Your reply rate dropped last month. SPF is set. DKIM is signed. DMARC is in place. You haven't changed a word of your copy. Your sequences are still running in Instantly and your open rates look normal. But bookings fell 60%. Open rates mean nothing when emails are landing in spam. Inbox providers pre-cache opens on delivery, which inflates the metric regardless of whether a human read the message.
Cold email deliverability fails in six distinct ways, and the problem is almost never what you think it is. Every guide on the topic teaches you how to set up correctly — but setup guides don't help you find which specific thing broke in a system that was already working. That diagnostic problem is different from the setup problem, and it calls for a different approach.
This article is a cold email deliverability audit protocol. Six failure points, checked in priority order. When you find the first one that fails your test, that's where your fix starts. Each section gives you the specific test to run and the specific action to take if the test fails.
Why Deliverability Collapses After Setup (Not During It)
Most cold email deliverability guides are written for launch day. They walk through SPF records, DKIM selectors, DMARC policies, warmup ramps, and spam test scores. They cover how to get a system right at the start.
The failure mode that actually kills cold email programs is drift — something changes after setup. A new ESP gets added to the sending stack without updating the SPF record. A domain accumulates too many bounces over three months and its Google Postmaster score moves from Medium to Low. A sending volume spikes when a new rep joins the team. Inbox provider policy changes raise the bar without warning.
A passing setup checklist from six months ago tells you nothing about the state of your system today. Authentication records drift when tools are added. Domain reputation degrades when list quality slips. Google and Yahoo updated their bulk-sender requirements in February 2024 and have been enforcing them since.
The diagnostic mindset is different: instead of "did I set this up correctly?" you need to ask "which of the six things that can break has broken, and how do I find it?"
| Setup Checklist | Deliverability Audit | |
|---|---|---|
| When you run it | Before launch | When reply rate drops |
| What it answers | "Is my configuration correct?" | "Which failure point is active?" |
| Primary tools | MXToolbox, mail-tester.com | MXToolbox, Postmaster Tools, Instantly reports |
| Output | Configuration status | Identified failure point + fix |
Caption: A setup checklist and a deliverability audit answer different questions. Use the right tool for the right problem.
Once you accept that the problem is diagnostic rather than setup-related, the next step is knowing which of the six failure categories to test first.
If you're also seeing issues with multichannel outbound sequence performance more broadly, the infrastructure layer — which this audit covers — is always the first place to look.
The Six Failure Points: A Diagnostic Map
Cold email deliverability problems map to six distinct failure categories. Each has a different cause, a different test, and a different fix. Running them in order matters: start with the most common cause (authentication drift) and work toward the least common (inbox provider policy violations).
| # | Failure Point | Test Signal | Diagnostic Tool |
|---|---|---|---|
| 1 | Authentication drift | Emails fail SPF/DKIM/DMARC checks | MXToolbox |
| 2 | Domain reputation degradation | Low domain score; blacklist listing | Google Postmaster Tools, MXToolbox blacklist |
| 3 | List quality collapse | High bounce rate; high spam complaint rate | Instantly reports, Postmaster Tools |
| 4 | Content triggers | Low spam score; specific rule violations | Mail-Tester, Gmail spam header |
| 5 | Sending volume ramp violation | Volume spike visible in daily send history | Instantly daily send report |
| 6 | Provider policy violation | Compliance with Google/Yahoo bulk-sender rules | Postmaster Tools, ESP settings |
Caption: Six failure points in diagnostic priority order. Work top to bottom until you find the first failure.
Each of the following sections covers one failure point: what causes it, how to test for it in under 15 minutes, and what to do when it fails.
Failure Point 1: Authentication Drift
Authentication is the first check because it is the most common cause of post-launch deliverability collapse and the fastest to confirm or rule out.
Why Authentication Records Drift After Launch
SPF records need to be updated every time a new sending tool is added to the stack. If you added Instantly six months after launch without updating your SPF include: directive, every email sent through Instantly goes out without SPF authentication. The same applies to any tool that sends on your domain's behalf: Google Workspace, HubSpot, a deliverability warmup service.
