Email Deliverability Audit: Find and Fix Inbox Issues

An email deliverability audit should show why your mail bounces, lands in spam, or stops earning engagement. You do not need to change platforms first. You need a clean view of domains, authentication, list quality, complaints, engagement, content, and sending behavior.

What an Email Deliverability Audit Should Tell You

An email deliverability audit should tell you what is hurting trust between your sending infrastructure and mailbox providers.

The goal is simple. Find why mail is:

• Bouncing before delivery.
• Reaching the mailbox but landing in spam.
• Reaching the inbox but getting ignored.
• Triggering complaints, unsubscribes, or blocks.
• Performing worse at specific providers like Gmail, Yahoo, Outlook, or corporate domains.

A good audit does not stop at “your deliverability is bad.” It ties symptoms to causes. For example:

• A bounce spike from one signup source points to list acquisition quality.
• Spam placement at Gmail after a volume jump points to reputation and engagement.
• DKIM failures on one subdomain point to DNS or sending tool configuration.
• High complaints from a cold segment point to consent and targeting.

Delivery rate vs. deliverability vs. inbox placement

These terms get mixed together. Keep them separate.

Metric	What it means	What it does not tell you
Delivery rate	The percent of sent emails accepted by receiving servers	Whether the message reached the inbox or spam folder
Deliverability	Your ability to get accepted and placed well over time	One single universal score across all providers
Inbox placement	Whether accepted mail lands in inbox, spam, promotions, or another folder	Why it landed there without more context

A high delivery rate can hide an inbox placement problem. If 99% of messages get accepted but Gmail sends most of them to spam, your campaign still fails.

That is why an inbox placement audit should sit beside your bounce and complaint review. You need both server-level and mailbox-level signals.

Core audit areas

Use this email deliverability audit checklist as your baseline:

Area	What to check	Why it matters
Authentication	SPF, DKIM, DMARC, alignment, DNS records	Proves mail is allowed to send from your domain
Sender reputation	Bounces, complaints, blocks, spam traps, volume history	Determines how much providers trust you
List quality	Invalid, risky, stale, disposable, role, and catch-all addresses	Bad contacts create bounces and complaints
Engagement	Opens, clicks, replies, conversions, inactivity	Providers learn from recipient behavior
Content	Links, branding, unsubscribe, relevance, formatting	Poor content can amplify existing reputation issues
Infrastructure	IPs, domains, subdomains, sending tools, suppressions	Misconfiguration causes preventable failures

Step 1: Audit Your Sending Domains and Authentication

Start your email authentication audit by proving every sending domain can authenticate and align correctly.

Mailbox providers want to know three things:

1. Is this server allowed to send for this domain?
2. Did the message survive transit without being modified?
3. Does the visible From domain align with authenticated domains?

That means you need to check SPF, DKIM, and DMARC.

Check SPF

SPF lists the services allowed to send mail for your domain.

Look for:

• Missing SPF records.
• Multiple SPF records on the same domain.
• Too many DNS lookups.
• Old vendors still included.
• Overly permissive mechanisms like +all.
• Root domains used by too many tools.

A bloated SPF record creates risk. It also makes troubleshooting harder. Remove services you no longer use.

Check DKIM

DKIM signs messages with a private key. The receiving server verifies the signature using a public DNS record.

Look for:

• Missing DKIM selectors.
• Broken or outdated DKIM records.
• DKIM disabled in one sending platform.
• Messages signed by a vendor domain instead of your domain.
• Failed DKIM after templates or footers modify messages.

If you use multiple tools, test each one. Your marketing platform may sign correctly while your CRM sequence tool fails.

Check DMARC alignment

DMARC tells receivers what to do when SPF or DKIM fails. It also checks alignment with the visible From domain.

Review:

• Whether DMARC exists.
• Whether the policy is none, quarantine, or reject.
• Whether reports go to a monitored mailbox or parser.
• Whether SPF or DKIM aligns with the From domain.
• Whether subdomain policy is defined.

You do not need to jump straight to reject if your setup is messy. First, collect reports. Then fix legitimate senders. Then tighten policy.

