Email deliverability audit: the six steps, and the one most audits rush

You craft a cold email campaign with care. Strong subject line, genuine personalization, perfect send time. And yet: 18% bounces, replies that never come, and your domain's sender reputation slowly deteriorating.

The problem isn't your sequence. It's your data.

An email deliverability audit is how you find out where the problem actually sits. It checks, in order, whether receivers can authenticate you, how they rate your domain, where your messages land, and whether the addresses on your list still exist. Most audits spend an hour on DNS records and one line on the list. This one does the opposite on the step where the data decides: bounce rate by source, verification at send time, and what enrichment changes, with numbers.

Below: the signs that call for an audit, the six steps, a summary table you can work from, how long it takes and who should run it, and how to fix what it finds.

What is an email deliverability audit?

An email deliverability audit is a one-off review of everything that decides whether your emails reach the inbox: authentication records, sender reputation, inbox placement, list quality, content and engagement. It ends with a verdict per area and a short list of fixes, ranked by what each problem costs you today.

It is not the same thing as monitoring. Monitoring is the recurring work you do every week or month, the controls listed in our email deliverability checklist. An audit is the deep pass you run once, when something has gone wrong or before something big, and it is what tells you which recurring controls you were missing.

Email deliverability is the ability of an email to reach the recipient's inbox - rather than being rejected, filtered to spam, or silently dropped.

It depends on several metrics tied to your sender reputation:

A single send with a high bounce rate can be enough to tip your domain into blacklists maintained by Spamhaus, Barracuda, or Microsoft. And once blacklisted, recovery is slow and costly.

The good news: the vast majority of bounces are preventable - as long as you address data quality before hitting send.

Signs you need an email deliverability audit

A deliverability problem rarely announces itself. It shows up as a handful of small signals that are easy to explain away one at a time. When two or more of these appear together, stop sending to the full list and run the audit first.

• Hard bounces climbing on a list you thought was clean, or a bounce warning from your sending platform.
• Spam complaints appearing where there were none, even a few per campaign.
• Open rates falling across every campaign at once, not on one subject line. Opens are a noisy metric since mail privacy features started preloading images, so what counts is a sudden drop across providers, not the absolute number.
• Replies drying up while volume and targeting have not changed.
• Your own test messages landing in spam or in a promotions tab on Gmail or Outlook.
• Your domain or sending IP listed on a public blocklist.

There is also a good reason to audit when nothing is wrong yet: right before a change that puts reputation at risk. A new sending domain, a new sequencing tool, a large imported list or a jump in volume are all moments where an email deliverability audit costs a day and saves a quarter. If you already track outbound performance, bounce rate belongs with the other data enrichment KPIs on your dashboard: it is usually the first of these signals to move.

Why your lists degrade (even when you don't notice)

B2B contact databases decay faster than most teams realize. Industry research consistently shows that a database loses between 25 and 30% of its validity every year. In practice, a list built 18 months ago likely contains 35 to 40% of addresses that have since become invalid or risky.

The causes are well-documented:

Job changes are the primary driver of list decay. An SDR who adds a prospect to a CRM in March may find that person at a completely different company by November - with a brand-new email address. The old one bounces, but it's still sitting in your list.

Corporate restructuring - acquisitions, mergers, rebranding - can invalidate entire domains overnight. Hundreds of addresses become unreachable in a single event.

Catch-all domains are particularly deceptive. These mail servers technically accept every email sent to their domain, including messages to non-existent mailboxes. The result: no immediate bounce, but messages that disappear into a void. Nearly impossible to detect without deeper verification.

Manual data entry creates a slow accumulation of errors: typos, inconsistent formats, copy-pasted data from multiple sources. According to HubSpot, sales teams waste an average of 27% of their time dealing with poor-quality data.

Without regular enrichment, these issues compound silently - until the day deliverability collapses.

How to run an email deliverability audit, step by step

Run the steps in this order. Each one rules out a cause before the next one looks at it: there is no point testing inbox placement if receivers cannot authenticate you, and no point rewriting copy while a fifth of the list bounces.

Step 1: Check authentication (SPF, DKIM, DMARC)

Receivers first ask whether you are allowed to send for your domain. SPF lists the servers that may send for it, DKIM signs each message so it cannot be altered on the way, and DMARC tells receivers what to do when the first two fail, and where to send reports. Gmail and Yahoo have required all three from bulk senders since February 2024. In the audit, check that each record exists, that every tool sending on your behalf (CRM, sequencer, help desk, invoicing) is covered, and that DMARC sends its reports to an address someone actually reads. The free lookup below reads the SPF record published on any domain and counts its DNS lookups against the limit of ten.

