Email deliverability audit checklist: what actually breaks B2B sending domains

No error message tells you when deliverability breaks — replies just quietly drop. Here’s the checklist that actually catches it, and a 15-minute version you can run yourself with free tools.

Email deliverability doesn't fail loudly. There's no error dialog, no failed-build notification, no red banner in a dashboard. It fails as a slow, quiet decline in replies that's almost impossible to attribute to a cause unless you're specifically checking the infrastructure underneath your sending domain.

The checklist

1. SPF — valid, and under the 10-lookup limit

Exactly one SPF record, every mechanism accounted for, total lookups (including nested ones inside each include:) under 10. See our SPF lookup limit guide for the full walkthrough.

2. DKIM — valid selector, key present, not expired

Every service that sends on your behalf needs its own DKIM selector published and passing. A key that was valid at setup can silently break after a provider migration, a domain re-platform, or a certificate rotation nobody flagged as DKIM-relevant.

3. DMARC — record present, and actually enforcing

A DMARC record existing is not the same as it protecting anything. See our DMARC policy guide for why p=none is the default almost everyone gets stuck at.

4. MX records — correct and prioritized

Straightforward to set up once and easy to forget entirely — worth confirming after any provider migration, since a stale MX record can misroute inbound mail without affecting outbound sending at all, making it invisible until someone complains they never got a reply.

5. Blacklist status — across the major RBLs

Spamhaus ZEN, SpamCop, and Barracuda are the three most consequential lists for B2B mail. A listing after one bad campaign or a shared-IP neighbor's bad behavior can silently tank delivery rates until someone notices and requests delisting.

6. Sender reputation — IP and domain history

Past blacklist events, warm-up status for newer domains, and ESP-side sender score where the platform exposes one. This is the layer that explains why a technically-correct setup is still landing in spam for some recipients.

A 15-minute self-check with free tools

You don't need a paid tool to get a rough read on your own domain:

• MXToolbox — SPF record check (flags lookup count), MX lookup, and blacklist check against the major RBLs in one pass.
• Google Admin Toolbox — Check MX — a second, independent read on MX and basic authentication records.
• mail-tester.com — send a real test email to the address it gives you and get a scored breakdown of SPF, DKIM, DMARC, and content-level spam signals together.

Run all three, and you'll have a genuinely useful picture of where you stand — this is close to the first pass we run manually before writing up a formal report.

Where free tools stop, and what actually needs a person

The free tools above tell you pass/fail — and honestly, for a first read on your own domain, that's genuinely enough for a lot of teams. What they don't do is the part that actually matters once you know something's wrong: tell you which fix is safe to make first without breaking mail flow, cross-reference ESP-side reputation signals the public tools can't see, or make the change in your DNS for you. Reading the report was never the hard part; making the right change safely is.