Email Deliverability Audit

Email Deliverability Audit

If your positive reply rate is dropping and you don't know why, start here. Most of the time the problem is deliverability — your emails aren't reaching inboxes. This skill tells you what's broken.

What it checks

The 1% rule — and the floors that gate it

A healthy domain replies at 1% or better after 200 emails sent. Below 1% on a fair sample, something is broken, and if it stays broken the domain gets cancelled.

The 1% rule is one number: the same 1% that flags a domain here is the line that retires it in /inbox-lifecycle-manager. What separates "flag" from "cancel" is not a softer second threshold — it is the floors. Below a floor, the answer is "we don't know yet", which is a legitimate output rather than a failure.

Reporting 0.00% reply on 14 sends as a failure, or condemning a three-week-old domain that has not finished ramping, is how healthy domains get killed.

Possible causes when a domain is below the line (the audit's root-cause suggestions try to pinpoint which):

• Emails landing in spam — run the spam placement test
• Domain reputation damaged — check DMARC reports and the bounce codes
• Copy is broken — re-run /spam-word-checker; confirm with a control-fleet placement test
• List is cold or wrong ICP — check bounce rate; if >3%, the list is the problem, not the domain
• Inbox hasn't warmed enough — check warmup status and domain age

The domain-vs-copy isolation test

Low placement alone does not tell you whether the domain is burned or the copy is toxic. Run the same copy from a known-good control fleet:

When to use

• Reply rate dropped by >30% week-over-week → run the full audit
• Bounces spiked above 2% → run auth + spam-placement checks
• Before scaling a campaign (make sure infrastructure is ready)
• Monthly as routine hygiene
• When taking over a Smartlead account you didn't set up

Inputs

• SMARTLEAD_API_KEY (env)
• Optional: scope the audit
  • --client-id=X (for sub-clients)
  • --campaign-id=X (audit only one campaign's inboxes)
  • --domain=example.com (audit only one domain)
  • --tag=active (audit only inboxes tagged active)

Steps

1. Pull the inbox inventory

npx tsx scripts/audit-inboxes.ts --all --out=/tmp/audit/inboxes.csv

Outputs per inbox: id, email, domain, warmup_status, reputation, max_warmup/day, sent_today, smtp_ok, imap_ok, is_blocked, tags.

2. Check domain authentication

npx tsx scripts/check-domain-auth.ts --from-csv=/tmp/audit/inboxes.csv --out=/tmp/audit/auth.csv

For each unique domain, runs:

dig TXT <domain> +short                             # SPF
dig TXT _dmarc.<domain> +short                      # DMARC

# DKIM has NO single selector. Present if ANY of these resolves:
dig TXT   google._domainkey.<domain>    +short      # Google / Gmail-backed — the common one
dig CNAME selector1._domainkey.<domain> +short      # Microsoft 365 — a CNAME, TXT returns nothing
dig CNAME selector2._domainkey.<domain> +short      # Microsoft 365, second key
dig TXT   default._domainkey.<domain>   +short      # generic fallback, frequently empty

⛔ Never check default._domainkey alone. It is empty on most real fleets, and a default-only check reports every domain as "missing DKIM" — which routes genuinely burned domains to "fix your DNS" and wastes a week republishing records that already exist. The script tries all four and reports which one resolved.

Outputs: domain, spf_present, spf_strict, dkim_present, dmarc_present, dmarc_policy (none/quarantine/reject).

3. Pull sent + reply + bounce metrics per campaign/inbox

npx tsx scripts/audit-performance.ts --days=30 --out=/tmp/audit/performance.csv

Walks all active campaigns, pulls per-inbox analytics for the last 30 days. Output columns: inbox_id, email, domain, type, tags, sent, replies, bounces, reply_rate_pct, bounce_rate_pct, flag_low_reply, flag_high_bounce.

Flagged automatically:

• flag_low_reply = TRUE if sent ≥200 and reply_rate_pct < 1.0 (the 1% rule)
• flag_high_bounce = TRUE if sent ≥50 and bounce_rate_pct > 3.0

4. (Optional) Run a Smart Delivery spam placement test

npx tsx scripts/run-spam-test.ts --campaign-id=12345 --senders=100 --out=/tmp/audit/spam-test.json

This creates a real inbox-placement test via Smartlead's Smart Delivery API:

• Uses the only available provider pools: G Suite + Office365 (provider_ids 20, 21)
• Sends to ~200 seed mailboxes with 100 of your senders
• Waits for completion (5-20 min)
• Pulls: providerwise, spam-filter-details, dkim-details, spf-details, blacklist

Output shows: what % lands in Inbox vs Spam vs Promotions, broken down by your sender and the receiver provider. This is the ground truth.

5. Synthesize the report

Read the three CSVs (inboxes.csv, auth.csv, performance.csv) plus the spam-test JSON if you ran one, and write the report by hand in this shape. There is no generator script; the synthesis is the judgment call, and the template below is what it should look like:

# Deliverability Audit — 2026-04-17

## Summary

- 80 inboxes audited across 40 domains
- 3 inboxes blocked (4% of fleet)
- 5 domains missing DKIM
- 2 domains with DMARC policy=none (no enforcement)
- Fleet performance (last 30d):
    Sent:           42,384
    Replies:          523
    Overall reply rate: 1.23% (PASS — above 1% threshold)
    Bounces:           382
    Bounce rate:      0.90% (PASS — below 2%)
- 4 inboxes failed the 1% rule (sent ≥200, reply rate <1%)
- Spam placement (test run): 83% inbox / 14% spam / 3% tabs (ACCEPTABLE but not great)

## Critical issues (fix within 24h)

1. Domain trygrowth.co has no DMARC record. Add: v=DMARC1; p=none; rua=mailto:dmarc@trygrowth.co
2. Inbox sales@trygrowth.co blocked in warmup — likely flagged by warmup network. Rotate out of campaigns.
3. 12 inboxes have 0 daily sent today despite being in active campaigns. Check campaign schedule.
4. Inbox marketing@other.co failed the 1% rule: 347 sent, 1 reply (0.29% reply rate). Investigate:
   - Check spam placement for this inbox
   - Compare copy vs. a sibling inbox that's passing
   - Rotate inbox out if bad reputation is confirmed

## Warnings (fix within 1 week)

- 5 domains missing DKIM record at default._domainkey
- 3 inboxes reputation dropped "fair" → "bad"
- Spam filter trigger DKIM_INVALID firing 8% of the time — likely for a subset of domains

## Action items (prioritized)

1. [HIGH] Add missing DKIM records to: trygrowth.co, othergrow.co, ...
2. [HIGH] Rotate out blocked inboxes: sales@trygrowth.co, marketing@other.co, ...
3. [MED] Tighten DMARC to p=quarantine on all domains after 2 weeks of p=none observation
4. [MED] Replace 3 bad-reputation inboxes (tag them "retired", provision new)
5. [LOW] Re-run spam placement test after fixing DKIM issues

6. Act on the action items

Feed the action items into the right skills:

• Missing DKIM / SPF → /zapmail-domain-setup-public to reconnect domains through Zapmail
• Blocked inboxes → /smartlead-inbox-manager to tag "retired" and rotate in insurance
• Campaign schedule issues → Smartlead campaign schedule settings
• Bad copy flagged → /spam-word-checker on the campaign copy

Interpreting the numbers