Skill: leooooooow/email-deliverability (version 1.1.0)

--- name: "Email Deliverability" description: "Audit and improve email deliverability for ecommerce marketing by diagnosing spam folder issues, list hygiene problems, authentication gaps, and sending reputation issues." version: "1.0" category: "ecommerce-marketing" tags: ["email", "deliverability", "spam", "authentication", "list-hygiene", "reputation"] --- # Email Deliverability Audit and improve email deliverability for ecommerce marketing. This skill provides a systematic framework for diagnosing why emails land in spam, identifying authentication gaps, cleaning subscriber lists, and repairing sending reputation to maximize inbox placement rates. --- ## Quick Reference Use this table to rapidly assess the current state of any deliverability dimension. | Decision Area | Strong | Acceptable | Weak | |---|---|---|---| | **Inbox Placement Rate** | >95% inbox placement across major providers | 85-95% placement with minor provider-specific issues | <85% placement or blacklisted at one or more major provider | | **Authentication (SPF/DKIM/DMARC)** | All three configured with DMARC at p=reject and aligned | SPF + DKIM in place, DMARC at p=none or p=quarantine | Missing one or more protocol, no DMARC, or misaligned records | | **Bounce Rate** | <1% hard bounces per campaign | 1-2% hard bounces, soft bounces under 5% | >2% hard bounces or >5% soft bounces per campaign | | **Spam Complaint Rate** | <0.05% (below 1 per 2,000 emails) | 0.05-0.08% with downward trend | >0.08% or rising trend (Google threshold is 0.10%) | | **List Hygiene** | Verified within 90 days, engaged segments defined, sunset policy active | Verified within 6 months, basic segmentation in place | No verification in 6+ months, no segmentation, no sunset policy | | **Sending Infrastructure** | Dedicated IP with warm-up complete, consistent volume, subdomain isolation | Shared IP with reputable ESP, moderate volume consistency | Unknown IP reputation, erratic volume, no subdomain separation | | **Content Quality** | Personalized, mobile-optimized, <0.1% spam trigger density, clear unsubscribe | Template-based with some personalization, visible unsubscribe | Heavy image-to-text ratio, spam trigger words, hidden unsubscribe | | **Engagement Metrics** | >20% open rate, >2.5% CTR, <0.3% unsubscribe rate | 15-20% open rate, 1.5-2.5% CTR, 0.3-0.5% unsubscribe | <15% open rate, <1.5% CTR, >0.5% unsubscribe rate | --- ## Solves This skill addresses the following ecommerce email marketing problems: 1. **Emails landing in spam or promotions tabs** -- Campaigns reach spam folders at Gmail, Outlook, or Yahoo despite legitimate content, reducing revenue from email marketing by 50-80%. 2. **Declining open and click-through rates** -- Engagement metrics drop over time as sender reputation degrades, list quality decays, or content triggers spam filters. 3. **Authentication failures and spoofing vulnerability** -- Missing or misconfigured SPF, DKIM, or DMARC records cause delivery failures and leave the domain open to phishing impersonation. 4. **High bounce rates damaging sender reputation** -- Accumulated invalid addresses, typo domains, and abandoned mailboxes generate hard bounces that erode IP and domain reputation with mailbox providers. 5. **Blacklisting and IP reputation damage** -- Sending IP or domain appears on one or more DNS-based blacklists (Spamhaus, Barracuda, SORBS), causing widespread delivery failures. 6. **Subscriber list decay and disengagement** -- Lists degrade at 25-30% per year through abandoned addresses, role accounts, and spam traps, dragging down overall deliverability. 7. **Inconsistent sending patterns triggering throttling** -- Irregular send volumes (e.g., nothing for weeks then a massive blast) cause mailbox providers to throttle or defer messages. --- ## Workflow ### Step 1: Baseline Deliverability Assessment Establish the current state by gathering quantitative data across all relevant dimensions. **Inputs needed:** - Access to ESP dashboard (Klaviyo, Mailchimp, Omnisend, etc.) - Domain and sending IP addresses - Last 90 days of campaign performance data **Actions:** 1. Pull inbox placement rates by provider (Gmail, Outlook, Yahoo, Apple Mail) using seed-list testing tools (GlockApps, Inbox Monster, or Everest). 2. Record aggregate open rate, click rate, bounce rate, unsubscribe rate, and spam complaint rate for last 90 days. 3. Check Google Postmaster Tools for domain and IP reputation status. 4. Run IP addresses against major blacklists: Spamhaus (SBL, XBL, PBL), Barracuda, SORBS, SpamCop, URIBL. 5. Document sending volume patterns over the last 90 days (daily/weekly volume graph). **Output:** A baseline scorecard with numeric values for each Quick Reference dimension. ### Step 2: Authentication Audit Verify that all email authentication protocols are correctly configured and aligned. **Actions:** 1. Query DNS for SPF record on the sending domain. Validate syntax, check for >10 DNS lookups, confirm the ESP's include is present. 2. Verify DKIM signing by sending a test email and inspecting headers. Confirm key length is 1024-bit or higher (2048-bit preferred). Verify alignment with the From domain. 3. Check DMARC record. Assess policy level (none/quarantine/reject), alignment mode (relaxed/strict), and reporting configuration (rua/ruf). 4. If applicable, check BIMI record and VMC certificate status. 5. Verify return-path/envelope-from alignment for SPF. 6. Test with MXToolbox, dmarcian, or mail-tester.com to get a composite authentication score. **Output:** Authentication status matrix. See `references/authentication-setup-guide.md` for remediation steps. ### Step 3: List Health Analysis Assess the quality, composition, and engagement profile of the subscriber list. **Actions:** 1. Export list with engagement data: last open date, last click date, total opens/clicks in 90 days, acquisition source, subscription date. 2. Segment the list into engagement tiers: - **Active**: Opened or clicked in last 30 days - **Lapsing**: Last engagement 31-90 days ago - **Inactive**: Last engagement 91-180 days ago - **Dead**: No engagement in 180+ days or never engaged 3. Identify risky address patterns: role accounts (info@, sales@, support@), disposable domains (guerrillamail, tempmail), known spam trap providers. 4. Run the list through a verification service (ZeroBounce, NeverBounce, BriteVerify) to flag invalid, catch-all, and risky addresses. 5. Calculate list decay rate and project forward 6 months. **Output:** List health report with segment sizes, risk flags, and recommended removals. See `references/list-hygiene-guide.md`. ### Step 4: Content and Technical Scan Evaluate email content for spam filter triggers and technical issues. **Actions:** 1. Analyze the last 10 campaigns for spam trigger patterns: - Subject line: ALL CAPS, excessive punctuation, urgency words ("Act now!", "Limited time!") - Body: image-to-text ratio (target >60% text), spam trigger word density, URL shorteners, excessive links - HTML: broken tags, excessive inline CSS, missing alt text on images, non-standard fonts 2. Check email weight (target <100KB total) and image hosting (external CDN vs. embedded). 