The 2026 Cold Email Deliverability Checklist (DKIM, SPF, DMARC, and Beyond)

Since Gmail and Yahoo's 2024 bulk sender enforcement — and the tightening that followed in 2025 — cold outbound has become an infrastructure problem at least as much as a copywriting problem. If your messages don't pass authentication or your sending reputation is shaky, the world's best email won't matter, because nobody will see it.

This is the exact pre-launch checklist our infrastructure team runs before turning on a new sending stack for a client.

Domain and DNS

• Use dedicated sending domains (e.g. get-acme.com, try-acme.com) — never your primary brand domain for cold outbound.
• Set SPF to a hard fail (-all), not soft fail (~all), and audit included senders quarterly.
• Enable DKIM with at least a 2048-bit key on every sending domain.
• Publish a DMARC policy of at least p=quarantine with rua reporting to a monitored mailbox.
• Add a BIMI record once DMARC enforcement is stable — it improves both deliverability and brand trust.
• Confirm reverse DNS (PTR) on every sending IP matches the HELO hostname.

Inbox warmup

New mailboxes must be warmed slowly. Going from zero to 50 cold sends per day in week one is a guaranteed reputation killer. Our standard ramp:

1. Days 1–7: 5–10 sends per day, 100% to warmup network.
2. Days 8–14: 15–25 sends per day, mixed warmup and seed list.
3. Days 15–21: 25–35 sends per day, begin gradual cold sends.
4. Day 22+: scale by no more than 10 sends per mailbox per week, capped at 40/day.

Volume and pacing

• Stay under 40 sends per mailbox per day — the soft cap most providers tolerate.
• Randomize send intervals between 30 and 180 seconds. No bot-like cadence.
• Spread total volume across enough mailboxes that no single inbox provider sees a sudden spike from your domains.
• Pause individual mailboxes immediately if reply rate drops below 1% over a 7-day window — that's an early reputation signal.

Content hygiene

• No tracking pixels in cold sequences. They tank inbox placement at every major provider.
• Avoid all attachments and inline images on the first 2–3 touches.
• Plain-text-style HTML only. No fancy templates, no logos, no footers.
• One link maximum per email, and only after the second touch.
• Always include a working, one-click unsubscribe — required under both Google bulk sender rules and most regional regulations.

Monitoring

Set up daily monitoring on Google Postmaster, Microsoft SNDS, and a third-party seed test (Glock Apps or similar). The metric that matters most: spam placement rate. Anything above 5% is a fire — pull volume immediately and diagnose before scaling back up.