How to Audit Your Cold Email Infrastructure in 30 Minutes

We ran a DNS audit across 1,000+ cold email domains at MailDeck. 67% had at least one critical authentication error. These are domains actively sending cold email with broken SPF records, missing DMARC policies, and misconfigured DKIM selectors. Every one of those errors silently kills inbox placement. Based on Q2 2026 MailDeck platform data from 3,000+ domains under management, the gap between a clean infrastructure audit and an ignored one is the difference between 98% inbox placement and 60-70% placement with accelerating domain burn.

I built the infrastructure behind MailDeck's 50M+ emails sent monthly. This cold email infrastructure audit is the exact process we use internally to verify that 833K+ managed inboxes are ready to send. It takes 30 minutes, uses free tools, and covers every layer that affects whether your email reaches the inbox.

What a Cold Email Infrastructure Audit Actually Covers

A cold email deliverability audit is broader than checking whether your emails "look right." Infrastructure is everything between your sending account and the receiving server's inbox placement decision. Your sequencer is a scheduler. The infrastructure underneath determines 60% of your deliverability outcome.

This 30-minute audit covers six layers:

Each layer has specific pass/fail thresholds. If any layer fails, everything downstream underperforms regardless of how good your copy or list targeting is.

Layer 1: Cold Email DNS Setup Check (8 Minutes)

DNS authentication is the foundation. If SPF, DKIM, or DMARC is misconfigured, receiving servers downgrade or reject your email before evaluating anything else. This is the highest-impact layer of any cold email infrastructure checklist.

In MailDeck's audit of 1,000+ domains, these were the ten most common DNS errors ranked by frequency:

67% of domains had at least one of these errors. Based on MailDeck DNS audit data across 1,000+ cold email domains, Q2 2026.

How to Check SPF, DKIM, and DMARC

Tools needed: MXToolbox, your DNS provider's dashboard

SPF check (3 minutes):

Go to MXToolbox SPF Lookup. Enter your sending domain. Verify:

A correct SPF record for Microsoft 365 looks like this:

```

v=spf1 include:spf.protection.outlook.com -all

```

A correct SPF record for Google Workspace:

```

v=spf1 include:_spf.google.com -all

```

If you use multiple sending services, combine them in one record:

```

v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all

```

DKIM check (2 minutes):

Use MXToolbox DKIM Lookup. Enter your domain and the DKIM selector (usually selector1 for Microsoft 365, google for Google Workspace).

DMARC check (3 minutes):

Use MXToolbox DMARC Lookup. Enter your domain.

A proper DMARC record:

```

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100

```

Google enforces DMARC compliance for bulk senders. Domains without a published DMARC policy face stricter filtering and higher spam placement rates. Reference: Google Email Sender Guidelines.

Layer 2: Domain Health Check (5 Minutes)

DNS records can be perfect and domain health can still be damaged. Domain reputation is a dynamic score that changes based on your sending behavior over time. This layer checks whether your domains are currently healthy.

Google Postmaster Tools Check

Google Postmaster Tools is the only authoritative source for your domain's spam rate at Gmail. Set it up for every sending domain.

If spam rate exceeds 0.3%, pause sending from that domain immediately. At MailDeck, we set the threshold at 0.3% as the domain burn indicator. Above this level, inbox placement degrades rapidly and domain recovery timelines extend from days to weeks. Based on monitoring across 3,000+ domains, Q2 2026.

Blacklist Check

Use MXToolbox Blacklist Check to verify your sending domain and IP against 80+ blacklists simultaneously.

Spam Score Test

Send a test email from each sending domain to mail-tester.com. This checks your email against SpamAssassin rules, blacklists, and authentication in a single pass.

Layer 3: Mailbox and Warmup Status Audit (5 Minutes)

Clean DNS and healthy domains mean nothing if your mailboxes are burned or warmup has degraded. This layer verifies that your actual sending accounts are in working condition.

Warmup Health Check

Log into your warmup tool (Smartlead, Instantly, or Plsuvibe) and check these metrics for every active mailbox:

MailDeck's warmup reference thresholds by inbox type:

Based on Q2 2026 MailDeck platform data from 833K+ managed inboxes.

A critical detail: only use Smartlead Premium, Instantly, or Plusvibe.ai warmup pools. Standard warmup pools can over-send and spike suspicion signals. A bad warmup pool is worse than no warmup because it can flag a healthy domain before you send a single cold email.