3. Verify unsubscribe mechanism: one-click List-Unsubscribe header, visible footer link, functional processing. 4. Test rendering across top 10 email clients using Litmus or Email on Acid. 5. Verify plain-text MIME part exists alongside HTML. 6. Check for proper use of preheader text. **Output:** Content audit findings with specific fix recommendations per campaign template. ### Step 5: Sending Infrastructure Review Evaluate the technical sending setup and its impact on deliverability. **Actions:** 1. Determine IP type: dedicated vs. shared. If dedicated, assess warm-up status and age. 2. Review sending subdomain configuration (e.g., mail.store.com vs. store.com). Verify DNS records point correctly. 3. Analyze volume patterns: look for spikes >2x normal volume, gaps in sending, day-of-week distribution. 4. Check ESP configuration: throttling settings, retry logic, feedback loop enrollment with major providers. 5. Verify TLS encryption is enforced for transmission. 6. Review bounce handling: automatic suppression of hard bounces, soft bounce retry policy. **Output:** Infrastructure assessment with configuration recommendations. ### Step 6: Remediation Plan Prioritize and sequence fixes based on impact and effort. **Priority framework:** 1. **Critical (fix immediately):** Blacklist removal, authentication failures, >2% bounce rate 2. **High (fix within 1 week):** DMARC policy upgrade, list cleaning, bounce processing fixes 3. **Medium (fix within 2 weeks):** Content optimization, sunset policy implementation, sending pattern normalization 4. **Low (fix within 1 month):** BIMI setup, advanced segmentation, A/B testing framework **Actions:** 1. Create a sequenced action list using the priority framework. 2. For blacklist removal: identify the listing, follow the specific delisting process, document the cause and prevention measure. 3. For authentication: implement fixes per `references/authentication-setup-guide.md`. 4. For list hygiene: execute cleaning per `references/list-hygiene-guide.md`. 5. Establish sending calendar with consistent volume ramp. **Output:** Prioritized remediation plan with owners, timelines, and success criteria. ### Step 7: Monitoring and Continuous Improvement Set up ongoing monitoring to maintain deliverability gains. **Actions:** 1. Configure Google Postmaster Tools alerts for reputation changes. 2. Set up automated seed-list testing on a weekly cadence. 3. Implement real-time bounce and complaint monitoring with threshold alerts: - Bounce rate alert: >1.5% per campaign - Complaint rate alert: >0.05% per campaign 4. Schedule quarterly list hygiene reviews. 5. Create a monthly deliverability dashboard tracking all Quick Reference dimensions. 6. Document a runbook for common deliverability incidents (blacklisting, sudden reputation drop, provider-specific blocking). **Output:** Monitoring configuration and deliverability dashboard template. See `assets/quality-checklist.md` for ongoing audit use. --- ## Worked Examples ### Example 1: Fashion Ecommerce Brand with Gmail Spam Problem **Situation:** An online fashion retailer (250K subscriber list) using Klaviyo sees their Gmail open rates drop from 22% to 9% over 8 weeks. Their Black Friday campaign drove 40% of annual email revenue last year, and the holiday season is 10 weeks away. **Step 1 -- Baseline Assessment:** | Metric | Current Value | Target | |---|---|---| | Overall open rate | 12.4% | >20% | | Gmail open rate | 9.1% | >20% | | Outlook open rate | 18.7% | >20% | | Yahoo open rate | 16.2% | >20% | | Bounce rate | 3.2% | <1% | | Spam complaint rate | 0.12% | <0.05% | | List size | 248,600 | -- | | Last list cleaning | 14 months ago | Every 90 days | Google Postmaster Tools shows domain reputation as "Low" and IP reputation as "Medium." **Step 2 -- Authentication Audit:** - SPF: Present but includes 11 DNS lookups (exceeds 10-lookup limit). Fails intermittently. - DKIM: 1024-bit key, aligned. Functional but should upgrade to 2048-bit. - DMARC: `v=DMARC1; p=none;` -- No enforcement, no reporting configured. - Return-path: Misaligned (using Klaviyo default, not custom bounce domain). **Step 3 -- List Health Analysis:** | Segment | Count | Percentage | |---|---|---| | Active (30 days) | 62,150 | 25.0% | | Lapsing (31-90 days) | 49,720 | 20.0% | | Inactive (91-180 days) | 54,692 | 22.0% | | Dead (180+ days) | 82,038 | 33.0% | Verification service results: 8,400 invalid addresses (3.4%), 2,100 spam traps identified (0.84%), 4,200 role accounts (1.7%). **Step 4 -- Content Scan:** - Image-to-text ratio: 85% images, 15% text (too image-heavy) - Subject lines frequently use ALL CAPS and multiple exclamation marks - No plain-text MIME part in any campaign - List-Unsubscribe header missing; only a small footer link present - Average email size: 340KB (3.4x recommended maximum) **Step 5 -- Infrastructure Review:** - Shared IP through Klaviyo (acceptable) - Sending pattern: 2-3 campaigns per week, but skipped 3 weeks in August, then sent 5 campaigns in one week - Custom sending domain configured but bounce domain not set up **Step 6 -- Remediation Plan:** | Priority | Action | Timeline | Expected Impact | |---|---|---|---| | Critical | Remove 8,400 invalid addresses and 2,100 spam traps | Day 1 | Reduce bounce rate from 3.2% to ~1.5% | | Critical | Fix SPF record: flatten to reduce lookups below 10 | Day 1 | Resolve intermittent SPF failures | | High | Suppress 82,038 dead subscribers from regular campaigns | Day 2 | Reduce complaint rate, improve engagement ratios | | High | Configure DMARC reporting: add rua tag | Day 2 | Gain visibility into authentication failures | | High | Set up custom bounce domain in Klaviyo | Day 3 | Align return-path for SPF | | Medium | Redesign templates: 60/40 text-to-image ratio | Week 1-2 | Reduce spam filter scoring | | Medium | Add plain-text parts and List-Unsubscribe header | Week 1 | Improve Gmail compliance | | Medium | Implement sunset policy: suppress 180+ day inactives | Week 2 | Long-term list health | | Low | Upgrade DKIM to 2048-bit | Week 3 | Future-proof authentication | | Low | Move DMARC to p=quarantine after 30 days of monitoring | Week 4 | Strengthen domain protection | **Step 7 -- Results after 6 weeks:** | Metric | Before | After | Change | |---|---|---|---| | Overall open rate | 12.4% | 24.8% | +100% | | Gmail open rate | 9.1% | 22.3% | +145% | | Bounce rate | 3.2% | 0.6% | -81% | | Spam complaint rate | 0.12% | 0.03% | -75% | | Active list size | 248,600 | 156,200 | -37% (intentional) | | Revenue per email | $0.04 | $0.11 | +175% | --- ### Example 2: Supplement Brand Blacklisted After Migration **Situation:** A health supplements DTC brand (80K subscribers) migrated from Mailchimp to Omnisend. Two weeks after migration, delivery