Email Deliverability Audit: How to Scope a Recovery Project

An email deliverability audit is a bounded diagnostic that answers one question: why aren't your emails landing in the inbox? The audit inspects seven layers: authentication records, sender reputation, list quality, content and engagement, sending infrastructure, DNS and IT handoffs, and feedback loops. Run one the moment open rates drop more than 15% week over week, when Google Postmaster Tools or Microsoft SNDS flags your domain, or when a Gmail or Outlook block hits a campaign. The output is a 30/60/90-day recovery plan, not another A/B test on subject lines. Scope it tight. Hand it to a vetted email deliverability specialist. Measure recovery against inbox placement and revenue per send, not opens.

What is an email deliverability audit?

An email deliverability audit is a time-boxed technical review of every system that decides whether your email reaches the inbox. It covers authentication (SPF, DKIM, DMARC, BIMI), domain and IP reputation, list hygiene, engagement signals, sending infrastructure, and the DNS records your IT team controls. A vetted email marketer runs it in 7-10 business days.

That scope matters. A standard "email audit" from an agency usually reviews copy, segmentation, and lifecycle flows. A deliverability audit sits one layer below that. It assumes your copy is fine and asks why mailbox providers are rejecting, bulking, or throttling it anyway.

Expect three outputs from a good audit:

1. A current-state report naming every broken or at-risk signal.
2. A prioritized fix list with owners (marketing, IT, ESP vendor).
3. A 30/60/90-day recovery plan with acceptance criteria tied to Google Postmaster Tools and Microsoft SNDS data.

If the deliverable is a slide deck without named thresholds, send it back. The audit should give you specific targets: spam complaint rate below 0.1%, inbox placement above 95% for engaged segments, DMARC alignment at 100% for your primary send domain.

When to run one: five signals your sender reputation is in trouble

Run a deliverability audit when any one of five signals fires. A double-digit open-rate drop. A spam complaint rate above 0.3%. A Google Postmaster or Microsoft SNDS reputation flag. A direct mailbox-provider block. Or revenue per send falling faster than list size. Don't wait for all five.

The hardest trigger to catch is the slow bleed. Open rates can drift down over months as mailbox providers route more of your sends to Promotions, Updates, or Spam. By the time revenue per send drops 25%, your sender reputation has already been degraded for a quarter.

Signals to monitor weekly:

• Google Postmaster spam rate. Red zone starts at 0.3% per Google's bulk-sender rules.
• Microsoft SNDS color. Yellow or red on any IP you send from is a trigger.
• DMARC aggregate reports. A pct=100 policy with failing records on your own domain means someone (you or a spoofer) is sending unauthenticated email.
• Hard bounce rate. Above 2% on a cold or re-engagement campaign is a problem.
• Direct block messages. Look for 550 5.7.1, 421 4.7.0, or Spamhaus listings in your ESP's deferral or bounce logs.

Spamhaus and other block-list operators are the end state of a reputation problem, not the start. If you're on a list, you missed every earlier signal.

One more trigger: a cutover. If you migrated ESPs, changed sending domains, warmed a new IP, or let your marketing automation go unused for 90-plus days, run the audit before you resume volume. Dormant programs are the single biggest preventable source of blocks.

The 7 layers every audit must cover

A credible email deliverability audit inspects seven layers: authentication, reputation, list quality, content and engagement, infrastructure and IP, DNS and IT handoffs, and feedback loops. Each layer has distinct signals, distinct owners, and distinct fixes. Skip one and the recovery regresses within a quarter.

Here are the four highest-impact layers summarized. The remaining three sit in prose below the table.

Beyond those four, the audit also inspects:

Infrastructure and IP. Shared IP pools can drag your domain down when another sender on the pool misbehaves. Dedicated IPs need proper warmup: 50 sends on day one, doubled daily, per M3AAWG sender best practices. Audit your ESP's IP pool policy and your warmup plan if volume is above 100,000 per month.

