Email Deliverability Audit in 2026: A Step-by-Step DIY Checklist

An email deliverability audit answers one question: why isn’t mail reaching the inbox, and what needs fixing first? People usually go looking for one after something changes:

• Open or reply rates drop suddenly.
• Messages land in spam or the Promotions tab.
• Outlook.com starts bouncing mail with “550 5.7.515”.
• They’re moving to a new email platform, domain or cold-email setup.

Since Gmail and Yahoo started enforcing bulk-sender rules in February 2024, and Microsoft followed in May 2025, most of the audit is checking you meet those rules. Our Gmail, Yahoo and Outlook sender requirements guide covers them in full. The rest is reputation and list health, which the rules also depend on.

What a proper audit checks

A full audit covers six layers. Problems in an earlier layer usually cause problems in later ones, so work in this order.

1. Authentication: SPF, DKIM and DMARC records, and whether they pass and align for real messages.
2. Infrastructure: sending IPs (shared or dedicated), reverse DNS (PTR), TLS, and how domains and subdomains are split between marketing and transactional mail.
3. Reputation: what Gmail and Microsoft report about your domain and IPs, plus blocklist status.
4. List health: how addresses were collected, bounce rates, inactive subscribers and complaint rates.
5. Compliance headers and content: one-click unsubscribe headers, a visible unsubscribe link, a valid From and Reply-To, and links to domains with a good reputation.
6. Placement: where test messages actually land at each major provider.

The DIY checklist

1. List every service that sends as your domain

Write down everything that puts your domain in the From: address: your email marketing platform, CRM, Google Workspace or Microsoft 365, help desk, billing system, ecommerce platform and any cold-email tools. Audits often fail at this step because nobody knows that the invoicing tool sends 3,000 emails a month.

Pass: a complete list, confirmed later by DMARC reports.

2. Check your DNS records

Run your domain through our free email deliverability checker. It looks up MX, SPF, DKIM (on common selectors), DMARC, BIMI and MTA-STS in your browser.

Pass:

• Exactly one SPF record that covers every service from step 1, ends in ~all or -all, and uses no more than 10 DNS lookups.
• A DKIM key for each sending service. Find custom selectors in each platform’s domain settings.
• A DMARC record with at least p=none and a rua= address for reports.

3. Read the headers of a real message

Send a real campaign or message from each service to a Gmail address. Open it, choose “Show original,” and read the authentication results.

Pass:

• SPF, DKIM and DMARC all show PASS.
• The DKIM d= domain matches your From: domain, or is a subdomain of it. If it shows your platform’s domain instead, turn on custom domain authentication in that platform.

This is the step DNS checks can’t do. A record can exist and still not be used.

4. Check unsubscribe headers

In the same “Show original” view, look for List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click on marketing messages. Check that the body has a visible unsubscribe link.

Pass: both headers are present on marketing mail, and unsubscribes are processed within 48 hours. That’s Google’s deadline. Yahoo allows 2 days.

5. Check reputation

• Google Postmaster Tools: free once you verify your domain. Look at the user-reported spam rate. Google asks for below 0.1% and never 0.3% or higher. Also check the authentication and compliance data.
• Microsoft SNDS: free, but only for IPs you control. Skip it if you send through a shared platform pool.
• Blocklists: check your sending IPs and domain on a multi-list lookup such as MxToolbox’s free tools.

Pass: spam rate under 0.1%, no listings on major blocklists.

6. Check list health

Pull these numbers from your email platform for the last 90 days:

• hard bounce rate;
• complaint rate;
• the share of your list that hasn’t opened or clicked in 6 months;
• how new subscribers are added (single or double opt-in, imports, purchased or scraped lists).

Pass: hard bounces suppressed after every send, complaint rates well under the 0.1% Gmail target, no purchased lists, and a plan to suppress or re-engage long-inactive subscribers. Purchased and scraped lists are the fastest route to high complaint rates, and no DNS fix compensates for them.

7. Run an inbox placement test

Send your real template to a seed list that covers Gmail, Outlook.com, Yahoo and a few business mail systems. Note inbox, Promotions and spam placement for each.

Pass: consistent inbox or Promotions placement across providers. A single bad result isn’t conclusive, so run it twice.

8. Review sending patterns

Look for sudden volume spikes, a new domain or IP sending at full volume from day one, or marketing and transactional mail sharing one stream. Gradual ramp-ups and separate subdomains (for example news.yourdomain.com for marketing) limit the damage when one stream has problems.

9. Write the fix plan

Rank what you found:

1. Anything that makes authentication fail: missing or duplicate SPF, more than 10 SPF lookups, unaligned DKIM, missing DMARC.
2. Compliance gaps: missing one-click unsubscribe headers, slow unsubscribe processing.
3. Reputation and list problems: high spam rate, blocklist listings, stale segments.
4. Improvements: DMARC enforcement (quarantine, then reject), BIMI, MTA-STS.

After fixes, recheck the DNS, resend a header test, and watch Postmaster Tools for two to four weeks.

Tools for each step

For a fuller comparison, see the best email deliverability tools.

When to pay someone

The checklist above is enough for most small senders. Consider paying a specialist when:

• Authentication passes but mail still lands in spam. That points to reputation, content or engagement problems, which take experience to diagnose.
• You’re on a blocklist and the listing doesn’t clear after you fix the cause.
• You send from your own IPs or mail servers. PTR, TLS, IP warm-up and feedback loops add a layer most marketers don’t handle day to day.
• You need to reach DMARC reject across many domains or business units without blocking legitimate mail.
• Your volume is high enough that a bad week costs real revenue.

Before you hire, ask:

• What exactly does the audit check? Ask for a sample report.
• Do you read real message headers and DMARC reports, or only DNS?
• Is the fix plan prioritized, and is implementation included or extra?
• How will we measure whether it worked (Postmaster Tools spam rate, placement tests, bounce codes)?

Be wary of anyone who guarantees inbox placement. Mailbox providers decide placement per message and per recipient, so nobody can promise it.