rates collapse. Customer service reports customers are not receiving order confirmations. **Step 1 -- Baseline Assessment:** | Metric | Pre-Migration | Post-Migration | |---|---|---| | Delivery rate | 97.8% | 72.4% | | Open rate | 24.1% | 8.3% | | Bounce rate | 0.8% | 11.6% | | Spam complaints | 0.03% | 0.22% | **Step 2 -- Authentication Audit:** - SPF: Old Mailchimp include still present, Omnisend include added. Record is valid but contains stale data. - DKIM: Mailchimp DKIM key still in DNS. Omnisend DKIM not yet configured -- emails are unsigned. - DMARC: `v=DMARC1; p=quarantine;` -- Emails failing DKIM are being quarantined by receiving servers. This is the primary cause of the delivery collapse. - Custom bounce domain: Not configured in Omnisend. **Step 3 -- List Health Analysis:** During migration, the full list was imported without suppression lists. Result: - 3,200 previously hard-bounced addresses reimported and mailed - 1,800 previously unsubscribed contacts reimported (CAN-SPAM violation risk) - 12,400 addresses inactive for 1+ year reimported and mailed in the first blast The initial Omnisend campaign was sent to all 80K contacts at once -- no warm-up on the new sending infrastructure. **Step 4 -- Content Scan:** - Transactional emails (order confirmations, shipping) are sending from the same domain and IP as marketing -- reputation damage is affecting transactional delivery. - Health supplement content includes terms frequently flagged by spam filters: "miracle," "guaranteed results," "doctor recommended," "free trial." **Step 5 -- Infrastructure Review:** - Omnisend shared IP pool: The brand's sending behavior has not yet been isolated, but volume spike triggered provider-level throttling. - IP check reveals listings on Spamhaus SBL and Barracuda BRBL. - No dedicated sending subdomain -- marketing and transactional both send from supplements-brand.com. **Step 6 -- Remediation Plan:** | Priority | Action | Timeline | |---|---|---| | Critical | Configure Omnisend DKIM signing immediately | Hour 1 | | Critical | Remove old Mailchimp SPF include | Hour 1 | | Critical | Reimport suppression lists: hard bounces, unsubscribes, spam complaints | Hour 2 | | Critical | Submit delisting requests to Spamhaus and Barracuda with evidence of corrective action | Day 1 | | Critical | Separate transactional emails to subdomain (transact.supplements-brand.com) with own authentication | Day 1-2 | | High | Suppress all 12,400 long-inactive contacts | Day 1 | | High | Begin IP warm-up: start with 500/day to engaged-only segment, double every 2-3 days | Day 2-14 | | Medium | Set up mail.supplements-brand.com for marketing sends | Week 2 | | Medium | Rewrite templates to remove spam trigger health claims | Week 2-3 | | Low | Implement engagement-based sending segments in Omnisend | Week 3-4 | **Results after 4 weeks:** - Delivery rate recovered to 96.2% - Delisted from both Spamhaus and Barracuda within 5 days of request - Transactional email delivery rate: 99.4% (isolated subdomain) - Open rate: 21.7% (approaching pre-migration levels) - Warm-up completed successfully, sending to 45K engaged subscribers --- ## Common Mistakes 1. **Sending to the entire list without segmentation.** Mailing 180-day-inactive subscribers alongside active ones drags down engagement ratios and trains mailbox providers to deprioritize your messages. Always segment by engagement recency and adjust frequency accordingly. 2. **Ignoring Google Postmaster Tools data.** Google processes ~30% of all email. If your domain reputation shows "Low" in Postmaster Tools, you have a Gmail problem regardless of what your ESP dashboard says. Check Postmaster Tools weekly at minimum. 3. **Flattening SPF records incorrectly.** When SPF exceeds 10 DNS lookups, some senders hardcode IP addresses to flatten it. This breaks when the ESP changes IPs. Use an SPF flattening service that auto-updates, or restructure includes to stay under the limit natively. 4. **Setting DMARC to p=reject before monitoring.** Jumping straight to a reject policy without first collecting aggregate reports at p=none will cause legitimate email from third-party senders (review request tools, loyalty platforms) to be silently rejected. Always start at p=none with rua reporting, then move to quarantine, then reject. 5. **Not migrating suppression lists during ESP changes.** When switching ESPs, the suppression list (hard bounces, unsubscribes, spam complaints) must transfer. Failing to do so means remailing people who already opted out or bounced, which causes immediate reputation damage and potential legal liability. 6. **Buying or renting email lists.** Purchased lists contain spam traps, invalid addresses, and unengaged recipients. Even a small purchased list segment (5-10% of total) can poison domain reputation for months. There is no legitimate shortcut to list building. 7. **Sending high-volume campaigns on inconsistent schedules.** Going from 0 sends in a week to 500K in a day triggers volume-based throttling at every major provider. Maintain consistent sending cadence and increase volume gradually (no more than 2x per week during ramp-up). 8. **Using URL shorteners in email body.** Bit.ly, TinyURL, and similar shorteners are heavily abused by spammers. Spam filters penalize their presence. Always use full, branded URLs or your own redirect domain. 9. **Neglecting the plain-text version.** Sending HTML-only emails without a plain-text MIME alternative raises spam scores. Every email should include a well-formatted plain-text part that mirrors the HTML content. 10. **Treating deliverability as a one-time fix.** Deliverability is an ongoing discipline. Lists decay at 25-30% per year, mailbox provider algorithms change, and sending patterns shift. Quarterly audits using the full workflow are essential to maintaining inbox placement. --- ## Resources - **Google Postmaster Tools** -- https://postmaster.google.com -- Free domain and IP reputation monitoring for Gmail delivery. - **MXToolbox** -- https://mxtoolbox.com -- DNS lookup, blacklist checking, SPF/DKIM/DMARC validation. - **dmarcian** -- https://dmarcian.com -- DMARC deployment and reporting platform. - **mail-tester.com** -- https://www.mail-tester.com -- Send a test email and receive a deliverability score with specific improvement recommendations. - **Spamhaus** -- https://www.spamhaus.org -- Check and request delisting from the most widely used DNS blacklist. - **GlockApps / Inbox Monster** -- Seed-list based inbox placement testing across major providers. - **ZeroBounce / NeverBounce / BriteVerify** -- Email list verification services for identifying invalid, risky, and spam-trap addresses. - **Litmus / Email on Acid** -- Email rendering testing across clients and devices. - **RFC 7489 (DMARC)** -- https://datatracker.ietf.org/doc/html/rfc7489 -- The DMARC specification. - **M3AAWG Best Practices** -- https://www.m3aawg.org/published-documents -- Industry best practices for messaging anti-abuse.

