Email Deliverability Audit: SPF, DKIM, DMARC and List Hygiene for US Businesses

An email campaign can have a strong offer, useful content and a clean design—and still underperform because messages are rejected, placed in spam or sent to people who no longer want them.

For US businesses, an email deliverability audit should answer three questions before the next major campaign:

1. Can mailbox providers verify who sent the message?
2. Does the list contain people likely to expect and value the email?
3. Can recipients unsubscribe easily, and does the business honor that choice?

Deliverability is not a switch that guarantees the inbox. Authentication, reputation, recipient behavior, content, infrastructure and provider-specific filtering all contribute. The goal is to remove preventable problems and build a measurable sending process.

1. Inventory every system that sends from your domain

Start with a sender map. Include the email marketing platform, CRM sequences, eCommerce notifications, sales outreach tools, customer-support system, scheduling platform and any website plug-in that sends mail.

For each source, record:

An old tool can continue sending after a campaign ends, creating authentication gaps and reputation risk. Do not publish DNS changes until legitimate senders are identified; removing an active platform from SPF or changing DMARC enforcement abruptly can disrupt valid mail.

2. Verify SPF, DKIM and DMARC

Google’s current email sender guidelines require SPF or DKIM for all senders to personal Gmail accounts. Senders exceeding 5,000 messages per day to Gmail accounts must use SPF, DKIM and DMARC, meet alignment requirements, use TLS, maintain valid DNS and support one-click unsubscribe for marketing and subscribed messages.

These controls have different jobs:

SPF: authorize sending systems

SPF lists the servers permitted to send mail for a domain. Audit the existing record for missing platforms, retired services, duplicate records and excessive DNS lookups. One accurate SPF record is better than adding new entries without understanding the existing chain.

DKIM: sign the message

DKIM adds a cryptographic signature that a receiving server can verify. Confirm that each important sending platform signs with a domain the business controls, not only a shared provider domain. Send test messages and inspect the headers rather than assuming that a dashboard toggle completed the setup.

DMARC: define alignment and reporting

DMARC checks whether the domain visible in the From address aligns with authenticated SPF or DKIM results. Start by collecting and reviewing reports, locate legitimate failures, and then plan enforcement based on evidence. Moving directly to a restrictive policy without a sender inventory can block real customer or sales email.

Authentication proves domain use; it does not prove the message is wanted. A fully authenticated campaign can still reach spam if recipients complain or ignore it.

3. Protect complaint rates and sender reputation

Gmail tells senders to keep the spam rate reported in Postmaster Tools below 0.3%. Yahoo’s sender best practices also call for authentication and a spam complaint rate below 0.3%.

Treat 0.3% as a boundary, not a target. The practical recommendation is to investigate upward movement before reaching it. Review complaints by list source, campaign, subject, offer and sending domain. Pause the segment creating disproportionate complaints while the acquisition and expectation problem is examined.

Sudden volume increases can also create instability. If a domain has been quiet, avoid sending the entire database in one day. Begin with recent, engaged recipients, keep volume predictable and expand only after checking bounces, complaints and provider feedback.

4. Audit list acquisition and hygiene

List quality begins before the address reaches the email platform. Record the page, form, event, checkout or sales process that collected each address and the permission or relationship associated with it.

Check for:

• purchased, scraped or poorly documented lists;
• role accounts and invalid addresses;
• hard bounces that were not suppressed;
• repeated soft bounces that need review;
• contacts imported without source or date;
• old unengaged recipients receiving every campaign;
• duplicate contacts across CRM and email systems;
• transactional customers added automatically to unrelated promotions.

Google recommends sending subscription email to people who want it, confirming addresses and periodically checking that recipients still want messages. A re-engagement campaign can help clarify interest, but repeatedly mailing inactive people is not a substitute for a clear retention policy.

For eCommerce teams, review automation audiences as carefully as newsletters. The Shopify abandoned-cart email audit explains how exclusions and purchase checks prevent irrelevant reminders.

5. Make unsubscribe handling immediate and consistent

Gmail’s bulk-sender rules require one-click unsubscribe headers for marketing and subscribed messages, plus a visible unsubscribe link in the body. That technical one-click function is separate from a preference-center page.

US businesses must also consider the FTC’s CAN-SPAM compliance guidance. It applies to commercial messages, including business-to-business email. The FTC requires accurate headers and subject lines, a valid postal address, a clear opt-out method and fulfillment of opt-out requests within 10 business days. Businesses remain responsible when a contractor sends on their behalf.

Operationally, suppression should happen much faster. Sync unsubscribes across the email platform, CRM and sales tools so another workflow does not restart promotional mail. Keep transactional messages separate and do not disguise advertising as an account notice. This is general marketing guidance, not legal advice; businesses should review their specific obligations with qualified counsel.

6. Test the complete path before launch

Send a controlled test to accounts at Gmail, Yahoo and the business’s own domain. Inspect the received headers and confirm:

• SPF, DKIM and DMARC results pass as intended;
• the From name, address and reply path are accurate;
• links use expected domains and resolve correctly;
• one-click and in-body unsubscribe methods work;
• the preference is written back to every relevant system;
• the physical address and required disclosures appear;
• the email renders on common mobile and desktop clients;
• hard bounces, complaints and delivery errors reach an owner.

A seed test cannot predict every recipient’s inbox placement, but it can expose configuration and workflow failures before a large send.

7. Measure business response, not open rate alone

Privacy features, image blocking and automated scanners make opens and clicks imperfect. Use them as directional signals, then connect email activity to real outcomes: enquiry, booking, qualified lead, purchase or unsubscribe.

The GA4 lead-tracking guide shows how to define meaningful website actions. The CRM follow-up automation guide covers ownership and next steps after a response.

For a hypothetical US professional-services firm, a useful weekly scorecard might show delivered messages, hard bounces, complaints, unsubscribes, consultation-page visits, booked consultations and qualified opportunities by campaign. That prevents a high open rate from hiding weak commercial response.

The practical takeaway

Before increasing email volume, confirm every sender, authenticate the domain, review DMARC reports, remove risky audience sources, make unsubscribe frictionless, test real inboxes and connect campaign response to CRM outcomes. Stronger deliverability is usually the result of consistent operational discipline—not one DNS record or subject-line trick.

You can build a free marketing action plan with three priority improvements, recommended channels and practical next steps, plus a free consultation.

Need a structured review of email authentication, list quality, automations and campaign measurement? Discuss email marketing and CRM automation with SW SOFTTECH. Share your sending platform, domain and primary campaign goal so the consultation can focus on the most material gaps.

Primary Google, Yahoo and FTC guidance checked October 20, 2026. Mailbox-provider requirements and enforcement practices can change. No configuration can guarantee inbox placement or campaign performance.