DKIM selectors can silently fail after a domain provider migration or a workspace change. If the DNS TXT record for a DKIM selector gets dropped during a migration, DKIM signing fails on all emails using that selector.
DMARC policies set to p=none at launch are often forgotten. They satisfy the "present" requirement but provide no actual spam protection, and they leave you blind to authentication failures unless you have a reporting address configured.
How to Test: Authentication Check Protocol
Run each of these in sequence using MXToolbox (mxtoolbox.com):
- SPF check: Enter the sending domain. Confirm the result shows all active sending infrastructure in the
include:chain. Check for thetoo many lookupserror, which means SPF is failing silently (the RFC limit is 10 DNS lookups). - DKIM check: Test with the specific selector used by each Email Service Provider (ESP). Instantly typically uses a selector unique to your account; check in Instantly's SMTP settings.
- DMARC check: Confirm the record is present. Confirm a
ruareporting address is configured so authentication failures surface in reports rather than disappearing silently.
Run these checks on the sending domain specifically, not on the root domain if you're using a subdomain for cold outbound.
The Fix
- SPF: Update the
include:list for each ESP in use. If you're over the 10-lookup limit, use an SPF flattening tool like dmarcian or AutoSPF to consolidate the record. - DKIM: Regenerate the signing key for any affected ESP and republish the DNS TXT record. Use a 2048-bit key minimum.
- DMARC: Move from
p=nonetop=quarantineonce authentication is stable. Add aruareporting address — Postmark's free DMARC reporting is a practical starting point.
Google requires SPF, DKIM, and DMARC for senders of 5,000+ daily emails to Gmail accounts, per the Email Sender Guidelines updated February 2024.
Once authentication checks pass, move to Failure Point 2. The same sending infrastructure that feeds authentication is what drives cold email personalization at scale — so getting authentication right protects the entire outbound program.
Failure Point 2: Domain Reputation Degradation
Authentication tells inbox providers who is sending. Domain reputation tells them whether to trust the sender. A domain can pass all authentication checks and still have degraded reputation.
What Domain Reputation Actually Measures
Inbox providers build a reputation score for each sending domain based on behavioral signals: how often recipients mark messages as spam, how often they move messages to the trash without reading, what the bounce rate is, and how often recipients engage positively (replies, opens, moves out of spam).
Gmail's domain reputation model exposes this score directly in Google Postmaster Tools. Scores move between four states: High, Medium, Low, and Bad. The transition from Medium to Low often corresponds exactly with a reply rate drop.
How to Test: Reputation Check Protocol
Google Postmaster Tools: If you don't already have the domain verified in Postmaster Tools, do it now. The reputation tab shows a domain score history and a spam rate graph — these two metrics together tell you whether the problem is volume-based (score declining gradually) or event-based (score dropped sharply after a specific send).
Blacklist check: Run the sending domain through MXToolbox's multi-blacklist check. This checks against more than 100 spam blacklists simultaneously. A listing on Spamhaus, Barracuda, or SORBS explains an immediate, complete deliverability collapse rather than a gradual decline.
IP-level check: If using a dedicated sending IP (common in high-volume Instantly configurations), run the IP address through MXToolbox's blacklist check separately. Domain and IP reputation are tracked independently.
The Fix
- If blacklisted: Submit a removal request to each blacklist (spamhaus.org/removal for Spamhaus). Spamhaus requires demonstrating the root cause has been addressed. Most blacklists have self-service removal for first-time listings; repeat listings require a support escalation.
- If Google Postmaster shows Low or Bad: Pause sending on the affected domain immediately. Pull all contacts with hard bounces from sequences. Clean the remaining list by removing contacts who haven't engaged in 90 days. Resume at 20–30% of the previous daily send volume and monitor Postmaster daily.
- Recovery timeline: Moving from Low to Medium reputation typically takes 4–8 weeks of clean sending. The exact timeline depends on daily send volume and engagement signals during recovery. There is no shortcut.
Failure Point 3: List Quality Collapse
Authentication and domain reputation are infrastructure problems. List quality is a data problem, and it's usually slower to surface.
How List Quality Degrades Over Time
B2B contact data decays faster than most teams account for. People change jobs, companies restructure, and roles turn over — email addresses that were valid when sourced from Clay six months ago may be returning bounces today.