path: output-template.md
content: # Email Deliverability Audit Report Template

Use this template to structure deliverability audit findings. Fill in each section with data from the workflow steps.

---

## Report Header

```
DELIVERABILITY AUDIT REPORT
Client:          [Brand Name]
Domain:          [sending-domain.com]
ESP:             [Klaviyo / Mailchimp / Omnisend / etc.]
Audit Date:      [YYYY-MM-DD]
Auditor:         [Name]
Report Period:   [Start Date] to [End Date] (last 90 days recommended)
```

---

## Executive Summary

**Overall Deliverability Grade:** [A / B / C / D / F]

**Key Findings:**
1. [Most critical finding -- one sentence]
2. [Second most critical finding -- one sentence]
3. [Third finding -- one sentence]

**Estimated Revenue Impact:** [Estimated monthly revenue lost due to deliverability issues]

**Recommended Priority:** [Critical -- immediate action / High -- action within 7 days / Medium -- action within 30 days]

---

## Section 1: Baseline Metrics

| Metric | Current Value | Industry Benchmark | Status |
|---|---|---|---|
| Overall Delivery Rate | __% | >97% | [Strong/Acceptable/Weak] |
| Inbox Placement Rate | __% | >95% | [Strong/Acceptable/Weak] |
| Open Rate (aggregate) | __% | 15-25% | [Strong/Acceptable/Weak] |
| Click-Through Rate | __% | 1.5-3.5% | [Strong/Acceptable/Weak] |
| Hard Bounce Rate | __% | <1% | [Strong/Acceptable/Weak] |
| Soft Bounce Rate | __% | <3% | [Strong/Acceptable/Weak] |
| Spam Complaint Rate | __% | <0.05% | [Strong/Acceptable/Weak] |
| Unsubscribe Rate | __% | <0.5% | [Strong/Acceptable/Weak] |

**Provider-Specific Inbox Placement:**

| Provider | Inbox | Spam | Missing | Volume Share |
|---|---|---|---|---|
| Gmail | __% | __% | __% | __% |
| Outlook/Hotmail | __% | __% | __% | __% |
| Yahoo/AOL | __% | __% | __% | __% |
| Apple Mail | __% | __% | __% | __% |
| Other | __% | __% | __% | __% |

**Google Postmaster Tools:**
- Domain Reputation: [High / Medium / Low / Bad]
- IP Reputation: [High / Medium / Low / Bad]
- Spam Rate: __%
- Authentication Rate: __%

---

## Section 2: Authentication Status

| Protocol | Status | Details | Action Required |
|---|---|---|---|
| SPF | [Pass/Fail/Partial] | [Record summary, lookup count] | [Yes/No -- detail] |
| DKIM | [Pass/Fail/Partial] | [Key length, alignment status] | [Yes/No -- detail] |
| DMARC | [Pass/Fail/Partial] | [Policy level, reporting config] | [Yes/No -- detail] |
| BIMI | [Pass/Fail/N/A] | [VMC status, logo file] | [Yes/No -- detail] |
| Return-Path | [Aligned/Misaligned] | [Bounce domain config] | [Yes/No -- detail] |
| TLS | [Enforced/Optional/None] | [Encryption status] | [Yes/No -- detail] |

**SPF Record:**
```
v=spf1 [current record contents]
```
DNS Lookups: [X]/10

**DKIM Selector(s):**
```
[selector]._domainkey.[domain] -> [key summary]
```

**DMARC Record:**
```
v=DMARC1; p=[policy]; [full record]
```

---

## Section 3: List Health

**List Composition:**

| Segment | Count | Percentage | Recommendation |
|---|---|---|---|
| Active (0-30 days) | __ | __% | Continue mailing |
| Lapsing (31-90 days) | __ | __% | Reduce frequency / re-engage |
| Inactive (91-180 days) | __ | __% | Re-engagement campaign or suppress |
| Dead (180+ days) | __ | __% | Suppress from regular sends |
| Never Engaged | __ | __% | Verify and suppress |
| **Total** | **__** | **100%** | |

**Risk Flags:**

| Risk Type | Count | Percentage | Action |
|---|---|---|---|
| Invalid addresses | __ | __% | Remove immediately |
| Spam traps (known) | __ | __% | Remove immediately |
| Role accounts | __ | __% | Review and suppress |
| Disposable domains | __ | __% | Remove immediately |
| Catch-all domains | __ | __% | Monitor bounce behavior |
| Duplicate addresses | __ | __% | Deduplicate |

**List Decay Projection:**
- Current monthly decay rate: __%
- Projected list size in 6 months (without new acquisition): __
- Recommended cleaning frequency: [Monthly / Quarterly]

---

## Section 4: Content Analysis

| Factor | Finding | Score Impact | Fix Priority |
|---|---|---|---|
| Image-to-text ratio | [X% image / Y% text] | [High/Med/Low] | [Priority] |
| Spam trigger words | [Count and examples] | [High/Med/Low] | [Priority] |
| Subject line patterns | [Issues found] | [High/Med/Low] | [Priority] |
| Email size | [X KB] | [High/Med/Low] | [Priority] |
| Plain-text part | [Present/Missing] | [High/Med/Low] | [Priority] |
| List-Unsubscribe header | [Present/Missing] | [High/Med/Low] | [Priority] |
| Unsubscribe visibility | [Visible/Hidden] | [High/Med/Low] | [Priority] |
| URL shorteners | [Found/None] | [High/Med/Low] | [Priority] |
| Broken HTML | [Issues found] | [High/Med/Low] | [Priority] |
| Preheader text | [Present/Missing] | [High/Med/Low] | [Priority] |