Mailbox Send Limit Check

Verify that your actual cold send volume per inbox per day matches your inbox type's safe threshold:

If your sequencer is pushing more cold emails per inbox per day than these thresholds, reduce immediately. Exceeding safe send limits is the fastest way to trigger inbox provider throttling and domain reputation damage.

Layer 4: IP Model Verification (3 Minutes)

Your IP model determines your baseline deliverability ceiling. This check takes 3 minutes and tells you whether your infrastructure has a structural risk you can't fix with better copy or lists.

Identify Your IP Model

Red Flags in IP Verification

For a deeper comparison of shared vs. dedicated IP models and how they affect cold email deliverability, see our full breakdown: Shared IP vs Dedicated IP for Cold Email: What Actually Affects Deliverability.

Layer 5: Sending Configuration Audit (5 Minutes)

Your sequencer settings can override everything else. Perfect DNS, healthy domains, and clean IPs still fail if the sending tool is configured to trigger spam filters.

Outlook-Specific Configuration Check

Outlook sends require the strictest configuration of any inbox type. Every item below is a pass/fail check:

One EdTech marketing agency running campaigns across Outlook and Google Workspace had open tracking enabled on all Outlook sends and links in every email body. They also used a shared SMTP provider for 30% of their volume.

After a full cold email infrastructure audit, they disabled tracking on Outlook, removed all body links from Outlook campaigns, and migrated to a dedicated diversified stack (Google Workspace + Outlook + Private SMTP with dedicated IPs). Inbox placement improved by 16 percentage points. The additional delivered emails generated $12K in incremental MRR.

Google Workspace Configuration Check

Google Workspace is more flexible, but still has configuration that matters:

Universal Send Timing Check

Regardless of inbox type, verify these settings in your sequencer:

Layer 6: List Hygiene Snapshot (4 Minutes)

The final layer checks whether your lead data will damage the infrastructure you just verified. Bad lists destroy good infrastructure faster than any misconfiguration.

Bounce Rate Check

Pull bounce rates from your sequencer for all active campaigns:

Verification Status Check

At MailDeck, campaigns auto-pause if reply rate drops below 1.5%. This protects domain health from list quality degradation. Based on operational thresholds across 833K+ managed inboxes.

The 30-Minute Cold Email Infrastructure Checklist

Here is the complete cold email infrastructure checklist consolidated into a single pass/fail table. Print this or save it. Run it every two weeks.

If all 24 checks pass, your infrastructure is ready for cold sending. Any single failure in checks 1-12 (DNS and domain health) should be fixed before sending another email. Failures in checks 13-24 (mailbox, configuration, lists) should be fixed within 24 hours.

What to Do When the Audit Finds Problems

Finding errors is the point. Here's the priority order for fixing what the cold email infrastructure audit reveals.

Priority 1: DNS Authentication Fixes (Fix Immediately)

DNS errors affect every email you send from that domain. Fix these before touching anything else.

At MailDeck, DNS propagation is verified end-to-end before the first email leaves any domain. Full onboarding including automated SPF, DKIM, and DMARC configuration takes 48 hours with verification at every step. This process produces 98% inbox placement from day one across all three infrastructure types (Microsoft 365, Google Workspace, Private SMTP). Based on Q2 2026 MailDeck onboarding data.

Priority 2: Domain Health Recovery (Fix Within 24 Hours)

Priority 3: Configuration and List Fixes (Fix Within 48 Hours)

Setting Up Recurring Cold Email Infrastructure Audits

A single audit snapshot is valuable. A recurring audit process protects your infrastructure continuously.

Recommended Audit Schedule

At enterprise scale (100K+ emails per month), 10-20% of domains burn monthly under active load. Regular audits catch degradation early before a domain's reputation drops past the recovery threshold. Across MailDeck's 3,000+ managed domains, continuous monitoring catches authentication issues within hours, preventing the cascading damage that a weekly or monthly check cycle would miss. Q2 2026 platform data.

Why Infrastructure Quality Determines Deliverability

Your sequencer is a scheduler. Your copy is a message. Your infrastructure is what carries that message from your mailbox to the recipient's inbox. Every layer of the cold email infrastructure audit directly impacts that journey.

MailDeck provides cold email infrastructure across Microsoft 365 Outlook, Google Workspace, and Private SMTP, managing 833K+ inboxes for 1,631+ clients. Every MailDeck inbox ships with automated SPF, DKIM, and DMARC configuration, DNS propagation verification before first send, and continuous domain health monitoring.

