Cold Email Deliverability Checklist 2026 (Spam Filters, SPF DKIM DMARC)

Cold email is not dead in 2026 — lazy cold email is. Spam filters in Gmail, Outlook and Yahoo now score every message on authentication, reputation and engagement, and a single misconfigured DNS record can send your whole campaign to the junk folder. This is the checklist we run before any outbound campaign: work through it top to bottom and most deliverability problems disappear before you press send.

1. SPF: authorize who sends for you

SPF is the DNS TXT record that lists which servers may send email for your domain. In 2026 the rules that matter: keep the record under the 10-DNS-lookup limit (flattening tools help), include every provider you actually send from, and never publish two SPF records — one domain, one v=spf1 record. An unauthorized relay or a forgotten include is one of the most common reasons new domains get flagged in week one.

2. DKIM: sign every message

DKIM cryptographically signs your mail so receivers can prove it was not altered in transit. Use 2048-bit keys, publish the selector your provider gives you, and verify the signature passes on test sends (Gmail's 'Show original' shows a PASS/FAIL per check). Rotate keys at least once a year. If you send through multiple tools — a CRM, an outreach sequencer, a helpdesk — each one needs its own DKIM selector configured.

3. DMARC: enforce and watch

DMARC tells inboxes what to do when SPF and DKIM fail, and sends you reports about who is mailing as your domain. Since Google and Yahoo made DMARC mandatory for bulk senders, a domain without it is a red flag on its own. Roll out in stages: p=none to collect reports, then quarantine, then reject once you see only legitimate sources passing alignment. Add a rua= address so the reports actually reach you.

4. Warm up the domain and the mailbox

Never launch cold email from your main company domain. Register a lookalike domain (yourbrand.com -> tryyourbrand.com), set up 2-3 mailboxes on it, and warm them for 2-3 weeks: low daily volume, high reply rate, real human conversations mixed in. Jump from 0 to 200 sends a day and even a perfectly authenticated domain lands in spam. Scale by roughly 20-30 sends per day per mailbox, and keep total volume per mailbox under ~50/day in steady state.

5. List hygiene and the spam traps

Spam filters punish bounces. Verify every list before importing it (catch-all domains included), hard-bounce once and suppress forever, and honor unsubscribes immediately — one-click unsubscribe headers (List-Unsubscribe) are now expected by Gmail and Yahoo for bulk mail. Purchased lists are the fastest route to a spam trap and a burned domain; if you did not collect it, do not send to it.

6. Copy that does not look (or smell) like spam

The filters read your email too. In practice that means: one clear link, not five; no URL shorteners; no image-heavy layouts; plain text or minimal HTML; no 'act now' trigger-word stacks; a real signature with a real website. Personalization still wins — a first line that proves you looked at the prospect's world beats any template. Keep it short: 50-125 words gets the best reply rates in 2026.

7. Watch the metrics that receivers watch

Gmail and Outlook judge you by engagement: delete-without-reading, spam complaints, reply rate. Track your own proxy metrics — reply rate (healthy: 3-8% cold), bounce rate (under 2%), complaint rate (under 0.1%) — and pause any segment that underperforms. If open tracking is on, remember Apple Mail Privacy Protection inflates it; treat opens as directional, replies as truth.

The 60-second pre-send audit

SPF pass, DKIM pass, DMARC at quarantine or better — check on mail-tester.com. Fresh sending domain, warmed mailboxes, volume inside caps. List verified, unsubscribe working, one link per email. If all four are green, send. If you want the outreach side — sequences, personalization at scale, a client-getting workflow you can run from one dashboard — that is exactly what we built the AI Outreach Kit for.

Get it here: AI Outreach Kit — storefront or download it on itch.io. 50 tested prompts, 15 templates and 4 full outreach sequences for freelancers and agencies — plus the deliverability checklist above in printable form.