DNS and IT handoffs. This is where most audits break down. Marketing owns the ESP. IT owns DNS. SPF, DKIM, and DMARC records live in DNS. A deliverability specialist writes the records, but an IT admin has to publish them. Scope the audit so IT is a named participant from day one, not an afterthought. If the handoff is the slow part, a marketing automation specialist with ESP-plus-DNS fluency can carry both sides.

Feedback loops and compliance. Yahoo, Microsoft, and Comcast publish feedback loops that forward subscriber spam complaints back to you. Register for each. Also confirm compliance with the FTC's CAN-SPAM guidance, GDPR for EU recipients, and Google and Yahoo's 2024 bulk-sender requirements (one-click unsubscribe, DMARC enforced, spam rate under 0.3%).

The authoritative reference for authentication is RFC 9989, the current DMARC specification published by the IETF in May 2026. If the audit cites older DMARC guidance without naming the RFC version, that's a signal the specialist hasn't kept current. The IETF DMARC working group tracks the latest.

The 30/60/90-day email deliverability recovery playbook

A deliverability recovery runs in three phases: stop the bleeding (days 0-30), rebuild reputation (days 30-60), and reinstate volume (days 60-90). Each phase has a single goal, a short list of actions, and a measurable exit criterion. Skipping phases is the fastest way to re-trigger the same blocks.

Days 0-30: Stop the bleeding

The goal in the first 30 days is to stop sending to recipients who are hurting your reputation and lock down the authentication records that let mailbox providers trust your mail. No volume growth, no new segments, no new campaigns beyond the recovery series.

1. Pause all sends to unengaged segments. "Unengaged" means no open or click in 90 days for B2B, 60 days for B2C.
2. Publish or correct SPF, DKIM, and DMARC records. Enforce DMARC at p=quarantine for a two-week observation window, then move to p=reject if reports are clean.
3. Register for feedback loops at Microsoft SNDS, Yahoo, and Comcast.
4. Register your sending domain in Google Postmaster Tools and verify the TXT record.
5. Exit criterion: spam complaint rate below 0.3% on all remaining sends; DMARC aggregate reports arriving daily with zero failing sources outside your known ESPs.

Days 30-60: Rebuild reputation

Phase two reactivates the segments that still have a pulse. Keep volume well below pre-incident levels. The goal is to earn back a "Medium" or better Google Postmaster domain reputation before you reinstate the suppressed list.

1. Launch a segmented re-engagement series to the "warm but quiet" audience (opened or clicked in 90-180 days). Max two emails, two weeks apart.
2. If sends come from a dedicated IP, run or extend an IP warmup following M3AAWG guidance.
3. Audit template HTML. Strip tracking pixels nested inside bare-link images, fix unbalanced text-to-image ratios, remove spam-trigger phrases flagged by your ESP's content scorer.
4. Review subject lines for the last 90 days against open-rate decile. Kill the bottom quintile.
5. Exit criterion: Google Postmaster domain reputation "Medium" or better; weekly open rate within 10% of the 12-month baseline.

Days 60-90: Reinstate volume

Phase three brings volume back and locks in the guardrails that prevent the next incident. The output of this phase is a documented runbook the lifecycle team can operate without the specialist in the room.

1. Bring suppressed segments back in slices of 10,000 recipients per week, highest-engagement first.
2. Document guardrails: suppression rules, complaint-rate thresholds that trigger an auto-pause, DNS change-management checklist.
3. Hand reporting over to the owner on your team (lifecycle marketer, marketing ops, or RevOps).
4. Exit criterion: inbox placement above 95% for engaged segments measured through a seedlist tool; revenue per send recovered to within 5% of pre-incident baseline.

If any exit criterion misses, don't advance. Stay in that phase another two weeks. Advancing with a yellow signal is how 60-day recoveries turn into 180-day ones.

