email-deliverability-audit

Email Deliverability Audit

If your positive reply rate is dropping and you don't know why, start here. Most of the time the problem is deliverability — your emails aren't reaching inboxes. This skill tells you what's broken.

What it checks

The 1% rule — and the floors that gate it

A healthy domain replies at 1% or better after 200 emails sent. Below 1% on a fair sample, something is broken, and if it stays broken the domain gets cancelled.

The 1% rule is one number: the same 1% that flags a domain here is the line that retires it in /inbox-lifecycle-manager. What separates "flag" from "cancel" is not a softer second threshold — it is the floors. Below a floor, the answer is "we don't know yet", which is a legitimate output rather than a failure.

Reporting 0.00% reply on 14 sends as a failure, or condemning a three-week-old domain that has not finished ramping, is how healthy domains get killed.

Possible causes when a domain is below the line (the audit's root-cause suggestions try to pinpoint which):

• Emails landing in spam — run the spam placement test
• Domain reputation damaged — check DMARC reports and the bounce codes
• Copy is broken — re-run /spam-word-checker; confirm with a control-fleet placement test
• List is cold or wrong ICP — check bounce rate; if >3%, the list is the problem, not the domain
• Inbox hasn't warmed enough — check warmup status and domain age

The domain-vs-copy isolation test

Low placement alone does not tell you whether the domain is burned or the copy is toxic. Run the same copy from a known-good control fleet:

When to use

• Reply rate dropped by >30% week-over-week → run the full audit
• Bounces spiked above 2% → run auth + spam-placement checks
• Before scaling a campaign (make sure infrastructure is ready)
• Monthly as routine hygiene
• When taking over a Smartlead account you didn't set up

Inputs

• SMARTLEAD_API_KEY (env)
• Optional: scope the audit
  • --client-id=X (for sub-clients)
  • --campaign-id=X (audit only one campaign's inboxes)
  • --domain=example.com (audit only one domain)
  • --tag=active (audit only inboxes tagged active)

Steps

1. Pull the inbox inventory

npx tsx scripts/audit-inboxes.ts --all --out=/tmp/audit/inboxes.csv

Outputs per inbox: id, email, domain, warmup_status, reputation, max_warmup/day, sent_today, smtp_ok, imap_ok, is_blocked, tags.

2. Check domain authentication

npx tsx scripts/check-domain-auth.ts --from-csv=/tmp/audit/inboxes.csv --out=/tmp/audit/auth.csv

For each unique domain, runs:

dig TXT <domain> +short                             # SPF
dig TXT _dmarc.<domain> +short                      # DMARC

# DKIM has NO single selector. Present if ANY of these resolves:
dig TXT   google._domainkey.<domain>    +short      # Google / Gmail-backed — the common one
dig CNAME selector1._domainkey.<domain> +short      # Microsoft 365 — a CNAME, TXT returns nothing
dig CNAME selector2._domainkey.<domain> +short      # Microsoft 365, second key
dig TXT   default._domainkey.<domain>   +short      # generic fallback, frequently empty

⛔ Never check default._domainkey alone. It is empty on most real fleets, and a default-only check reports every domain as "missing DKIM" — which routes genuinely burned domains to "fix your DNS" and wastes a week republishing records that already exist. The script tries all four and reports which one resolved.

Outputs: domain, spf_present, spf_strict, dkim_present, dmarc_present, dmarc_policy (none/quarantine/reject).

3. Pull sent + reply + bounce metrics per campaign/inbox

npx tsx scripts/audit-performance.ts --days=30 --out=/tmp/audit/performance.csv

Walks all active campaigns, pulls per-inbox analytics for the last 30 days. Output columns: inbox_id, email, domain, type, tags, sent, replies, bounces, reply_rate_pct, bounce_rate_pct, flag_low_reply, flag_high_bounce.

Flagged automatically:

• flag_low_reply = TRUE if sent ≥200 and reply_rate_pct < 1.0 (the 1% rule)
• flag_high_bounce = TRUE if sent ≥50 and bounce_rate_pct > 3.0

4. (Optional) Run a Smart Delivery spam placement test

npx tsx scripts/run-spam-test.ts --campaign-id=12345 --senders=100 --out=/tmp/audit/spam-test.json

This creates a real inbox-placement test via Smartlead's Smart Delivery API:

• Uses the only available provider pools: G Suite + Office365 (provider_ids 20, 21)
• Sends to ~200 seed mailboxes with 100 of your senders
• Waits for completion (5-20 min)
• Pulls: providerwise, spam-filter-details, dkim-details, spf-details, blacklist

Output shows: what % lands in Inbox vs Spam vs Promotions, broken down by your sender and the receiver provider. This is the ground truth.

5. Synthesize the report

Read the three CSVs (inboxes.csv, auth.csv, performance.csv) plus the spam-test JSON if you ran one, and write the report by hand in this shape. There is no generator script; the synthesis is the judgment call, and the template below is what it should look like:

# Deliverability Audit — 2026-04-17

## Summary

- 80 inboxes audited across 40 domains
- 3 inboxes blocked (4% of fleet)
- 5 domains missing DKIM
- 2 domains with DMARC policy=none (no enforcement)
- Fleet performance (last 30d):
    Sent:           42,384
    Replies:          523
    Overall reply rate: 1.23% (PASS — above 1% threshold)
    Bounces:           382
    Bounce rate:      0.90% (PASS — below 2%)
- 4 inboxes failed the 1% rule (sent ≥200, reply rate <1%)
- Spam placement (test run): 83% inbox / 14% spam / 3% tabs (ACCEPTABLE but not great)

