Email Deliverability Audit
If your positive reply rate is dropping and you don't know why, start here. Most of the time the problem is deliverability — your emails aren't reaching inboxes. This skill tells you what's broken.
What it checks
| Layer | What | How |
|---|
| DNS auth | SPF, DKIM, DMARC present on each sending domain | dig commands |
| Inbox health | Warmup status, reputation, blocks, connection failures | Smartlead email-accounts API |
| Volume health | Daily sent trending, capacity utilization | Smartlead analytics |
| Send + reply rate per inbox | Sent count, reply count, reply rate % over lookback period | Smartlead campaign analytics |
| Bounce rate | Per-inbox and per-domain bounce rate over last 30 days | Smartlead campaign analytics |
| Spam placement | Real inbox-vs-spam test via Smartlead Smart Delivery | optional |
The 1% rule — and the floors that gate it
A healthy domain replies at 1% or better after 200 emails sent. Below 1% on a fair sample,
something is broken, and if it stays broken the domain gets cancelled.
The 1% rule is one number: the same 1% that flags a domain here is the line that retires it in
/inbox-lifecycle-manager. What separates "flag" from "cancel" is not a softer second threshold —
it is the floors. Below a floor, the answer is "we don't know yet", which is a legitimate
output rather than a failure.
| Judgment | Floor before it counts |
|---|
| Reply rate | 200 sends in the window |
| Bounce rate | 50 sends |
| Bounce composition (which bucket) | 30 classified bounces for that domain |
| Any cancel decision | 30 days of domain age; unknown age counts as young |
| Placement test | 100-300 senders per test |
Reporting 0.00% reply on 14 sends as a failure, or condemning a three-week-old domain that has
not finished ramping, is how healthy domains get killed.
| Reply rate (≥200 sends) | Reading |
|---|
| ≥ 1.5% | Genuinely good. Leave it alone. |
| 1.0 - 1.5% | Healthy. The rule passes. |
| < 1.0% | Burned. Hand to /inbox-lifecycle-manager — but only if it also clears the 200-send and 30-day floors. |
| 0 replies on ≥150 sends | Decisive. A flat zero needs less sample than a low-but-nonzero rate. |
Possible causes when a domain is below the line (the audit's root-cause suggestions try to
pinpoint which):
- Emails landing in spam — run the spam placement test
- Domain reputation damaged — check DMARC reports and the bounce codes
- Copy is broken — re-run
/spam-word-checker; confirm with a control-fleet placement test
- List is cold or wrong ICP — check bounce rate; if >3%, the list is the problem, not the domain
- Inbox hasn't warmed enough — check warmup status and domain age
The domain-vs-copy isolation test
Low placement alone does not tell you whether the domain is burned or the copy is toxic. Run the
same copy from a known-good control fleet:
| Your fleet | Control fleet | Verdict |
|---|
| < 100% | ~100% | Domain-side. Your sending infrastructure is the problem. |
| < 100% | < 100% | Copy. Rewrite before you replace a single domain. |
| ≥ 85% | ≥ 85% | Neither. Infrastructure is fine — this is targeting or offer. |
| control untestable | — | Assume copy. It is cheaper to fix and reversible. |
When to use
- Reply rate dropped by >30% week-over-week → run the full audit
- Bounces spiked above 2% → run auth + spam-placement checks
- Before scaling a campaign (make sure infrastructure is ready)
- Monthly as routine hygiene
- When taking over a Smartlead account you didn't set up
Inputs
SMARTLEAD_API_KEY (env)- Optional: scope the audit
--client-id=X (for sub-clients)--campaign-id=X (audit only one campaign's inboxes)--domain=example.com (audit only one domain)--tag=active (audit only inboxes tagged active)
Steps
1. Pull the inbox inventory
npx tsx scripts/audit-inboxes.ts --all --out=/tmp/audit/inboxes.csv
Outputs per inbox: id, email, domain, warmup_status, reputation, max_warmup/day, sent_today, smtp_ok, imap_ok, is_blocked, tags.