A record above ten lookups returns a permanent error and receivers treat your SPF as absent, with no bounce and no warning. The full reading of a record, and the ways back under the ceiling, are on our SPF record check page.

Step 2: Read your sender reputation

Reputation is the score mailbox providers keep on your domain and sending IPs, built from bounces, complaints and engagement. Read it where the providers publish it: Google Postmaster Tools for Gmail, Microsoft SNDS for Outlook if you send from your own IPs, and the main public blocklists for your domain and IP. Write down the verdict and the trend over the last 30 days. A poor reputation is a symptom, not a cause: the later steps of the audit are where you find out what produced it.

Step 3: Test inbox placement with a seed list

A seed list test sends one real campaign to a set of test mailboxes spread across providers (Gmail, Outlook, Yahoo, corporate gateways) and reports where each copy lands: inbox, promotions, spam or nowhere. It is the only step that measures placement directly instead of inferring it. Run it with your real sending setup and real copy, not a test template, and run it twice on different days before concluding: a single seed test is a sample of one.

Step 4: Audit the list itself

This is the step most audits cover in one line ("clean your list") and the one that decides the most. Bounces, spam traps and a good share of complaints all start in the list. Measure the bounce rate per data source, flag role and disposable addresses, separate catch-all results, and check the age of every verification. We go through it in depth in the next section, because it is where enrichment changes the numbers.

Step 5: Review content and compliance

Content rarely sinks a clean sender on its own, but it can tip a fragile one. Check the ratio of links to text, the domains you link to (a shortener or a domain with its own poor reputation hurts you), image-only emails, heavy tracking, and a working unsubscribe link. For commercial email to US recipients, CAN-SPAM requires a valid postal address and an opt-out honored within ten business days, so check both appear in every template.

Step 6: Look at engagement

Mailbox providers watch what recipients do with your messages: replies, deletions without reading, moves out of spam, complaints. Pull reply rate and complaint rate per campaign and per segment over the last 90 days. Segments that never engage are a reputation cost: retire them or re-confirm them before the next send rather than mailing them by habit.

The email deliverability audit at a glance

Use this table as the working sheet of the audit. It lists what to look at and what a problem looks like; the numeric thresholds live in the deliverability checklist, and the tools for each check in our guide to email deliverability tools.

Step 4 of the email deliverability audit, in depth: the list

Authentication and reputation tell you how receivers see you. The list tells you why. Every hard bounce is an address that should never have been sent to, and the bounce rate is the one metric in the whole audit you control entirely before the send.

Measure bounce rate by data source, not overall

An overall bounce rate of 6% says the list is a problem. It does not say which part. Tag every contact with where it came from (a trade-show scan, a CRM export from two years ago, a LinkedIn or Sales Navigator export, a purchased file, inbound sign-ups) and compute hard bounces per source on your last two or three campaigns.

In most audits one or two sources produce most of the bounces. The old CRM segment and the event list are the usual suspects, because nobody has verified them since the day they were collected. That changes the fix. Instead of re-verifying everything, you verify and re-enrich the sources that bounce, and you add a verification step at the entry point of each source so the problem does not come back.

In the Derrick web app, add a source column to the list before you run Email Verification: the status comes back on each row, so the risk per source is a simple pivot. The same works in the Google Sheets sidebar if your list already lives in a sheet.

Role, disposable and catch-all addresses

Three kinds of address pass a basic syntax check and still hurt you. Role addresses (info@, sales@, contact@) are shared inboxes: they are read by whoever is on duty, rarely reply and complain more readily, so keep them out of cold outreach and find the named contact instead. Disposable addresses come from temporary inbox services used to get past a sign-up form; they die within hours or days and should simply be removed. Catch-all domains accept every address at the server, so no verifier can confirm the mailbox behind them: treat the result as unknown rather than valid, and send to those addresses in small batches you can watch.

A verification that labels each address with one of these categories turns the list review from a guess into a sort. Here is what enrichment adds on top of that sort.

Data enrichment isn't just about adding a phone number or job title to a contact. In the context of email deliverability, it plays three distinct and complementary roles.

1. Real-time validation: filter before you send

Before any address enters a sending sequence, email verification qualifies it across multiple categories:

• Valid: the address exists and accepts messages
• Invalid: the address doesn't exist or the domain is dead
• Catch-all: the domain accepts everything but the mailbox can't be confirmed
• Disposable: a temporary address created to bypass signup forms
• Spam trap: a honeypot address placed by anti-spam organizations

This qualification happens through SMTP checks (does the server respond?), MX record lookups (is the domain properly configured to receive mail?), and known pattern databases.