## Critical issues (fix within 24h)

1. Domain trygrowth.co has no DMARC record. Add: v=DMARC1; p=none; rua=mailto:[email protected]
2. Inbox [email protected] blocked in warmup — likely flagged by warmup network. Rotate out of campaigns.
3. 12 inboxes have 0 daily sent today despite being in active campaigns. Check campaign schedule.
4. Inbox [email protected] failed the 1% rule: 347 sent, 1 reply (0.29% reply rate). Investigate:
   - Check spam placement for this inbox
   - Compare copy vs. a sibling inbox that's passing
   - Rotate inbox out if bad reputation is confirmed

## Warnings (fix within 1 week)

- 5 domains missing DKIM record at default._domainkey
- 3 inboxes reputation dropped "fair" → "bad"
- Spam filter trigger DKIM_INVALID firing 8% of the time — likely for a subset of domains

## Action items (prioritized)

1. [HIGH] Add missing DKIM records to: trygrowth.co, othergrow.co, ...
2. [HIGH] Rotate out blocked inboxes: [email protected], [email protected], ...
3. [MED] Tighten DMARC to p=quarantine on all domains after 2 weeks of p=none observation
4. [MED] Replace 3 bad-reputation inboxes (tag them "retired", provision new)
5. [LOW] Re-run spam placement test after fixing DKIM issues

6. Act on the action items

Feed the action items into the right skills:

• Missing DKIM / SPF → /zapmail-domain-setup-public to reconnect domains through Zapmail
• Blocked inboxes → /smartlead-inbox-manager to tag "retired" and rotate in insurance
• Campaign schedule issues → Smartlead campaign schedule settings
• Bad copy flagged → /spam-word-checker on the campaign copy

Interpreting the numbers

Bounce rates

• <1% — Excellent. Healthy list.
• 1-2% — Normal for cold. No action.
• 2-3% — Yellow. Check list quality, might be old emails.
• >3% — Red. Verify the list (MillionVerifier), consider pausing.
• >5% — Stop immediately. You're damaging domain reputation.

Spam placement

• >90% inbox — Great. Ship more.
• 85-90% inbox — Healthy. This is the line a domain must clear to be considered good metal.
• 70-84% inbox — Degraded. Look at spam-filter-details to see what's triggering.
• <70% inbox — Red, and a hard gate: do not attach this domain to a campaign. Pause and fix auth + copy before sending more.

Test with 100-300 senders. Smaller samples swing by double digits run to run.

DMARC policies

• None — Acceptable for first 2 weeks of a domain's life. After that, tighten.
• Quarantine — Recommended long-term. Emails that fail auth land in spam.
• Reject — Strictest. Only use after 30+ days of clean rua= reports confirming all legitimate mail passes.

Warmup reputation

• Smartlead reports reputation as 0-100. Higher is better.
• ≥98% — required before promoting a reserve inbox into a live campaign.
• 80-98% — sending is fine, but don't promote fresh reserves at this level.
• 50-80% — keep warming, don't use for critical sends.
• <50% — don't send from this inbox; warmup peers aren't seeing it in their inboxes.

⚠️ Warmup switched OFF is not a reputation of zero — it is no reading at all. An inbox with warmup off reports nothing, so it cannot be evaluated. Treat it as held: out of capacity, not attached to campaigns, reported for a human. Do not silently turn warmup back on to make a number appear — that rewrites the signal you are trying to measure.

Common root causes

• SPF too lax — v=spf1 +all whitelists everyone. Use v=spf1 include:zapmail.com ~all or similar.
• DKIM missing — new domain, selector not published. Zapmail publishes at default._domainkey by default.
• DMARC alignment failure — From-domain doesn't match SPF/DKIM domain. Usually a misconfigured reply-to or a 3rd-party sender.
• Too many inboxes per domain — Gmail flags domains with >3-5 inboxes as suspicious. Keep it at 2/domain.
• Judging a domain that is too young or too quiet — under 30 days old or under 200 sends, the numbers cannot distinguish a burned domain from an unlucky week. This is not a root cause; it is the absence of evidence, and it is the single most common way a healthy domain gets killed.
• Aggressive warmup ramp — Jumping from 5 to 40/day in one week = flag. Ramp over 2-4 weeks.
• Shared sending IP with spam traffic — Zapmail/most providers use shared pools. If someone else on your IP spammed, you suffer. Not much to do except wait for pool rotation.

What to do next

If any flag fired: /deliverability-incident-response → triage decision tree for whatever was flagged (low reply rate, high bounce, blocked inbox, etc).

If a domain is confirmed burned: /inbox-lifecycle-manager → the cancel/promote/buy decision, with the guards that stop you cancelling into a send shortfall.

If all clean: next Monday, run this again. This audit is the Monday task in /cold-email-weekly-rhythm.

Or wait: if you just applied fixes, wait 7 days then re-audit. Reputation changes propagate slowly.

Related skills

• /smartlead-inbox-manager — execute the action items (rotate, retag, warmup settings)
• /zapmail-domain-setup-public — fix DNS/auth issues at the domain provider
• /spam-word-checker — check copy for spam-triggering phrases
• /deliverability-test-public — lighter-weight SMTP vs Gmail vs Outlook reply/bounce comparison
• /inbox-lifecycle-manager — acts on the verdict: cancel, promote reserves, plan the buy

Scripts

• scripts/audit-inboxes.ts — pull + format inbox inventory
• scripts/check-domain-auth.ts — dig-based SPF/DKIM/DMARC checks
• scripts/audit-performance.ts — per-inbox sent / replies / bounces / rates from campaign analytics (applies the 1% rule)
• scripts/run-spam-test.ts — create + poll + pull Smart Delivery test

References

• references/dns-records.md — SPF/DKIM/DMARC record templates + interpretation guide