Email deliverability audit: the full DIY procedure, phase by phase

Deliverability consultants charge four figures for an audit, and much of what that buys is a procedure: a fixed sequence of checks across authentication, infrastructure, reputation, list health and placement, run with tools that are mostly free, producing a findings list ranked by severity. The expertise is real, and there are cases that warrant hiring it. But the procedure itself is documentable, and this guide documents it, five phases, roughly an afternoon for a single domain, with every tool linked at the step where it's used.

Two ground rules before phase one. Audit the domain that actually sends, which for most organizations means the marketing subdomain and the transactional subdomain separately, not just the corporate root. And write findings down as you go with a severity attached, because the output of an audit is a prioritized repair list, not a feeling.

Phase 1: authentication (pass/fail, no partial credit)

The identity layer comes first because everything downstream attaches to it. For each sending domain:

1. SPF. Run the SPF checker: exactly one record, syntactically valid, every current sending service included, and a lookup count safely under the ten-lookup limit. A permerror here is a critical finding; a softfail on your own mail is high.
2. DKIM. Verify each service's selector with the DKIM checker; confirm signatures use your domain, not the platform's, since that is what alignment requires.
3. DMARC. Inspect with the DMARC checker: record present, rua reporting address set, and a policy that reflects a decision rather than a default. p=none with no one reading the reports is a finding; the escalation path is in DMARC policy.
4. The live verdict. Send real mail from each stream to a mailbox you control, and read Authentication-Results with the email header analyzer. Settings pages report intent; this header reports fact.

The email authentication checker bundles the DNS side of all three into one pass, and the requirements being audited against are the providers' own, kept current on our Gmail, Yahoo and Outlook pages.

Phase 2: infrastructure and DNS hygiene

Now the plumbing under the identity. The email DNS check surveys the records in one view; the findings to chase:

• MX records present and resolving (MX lookup confirms), because domains that cannot receive mail look disposable to some receivers.
• Reverse DNS on sending IPs: the PTR record must resolve and match forward, a hard Gmail requirement for connecting hosts, checkable with the reverse DNS checker. On a platform's shared pool this is the platform's job; verify rather than assume.
• Blocklist status for domain and sending IPs via the blacklist checker. Note which lists: a hit on a widely consulted list is high severity, an entry on an obscure aggregator often is not.
• Stream separation. Marketing, transactional and corporate mail on distinct subdomains, so reputations are isolated and diagnosable; if everything sends from the root, record it as a structural finding.

Phase 3: reputation, from the receivers' mouths

You cannot query most filters, but you can collect every verdict that is published. Google Postmaster Tools is the anchor: domain reputation and IP reputation bands, plus your measured spam-complaint rate against Google's published 0.3% ceiling. If the domain isn't registered there, that is itself a finding, and registration only collects data going forward. Add Microsoft SNDS if you run your own IPs, note whether your platform consumes feedback loops where providers offer them, and pull your platform's complaint and bounce reporting for the trailing quarter. What you're assembling is the reputation picture the filters already have; the meaning of each band and signal is unpacked in sender reputation.

Phase 4: list and engagement metrics

The audit's least automated and most predictive phase, because list decay is upstream of most reputation damage. From your platform's data, establish four numbers and their 12-month trends:

1. Bounce rate, split hard versus soft; rising hard bounces mean acquisition or hygiene failure.
2. Complaint rate per campaign against the 0.3% ceiling, remembering the true rate is only measurable at Gmail via Postmaster Tools.
3. Engagement distribution: what share of the list has opened or clicked nothing in 90+ days, and whether those addresses are still being mailed; an absent sunset policy is a standard finding.
4. Acquisition quality: every list source, whether double opt-in gates it, and whether any imports of uncertain provenance exist, which is where spam traps come from.

Phase 5: placement observation

Finally, look at where mail actually lands: seed mailboxes you control at the major providers, a real campaign, results recorded per provider with the Promotions tab counted as inbox. The full method, and the honest limits of small-sample self-testing, are in how to check if emails go to spam. This phase turns the audit from a configuration review into a deliverability audit; a domain can pass phases one through four and still be spam-foldered at one provider for reputation reasons, and only observation catches it.

Turning findings into a repair sequence

Sort findings by a simple severity rule: anything that breaks authentication or violates a published provider requirement is critical; reputation and list findings are high; structural and content findings are medium. Then fix in that order, because the fixes compound downward, an authentication repair makes the reputation repairs legible to receivers. The repair playbook itself is how to improve email deliverability, and the deliverability troubleshooter walks the same diagnostic logic interactively if you want a guided pass.

Then put the audit on a clock. Configuration drifts, vendors change records, lists decay: the one-time audit becomes a quarterly light pass plus the standing monitoring in the email deliverability checklist. When to buy help instead: active blocklisting with unclear cause, a cold-start warming project at serious volume, or reputation damage that hasn't responded to a disciplined quarter of the repairs above. A consultant inherits a better project, and a smaller bill, when this audit is already done.

Related guides

• Email deliverability checklist — the recurring version of this audit, scheduled
• How to improve email deliverability — the repair playbook the findings feed
• Email deliverability score — phases 1 and 2 in a two-minute automated pass
• Deliverability troubleshooter — the guided interactive diagnostic
• How to check if emails go to spam — the placement-observation phase in depth
• Gmail sender requirements — the standard the audit measures against

About this guide

Written by InboxRatio Editorial. The procedure audits against the mailbox providers' published requirements and the protocol specifications; severity guidance is practitioner convention and labeled as such. The tools linked are our own free checkers, which read public DNS and message headers. No vendor sponsorship influences it.

Methodology

InboxRatio's benchmark applies the same discipline this audit teaches, controlled conditions, per-provider placement recorded, to the platforms we review; results feed the deliverability rankings as test cycles complete. This guide draws on provider documentation rather than our measurements; the protocol is in how we test and our source rules in sources.

Last updated

18 September 2026. Requirements audited against are reviewed quarterly.

Frequently asked questions

What is an email deliverability audit? A structured review of everything that determines where your mail lands: authentication (SPF, DKIM, DMARC), sending infrastructure and DNS, sender reputation, list health and engagement, and observed placement, producing a severity-ranked repair list.

Can I do a deliverability audit myself? Yes, for most senders. The checks run on free tools and your own platform's reporting, and this guide is the procedure. Complex cases, active blocklistings, large multi-domain estates, unresponsive reputation damage, are where paid expertise earns its fee.

How long does a deliverability audit take? Roughly an afternoon for one sending domain using this procedure: minutes per check in phases one and two, longer in the list and placement phases. The quarterly maintenance pass afterward is much shorter, per the checklist.

What tools do I need for a deliverability audit? DNS and authentication checkers (SPF, DKIM, DMARC, or the combined deliverability score), a header analyzer, a blacklist checker, Google Postmaster Tools, your platform's metrics, and seed mailboxes you control.

How often should I audit deliverability? Full procedure: on any platform or domain change, after any placement incident, and annually regardless. Light pass: quarterly, with the always-on monitoring (Postmaster Tools, bounce and complaint trends) catching drift between passes.

What does a deliverability consultant do differently? Largely this procedure with more experience reading ambiguous results, plus provider escalation experience and remediation management. Arriving with this audit complete makes their work faster and cheaper, and sometimes unnecessary.

The audit is just organized looking: five phases, free tools, one afternoon, one ranked list of what to fix. Open with the automated pass, the email deliverability score, and work the phases from there.