---

## Section 5: Infrastructure Assessment

| Component | Current State | Recommendation |
|---|---|---|
| IP Type | [Dedicated/Shared] | [Recommendation] |
| IP Warm-up Status | [Complete/In Progress/Not Started] | [Recommendation] |
| Sending Subdomain | [Configured/Not Configured] | [Recommendation] |
| Bounce Domain | [Custom/Default] | [Recommendation] |
| Feedback Loops | [Enrolled/Not Enrolled] | [Recommendation] |
| Volume Consistency | [Consistent/Erratic] | [Recommendation] |

**Blacklist Status:**

| Blacklist | Status | Listing Reason | Delisting Action |
|---|---|---|---|
| Spamhaus SBL | [Clean/Listed] | [Reason if listed] | [Action if listed] |
| Spamhaus XBL | [Clean/Listed] | [Reason if listed] | [Action if listed] |
| Barracuda BRBL | [Clean/Listed] | [Reason if listed] | [Action if listed] |
| SORBS | [Clean/Listed] | [Reason if listed] | [Action if listed] |
| SpamCop | [Clean/Listed] | [Reason if listed] | [Action if listed] |
| URIBL | [Clean/Listed] | [Reason if listed] | [Action if listed] |

---

## Section 6: Remediation Plan

| # | Action | Priority | Owner | Deadline | Status | Expected Impact |
|---|---|---|---|---|---|---|
| 1 | [Action description] | [Critical/High/Med/Low] | [Name] | [Date] | [Not Started/In Progress/Done] | [Expected metric change] |
| 2 | | | | | | |
| 3 | | | | | | |
| 4 | | | | | | |
| 5 | | | | | | |

---

## Section 7: Monitoring Plan

**Alerts Configured:**

| Alert | Threshold | Notification | Owner |
|---|---|---|---|
| Bounce rate spike | >1.5% per campaign | [Email/Slack] | [Name] |
| Complaint rate spike | >0.05% per campaign | [Email/Slack] | [Name] |
| Blacklist detection | Any new listing | [Email/Slack] | [Name] |
| Reputation drop | Below "Medium" in GPT | [Email/Slack] | [Name] |

**Review Schedule:**
- Weekly: Google Postmaster Tools check, campaign metric review
- Monthly: Seed-list inbox placement test, blacklist scan
- Quarterly: Full list hygiene audit, authentication review, content audit

---

## Appendix

**Tools Used:**
- Inbox placement: [GlockApps / Inbox Monster / Everest]
- List verification: [ZeroBounce / NeverBounce / BriteVerify]
- Authentication: [MXToolbox / dmarcian / mail-tester.com]
- Rendering: [Litmus / Email on Acid]
- Blacklists: [MXToolbox / multirbl.valli.org]

**Data Sources:**
- ESP dashboard export (date range: __)
- Google Postmaster Tools (date range: __)
- Seed-list test results (test date: __)
- List verification report (verification date: __)


path: authentication-setup-guide.md
content: # Email Authentication Setup Guide

This guide covers SPF, DKIM, DMARC, and BIMI configuration for ecommerce sending domains. Follow the protocols in order -- each builds on the previous.

---

## SPF (Sender Policy Framework)

SPF tells receiving servers which IP addresses and services are authorized to send email on behalf of your domain.

### How SPF Works

When a receiving server gets an email claiming to be from `yourstore.com`, it checks the DNS TXT record at `yourstore.com` for an SPF policy. If the sending server's IP is listed in that policy, SPF passes. If not, it fails.

### Setting Up SPF

**1. Identify all legitimate sending sources:**
- Your ESP (Klaviyo, Mailchimp, Omnisend, etc.)
- Transactional email service (Postmark, SendGrid, Amazon SES)
- Help desk (Zendesk, Freshdesk, Gorgias)
- Any other service sending as your domain

**2. Build the SPF record:**

```
v=spf1 include:_spf.google.com include:sendgrid.net include:klaviyo.com ~all
```

Structure:
- `v=spf1` -- version identifier (required, must be first)
- `include:[domain]` -- authorize a third-party service's IP ranges
- `ip4:[address]` -- authorize a specific IPv4 address or CIDR range
- `~all` -- soft fail for unauthorized senders (use during setup)
- `-all` -- hard fail for unauthorized senders (use once validated)

**3. Publish as a DNS TXT record** on the root domain (e.g., `yourstore.com`).

### SPF Constraints and Common Problems

- **10 DNS lookup limit:** Each `include`, `a`, `mx`, `ptr`, and `redirect` mechanism counts as one DNS lookup. Nested includes also count. Exceeding 10 causes a permanent error (`permerror`), which many receivers treat as a fail.
- **Counting lookups:** Use `mxtoolbox.com/spf.aspx` to see total lookup count.
- **Fixing excess lookups:**
  - Remove services you no longer use
  - Replace `include` with direct `ip4`/`ip6` entries for services with static IPs (but note these break if the service changes IPs)
  - Use an SPF flattening service (e.g., autospf.com, dmarcian SPF Surveyor) that auto-resolves includes to IP addresses and keeps the record updated
  - Split sending across subdomains (e.g., marketing sends from `mail.yourstore.com` with its own SPF record)
- **Only one SPF record per domain:** Multiple TXT records starting with `v=spf1` cause SPF to fail. Merge them into one.
- **No SPF on subdomains by default:** SPF records are not inherited. If you send from `mail.yourstore.com`, it needs its own SPF record.

### SPF Alignment

For DMARC to use SPF results, the domain in the envelope-from (Return-Path) must align with the domain in the header-from. Most ESPs provide a custom bounce/return-path domain setting to achieve this. Configure it.

---

## DKIM (DomainKeys Identified Mail)

DKIM cryptographically signs outgoing emails so receivers can verify the message was not altered in transit and was authorized by the domain owner.

### How DKIM Works

The sending server signs a hash of specified email headers and body content using a private key. The corresponding public key is published in DNS. The receiving server retrieves the public key and verifies the signature.

### Setting Up DKIM

**1. Generate a key pair through your ESP.**

Most ESPs handle key generation. You will receive a DNS record to publish. Example:

```
Host:  s1._domainkey.yourstore.com
Type:  CNAME (or TXT)
Value: s1.domainkey.klaviyo.com (CNAME) or "v=DKIM1; k=rsa; p=MIGfMA0G..." (TXT)
```

**2. Publish the DNS record.**

Add the CNAME or TXT record at the specified hostname. CNAME is preferred when the ESP offers it because key rotation is handled automatically.

**3. Enable signing in your ESP dashboard.**

Most ESPs have a domain authentication or sender authentication section. Complete the verification steps.