The difference in practice: MailDeck's Microsoft 365 Outlook tenants use individual Azure tenants with official Microsoft IP pools, whitelisted by default across virtually every receiving server. Warmup takes 3-7 days instead of 3-6 weeks on raw dedicated SMTP. Google Workspace inboxes run on official Google IP pools with the highest trust score of any sending infrastructure. Private SMTP uses dedicated IPs per client with zero shared IP risk.

For teams running their own audit and finding infrastructure gaps, the fix is either spending hours configuring DNS records, managing warmup pools, and monitoring domain health manually, or choosing infrastructure that handles all of this from day one. MailDeck's 48-hour onboarding with full DNS verification and 98% inbox placement rate reflects what a clean infrastructure audit looks like at scale.

FAQ

How do I check if my SPF, DKIM, and DMARC are set up correctly?

Use MXToolbox to query each record type for your sending domain. SPF: verify one record exists, ends with -all or ~all, and stays under 10 DNS lookups. DKIM: confirm a 2048-bit key is published at your selector. DMARC: check that a policy exists and is set to p=quarantine or p=reject. In MailDeck's DNS audit of 1,000+ domains, 67% had at least one critical authentication error, with multiple SPF records (23%) and missing DMARC (19%) as the most common failures. Q2 2026 data.

How often should I audit my cold email infrastructure?

Run a full cold email infrastructure audit every 2 weeks if you send more than 50K emails per month. Weekly checks on domain spam rate via Google Postmaster Tools and warmup reply rates are essential between full audits. At MailDeck, we monitor 3,000+ domains continuously and flag issues before they impact deliverability. Domain health can deteriorate within days if a sending pattern triggers spam filters.

What tools can I use to check my email deliverability?

Five free tools cover 90% of a cold email deliverability audit: MXToolbox for DNS record verification, Google Postmaster Tools for domain spam rate monitoring, mail-tester.com for spam score testing, Mailmeteor spam checker for copy analysis, and your sequencer's built-in analytics for bounce and reply rates. These tools combined take under 30 minutes to run across all your sending domains.

Why are my cold emails going to spam?

The most common cause is broken DNS authentication. In MailDeck's audit of 1,000+ cold email domains, 67% had at least one critical error: multiple SPF records (23%), missing DMARC (19%), SPF ending with +all (14%), or exceeding 10 DNS lookups (12%). Beyond DNS, shared IP pools, exhausted warmup, poor list hygiene (bounce rate above 5%), and tracking pixels in Outlook sends all trigger spam placement. Run the full 24-point checklist in this article to identify which layer is failing.

What happens if DMARC is not set up for cold email?

Without DMARC, your emails face stricter filtering and higher spam placement rates. Google enforces DMARC compliance for bulk senders and applies increased scrutiny to domains without a published DMARC policy. In MailDeck's DNS audit data, 19% of cold email domains had no DMARC record at all. Setting DMARC to at least p=quarantine signals to receiving servers that you take authentication seriously and improves inbox placement measurably.

Methodology

Data source: MailDeck platform data from 833K+ managed inboxes across 1,631+ clients, covering Microsoft 365 Outlook, Google Workspace, and Private SMTP infrastructure.

DNS audit sample: 1,000+ cold email domains audited for SPF, DKIM, and DMARC configuration errors. Error frequency percentages reflect the proportion of domains exhibiting each specific error.

Domain monitoring: 3,000+ domains under continuous management with SPF, DKIM, and DMARC verification.

Deliverability measurement: 98% inbox placement rate measured via seed list testing and Google Postmaster Tools integration.

Warmup thresholds: Derived from platform-wide warmup performance data across all three infrastructure types.

Client case study: EdTech marketing agency results (16% inbox placement improvement, $12K incremental MRR) reflect one client's specific migration outcome. Individual results vary based on prior infrastructure, sending behavior, list quality, and target audience.

Limitations: DNS error frequency data reflects the specific sample of 1,000+ domains audited and may not represent all cold email domains globally. Warmup timelines and send limits are guidelines based on aggregate platform data; individual inbox performance varies.

Last updated: April 2026

Written by Nikita Stoletov

CTO | Outbound Infrastructure & Deliverability Engineering

Built infrastructure delivering 50M+ emails monthly across 3,000+ domains with 98% inbox placement at MailDeck.

LinkedIn View Profile