Review subdomain strategy

Separate mail streams where possible.

Common patterns:

• mail.example.com for marketing.
• notify.example.com for transactional messages.
• outreach.example.com for sales or cold email.
• A separate domain for high-risk experiments.

Do not mix password resets with cold outreach on the same domain. Transactional mail needs the cleanest possible reputation. If marketing or sales creates complaints, you do not want that damage attached to critical user notifications.

Confirm Gmail and Yahoo bulk sender compliance

If you send bulk mail to Gmail or Yahoo users, confirm the basics:

• SPF or DKIM authentication.
• DMARC on the sending domain.
• Alignment for direct mail where required.
• Easy one-click unsubscribe for marketing mail.
• Low spam complaint rate.
• Valid forward and reverse DNS where relevant.
• TLS support.

You should also track provider-specific performance. Gmail may react differently than Outlook or corporate Microsoft 365 domains.

Step 2: Review Bounce Rate, Complaints, and Suppressions

Your bounce rate audit should separate address problems from temporary delivery failures and policy blocks.

Start with raw sending logs if you can get them. ESP dashboards help, but they often group failures too broadly.

Separate failure types

Classify bounces into these groups:

Failure type	Meaning	Typical action
Hard bounce	Address or domain does not exist, or recipient rejects permanently	Suppress immediately
Soft bounce	Temporary issue like full mailbox, greylisting, timeout, or rate limit	Retry under a controlled policy
Block or policy rejection	Receiver refused mail due to reputation, content, or authentication	Investigate sender reputation and compliance
Unknown failure	Ambiguous SMTP response or tool-level error	Review logs and reclassify if possible

Do not treat every soft bounce as harmless. Repeated soft bounces can indicate a bad domain, throttling issue, or reputation problem.

Find bounce spikes

Break bounces down by:

• Campaign.
• Sending domain.
• Sending tool.
• Mailbox provider.
• Signup source.
• Import batch.
• CRM owner.
• Contact age.
• Country or region.
• Segment or lifecycle stage.

A sudden spike often has a clear source. Maybe a webinar list had typo-heavy addresses. Maybe a sales import included scraped contacts. Maybe a form bot flooded your database with fake signups.

You want root cause, not averages. A 1.5% overall bounce rate can hide a 12% bounce rate in one segment.

Review complaints

Your spam complaint rate tells mailbox providers whether recipients expected your mail.

Check complaints by:

• Campaign type.
• Subject line and offer.
• Acquisition source.
• Time since signup.
• Engagement history.
• Mailbox provider.

Complaints usually mean one of four things:

1. The person did not consent.
2. The person forgot they consented.
3. The message did not match expectations.
4. The unsubscribe path was hard to find.

Make unsubscribing easier than complaining. A visible unsubscribe link protects reputation.

Confirm suppressions work everywhere

Suppression failures create repeat bounces and complaints.

Audit whether these records sync across all tools:

• Hard bounces.
• Unsubscribes.
• Spam complaints.
• Manual opt-outs.
• Role accounts you do not mail.
• Customers who should not receive prospecting.
• Legal suppression lists.
• Internal test domains.

If you use more than one platform, do not assume suppression is shared. Test it.

Create a test contact. Unsubscribe it in one tool. Check whether it appears suppressed in the others.

Step 3: Check List Quality and Risky Email Addresses

A list quality audit finds the contacts most likely to bounce, complain, ignore, or damage sender reputation.

This is where many deliverability problems start. Authentication can be perfect and content can be reasonable. A poor list will still hurt you.

Audit acquisition and import paths

Map every way an email address enters your system:

• Signup forms.
• Checkout flows.
• Demo requests.
• Newsletter forms.
• Webinar registrations.
• Event badge scans.
• Partner lists.
• Sales prospecting imports.
• CRM enrichment.
• Product invites.
• Support forms.
• API-created users.

For each source, ask:

• Did the person type the address themselves?
• Did they give clear consent?
• Was the address verified in real time?
• Was double opt-in used?
• Was the source bot-protected?
• Does the source produce bounces or complaints?
• How old is the data before first send?

