What's the single highest-impact item on this list?

If mail is bouncing: authentication (SPF/DKIM/DMARC) — modern providers refuse unauthenticated mail outright. If mail delivers but lands in spam: list hygiene and complaint rate. Run the email health check first; it covers the whole infrastructure section in one pass.

How often should I run through this checklist?

The infrastructure section: after any DNS, vendor, or platform change, and on a monthly schedule otherwise. Hygiene and sending-practice items are ongoing process, not a periodic check — build them into your sending workflow once.

Is 0.3% spam complaints really the limit?

Google publishes 0.3% as the threshold above which bulk senders see delivery impact, and recommends staying under 0.1%. In practice treat 0.1% as the working ceiling — by the time you're at 0.3% the damage is underway.

The email deliverability checklist: 24 checks before you press send

Deliverability problems are almost never one big thing — they're an accumulation of small unchecked boxes. This is the full list, ordered by how often each item is the culprit. Work top to bottom; the infrastructure section alone resolves most inbox-placement problems.

Updated July 25, 2026

Infrastructure and authentication

SPF record exists, includes every sending service, and stays under 10 DNS lookups — check with the SPF checker.
Exactly one SPF record on the domain — duplicates invalidate both.
DKIM enabled at every sending platform with your own domain's key, not the platform default — how to enable DKIM.
DMARC record published, at minimum p=none with a rua= reporting address — setup guide.
SPF or DKIM aligns with your From domain (both is better).
MX records resolve and are ordered correctly — MX lookup.
Sending IPs have valid reverse DNS (PTR) — a hard requirement at Gmail; see 550 5.7.25.
Domain and IPs are off the major blocklists — blacklist checker.

List hygiene

Every address is opt-in. Purchased or scraped lists poison reputation faster than anything else on this page.
Hard bounces are suppressed immediately and automatically — hard vs soft bounces.
Recipients who haven't engaged in ~6 months are in a re-permission or suppression flow, not the main list.
New signups are verified (double opt-in or at least syntax + MX validation) before the first campaign reaches them.
Role addresses (info@, admin@) and known spam traps are filtered out.

Sending practices

New domains and IPs are warmed up gradually, not launched at full volume.
Volume is consistent day to day — spikes read as compromise or spam.
Marketing and transactional mail run on separate subdomains so reputations don't cross-contaminate.
One-click unsubscribe (RFC 8058 List-Unsubscribe headers) is present on all bulk mail — required by Gmail and Yahoo.
Unsubscribes are honored within two days, and the spam-complaint rate stays under 0.3% (Google's published threshold).

Content

From name and address are stable — changing them resets recipient recognition and filter trust.
Subject lines make a promise the body keeps; misleading subjects drive the complaints that kill reputation.
HTML is clean: no forms, no attachments on bulk mail, a working plain-text part, and a text-to-image ratio that isn't one giant image.
Every link domain in the body is yours or reputable — a single blocklisted link domain can spam-folder the whole message.
A physical mailing address and working unsubscribe link appear in the footer (legally required in most jurisdictions).

Monitoring — the part everyone skips

Everything above decays: vendors change IPs, a teammate adds a tool that sends as your domain, a key rotates. The senders who stay in the inbox are the ones who notice within hours, not quarters.

DMARC aggregate reports are collected and actually read — how to read them.
Google Postmaster Tools is set up and reviewed for reputation and spam-rate trends.
Authentication is re-verified on a schedule (or monitored continuously) rather than only when something breaks.
Placement is spot-checked with an inbox test after any infrastructure or vendor change.