Cold email deliverability checklist for 2026

There is no single trick that gets cold email into the inbox in 2026. There is a stack of four layers, checked in order, and each one gates the next. This is the checklist we point every new sender at before their first real campaign.

Layer 1: Authentication

• A single SPF record ending in -all (hard fail), under the 10-DNS-lookup limit.
• DKIM signing enabled and verifying on outbound test sends.
• A DMARC record at _dmarc.yourdomain.com with a real policy (p=quarantine or p=reject), not just p=none.
• A dedicated sending (sub)domain — never your primary corporate domain — so a reputation hit never touches billing or support email.

Verify all three in one pass with the free SPF checker and DMARC checker. If either comes back "action required," stop here — nothing downstream matters until this is clean. The mechanics are covered in full in SPF, DKIM & DMARC explained.

Layer 2: Warmup

• Let a new domain age at least a couple of weeks before any sending.
• Ramp volume gradually — tens of emails a day in week one, not hundreds.
• Prioritize real engagement (opens, replies) over raw volume during the ramp.
• Never point a brand-new domain straight at a real campaign list.

The full ramp schedule is in what is a warmed sender pool and email warmup explained.

Layer 3: Reputation monitoring

• Watch Postmaster-Tools-style signals continuously, not once at setup.
• Know your spam-complaint-rate threshold and what happens if you cross it.
• Have a circuit-breaker — automatic or manual — that pauses a domain the moment its reputation drifts, before it drags down everything else you send from.
• Run a periodic blacklist check on your sending IP against the well-known DNSBLs.

The mechanics behind this layer are in how sender-reputation scoring actually works.

Layer 4: Suppression and hygiene

• Suppress hard bounces immediately, before the next send goes out.
• Suppress on a soft-bounce threshold rather than retrying forever.
• Every message carries a working, RFC 8058 one-click unsubscribe — and it takes effect before the next send, not after.
• Run outbound copy through a spam-word checker before a campaign ships — a subject line stuffed with "act now" and "100% free" invites a spam-folder verdict regardless of your DNS.

CogniLead is a deliverability engine, not a lead database — you supply recipients via the API and it protects the send. See pricing or the MCP server to wire it into an agent.