Old contacts decay. People change jobs. Domains expire. Mailboxes close. A clean list becomes risky if you leave it untouched.

Look for risky address patterns

Flag these during the list quality audit:

Address type	Example	Risk
Disposable email	Temporary inbox domains	Often low intent and short-lived
Role account	info@, support@, sales@	Shared inbox, low personal engagement, higher complaint risk
Typo domain	gmial.com, hotmial.com	Preventable hard bounce
Catch-all domain	Accepts any local part	Address may appear valid but still be risky
Free-provider pattern	Large volumes of Gmail/Yahoo/Outlook	Not bad by itself, but needs provider-level monitoring
Corporate stale contact	Old employee address	Likely to bounce after job changes

Real-time verification should run before bad data enters your system.

Good checkpoints:

1. Signup: Catch typos, disposable addresses, and obvious invalids before account creation or lead capture.
2. Import: Validate CSVs and CRM uploads before a campaign.
3. Enrichment: Re-check enriched or appended addresses before use.
4. Pre-send: Verify old or inactive segments before reactivation.

Bounceable is useful here because it checks deliverability, disposable domains, role accounts, typo suggestions, catch-all behavior, and bounce risk before you send.

An illustrative verification result might look like this:

{
  "email": "alex@gmial.com",
  "verdict": "undeliverable",
  "risk": "high",
  "checks": {
    "syntax": "valid",
    "domain": "typo_suspected",
    "disposable": false,
    "role": false,
    "catch_all": false
  },
  "suggestion": "alex@gmail.com"
}

Use the result to make a routing decision.

Verdict	Suggested action
Deliverable	Send normally, subject to consent and engagement rules
Risky	Send only if consent is strong, or route to lower-risk flows
Undeliverable	Suppress before sending
Unknown	Re-verify later or send cautiously if the contact is valuable and consented

Do not send to every “unknown” address by default. Unknown is not the same as safe.

Step 4: Analyze Engagement and Segmentation Health

Engagement health shows whether recipients want your mail after it reaches them.

Mailbox providers watch recipient behavior. Positive engagement helps. Long-term inactivity and complaints hurt.

Review more than opens

Open tracking has limits. Privacy features can inflate or hide opens. Use a broader set of signals:

• Clicks.
• Replies.
• Conversions.
• Product activity.
• Purchases.
• Form submissions.
• Event attendance.
• Unsubscribes.
• Spam complaints.
• Deletes without reading, where available.
• Time since last meaningful action.

Define engagement for your business. A B2B sales team may value replies. A SaaS lifecycle team may value product logins. An ecommerce team may value clicks and purchases.

Compare engaged and unengaged segments by provider

Do not only compare global engagement.

Segment by mailbox provider:

Segment	Gmail	Yahoo	Outlook	Corporate domains
Active last 30 days	Healthy	Healthy	Watch	Healthy
Inactive 90 days	Watch	Weak	Weak	Mixed
Inactive 180+ days	High risk	High risk	High risk	High risk

This table is a pattern, not a benchmark. Build your own view from your data.

If one provider drops first, slow down there. You may need a provider-specific re-engagement plan.

Stop mailing inactive contacts forever

Sending to inactive contacts tells providers your mail is not wanted. Over time, that can reduce inbox placement for people who do want your mail.

Set rules such as:

• Suppress contacts with no engagement after 180 days.
• Shorten the window for cold or low-consent sources.
• Re-verify inactive contacts before reactivation.
• Send a short re-engagement series before sunset.
• Stop after no response. Do not keep trying every month.

A re-engagement campaign should be simple:

1. Confirm interest.
2. Offer preference options.
3. Make unsubscribe obvious.
4. Stop mailing non-responders.

A sunset rule is not lost revenue. It protects your ability to reach active recipients.

Step 5: Inspect Content, Links, and Sending Patterns

Content and cadence matter, but they usually magnify reputation and list problems rather than replace them.

Once authentication, bounces, complaints, and list quality are under control, review what you send and how you send it.

Check links and branding

Mailbox providers and security filters inspect links.