**4. Test by sending an email and inspecting headers.**

Look for:
```
dkim=pass header.d=yourstore.com header.s=s1
```

### DKIM Best Practices

- **Use 2048-bit keys.** 1024-bit is the minimum accepted length but is increasingly vulnerable. Some DNS providers have a 255-character TXT record limit; if so, split the key across multiple strings within one TXT record.
- **Rotate keys annually.** Publish the new key, update ESP configuration, then remove the old key after 48 hours.
- **Sign with your own domain, not the ESP's default.** Unsigned or third-party-signed emails fail DMARC alignment.
- **Sign each sending source separately.** Every service sending as your domain needs its own DKIM key published in your DNS.

### DKIM Alignment

For DMARC, the `d=` domain in the DKIM signature must match (or be a subdomain of) the header-from domain. If your From address is `[REDACTED_SECRET]`, the DKIM signature must have `d=yourstore.com` (or `d=mail.yourstore.com` in relaxed alignment mode).

---

## DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together with a policy that tells receivers what to do when authentication fails, and provides reporting so you can monitor abuse.

### How DMARC Works

The receiving server checks if the email passes SPF or DKIM with alignment to the From domain. Based on the DMARC policy, it then delivers, quarantines, or rejects the message. Aggregate reports are sent to the domain owner.

### Setting Up DMARC

**Phase 1: Monitor (weeks 1-4)**

Start with a monitoring-only policy to collect data without affecting delivery.

```
v=DMARC1; p=none; rua=mailto:[REDACTED_SECRET]; ruf=mailto:[REDACTED_SECRET]; pct=100;
```

- `p=none` -- take no action on failures (monitor only)
- `rua` -- address for aggregate reports (daily XML summaries)
- `ruf` -- address for forensic/failure reports (individual message details; not all providers send these)
- `pct=100` -- apply policy to 100% of messages

Use a DMARC report analyzer (dmarcian, Postmark DMARC, EasyDMARC) instead of raw XML reports.

**Phase 2: Quarantine (weeks 5-8)**

After confirming all legitimate sources pass, move to quarantine.

```
v=DMARC1; p=quarantine; rua=mailto:[REDACTED_SECRET]; pct=25;
```

Start with `pct=25` (apply quarantine to 25% of failing messages), then increase to 50%, 75%, 100% over several weeks while monitoring reports for false positives.

**Phase 3: Reject (week 9+)**

Once confident, enforce full rejection.

```
v=DMARC1; p=reject; rua=mailto:[REDACTED_SECRET]; pct=100;
```

### DMARC Record Placement

Publish as a TXT record at `_dmarc.yourstore.com`.

### DMARC Policy Considerations for Ecommerce

- **Third-party senders:** Review platforms, loyalty programs, and marketplace integrations that send email using your domain. Each must pass SPF or DKIM alignment before moving to quarantine/reject.
- **Subdomain policy:** Use `sp=none` if subdomains have different authentication needs while the main domain is at `p=reject`.
- **Forwarding:** Email forwarding breaks SPF (the forwarder's IP is not in your SPF). DKIM survives forwarding if the message is not modified. This is one reason DKIM alignment is more reliable than SPF alignment for DMARC.

---

## BIMI (Brand Indicators for Message Identification)

BIMI displays your brand logo next to emails in supporting clients (Gmail, Yahoo, Apple Mail). It requires DMARC at `p=quarantine` or `p=reject`.

### Requirements

1. DMARC policy at `p=quarantine` or `p=reject` with `pct=100`
2. A Verified Mark Certificate (VMC) from DigiCert or Entrust (required for Gmail; Yahoo shows logos without VMC)
3. Your trademarked logo in SVG Tiny PS format

### Setting Up BIMI

**1. Prepare your logo:**
- Must be SVG Tiny Portable/Secure format (not standard SVG)
- Square aspect ratio, centered logo on solid background
- Host at an HTTPS URL

**2. Obtain a VMC (for Gmail display):**
- Requires a registered trademark in a participating jurisdiction
- Apply through DigiCert or Entrust (annual cost: ~$1,000-1,500)

**3. Publish the BIMI record:**

```
Host:  default._bimi.yourstore.com
Type:  TXT
Value: v=BIMI1; l=https://yourstore.com/brand/logo.svg; a=https://yourstore.com/brand/vmc.pem;
```

- `l=` -- URL to your SVG logo
- `a=` -- URL to your VMC certificate (omit if no VMC)

### BIMI ROI for Ecommerce

BIMI improves brand recognition and trust in the inbox. Early data shows 10-20% improvement in open rates for BIMI-enabled senders, making the VMC investment worthwhile for brands sending >100K emails/month.

---

## Authentication Verification Checklist

After setup, verify all protocols:

- [ ] SPF record exists and is valid (`v=spf1` prefix, single record, <10 lookups)
- [ ] SPF includes all legitimate sending services
- [ ] SPF ends with `-all` or `~all`
- [ ] Custom return-path/bounce domain configured for SPF alignment
- [ ] DKIM key published for each sending service
- [ ] DKIM key length is 2048-bit
- [ ] DKIM signing enabled and verified via test email headers
- [ ] DKIM `d=` domain aligns with From domain
- [ ] DMARC record published at `_dmarc.[domain]`
- [ ] DMARC `rua` reporting configured and reports are being received
- [ ] DMARC policy is at minimum `p=quarantine` (target: `p=reject`)
- [ ] All third-party senders pass DMARC checks (review aggregate reports)
- [ ] BIMI record published (if DMARC is at quarantine/reject and trademark is registered)
- [ ] Test email scores 10/10 on mail-tester.com

---

## Troubleshooting

| Symptom | Likely Cause | Fix |
|---|---|---|
| SPF permerror | >10 DNS lookups | Flatten record or split across subdomains |
| SPF softfail/fail | Sending IP not in SPF | Add the service's include mechanism |
| DKIM fail | Key not published or wrong selector | Verify DNS record matches ESP configuration |
| DKIM body hash mismatch | Message modified in transit (forwarding, list software) | Check for intermediary modification; rely on DKIM alignment rather than SPF for DMARC |
| DMARC fail (both SPF and DKIM) | Neither protocol aligned with From domain | Configure custom domains for both SPF and DKIM alignment |
| DMARC reports show unknown senders | Spoofing or forgotten authorized service | Investigate source IPs; add legitimate services or tighten policy |


path: list-hygiene-guide.md
content: # Email List Hygiene Guide

Systematic practices for cleaning, segmenting, and maintaining ecommerce email lists to protect sender reputation and maximize engagement.