Fractional vs full-time: who should run it

A fractional email deliverability specialist is the right hire for a bounded 30-90 day recovery project. A full-time email or lifecycle marketer makes sense when your program is healthy and you need ongoing campaign ownership. The two roles are not interchangeable, and conflating them is a $120,000 mistake.

The honest trade-off:

MarketerHire has placed senior email and lifecycle marketers across 30,000-plus matches with B2B SaaS, DTC, and services companies. The pattern across deliverability recoveries is consistent: the engagement starts fractional, resolves inside 90 days, and either ends or converts to a longer-term relationship for ongoing lifecycle work. If a Gmail block is live today, a vetted email marketer matched inside 48 hours beats a six-month search.

One caveat: if the problem is strategy, not execution, hire further up. A fractional CMO is the right call when a deliverability problem is actually a positioning problem (wrong audience, wrong offer, wrong frequency). The deliverability specialist cannot fix those from inside the ESP.

For the trade-off framing in detail, read MarketerHire's breakdown of fractional vs full-time vs agency and the practical how to hire an email marketer brief.

Email deliverability audit scoping brief you can hand to a specialist

The scoping brief below is what a specialist needs to quote the project, hit the ground running, and deliver against named acceptance criteria. Copy it, fill in the five bracketed fields, and send it with your discovery call. Expect a quote back in 48 hours.

Project scope

1. Audit the sending domain [your primary sending domain] and all subdomains with active email volume above 1,000 sends per month.
2. Review authentication records (SPF, DKIM, DMARC, BIMI) and align them with the current RFC 9989 DMARC specification.
3. Pull 90 days of sending data from [your ESP: Klaviyo, HubSpot, Marketo, Iterable, Customer.io, etc.] and reputation data from Google Postmaster, Microsoft SNDS, and seedlist tools.
4. Interview the IT lead who owns DNS and the lifecycle or ops lead who owns the ESP.

Deliverables

1. Current-state report naming every broken or at-risk signal across the seven audit layers.
2. Prioritized fix list with owners (marketing, IT, ESP vendor) and effort estimates.
3. 30/60/90-day recovery plan with phase-level exit criteria.
4. Written DNS record changes handed to IT in copy-paste format.
5. Weekly stand-up for the first 30 days; biweekly thereafter.

Acceptance criteria

1. Google Postmaster domain reputation at "High" by day 90.
2. Spam complaint rate below 0.1% on all engaged-segment sends by day 60.
3. Inbox placement above 95% for engaged segments by day 90.
4. DMARC enforced at p=reject with aggregate reports arriving daily and zero failing legitimate sources.
5. Revenue per send recovered to within 5% of the pre-incident baseline.

Access needed

1. ESP admin access, read-only reporting access, or screen-share for exports.
2. Google Postmaster Tools viewer access.
3. Microsoft SNDS access or an export of 90 days of data.
4. DNS admin introduction (a named contact, not credentials).
5. Last 90 days of campaign performance (CSV is fine).

Timeline and budget

• Audit phase: 10 business days.
• Recovery phase: 90 calendar days.
• Budget: $15K-$30K for a fractional specialist at 10-20 hours per week. Add 20% if the ESP migration or IP warmup is in scope.

Hand this brief to a vetted specialist and the first week is diagnostic, not scoping. That's the whole point of writing it down. If the scoping conversation itself takes a week, that's a signal the specialist is figuring out the audit on your time. The right hire has a template they adapt in a day.

Scope the audit, then hire the right specialist

The scoping brief above is the real deliverable of this guide. Fill in your sending domain, your ESP, your spam complaint rate from the last 90 days, and send it to a specialist who can quote against named acceptance criteria. If the quote comes back without a 30/60/90 plan and exit criteria, keep shopping.

No long-term contract. Two-week trial. Month-to-month after that. The 30,000-plus matches across email and lifecycle roles are the pattern recognition behind the match.