Two failure modes matter here:
Bounce rate accumulation: When enough emails hard bounce on the same sending domain, inbox providers interpret it as low-quality list hygiene. Google and Yahoo both use high bounce rates as a negative reputation signal.
Spam trap hits: Some email addresses in commercially sourced lists are operated by blacklist organizations as spam traps. A single spam trap hit is enough to trigger a Spamhaus listing.
How to Test: List Quality Audit
Pull the bounce rate report in Instantly for the past 30 days on the affected sending domain. Acceptable hard bounce rate: below 2%. Above 5% is a problem requiring immediate list remediation. Above 10% requires pulling the sending domain out of rotation.
Check the spam complaint rate in Google Postmaster Tools. Below 0.10% is acceptable. Above 0.30% means Gmail is actively filtering the domain.
The Fix
Remove all hard-bounced contacts from sequences immediately — Instantly handles this automatically if the bounce threshold is configured correctly, but verify the setting. Run the remaining list through an email verification tool: ZeroBounce, Bouncer, or Clay's built-in email validation column. Remove any contacts flagged as "risky" or "unknown." Re-enrichment and re-verification of contacts older than 90 days is the correct standard for active outbound programs.
Failure Point 4: Content Triggers
Content-based filtering operates independently of authentication and reputation. An email can pass all authentication checks, come from a domain with High reputation, and still land in spam on content score alone.
What Content Patterns Flag as Spam
Spam filters assign content scores based on word patterns, link behavior, and formatting. The most common triggers in cold outbound:
- Subject lines with "free," "guaranteed," "no cost," "act now," or multiple punctuation marks
- Excessive capitalization in subject lines
- High link-to-text ratio (more than one external link in a short email)
- URL shorteners or redirect links — these are high-risk for cold outbound
- HTML-heavy email bodies — spam filters score HTML cold outreach higher than plain text
- Unfilled personalization tokens (
{{first_name}}appearing as literal text when merge fails) - Images with no or minimal accompanying text
How to Test: Content Score Check
Use Mail-Tester to score the actual email. Send the real email — using the actual sending domain and the template you're testing — to the provided test address. Mail-Tester reports a score out of 10 and shows the specific SpamAssassin rules that triggered. Run Mail-Tester every time you update a template, not just at initial setup — spam filter rules update and a previously clean template can start triggering new rules.
A score below 8 out of 10 requires content remediation before sending at volume. The SpamAssassin breakdown tells you exactly which rules triggered, which makes the fix specific rather than speculative.
Also: send a test email to a Gmail address you control. When an email lands in spam, Gmail shows a "Why this message ended up in Spam" explanation that names the specific signal.
The Fix
- Rewrite subject lines to remove flagged terms. Test each variation with Mail-Tester before using.
- Move to plain-text or near-plain-text email body for cold outbound. Remove HTML formatting, reduce to one external link maximum.
- Replace URL shorteners with direct links.
- Test every personalization variable with a sample send before launching a new sequence. A single broken merge field in a high-volume sequence sends thousands of emails with visible template errors.
Failure Point 5: Sending Volume Ramp Violations
Inbox providers track the historical send volume of each domain. A domain that has been averaging 200 emails per day that jumps to 2,000 emails per day in a week will trigger volume-based filtering even when every other signal is clean.
How Volume Spikes Damage Deliverability
The warmup period builds a domain's sending history with inbox providers. That history creates the expectation for what normal volume looks like. A spike that deviates significantly from historical baseline triggers increased scrutiny even when the content, authentication, and reputation signals are fine.
This failure mode is most common when teams scale correctly on one domain — warm it up, build reputation — and then try to use that same domain at 5–10x the previous volume when adding new team members or launching a new campaign.
How to Test: Volume Ramp Check
Pull the daily send history from Instantly for the past 60 days on the affected domain. Graph it or look at the trend. A spike is visible immediately. Identify the date when reply rates or deliverability started declining and check whether a volume spike preceded it by 5–10 days (there is typically a lag between the volume spike and the inbox provider response).