Derrick's Email Verifier runs this check in real time at the moment of enrichment, in the web app or in Google Sheets. Every address is qualified before it enters a campaign - which eliminates avoidable bounces at the source.

2. Email finding: replace rather than delete

An invalid address in your database isn't necessarily a lost prospect. An email finder can locate the new professional address of a contact whose old one has bounced.

The process is straightforward: using the prospect's name and their current company domain (updated via their LinkedIn profile, for example), the tool reconstructs the address based on the company's email pattern. If mike.harris@old-company.com bounces but Mike has since moved to a new firm, enrichment can surface mike.harris@new-company.com - with built-in validation.

This shifts the logic from deletion (removing dead addresses) to recovery (finding the right contact again).

3. Normalization and deduplication: clean the foundations

Before validating, addresses need to be in a usable format. Data normalization corrects formatting errors - stray spaces, inconsistent casing, missing dots - while deduplication removes the duplicate entries that skew your stats and double the risk of spam complaints.

A prospect who receives the same email twice in the same campaign is three to four times more likely to click "Report as spam." And it's your sender reputation that pays the price.

Before vs. after: what the numbers show

Here's what enrichment actually changes on real deliverability metrics.

Typical scenario: a Growth Marketer prospecting 500 leads per month

Emma manages outbound prospecting for a B2B SaaS scale-up. Her contact base was built over 18 months from multiple sources: LinkedIn exports, Sales Navigator imports, manual entries from trade shows. Before enrichment:

After running the list through email verification and enriching invalid contacts with updated addresses:

Deliverability didn't improve because Emma rewrote her emails or changed her send times. It improved because the addresses she's sending to are real, active, and correctly formatted.

How to enrich your lists to improve deliverability: a step-by-step workflow

Here's the practical workflow to go from a degraded list to a clean, deliverable database.

Step 1: Audit your existing database

Before enriching, measure the actual state of your list. Send a neutral test message (a simple, non-commercial email) to a representative sample of 200 to 300 contacts. Analyze the bounces: hard bounces (address permanently invalid), soft bounces (temporary issue), or no delivery report at all.

This first diagnostic gives you a real decay rate to prioritize your enrichment effort.

Expected outcome: A segmentation of your database into healthy addresses, at-risk addresses, and addresses to replace.

Step 2: Bulk-verify existing addresses

For your existing addresses, run a batch email verification. In Derrick, this happens in the web app or in Google Sheets: paste your column of email addresses, run the Email Verifier, and each row receives a status (valid, invalid, catch-all, disposable).

See our detailed guide: How to verify your emails and clean your list

Expected outcome: Every address is qualified. You know exactly which ones to exclude from campaigns and which ones to enrich.

Step 3: Enrich contacts with invalid addresses

For contacts whose address has been flagged as invalid, don't delete them immediately. If you have the contact's name and current company, an email finder can recover their new professional address - with built-in validation.

Derrick's Lead Email Finder takes first name, last name, and company domain as input, and returns the valid professional address in the web app or in Google Sheets.

Expected outcome: A significant portion of "lost" contacts are recovered with a valid, up-to-date address.

Step 4: Normalize and deduplicate

Once valid addresses are in hand, run a normalization pass to correct inconsistent formats, then remove duplicates. Fix casing and stray spaces with LOWER() and TRIM(), then spot duplicates with Derrick's Find Duplicates in Google Sheets.

Expected outcome: A clean database, free of duplicates, with addresses in a consistent format.

Step 5: Set up a continuous enrichment process

One-time enrichment isn't enough. With 25 to 30% annual decay, an unmaintained list becomes problematic again within months. Best practice is to verify every new address before it enters a campaign, and re-verify active addresses every 3 to 6 months.

This can be automated via Zapier or Make integrations that trigger a Derrick verification every time a new lead enters your CRM.

Expected outcome: Deliverability that stays stable over time, without gradual degradation.

Verify at Send Time, Not at Import Time

One habit undoes most of the work described above, and it is almost universal: verifying a list once, at import, and treating the result as permanent.

An address is not a stable object. People change roles, companies restructure their mail routing, and mailboxes are deactivated on a schedule nobody outside the company knows. A verification result describes a moment, and the further you are from that moment the less it describes today. An address verified six months ago and left sitting in a CRM is, operationally, an unverified address wearing a green badge.

The practical rule is to attach a date to every verification and to re-check anything older than your sending cycle before it enters a campaign. At 1 credit per address, re-verifying a segment costs materially less than the deliverability damage from a single bounce spike, and it is the only step in the whole chain that directly protects the sender reputation everything else depends on.