2. Check domain authentication
npx tsx scripts/check-domain-auth.ts --from-csv=/tmp/audit/inboxes.csv --out=/tmp/audit/auth.csv
For each unique domain, runs:
dig TXT <domain> +short # SPF
dig TXT _dmarc.<domain> +short # DMARC
# DKIM has NO single selector. Present if ANY of these resolves:
dig TXT google._domainkey.<domain> +short # Google / Gmail-backed — the common one
dig CNAME selector1._domainkey.<domain> +short # Microsoft 365 — a CNAME, TXT returns nothing
dig CNAME selector2._domainkey.<domain> +short # Microsoft 365, second key
dig TXT default._domainkey.<domain> +short # generic fallback, frequently empty
⛔ Never check default._domainkey alone. It is empty on most real fleets, and a
default-only check reports every domain as "missing DKIM" — which routes genuinely burned
domains to "fix your DNS" and wastes a week republishing records that already exist. The script
tries all four and reports which one resolved.
Outputs: domain, spf_present, spf_strict, dkim_present, dmarc_present, dmarc_policy (none/quarantine/reject).
3. Pull sent + reply + bounce metrics per campaign/inbox
npx tsx scripts/audit-performance.ts --days=30 --out=/tmp/audit/performance.csv
Walks all active campaigns, pulls per-inbox analytics for the last 30 days. Output columns: inbox_id, email, domain, type, tags, sent, replies, bounces, reply_rate_pct, bounce_rate_pct, flag_low_reply, flag_high_bounce.
Flagged automatically:
flag_low_reply = TRUE if sent ≥200 and reply_rate_pct < 1.0 (the 1% rule)flag_high_bounce = TRUE if sent ≥50 and bounce_rate_pct > 3.0
4. (Optional) Run a Smart Delivery spam placement test
npx tsx scripts/run-spam-test.ts --campaign-id=12345 --senders=100 --out=/tmp/audit/spam-test.json
This creates a real inbox-placement test via Smartlead's Smart Delivery API:
- Uses the only available provider pools: G Suite + Office365 (provider_ids 20, 21)
- Sends to ~200 seed mailboxes with 100 of your senders
- Waits for completion (5-20 min)
- Pulls: providerwise, spam-filter-details, dkim-details, spf-details, blacklist
Output shows: what % lands in Inbox vs Spam vs Promotions, broken down by your sender and the receiver provider. This is the ground truth.
5. Synthesize the report
Read the three CSVs (inboxes.csv, auth.csv, performance.csv) plus the spam-test JSON if you
ran one, and write the report by hand in this shape. There is no generator script; the synthesis
is the judgment call, and the template below is what it should look like:
# Deliverability Audit — 2026-04-17
## Summary
- 80 inboxes audited across 40 domains
- 3 inboxes blocked (4% of fleet)
- 5 domains missing DKIM
- 2 domains with DMARC policy=none (no enforcement)
- Fleet performance (last 30d):
Sent: 42,384
Replies: 523
Overall reply rate: 1.23% (PASS — above 1% threshold)
Bounces: 382
Bounce rate: 0.90% (PASS — below 2%)
- 4 inboxes failed the 1% rule (sent ≥200, reply rate <1%)
- Spam placement (test run): 83% inbox / 14% spam / 3% tabs (ACCEPTABLE but not great)
## Critical issues (fix within 24h)
1. Domain trygrowth.co has no DMARC record. Add: v=DMARC1; p=none; rua=mailto:dmarc@trygrowth.co
2. Inbox sales@trygrowth.co blocked in warmup — likely flagged by warmup network. Rotate out of campaigns.
3. 12 inboxes have 0 daily sent today despite being in active campaigns. Check campaign schedule.
4. Inbox marketing@other.co failed the 1% rule: 347 sent, 1 reply (0.29% reply rate). Investigate:
- Check spam placement for this inbox
- Compare copy vs. a sibling inbox that's passing
- Rotate inbox out if bad reputation is confirmed
## Warnings (fix within 1 week)
- 5 domains missing DKIM record at default._domainkey
- 3 inboxes reputation dropped "fair" → "bad"
- Spam filter trigger DKIM_INVALID firing 8% of the time — likely for a subset of domains
## Action items (prioritized)
1. [HIGH] Add missing DKIM records to: trygrowth.co, othergrow.co, ...
2. [HIGH] Rotate out blocked inboxes: sales@trygrowth.co, marketing@other.co, ...