The Fix
Pull daily send volume back to the last clean baseline. A day-over-day increase of more than 50% from the 7-day average is the practical threshold to watch for; a week-over-week increase above 100% on a non-warmed domain is near-certain to trigger filtering. If the team needs to scale sending volume, the correct approach is domain diversification rather than single-domain volume increases. For outbound programs sending more than 500 emails per day, multiple sending domains are standard practice. Spread volume across three to five domains rather than increasing any single domain beyond the 500-per-day threshold.
For a new domain: start at 20–30 emails per day. Increase by no more than 30% per week. Use Instantly's built-in warmup feature in parallel to build inbox provider history while live sending begins.
Failure Point 6: Inbox Provider Policy Violations
The final failure point covers cases where the sending program is technically clean but has crossed a threshold in inbox provider policy — specifically the bulk-sender requirements that Google and Yahoo implemented in February 2024.
What Google and Yahoo Now Require
As of February 2024, Google requires all senders of 5,000 or more messages per day to Gmail addresses to meet three requirements or face inbox filtering:
- SPF, DKIM, and DMARC must all be in place.
- Spam rate must stay below 0.10% consistently; 0.30% is the enforcement threshold.
- One-click unsubscribe (
List-Unsubscribeheader) must be present on all commercial and bulk messages.
Yahoo implemented functionally identical requirements simultaneously. Microsoft enforces similar standards through its Smart Network Data Services (SNDS) program, though with less public documentation.
The one-click unsubscribe requirement catches teams who have not enabled it in their ESP settings. In Instantly, this is enabled under Settings. In other ESPs, it typically requires adding a header to the sending configuration.
How to Test: Policy Compliance Check
- Spam rate: Open Google Postmaster Tools and check the spam rate graph for the past 28 days. If it has exceeded 0.10%, you are in the enforcement zone.
- List-Unsubscribe header: Send a test email and view the raw headers. Confirm the
List-UnsubscribeandList-Unsubscribe-Postheaders are present. - Microsoft SNDS: Register at Microsoft SNDS to check the IP reputation and complaint rate for Microsoft-hosted email addresses. This is separate from Google Postmaster and covers Outlook, Hotmail, and Microsoft 365 addresses.
The Fix
Enable the List-Unsubscribe header in your ESP's deliverability settings. This is a configuration toggle, not a technical build.
If the spam rate has exceeded 0.10% in Postmaster: pause the domain, clean the list, and verify DMARC reporting is enabled. With reporting active, you can see which specific messages are generating complaints — which often points back to a specific segment, template, or sequence.
For teams running high-volume outbound through an AI BDR workflow, policy compliance at this level is non-negotiable — a single threshold breach degrades the entire sending infrastructure.
Running the Full Audit: A Decision Protocol
Run the six failure points in order. Each check takes 5–15 minutes. Stop when you find the first one that fails. Fix it. Run a controlled test send before moving to the next failure point.
| Step | Check | Tool | Pass Criteria | Action if Fail |
|---|---|---|---|---|
| 1 | Authentication | MXToolbox | SPF, DKIM, DMARC all pass | Update records per Failure Point 1 fix |
| 2 | Domain reputation | Postmaster Tools + MXToolbox blacklist | Reputation: High/Medium; no blacklist listing | Pause, clean, ramp per Failure Point 2 fix |
| 3 | List quality | Instantly bounce report + Postmaster spam rate | Bounce rate <2%; spam rate <0.10% | Remove bounces, re-verify list per Failure Point 3 fix |
| 4 | Content score | Mail-Tester + Gmail spam reason | Score 8+/10; no spam reason shown | Rewrite per Failure Point 4 fix |
| 5 | Volume ramp | Instantly daily send history | No spike >50% day-over-day from 7-day average | Return to baseline; diversify domains per Failure Point 5 fix |
| 6 | Provider compliance | Postmaster spam rate + email headers | Spam rate <0.10%; List-Unsubscribe present | Enable unsubscribe header; comply per Failure Point 6 fix |
Caption: Deliverability audit protocol. Work through steps in order. Stop at the first failure and fix before proceeding.
Document every check: date, domain, result, action taken. When multiple failures are active (which happens more often than you'd expect), you need a log to track which fixes have been applied and in what order.