The second habit worth adopting: never treat a catch-all result as a pass. A catch-all domain accepts everything sent to it, so no verifier can confirm an individual mailbox behind one. Sending to it is a calculated risk, and the calculation should be explicit rather than hidden behind a green checkmark.

How long an email deliverability audit takes, and who should run it

For a single domain sending from one or two tools, a first audit takes one to two working days of elapsed time, most of it waiting: DMARC reports arrive once a day, a seed test needs a real send, and the verification of a large list runs in the background. Hands-on time is closer to half a day. Add a day for each extra sending domain or brand, and more if nobody knows which tools send on the company's behalf, which is the most common finding of step 1.

Who should run it depends on where the problem sits. Steps 1 to 3 need someone with access to DNS and to the sending platforms: in a small team that is often the founder or the ops person, in a larger one IT and marketing ops together. Steps 4 to 6 belong to whoever owns the list and the campaigns, usually the growth or sales ops lead.

Do it yourself for almost everything, and especially for the list step: nobody outside your team knows where each segment came from or why it was collected. Bring in a specialist when you send from many domains, when you are already on a blocklist, or when reputation stays poor after the list is clean and authentication is correct. Those cases need someone who reads DMARC aggregate reports and deals with mailbox providers for a living.

As for frequency: a full email deliverability audit once or twice a year, one more after any incident or major change, and the recurring controls of the checklist in between. The time it saves your SDRs is easy to underestimate: every bounced or filtered sequence is research that has to be redone, which is where SDR productivity quietly leaks.

Fixing what the email deliverability audit finds

An audit is worth what you fix after it. Rank the findings by what they cost you now: anything that makes receivers reject or distrust you outright comes first, then what keeps bouncing, then what slowly wears reputation down.

Then re-run the steps that failed, not the whole audit: a second seed test after the authentication fixes, and the bounce rate per source on the next campaign. If reputation does not recover within a few weeks with a clean list and correct records, that is the case for outside help.

The list fixes pay twice. Fewer bounces protect the domain, and fewer dead addresses in the funnel lower your cost per lead and lift the quality of the leads that reach your sales team.

Mistakes that undo the fixes

Five habits undo the fixes above more often than any DNS error. Each one looks harmless on its own.

Problem 1: Sending without verifying addresses imported from LinkedIn or Sales Navigator

Impact: Even recent exports contain stale addresses. A 1,000-contact Sales Navigator export can include 15 to 20% invalid addresses if profiles haven't been recently updated. The result: bounce rate immediately above the critical threshold. Solution: Systematically run every new import through email verification before the first send.

Problem 2: Treating catch-all as valid

Impact: Catch-all domains return a false positive during verification - the server says "yes" even if the mailbox doesn't exist. Sending in volume to catch-all addresses generates silent bounces that don't surface immediately but steadily erode your reputation. Solution: Treat catch-all addresses as a risk category. Include them in small volumes initially to test real engagement before scaling sends.

Problem 3: Never re-verifying active addresses

Impact: A valid address today can become invalid in six months. A list that's never re-verified silently accumulates degraded addresses that blow up during the next send. Solution: Schedule quarterly verification on the oldest segments of your database.

Problem 4: Deleting all bounces without analyzing their type

Impact: Soft bounces (temporary issues: full inbox, server maintenance) are not invalid addresses. Immediately removing them means losing valid contacts. Solution: Distinguish hard bounces (remove immediately) from soft bounces (quarantine and retry after 5 to 7 days before making a final call).

Problem 5: Skipping deduplication before sending

Impact: A prospect who receives the same email twice in the same campaign is 3 to 4 times more likely to report it as spam - one of the most direct vectors of reputation damage. Solution: Deduplicate systematically before every import and before every export to your sending tool.

Key takeaways

• An email deliverability audit runs six steps in order: authentication, reputation, inbox placement, list, content, engagement.
• Measure bounces per data source: the list step is where most audits find the cause.
• A B2B database loses 25 to 30% of its validity per year - enrichment isn't optional, it's routine maintenance.
• Hard bounce rate must stay below 2% to avoid domain blacklisting.
• Catch-all domains are an invisible risk: they accept all emails but don't guarantee delivery.
• Enrichment isn't just about adding data - it's about recovering lost contacts with a valid, current address.
• Deduplication before sending is often overlooked but critical for sender reputation.
• Continuous enrichment (quarterly at minimum) beats a single annual cleanup every time.

We send one email every 2 weeks with what we measure on prospecting data and deliverability. Subscribe from the homepage, or see how clean data moves the rest of the funnel in our guide to the conversion impact of data enrichment.