Look for:

• URL shorteners.
• Excessive redirects.
• Mismatched link domains.
• Tracking domains with poor reputation.
• Broken HTTPS.
• Links to newly registered domains.
• Attachments in bulk campaigns.
• Inconsistent From names.
• Misleading subject lines.
• Brand names that do not match the sending domain.

Use branded tracking domains where possible. Keep redirects simple. Avoid link chains that pass through multiple unrelated domains.

Review cadence and volume

Volume spikes can look suspicious, especially from a new domain or dormant list.

Audit:

• Daily send volume.
• Weekly campaign count.
• Sudden increases by domain or provider.
• Sends after long inactivity.
• New IP or domain warmup behavior.
• Time between signup and first email.
• Time between last engagement and current campaign.

If you must increase volume, do it gradually. Segment by engagement first. Mail your most active recipients before older or colder segments.

Evaluate relevance and unsubscribe visibility

Ask practical questions:

• Did the recipient ask for this type of email?
• Does the subject match the body?
• Is personalization accurate?
• Is the offer relevant to the segment?
• Is the unsubscribe link visible?
• Does the preference center work?
• Are you sending too many similar messages?

Bad personalization can be worse than no personalization. “Hi {{first_name}}” mistakes signal low quality. Wrong company names or irrelevant lifecycle messages create complaints.

Do not over-credit content fixes

Teams often rewrite subject lines when the real problem is list quality.

Content fixes will not solve:

• Invalid addresses.
• Purchased lists.
• Broken DKIM.
• Missing suppressions.
• High complaint sources.
• Long-term inactive contacts.
• Disposable signups.
• Cold outreach from a damaged domain.

Fix the foundation first. Then optimize copy.

What to Do After the Audit

After the audit, prioritize fixes by reputation impact and create a 30-day remediation plan.

Do not leave the audit as a long spreadsheet. Turn findings into decisions, owners, and deadlines.

Prioritize by impact

Use this order:

1. Authentication failures. Fix SPF, DKIM, DMARC, alignment, and broken DNS.
2. Hard bounces. Suppress invalid addresses and stop bad sources.
3. Spam complaints. Remove complaint-prone segments and improve consent.
4. Inactive contacts. Re-engage, verify, or sunset them.
5. Suppression gaps. Make opt-outs and bounces sync everywhere.
6. Volume and cadence. Reduce spikes and rebuild gradually.
7. Content and links. Clean up tracking, branding, relevance, and unsubscribe paths.

This order keeps you focused on causes that mailbox providers care about most.

Build a 30-day remediation plan

A practical plan can look like this:

Timeframe	Actions
Days 1–3	Fix obvious DNS and authentication issues. Confirm each sending tool signs correctly.
Days 4–7	Pull bounce, complaint, and suppression reports. Stop campaigns to high-risk sources if needed.
Days 8–14	Verify risky imports, inactive segments, and old CRM contacts. Suppress undeliverable addresses.
Days 15–21	Launch re-engagement for inactive but consented contacts. Sunset non-responders.
Days 22–30	Resume volume gradually with engaged segments first. Monitor by provider and source.

Assign one owner for each workstream. Deliverability fails when every team assumes another tool or team owns the problem.

Monitor recurring metrics

Set a recurring deliverability health check. Weekly is enough for many teams. High-volume senders may need daily monitoring.

Track:

• Delivery rate.
• Hard bounce rate.
• Soft bounce rate.
• Block rate.
• Spam complaint rate.
• Unsubscribe rate.
• Click and reply rate.
• Engagement by mailbox provider.
• Inbox placement test results.
• DMARC pass and alignment rates.
• List growth by source.
• Verification failure rate.
• Suppression sync failures.

Review trends, not just single campaigns. A slow decline can be more dangerous than one bad send because teams normalize it.

Keep bad contacts out before they affect the next audit

The best audit result is fewer problems entering the system.

Add verification and list quality controls at the point of capture, import, enrichment, and pre-send. Bounceable can help you verify contacts in real time and flag disposable, risky, catch-all, typo, role, and undeliverable addresses before they create bounces or reputation damage.