Run the full audit once a month as a standing protocol on every active cold outbound domain. A clean audit takes 30–45 minutes. A failed audit that catches a problem early saves weeks of degraded performance and reputation recovery time.
Sources
- Google, Email Sender Guidelines (2024) — Google's official bulk sender requirements including SPF/DKIM/DMARC, spam rate thresholds, and List-Unsubscribe requirements.
- Google Postmaster Tools — Gmail's domain reputation reporting tool referenced throughout for reputation and spam rate checks.
- MXToolbox — Multi-function DNS and email authentication diagnostic tool for SPF, DKIM, DMARC, and blacklist checks.
- Mail-Tester — Spam score tool for content trigger analysis and SpamAssassin rule breakdown.
- Microsoft SNDS (Smart Network Data Services) — Microsoft's IP reputation and complaint rate reporting for Outlook/Hotmail deliverability.
Frequently Asked Questions
What is a cold email deliverability audit?
A cold email deliverability audit is a structured diagnostic sequence that identifies which of six failure points is causing cold emails to land in spam or generate low reply rates. Unlike a setup checklist, it runs on a live program to find what has changed or broken since launch.
Why are my cold emails going to spam even with SPF, DKIM, and DMARC set up?
Authentication records are one of six failure points. Emails still land in spam when domain reputation has degraded, list bounce rates have exceeded provider thresholds, email copy contains content triggers, sending volume spiked too fast for the domain's warmup history, or a Google/Yahoo bulk-sender policy threshold was crossed.
How do I test cold email inbox placement?
Use Mail-Tester or GlockApps: send your actual email from the actual sending domain to the provided test address. These tools show which inbox tab or spam folder the message lands in across multiple providers and show the specific rules that triggered spam filtering.
What SPF, DKIM, and DMARC settings does cold email require?
SPF must list all sending infrastructure with a -all or ~all terminator, staying under the 10 DNS lookup limit. DKIM requires a 2048-bit key aligned to the sending domain. DMARC must be present at minimum p=none with a rua reporting address. Google and Yahoo require all three for senders exceeding 5,000 messages per day to their platforms.
How do I fix domain reputation for cold email?
Open Google Postmaster Tools and check the domain reputation tab. If the score shows Low or Bad, pause sending immediately and clean the list: remove all hard bounces and contacts who haven't engaged in 90 days. Resume at 20–30% of the previous daily volume. If the domain is blacklisted, submit removal requests through each blacklist's self-service portal.
What is the correct warmup schedule for a new cold email domain?
Start at 20–30 emails per day. Increase by no more than 30% per week. Run a warmup service (Instantly's built-in warmup, Mailreach, or Lemwarm) in parallel for the first 4–6 weeks. Do not jump a new domain to full production volume before completing the warmup period.
What are Google's bulk sender requirements for cold email?
Since February 2024, Google requires senders of 5,000+ emails per day to Gmail to have SPF, DKIM, and DMARC in place; maintain a spam rate below 0.10%; and support one-click unsubscribe via the List-Unsubscribe header. Verify compliance in Google Postmaster Tools and in your ESP's header settings.
Fixing cold email deliverability is a diagnostic problem, not a configuration problem. The checklist approach assumes the system was set up correctly and is still running correctly — which is not the assumption you can make after a reply rate drop.
Run the audit in order: authentication, domain reputation, list quality, content triggers, volume ramp, provider compliance. The first failure point you find is the fix you make. Most deliverability collapses trace back to one or two failures, and most of those failures are in the first three categories.
Once deliverability is clean, the infrastructure is ready. The next problem to solve is what you're sending through it — cold email personalization at scale and multichannel outbound sequence cover that ground.
Start the deliverability audit today. The protocol takes under an hour. The repair time you save by catching a failure early is measured in weeks, not hours.
If cold email is only one part of your GTM system and you want to see where the full pipeline stands, the GTM Maturity Assessment maps your infrastructure across outbound, signal detection, and conversion. It takes 5 minutes.
Find Out Where Your GTM System Stands
Cold email deliverability is one layer of your GTM infrastructure. If you want to see how the full system holds up — outbound sequence design, signal detection, pipeline operations — the GTM Maturity Assessment maps it in 5 minutes.