absolutely help sustain inbox placement over time.
What Should the Final Audit Output and Remediation Plan Look Like?
A useful audit output is a prioritized fix list with owners and timelines because deliverability improves when teams change the right few things fast, not when they collect screenshots.
We like a simple red-yellow-green format by layer:
| Layer | Status | Example fix |
|---|---|---|
| Domain architecture | Yellow | Move outbound from main domain to adjacent domain set |
| DNS authentication | Red | Correct DKIM and publish DMARC this week |
| Mailbox health | Red | Pause 4 inboxes sending 70 per day and replace 2 burned mailboxes |
| Tool configuration | Yellow | Disable open tracking and reduce concurrency |
| List quality | Yellow | Re-verify old records and suppress catch-all segments |
| Sequence behavior | Green | Keep current cadence and email length |
Then convert that into a remediation sequence.
1. Pause clearly damaged inboxes.
2. Fix DNS alignment.
3. Lower volume and simplify tool settings.
4. Replace or rest aging mailboxes if needed.
5. Re-verify data and cut risky segments.
6. Relaunch with tighter monitoring for 10 to 14 days.
At OutboundPros we usually know within 2 weeks whether the audit fixes worked. The main numbers we watch are bounce rate, positive reply rate, and whether inboxes can maintain stable sending without warning signs. If those recover, scaling can resume carefully.
Frequently Asked Questions
How often should you run a cold email deliverability audit?
You should run a light audit monthly and a full audit whenever performance drops or infrastructure changes because most deliverability problems appear after small setup changes, not dramatic failures.
A full audit also makes sense when you add new domains, migrate providers, change sending tools, or increase volume by more than 25%.
Should you use your main company domain for cold email?
You should usually avoid using your main company domain for cold email because outbound risk belongs on a separate branded domain layer.
That protects the main domain's reputation while keeping brand consistency. The exception is very low-volume founder-led outreach with careful manual sending.
What bounce rate is too high for cold outbound?
A bounce rate above 4% to 5% is too high for a healthy cold outbound program because it usually signals list decay, poor verification, or technical misconfiguration.
Well-run campaigns often stay below 3%. If you cross 5%, stop scaling and audit before sending more.
Does warm-up solve deliverability problems by itself?
Warm-up does not solve deliverability problems by itself because reputation depends on authentication, data quality, content, and sending behavior too.
Warm-up helps new inboxes establish baseline activity, but it cannot compensate for broken DNS, bad lists, or over-sending.
Are open rates useful in a deliverability audit?
Open rates are only weakly useful in a deliverability audit because privacy protection and bot activity distort them heavily.
Reply quality, bounce rate, and change over time are better signals. Seed testing and inbox placement checks can help, but they should support, not replace, operational analysis.