---

## Why List Hygiene Matters

Email lists decay at 25-30% per year. Subscribers change jobs, abandon addresses, or lose interest. Every invalid or disengaged address you continue mailing erodes your sender reputation. Mailbox providers like Gmail and Yahoo track your engagement ratios -- the percentage of your sent mail that gets opened, clicked, or marked as spam. Mailing a bloated list full of dead addresses drives those ratios down, which pushes more of your email into spam, which further reduces engagement, creating a downward spiral.

For ecommerce specifically, list hygiene directly affects revenue. A clean 50K list that achieves 25% open rates will outperform a dirty 200K list at 8% open rates -- and cost less to send.

---

## List Verification

### When to Verify

- Before any major campaign (Black Friday, product launch)
- After importing a new list or migrating ESPs
- When bounce rates exceed 1.5% on any campaign
- On a quarterly schedule as ongoing maintenance
- Before re-engaging a dormant segment

### Verification Service Selection

Use a reputable verification service that checks for:

| Check Type | What It Catches | Priority |
|---|---|---|
| Syntax validation | Malformed addresses (missing @, invalid characters) | Essential |
| Domain validation | Non-existent domains, expired domains | Essential |
| Mailbox existence | Addresses that do not exist on valid domains | Essential |
| Spam trap detection | Known recycled and pristine spam traps | Essential |
| Disposable domain detection | Temporary email services (guerrillamail, tempmail, etc.) | High |
| Role account detection | info@, admin@, sales@, support@, webmaster@ | High |
| Catch-all domain identification | Domains that accept all addresses (cannot confirm validity) | Medium |
| Abuse/complainer detection | Addresses known to file spam complaints | Medium |

Recommended services: ZeroBounce, NeverBounce, BriteVerify, Kickbox. Budget $3-10 per 1,000 verifications.

### Post-Verification Actions

| Verification Result | Action |
|---|---|
| Valid | Keep in active list |
| Invalid | Remove immediately; add to suppression list |
| Spam trap | Remove immediately; investigate acquisition source |
| Disposable | Remove; block domain from future signups |
| Role account | Suppress from marketing; may keep for transactional if necessary |
| Catch-all | Keep but monitor; flag for removal if no engagement in 60 days |
| Risky/Unknown | Send to a small test segment first; suppress if bounce |

---

## Engagement-Based Segmentation

### Defining Engagement Tiers

Segment your list based on recency and frequency of interaction. Adjust thresholds based on your sending frequency -- these assume 2-4 emails per week.

**Tier 1 -- VIP / Highly Engaged (target: 10-15% of list)**
- Opened or clicked 3+ times in last 30 days
- Or purchased via email in last 30 days
- Treatment: Full sending frequency, early access, premium content

**Tier 2 -- Active / Engaged (target: 20-30% of list)**
- Opened or clicked at least once in last 30 days
- Treatment: Full sending frequency, standard campaigns

**Tier 3 -- Lapsing (target: 15-25% of list)**
- Last engagement 31-90 days ago
- Treatment: Reduced frequency (1-2 per week), re-engagement content, subject line testing

**Tier 4 -- Inactive (target: 10-20% of list)**
- Last engagement 91-180 days ago
- Treatment: Monthly re-engagement campaign only; sunset after one re-engagement attempt

**Tier 5 -- Dead / Unengaged (remainder)**
- No engagement in 180+ days, or never engaged after 90 days on list
- Treatment: Suppress from all sends; run one final re-engagement or remove

### Implementing Segments in Your ESP

Most ecommerce ESPs support dynamic segments based on engagement. Example Klaviyo segment definitions:

- **Engaged:** `Opened Email at least once in the last 30 days OR Clicked Email at least once in the last 30 days`
- **Lapsing:** `Opened Email at least once in the last 90 days AND Opened Email zero times in the last 30 days`
- **Inactive:** `Opened Email zero times in the last 90 days AND Was added to list more than 90 days ago`

Set campaign sending to target Engaged + Lapsing segments by default. Inactive and Dead segments should only receive re-engagement flows.

---

## Sunset Policy

A sunset policy defines when and how you stop mailing disengaged subscribers. This is the single most impactful list hygiene practice.

### Recommended Sunset Framework

```
Day 0:    Subscriber last engaged (opened or clicked)
Day 90:   Move to reduced frequency segment
Day 120:  Send re-engagement email 1 ("We miss you" / incentive offer)
Day 135:  Send re-engagement email 2 ("Last chance" / preference center)
Day 150:  Send final email ("We're removing you; click to stay")
Day 151:  No click on any re-engagement → suppress from all marketing
Day 365:  Remove from list entirely (retain in suppression list)
```

### Re-Engagement Campaign Best Practices

- **Subject lines that stand out:** Use their name, reference their last purchase, break your usual pattern ("We need to talk," "Should we stop emailing you?")
- **Offer an incentive:** 15-20% discount, free shipping, or exclusive access can recover 3-8% of inactive subscribers
- **Provide a preference center:** Let them choose frequency (weekly digest vs. daily) or topics (sales only, new arrivals only)
- **Make unsubscribing easy:** Paradoxically, making it easy to leave reduces spam complaints from people who stay
- **Measure the re-engagement series:** Track what percentage re-engage, and do not repeat the series more than once per subscriber

---

## Acquisition Hygiene

Prevent bad addresses from entering your list in the first place.

### Signup Form Best Practices

- **Double opt-in (confirmed opt-in):** Require new subscribers to click a confirmation link in a verification email. This eliminates typos, bots, and malicious signups. It reduces list growth rate by 20-30% but dramatically improves list quality.
- **Real-time validation on forms:** Use JavaScript-based validation (Kickbox, ZeroBounce API) to check addresses at the point of entry. Reject disposable domains, flag typos (gmial.com, yaho.com), and block role accounts.
- **CAPTCHA or honeypot fields:** Prevent bot signups that inject spam traps and invalid addresses.
- **Set expectations:** Tell subscribers what they will receive and how often. Mismatched expectations drive complaints.
- **Avoid pre-checked boxes:** Opt-in must be explicit. Pre-checked "subscribe to our newsletter" checkboxes during checkout produce disengaged subscribers and may violate GDPR.

