Deliverability is a list problem before it is a sending problem

Most outbound teams I look at have bought their infrastructure before they have looked at the list. Domains, mailboxes,
warm-up calendars, sending tools, a spreadsheet of sequences. The list — the thing that decides whether the first day of
a campaign produces replies or complaints — is checked last, if at all.

Authentication is the cheapest check in the stack: SPF, DKIM, a DMARC policy, a live address for the aggregate reports.
Google and Yahoo made it a requirement for bulk senders rather than a competitive edge, together with a complaint rate
under 0.3% and one-click unsubscribe. An afternoon of DNS work, and it is done.

After that, the failures stop announcing themselves. They arrive as bounces, as complaints, as a reply rate that looks
like a market problem but is a list problem.

The nine checks, in the order that removes risk

1. SPF and DKIM alignment — both records exist and the sending domain matches the From domain.
2. DMARC policy and reporting — a published policy with reports going somewhere a person reads.
3. Tracking-domain separation — clicks are rewritten to a CNAME on your own domain, not a shared vendor host.
4. One domain, one purpose — cold outreach, marketing and transactional mail on separate subdomains.
5. Root-domain folding — everything folded to the registrable domain before counting, or one company appears four times as www, as app, as a regional subdomain and as the root.
6. MX check per domain — a domain with no mail exchanger cannot receive the email being prepared for it.
7. Address-to-domain match — the address must belong to the domain it is filed under. This is the check that removes [e-mail] and addresses lifted from another company's page.
8. Role and pattern rejection — info@, support@, noreply@ separated rather than sent to.
9. Suppression and send caps — unsubscribes, bounces and previous non-replies subtracted before the batch is built, and a per-domain cap so the same company is not hit twice in a week.

What the numbers look like

These are our own prospecting numbers, not a client's. The working file holds 9,266 company domains, refreshed
19 September 2026. 1,358 of them carry a public address at all — 15%. Behind those addresses sit 1,358 domains, of
which 1,350 answer an MX lookup. The eight that do not would have gone out as part of a "verified" list.

The gap between 9,266 and 1,358 is the part people skip. Domain count is a sourcing metric. Address count is a sending
metric. They differ by a factor of seven.

Where the rows come from matters more than how many

Same checks, same budget, four source families, and the share of kept rows that carry a public address:

• agency directories — 60%
• package registries (NuGet, RubyGems, npm) — 15%
• GitHub repository homepages — 11%
• hiring feeds (Arbeitnow, HN Who is hiring) — 11%

An agency site is built to be contacted. An open-source project page links GitHub, not a sales team. The extraction rule
is identical in all four cases — take the domain from the post, never from the text — so the difference is the source,
not the method.

Yesterday's run added a new family to the file: application marketplaces. The Zapier directory exposes each app with a
structured vendor URL, which makes it the cleanest version of the rule so far. 3,000 applications gave 2,377 domains
that were not already in the file, 1,798 of them answered with a live site showing at least two product signals (76%),
and 1,538 survived once the threshold went to three signals (65%). That single pass was larger than any directory gave
us in a day — and it is also the weakest family on contacts, because the field is a website, not a mailbox.

The audit is a set of files, not an opinion

What comes out: an authentication report per sending domain, an MX report, three reject files (no MX, address-domain
mismatch, placeholder or role), a send plan with batch sizes and caps, a suppression list, and one call on the numbers.
Nothing in it is a promise about replies. A clean list removes bounces and complaints; whether a segment replies is a
question about the offer, and that is what a pilot is for.

The nine checks are written out, with the measured yields and the reject files, here:
Cold email deliverability audit — nine checks before the first send.