The B2B Email Deliverability Checklist for 2026

Nobody Talks About This

Everyone wants to talk about subject lines and open rates. Almost nobody wants to talk about whether their emails are actually reaching the inbox in the first place.

Deliverability is the plumbing of email marketing. Unsexy, invisible when it works, catastrophic when it doesn't. And since Google and Yahoo tightened their sender requirements in early 2024, the bar is higher than ever.

Here's the full checklist we follow at Veldspark — and the one we're building into ZenSendr so our users don't have to think about it.

Part 1: Authentication

If your emails aren't properly authenticated, inbox providers will either reject them outright or dump them in spam. There's no shortcut here.

SPF (Sender Policy Framework)

SPF tells receiving mail servers which IP addresses are allowed to send email on behalf of your domain.

Setup steps:

1. Identify every service that sends email from your domain (your app, your email marketing tool, Google Workspace, transactional email provider)
2. Create a TXT record in your DNS with all authorized senders
3. Example: v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all
4. Use ~all (soft fail) during testing, then switch to -all (hard fail) once confirmed

Common mistakes:

• Forgetting to include a sending service (your transactional emails fail SPF)
• Exceeding the 10 DNS lookup limit (SPF has a hard cap — use include sparingly)
• Using +all which authorizes literally everyone to send as your domain

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to your emails that proves they weren't tampered with in transit.

Setup steps:

1. Generate a DKIM key pair through your email provider's settings
2. Add the public key as a TXT record in your DNS (the provider gives you the exact record)
3. Your provider automatically signs outgoing emails with the private key
4. Verify with dig TXT selector._domainkey.yourdomain.com

Every sending service needs its own DKIM key. If you use Postmark for transactional and ZenSendr for marketing, both need separate DKIM records.

DMARC (Domain-based Message Authentication)

DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails.

Setup steps:

1. Start with a monitoring policy: v=DMARC1; p=none; rua=mailto:[email protected]
2. Monitor reports for 2–4 weeks to catch any legitimate senders failing authentication
3. Move to quarantine: v=DMARC1; p=quarantine; rua=mailto:[email protected]
4. Once clean, enforce: v=DMARC1; p=reject; rua=mailto:[email protected]

Do not skip the monitoring phase. Going straight to p=reject will block any legitimate email you forgot to authenticate.

Part 2: Domain Warm-Up

A brand new sending domain has no reputation. If you blast 10,000 emails on day one, every inbox provider will flag you as a spammer. Reputation is built gradually.

The 4-Week Ramp

Here's the warm-up schedule we recommend:

Rules During Warm-Up

• Only send to verified addresses. One hard bounce during warm-up does more damage than 10 hard bounces on an established domain.
• Encourage replies. Replies are the strongest positive signal to inbox providers. Ask a question. Make it easy to respond.
• Monitor daily. Check bounce rates, spam complaints, and inbox placement after every send.
• Don't send on weekends during warm-up. Volume drops look suspicious to filtering algorithms if your pattern is inconsistent.

Separate Domains for Outbound

If you do cold outreach, use a separate domain (e.g., mail.yourdomain.com or go.yourdomain.com). Never send cold emails from your primary domain. If the outbound domain gets burned, your company email and marketing sends are unaffected.

Part 3: List Hygiene

Bad lists kill deliverability faster than anything else. The numbers are straightforward:

• Bounce rate above 2% = inbox providers start throttling you
• Bounce rate above 5% = you're probably already in spam
• Spam complaint rate above 0.1% = Google will deprioritize your emails

Hygiene Practices

1. Verify before you send. Run your list through a verification service (ZeroBounce, NeverBounce, or the verification built into ZenSendr) before any campaign. Remove invalid, catch-all, and disposable addresses.
2. Remove non-engagers. If someone hasn't opened or clicked in 90 days, move them to a re-engagement segment. If they don't re-engage in 30 more days, remove them.
3. Honor unsubscribes immediately. Not in 24 hours. Not in "up to 10 business days." Immediately. Both CAN-SPAM and GDPR require it, and delayed unsubscribes generate spam complaints.
4. Watch for spam traps. Recycled email addresses that haven't been active in years are often repurposed as spam traps by ISPs. Regular list cleaning catches these.
5. Double opt-in for new subscribers. It adds friction, but it guarantees every address on your list is real and wanted. Worth it.

Part 4: Content Best Practices

Authentication and list hygiene get you to the inbox. Content keeps you there.

What Triggers Spam Filters

• Heavy image-to-text ratio. Emails that are mostly images with little text look like spam. Keep it balanced — at minimum, 60% text.
• Spam trigger phrases. "Act now," "limited time," "free money," "click here" — these phrases increase spam scores. Write like a human, not a late-night infomercial.
• URL shorteners. Bit.ly and similar shorteners are heavily abused by spammers. Use full URLs or branded short links.
• Missing unsubscribe link. Required by law, flagged by every major inbox provider. No exceptions.
• Attachments. Never send attachments in marketing email. Link to hosted files instead.

What Helps Deliverability

• Plain text version. Always include a plain text alternative alongside your HTML. Some filters penalize HTML-only emails.
• Consistent from-name and address. Don't rotate sender names to "test what works." Consistency builds recognition.
• List-Unsubscribe header. Add the List-Unsubscribe header so inbox providers can show a native unsubscribe button. This reduces spam complaints because people unsubscribe instead of reporting.

Part 5: Monitoring

Set up monitoring before you need it, not after your deliverability crashes.

Tools to Use

• Google Postmaster Tools — free, shows your domain reputation, spam rate, and authentication results for Gmail specifically. If you send to any Gmail addresses (you do), this is mandatory.
• MXToolbox — checks your DNS records, blacklist status, and email headers. Run a full domain health check monthly.
• Your ESP's analytics — bounce rates, complaint rates, and delivery rates per campaign. Set up alerts for anomalies.

Red Flags to Watch For

• Bounce rate suddenly above 2% on a previously clean list
• Open rates dropping by 20%+ across the board (could indicate inbox placement issues, not subject line problems)
• Delivery rate below 95%
• Any blacklist listing (check weekly via MXToolbox)

Why This Matters for ZenSendr

We're building all of this into ZenSendr so SMBs don't need to become deliverability experts. Automated authentication setup, built-in list verification, warm-up scheduling, and real-time reputation monitoring — all at a price point that doesn't require a CFO's approval.

But even with great tools, understanding the fundamentals matters. The checklist above is how you keep your emails out of spam and in front of the people who want to read them.