Email deliverability audit checklist: what to check and what to ask for
A useful email deliverability audit connects a reported problem to message evidence, the sending setup and a practical next step. Use this checklist to prepare your team, compare proposals or agree the scope with a specialist.
- What should an email deliverability audit include?
- It should define the affected messages and sending routes, check authentication on real messages, examine available mail-flow and filtering evidence, and compare affected and unaffected examples. The output should separate confirmed findings from hypotheses and give each recommended change an owner and a way to verify it.
Start with a business question you can investigate
“Our deliverability is poor” is difficult to test. “Proposals sent through our CRM have appeared in junk at two customer organisations since Monday” gives an investigator a route, a symptom and a time window. Record the original observation before introducing a suspected cause.
Identify who is affected and what is at stake. Separate proposals, invoices, support messages and prospecting sequences. Agree which domains, platforms, regions and message types belong in the assessment. An investigation into a CRM sending route does not automatically cover every application using the company domain.
If you only have a delivered status and no recipient evidence, begin with our guide to email delivered but missing from the inbox. If there are signs of unauthorised sending or account compromise, involve your security team immediately. A deliverability assessment is not a substitute for incident response.
The checklist: evidence, purpose and limits
| Check | Evidence to request | What to establish |
|---|---|---|
| 1. Scope and timeline | Affected message types, first observed date, recent changes and a named business owner. | A clear question and a defined investigation boundary. |
| 2. Sending routes | Domains, mailboxes, CRM or sequencer connections, relays and application owners. | Which system sends each message type and who can supply evidence. |
| 3. Authentication | Current records and received authentication results from each route in scope. | Whether the actual messages authenticate and align, rather than whether records merely exist. |
| 4. Mail flow | Message IDs, timestamps with time zones, sending events and available receiving-side traces. | Where a message was accepted, delayed, rejected or held. Record any missing visibility. |
| 5. Filtering and policy | Received headers, quarantine reasons and relevant policy or rule details. | Which control acted on a sample and whether other explanations need testing. |
| 6. Message and audience | Comparable versions, links, attachments, recipient environments and relevant sending history. | Whether the pattern follows a route, sender, message condition or recipient group. |
| 7. Campaign controls | Where outreach is in scope, list sources, exclusions, opt-out handling, bounce handling and sending limits. | Whether the operation respects agreed exclusions and platform rules. |
| 8. Findings and validation | Evidence references, confidence, priorities, owners and proposed follow-up checks. | What the team should do first and how it will assess the effect. |
Check real messages as well as the configuration
A record in DNS shows published configuration. It does not show that every CRM, support platform or sequencer uses the intended route. Ask for received samples from each agreed route and check the authentication result against the visible sender identity. A passing result still does not promise inbox placement. Microsoft explains the role and limits of email authentication (opens in a new tab).
Ask which logs the administrator can obtain and which questions they answer. Exchange Online message trace (opens in a new tab) provides message-processing events. Google Workspace Email Log Search (opens in a new tab) supports delivery investigations in that environment. Access to the sender’s tenant does not confer access to a customer’s tenant.
Keep a record of gaps. A recipient who cannot share a header leaves a different level of certainty from a recipient whose administrator supplies the filtering verdict. The report should explain that difference.
Prepare a small evidence pack
Use this list internally with the people authorised to provide evidence. An initial website enquiry only needs an outline of the problem.
The business owner supplies
- A short description of the symptom and when it began
- The message types and teams affected
- A record of what changed recently
- The questions the assessment must answer and who will act on the findings
The administrator supplies through an agreed process
- An inventory of the sending routes in scope
- A small set of affected and comparable unaffected examples
- Relevant message IDs, timestamps, errors and trace details
- Received headers or policy evidence where available, with unnecessary personal data removed
Questions to ask before commissioning an audit
Ask what evidence the investigator needs, how they will get it and what happens if it is unavailable. The proposal should identify the access route and distinguish read-only investigation from implementation. Guided sessions or administrator-provided exports may suit the work better than a new account.
Ask how a finding will become a decision. A list of warnings is less useful than an explanation of the affected route, the evidence supporting the conclusion, the change proposed and the person who can authorise it.
Ask which deliverables you can use without buying further services. Agree the report, technical specification, findings discussion and any testing in writing. If remediation is optional, that should be clear before the assessment starts.
Agree how results will be measured. A seed test records outcomes for its test accounts. An open rate does not independently establish inbox placement. A useful comparison states what was tested, what changed and which uncertainty remains.
What an actionable finding looks like
| Part of the finding | Example wording |
|---|---|
| Observation | Messages from one application have a different authentication result from messages sent directly. |
| Evidence and limit | The supplied samples show the difference. Other applications and recipient organisations have not yet been tested. |
| Next step | The application owner and mail administrator review the configured sending route against the intended design. |
| Change control | Any correction needs an approved specification, a named implementer and a rollback plan. |
| Verification | Repeat comparable messages through the affected route and inspect the received results. Report placement separately from authentication. |
Using the checklist for an agency client
An agency can use the checklist to turn a vague client concern into a bounded brief. Agree who owns the client conversation, who obtains administrator evidence and whose approval is required before anything changes.
Keep the agency’s commercial proposal separate from the technical findings. A suspected cause should remain a hypothesis in the client explanation until the evidence supports it. This makes it easier to recommend proportionate work and explain what is outside scope.
Questions about commissioning an audit
Is a DNS or blacklist check enough?
It can identify a useful lead, but it does not examine the whole message journey. An audit should relate any warning to the actual sending route, affected messages and recipient evidence. A listing or a clean result alone is not a complete diagnosis.
Can our IT team carry out the checks?
Yes. This checklist can structure an internal investigation. Specialist support is useful when evidence spans several platforms, the problem recurs or the team needs an independent interpretation and written plan.
Does an audit include fixing the problems?
Only if the written scope includes implementation. Neotiqa’s assessment is read-only, with remediation and monitoring available as separate engagements. Your team can act on the findings and specification.
What should we include when asking for a quote?
Describe the affected platforms, approximate scope and observed symptom, and say whether you are enquiring for your own business or an agency client. Do not submit passwords, contact lists or confidential email samples through the form.
Need a clear scope for your investigation?
Tell us what is happening and which systems are involved. We will discuss the evidence, the scope and whether an assessment is the right next step.