### Acquisition Sources to Monitor

Track deliverability metrics by acquisition source. If addresses from a particular source (contest entry, partner co-registration, popup on a specific landing page) show high bounce or complaint rates, fix or shut down that source.

| Source | Typical Quality | Watch For |
|---|---|---|
| Website signup with double opt-in | High | Low volume but high engagement |
| Checkout opt-in (explicit) | High | Moderate engagement; transactional buyers may not engage with marketing |
| Checkout opt-in (pre-checked) | Low-Medium | High unsubscribe and complaint rates |
| Contest/giveaway entry | Low | Disposable addresses, no purchase intent |
| Partner co-registration | Low-Medium | Mismatched expectations, high complaints |
| In-store POS collection | Medium | Typo rates 5-15%, verify within 48 hours |
| Imported/purchased lists | Very Low | Never do this. Spam traps, legal liability, reputation damage |

---

## Ongoing Maintenance Schedule

### Weekly

- Review campaign-level bounce and complaint rates
- Check for any addresses that hard-bounced and verify they are suppressed
- Monitor Google Postmaster Tools for reputation changes

### Monthly

- Review engagement tier distribution -- is the active segment growing or shrinking?
- Remove any new role accounts or disposable domain signups
- Check unsubscribe processing -- are unsubscribes being honored within 24 hours?

### Quarterly

- Run full list through verification service
- Execute sunset policy on accumulated inactive subscribers
- Audit acquisition sources for quality
- Review and update segment definitions if sending frequency has changed
- Pull deliverability report and compare to previous quarter

### Annually

- Full list audit with engagement, acquisition source, and revenue-per-subscriber analysis
- Review and update sunset policy thresholds
- Benchmark against industry standards
- Clean up suppression list (remove entries older than compliance requirements)

---

## Metrics to Track

| Metric | Healthy Range | Action Trigger |
|---|---|---|
| List growth rate (net) | >2% monthly | <0% (shrinking faster than growing) |
| Hard bounce rate per campaign | <0.5% | >1% on any single campaign |
| Spam complaint rate | <0.05% | >0.08% (approaching Gmail's 0.10% threshold) |
| Unsubscribe rate per campaign | <0.3% | >0.5% consistently |
| Active subscriber percentage | >40% of total list | <30% (list is mostly dead weight) |
| Verification failure rate (quarterly) | <2% of new adds | >5% indicates acquisition problem |
| Re-engagement recovery rate | 3-8% of targeted inactives | <1% means re-engagement content needs work |

---

## Legal Compliance Notes

List hygiene intersects with legal requirements:

- **CAN-SPAM (US):** Honor unsubscribe requests within 10 business days. Suppression list must be maintained.
- **GDPR (EU/UK):** Requires explicit consent, right to erasure, and data portability. Sunset policies must account for consent records.
- **CASL (Canada):** Requires express consent with specific identification. Implied consent expires after 2 years of last purchase or 6 months of last inquiry.
- **Retention:** Keep suppression records (email address + date + reason) even after removing the full subscriber record, to prevent re-importing suppressed addresses during list migrations.


path: quality-checklist.md
content: # Email Deliverability Quality Checklist

Use this checklist for ongoing audits. Review quarterly at minimum, or before any high-stakes campaign.

---

## Authentication (8 items)

- [ ] SPF record exists and passes validation
- [ ] SPF DNS lookup count is under 10
- [ ] SPF includes all current sending services (no stale entries)
- [ ] DKIM signing is active for every sending source
- [ ] DKIM key length is 2048-bit
- [ ] DMARC record is published with rua reporting configured
- [ ] DMARC policy is at p=quarantine or p=reject
- [ ] Custom bounce/return-path domain is configured for SPF alignment

## Sender Reputation (7 items)

- [ ] Google Postmaster Tools domain reputation is "Medium" or higher
- [ ] Google Postmaster Tools IP reputation is "Medium" or higher
- [ ] Sending IP/domain is clean on Spamhaus (SBL, XBL, PBL)
- [ ] Sending IP/domain is clean on Barracuda BRBL
- [ ] Sending IP/domain is clean on SORBS, SpamCop, and URIBL
- [ ] Feedback loops are enrolled with major providers (Outlook, Yahoo, AOL)
- [ ] Google Postmaster spam rate is below 0.10%

## List Hygiene (9 items)

- [ ] List verified through a validation service within the last 90 days
- [ ] Hard bounce suppression is processing automatically after each send
- [ ] Unsubscribe requests are honored within 24 hours
- [ ] Sunset policy is defined and actively enforced
- [ ] Subscribers inactive for 180+ days are suppressed from regular campaigns
- [ ] Role accounts (info@, admin@, sales@) are excluded from marketing sends
- [ ] No purchased, rented, or scraped addresses exist in the list
- [ ] Signup forms use double opt-in or real-time validation
- [ ] Acquisition sources are tracked and monitored for quality

## Sending Infrastructure (6 items)

- [ ] Sending subdomain is configured (not sending from bare root domain)
- [ ] Transactional and marketing emails use separate subdomains or IPs
- [ ] Sending volume is consistent week-over-week (no >2x spikes)
- [ ] TLS encryption is enforced for email transmission
- [ ] Bounce handling retries soft bounces appropriately and suppresses persistent failures
- [ ] IP warm-up was completed before reaching full volume (if dedicated IP)

## Content Quality (10 items)

- [ ] Email size is under 100KB total
- [ ] Image-to-text ratio is at least 60% text / 40% images
- [ ] Plain-text MIME part is included alongside HTML
- [ ] List-Unsubscribe header (RFC 8058 one-click) is present
- [ ] Unsubscribe link is visible and functional in email footer
- [ ] No URL shorteners (bit.ly, tinyurl, etc.) in email body
- [ ] Subject lines avoid ALL CAPS, excessive punctuation, and spam trigger phrases
- [ ] Preheader text is set and meaningful (not default or empty)
- [ ] Alt text is present on all images
- [ ] HTML is well-formed with no broken tags or unclosed elements

## Engagement and Monitoring (6 items)

- [ ] Open rate is above 15% across the active list
- [ ] Spam complaint rate is below 0.05% per campaign
- [ ] Hard bounce rate is below 1% per campaign
- [ ] Unsubscribe rate is below 0.5% per campaign
- [ ] Engagement-based segments are defined and used for send targeting
- [ ] Deliverability dashboard or alerting is configured and reviewed weekly

## Compliance (4 items)

- [ ] Physical mailing address is included in email footer
- [ ] Sender name and From address accurately identify the brand
- [ ] Consent records are stored for each subscriber (date, source, method)
- [ ] Suppression list is maintained across ESP migrations (bounces, unsubs, complaints)

---

**Total items: 50**

**Scoring guide:**
- 45-50 checked: Strong deliverability posture
- 35-44 checked: Acceptable with improvement areas
- 25-34 checked: Weak -- prioritize remediation
- Below 25: Critical -- deliverability is at significant risk

**Review frequency:** Quarterly full audit. Weekly spot-check on Engagement and Monitoring section.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)