3. [MED] Tighten DMARC to p=quarantine on all domains after 2 weeks of p=none observation
4. [MED] Replace 3 bad-reputation inboxes (tag them "retired", provision new)
5. [LOW] Re-run spam placement test after fixing DKIM issues
6. Act on the action items
Feed the action items into the right skills:
- Missing DKIM / SPF →
/zapmail-domain-setup-public to reconnect domains through Zapmail
- Blocked inboxes →
/smartlead-inbox-manager to tag "retired" and rotate in insurance
- Campaign schedule issues → Smartlead campaign schedule settings
- Bad copy flagged →
/spam-word-checker on the campaign copy
Interpreting the numbers
Bounce rates
- <1% — Excellent. Healthy list.
- 1-2% — Normal for cold. No action.
- 2-3% — Yellow. Check list quality, might be old emails.
- >3% — Red. Verify the list (MillionVerifier), consider pausing.
- >5% — Stop immediately. You're damaging domain reputation.
Spam placement
- >90% inbox — Great. Ship more.
- 85-90% inbox — Healthy. This is the line a domain must clear to be considered good metal.
- 70-84% inbox — Degraded. Look at spam-filter-details to see what's triggering.
- <70% inbox — Red, and a hard gate: do not attach this domain to a campaign. Pause and fix
auth + copy before sending more.
Test with 100-300 senders. Smaller samples swing by double digits run to run.
DMARC policies
- None — Acceptable for first 2 weeks of a domain's life. After that, tighten.
- Quarantine — Recommended long-term. Emails that fail auth land in spam.
- Reject — Strictest. Only use after 30+ days of clean
rua= reports confirming all legitimate mail passes.
Warmup reputation
- Smartlead reports reputation as 0-100. Higher is better.
- ≥98% — required before promoting a reserve inbox into a live campaign.
- 80-98% — sending is fine, but don't promote fresh reserves at this level.
- 50-80% — keep warming, don't use for critical sends.
- <50% — don't send from this inbox; warmup peers aren't seeing it in their inboxes.
⚠️ Warmup switched OFF is not a reputation of zero — it is no reading at all. An inbox with
warmup off reports nothing, so it cannot be evaluated. Treat it as held: out of capacity, not
attached to campaigns, reported for a human. Do not silently turn warmup back on to make a number
appear — that rewrites the signal you are trying to measure.
Common root causes
- SPF too lax —
v=spf1 +all whitelists everyone. Use v=spf1 include:zapmail.com ~all or similar.
- DKIM missing — new domain, selector not published. Zapmail publishes at
default._domainkey by default.
- DMARC alignment failure — From-domain doesn't match SPF/DKIM domain. Usually a misconfigured reply-to or a 3rd-party sender.
- Too many inboxes per domain — Gmail flags domains with >3-5 inboxes as suspicious. Keep it at 2/domain.
- Judging a domain that is too young or too quiet — under 30 days old or under 200 sends, the
numbers cannot distinguish a burned domain from an unlucky week. This is not a root cause; it is
the absence of evidence, and it is the single most common way a healthy domain gets killed.
- Aggressive warmup ramp — Jumping from 5 to 40/day in one week = flag. Ramp over 2-4 weeks.
- Shared sending IP with spam traffic — Zapmail/most providers use shared pools. If someone else on your IP spammed, you suffer. Not much to do except wait for pool rotation.
What to do next
If any flag fired: /deliverability-incident-response → triage decision tree for whatever was flagged (low reply rate, high bounce, blocked inbox, etc).
If a domain is confirmed burned: /inbox-lifecycle-manager → the cancel/promote/buy decision, with the guards that stop you cancelling into a send shortfall.
If all clean: next Monday, run this again. This audit is the Monday task in /cold-email-weekly-rhythm.
Or wait: if you just applied fixes, wait 7 days then re-audit. Reputation changes propagate slowly.
Related skills
/smartlead-inbox-manager — execute the action items (rotate, retag, warmup settings)/zapmail-domain-setup-public — fix DNS/auth issues at the domain provider/spam-word-checker — check copy for spam-triggering phrases/deliverability-test-public — lighter-weight SMTP vs Gmail vs Outlook reply/bounce comparison/inbox-lifecycle-manager — acts on the verdict: cancel, promote reserves, plan the buy
Scripts
scripts/audit-inboxes.ts — pull + format inbox inventoryscripts/check-domain-auth.ts — dig-based SPF/DKIM/DMARC checksscripts/audit-performance.ts — per-inbox sent / replies / bounces / rates from campaign analytics (applies the 1% rule)scripts/run-spam-test.ts — create + poll + pull Smart Delivery test
References
references/dns-records.md — SPF/DKIM/DMARC record templates + interpretation guide