A cold email campaign checklist covers four things before launch: domain authentication (SPF, DKIM, DMARC), a warmed-up sending domain, a verified list, and content tested against spam filters. Skip any one of them, and the campaign’s results say more about the setup than the pitch.
TL/DR
- Authenticate the sending domain with SPF, DKIM, and DMARC, and check they’re aligned, not just present.
- Warm up a new or dormant domain before sending real volume. Don’t skip this step to hit a launch date.
- Verify the list and remove anything that will bounce. A clean small list beats a large dirty one.
- Test the actual draft against a spam checker before the first send, not after replies stop coming in.
- Set daily sending limits before you start, and watch bounce and complaint rates for the first week.
Most first campaigns fail quietly. Nobody tells you a message landed in spam. You just see a reply rate that doesn’t match the effort that went into the copy, and the instinct is to rewrite the pitch. Sometimes that’s the right call. Often the problem was never the words.
This is the checklist worth running through before the first send, in the order that actually matters.
Is the Sending Domain Authenticated?
SPF, DKIM, and DMARC are the baseline, and “set up” isn’t the same as “working correctly.” A record can exist and still fail.
SPF lists which servers are allowed to send on behalf of the domain. It breaks silently after 10 DNS lookups, a limit defined in RFC 7208, and it’s easy to cross once a domain sends through more than one or two tools. An SPF Records Checker will show the current record and flag whether it’s already close to that limit before it breaks something.
DKIM signs the message so a receiving server can confirm it wasn’t altered in transit.
DMARC ties the two together and tells inbox providers what to do when a message fails either check. Most senders start in monitor mode, p=none, which reports failures without blocking anything, then move to stricter enforcement once the reports look clean. A DMARC Record Generator builds a valid record for whichever policy stage the domain is ready for.
Checking all three exist isn’t enough. Check that SPF and DKIM are aligned with the actual From domain, not just passing for a platform’s default domain somewhere underneath. A quick way to confirm: send a test email to a Gmail address, open it, choose Show original, and read the authentication results at the top.
Is a New or Dormant Domain Actually Warmed Up?
A domain that has never sent mail, or hasn’t sent any in months, has no sending history for inbox providers to judge it by. That absence gets read as risk, not as a blank slate.
Warmup is the process of building that history before the real campaign depends on it: sending a gradually increasing volume to real inboxes, and generating genuine engagement, opens, replies, corrections out of spam, along the way. It takes real time, usually weeks, not days, and there’s no shortcut that compresses it without the domain paying for it later in poor placement.
If the launch date was set before anyone thought about warm-up, that’s worth raising now rather than after the first batch underperforms. A domain mid-warmup can still take a small, careful test send. It shouldn’t take the full campaign volume on day one.
Is the List Actually Clean?
A list built from scraping, old exports, or a vendor list has addresses that no longer exist, were never opted into anything, or were never real to begin with. Every one of those is a risk to the sending domain, not just a wasted send.
High bounce rates tell inbox providers the sender doesn’t know who they’re emailing. Spam traps, addresses planted specifically to catch bad list hygiene, do worse than bounce; they damage reputation directly. And people who never expected the email are the people most likely to mark it as spam.
Run the list through a verification tool before the first send, remove hard bounces immediately after, and drop anyone who shows zero engagement across the first few sends. A smaller, real list beats a larger one padded with addresses that were never going to reply.
Has the Actual Draft Been Tested Against Spam Filters?
This is the step people skip because it feels like the least important one, and it’s also the cheapest to do.
Subject lines with excessive punctuation or urgency language, link-heavy bodies, a heavy image-to-text ratio, and missing unsubscribe language all add risk. None of them are disqualifying on their own. Stacked together, they tip a borderline sender over the edge.
Paste the actual subject line and body into a free email spam checker before sending, not the sanitized version written for the brief. It won’t catch a reputation problem or a bad list. It will catch the content issues that are genuinely free to fix before they cost a reply.
Are Sending Limits Set Before Launch, Not After?
Volume is a signal on its own, separate from everything above. A domain jumping straight to campaign-level sending looks nothing like normal mailbox behavior, and inbox providers read that pattern as risk regardless of how clean the authentication or content is.
Set a daily sending cap per mailbox before the first send, and plan to raise it gradually rather than deciding in the moment. If the campaign runs across multiple mailboxes, stagger them instead of firing all of them at full volume on day one.
What to Watch in the First Week
The checklist doesn’t end at send. The first week of real data tells you whether everything above actually held up.
| Signal | What it tells you | Where to check it |
| Bounce rate | List quality and address validity | Sending tool’s campaign report |
| Spam complaint rate | Content and list fit, aim to stay under 0.1% | Sending tool or Google Postmaster Tools |
| Open rate by provider | Whether one inbox provider is filtering differently | Sending tool, segmented by domain |
| Reply rate | Whether the campaign is working, once deliverability is ruled out | Sending tool |
A sudden drop in any of these mid-campaign is worth stopping for, not pushing through. It’s cheaper to pause and diagnose than to keep sending into a domain that’s losing reputation with every batch.
The Full Checklist
| Step | Check | Fix if it fails |
| 1 | SPF, DKIM, DMARC published and aligned | Correct the DNS records, retest with a real send |
| 2 | Domain has sending history or is mid-warmup | Start or continue warmup before scaling volume |
| 3 | List verified, hard bounces removed | Re-run verification, drop unverifiable addresses |
| 4 | Subject line and body tested against a spam checker | Fix flagged content before sending |
| 5 | Daily sending limits set per mailbox | Set a cap and a ramp schedule before launch |
| 6 | Monitoring in place for bounce and complaint rate | Set up Postmaster Tools or sending-tool alerts |
Frequently Asked Questions
How long before launch should this checklist start?
Authentication and list verification can happen close to launch. Warmup can’t. If the domain is new or dormant, start that process at least two to four weeks before the planned send date.
What’s the single most common mistake on this list?
Skipping warmup to hit a launch date. It’s the step with no shortcut, and it’s also the one most likely to get compressed under deadline pressure.
Can a spam checker catch a reputation problem?
No. It only tests content, wording, links, and formatting. A domain can pass every content check and still land in spam because of reputation or list issues, which is why this is one step among several, not the only one.
What bounce rate is too high to launch with?
There’s no universal number, but a bounce rate climbing past 2 to 3% on a verified list is a sign something in the list or the sending setup needs attention before continuing.
Should every mailbox in a campaign send at the same volume?
Not necessarily. Staggering volume across mailboxes, rather than scaling all of them identically, spreads the risk and makes it easier to tell which mailbox, if any, is causing a placement problem.
Before You Hit Send
None of these steps are hard individually. The campaigns that struggle are usually the ones where one step got skipped under time pressure, almost always warm-up or the spam check, because neither one shows up as broken until the replies don’t come in.
Run through the checklist above in order. If something fails, fix it before moving to the next step rather than noting it and continuing.
Sources
