Almost every deliverability failure we investigate traces back to a step that was skipped before the first message ever left the domain, not something that went wrong mid-campaign. Inbox providers are not evaluating your email in isolation; they are evaluating the sender's entire history, and that history starts accumulating the moment DNS propagates. This is the checklist to run, in order, before a new sending domain touches a real prospect list.
1. Publish authentication before anything else
SPF, DKIM and DMARC are not optional hardening for later. Without them, a growing share of major inbox providers will silently fold your mail into spam regardless of content quality. SPF is a TXT record listing which servers are allowed to send as your domain. DKIM is a public key published at a selector subdomain that lets the receiving server verify a cryptographic signature on the message. DMARC sits on top of both, telling receivers what to do when SPF or DKIM fails, and where to send aggregate reports. Add MTA-STS if your provider supports it: it forces mail to your domain over encrypted, certificate-verified connections rather than falling back to plaintext.
Example DNS records
; SPF: one TXT record on the root domain
example.com. TXT "v=spf1 include:_spf.yourprovider.com ~all"
; DKIM: TXT record on the selector subdomain your provider assigns
selector1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEB..."
; DMARC: TXT record on the _dmarc subdomain
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100; adkim=s; aspf=s"
; MTA-STS: announces a policy; the policy body lives at a hosted URL
_mta-sts.example.com. TXT "v=STSv1; id=2026011401"2. Give the domain time to look real
- Register the domain 30 to 60 days before you plan to send from it. Brand-new domains with no history are treated as higher risk by default.
- Put up basic website content on the root domain. A blank page or parked-domain splash is itself a signal.
- Add MX records and a working mailbox before you send, even if you are sending from a subdomain, because receivers check that the domain can receive mail.
- Send from a dedicated subdomain (mail.example.com) rather than the root when volume is high, so a reputation problem never touches your primary corporate domain.
3. Ramp volume, never jump straight to it
A domain with perfect authentication and a cold sending history will still land in spam if it suddenly sends 500 messages on day one. Reputation is built from consistent, gradually increasing volume with strong engagement: opens, replies, and rare complaints. Start low, hold each step until engagement looks healthy, and only then increase.
Week1
- Sends per mailbox / day
- 5-10
- Mix
- Internal or seed accounts only
Week2
- Sends per mailbox / day
- 15-25
- Mix
- Add a small, highly engaged external segment
Week3
- Sends per mailbox / day
- 30-50
- Mix
- Broaden the list; watch bounce rate closely
Week4
- Sends per mailbox / day
- 60-100
- Mix
- Approaching steady state
Week5
- Sends per mailbox / day
- 120-150
- Mix
- Full list eligible
Week6+
- Sends per mailbox / day
- 150-200
- Mix
- Steady state; monitor placement weekly from here on
| Week | Sends per mailbox / day | Mix |
|---|---|---|
| 1 | 5-10 | Internal or seed accounts only |
| 2 | 15-25 | Add a small, highly engaged external segment |
| 3 | 30-50 | Broaden the list; watch bounce rate closely |
| 4 | 60-100 | Approaching steady state |
| 5 | 120-150 | Full list eligible |
| 6+ | 150-200 | Steady state; monitor placement weekly from here on |
4. Verify the list before the domain touches it
- Run syntax and MX validation on every address. A list with more than 2 to 3% invalid addresses will damage a warming domain fast.
- Flag catch-all domains separately; they accept anything at the SMTP layer but tell you nothing about deliverability.
- Strip role-based addresses (info@, support@, admin@); they skew complaint rates and rarely convert.
- Deduplicate across lists and check every address against your suppression list before the first send.
- Segment by engagement history if you have it, and send the warming domain's early volume only to your best-performing segment.
5. Content and headers that don't read as automated
- Keep a healthy image-to-text ratio. A message that is mostly one large image reads as promotional to content filters.
- Use one link per early message, not a shortened redirect chain. Link reputation matters as much as domain reputation.
- Set a real, consistent From name and a working Reply-To address; mismatched or rotating sender identities are a strong spam signal.
- Include a clear, working unsubscribe or opt-out path even outside jurisdictions that require it. Complaint rate is one of the heaviest-weighted signals major inbox providers use.
6. Monitor after you send, not just before
Deliverability is not a one-time setup task. Check blocklist status daily during warmup, run periodic seed-list placement tests to see which folder you actually land in, and categorize every bounce rather than treating them as one undifferentiated failure rate. A rising soft-bounce rate on day three of a ramp is an early warning that is easy to miss if you're only watching the top-line send count.
The pull-back rule
If bounce rate crosses roughly 3 to 5% or spam complaints cross roughly 0.1% at any point in the ramp, cut volume in half immediately and hold for 48 hours before resuming. Don't wait for the weekly review.
The one-page version
- SPF, DKIM, DMARC (and MTA-STS if supported) published and verified before the first send
- Domain aged at least 2 to 4 weeks with basic website content and working MX
- Six-week volume ramp planned and scheduled, not improvised
- List verified for syntax, MX, catch-alls, role addresses and duplicates
- Consistent From name, working Reply-To, one link, real unsubscribe path
- Daily blocklist checks and bounce categorization for the first 60 days