The 2026 email marketing checklist nobody asked for but most of you need anyway
I spent last week going through a client's send infrastructure after their deliverability tanked from 94% to 61% in three months. The problem wasn't anything dramatic. It was a checklist gap. You're probably sitting on one right now. Here's what the actual checklist looks like when you strip out the fluff. Most people skip the parts that matter and obsess over the wrong stuff. Authentication is not optional. DMARC at p=reject isn't some advanced configuration anymore. It's the baseline. If you're running p=none or nothing at all, you're asking major inbox providers to treat your domain as suspicious. Set up SPF with a hardfail, add DKIM on every sending domain, and push DMARC to reject within 90 days. The transition period where you run monitoring mode first gives you visibility into unknown forwarders and third-party senders that might be quietly breaking your alignment.
I had a case where a newsletter client's DKIM was passing on their main domain but failing on a subdomain their agency had been using since 2023. Nothing in their tools flagged it because the tools were checking the primary domain. The subdomain had no DMARC record at all. We caught it by pulling raw authentication headers from Gmail and Outlook test sends. That's the part everyone misses. Don't trust your ESP's reporting dashboard alone. Test from actual inboxes. List hygiene matters more now than it did five years ago because inbox providers are scoring engagement at the domain level, not just the message level. A single sustained complaint rate above 0.1% on a sending domain will tank your entire domain's reputation across every campaign you run. Weekly suppression isn't enough. You need automated hard bounce removal within an hour of receipt and a complaint-based suppression that runs within 24 hours. Some platforms still batch this daily. That's too slow in 2026. Content validation includes checking your pre-header text against the preview pane length limits. Gmail cuts at roughly 40 characters on mobile and 60 on desktop. Outlook does something different entirely and will truncate at weird breakpoints depending on font rendering. I built a simple script that renders each subject line and pre-header combination through a headless browser with different viewport widths and captures the actual rendered character count. It's not glamorous. It saved us from three separate campaigns landing with cut-off pre-headers that completely changed the message.
Sending infrastructure needs a dedicated warming schedule for any new IP or domain. There's no shortcut here. Start at 100 to 200 sends per day, double every three to five days, and monitor bounce and complaint rates at each step. If your complaint rate hits 0.05% at any tier, stop increasing and hold steady until it drops below 0.02%. Volume ramps ignore this rule and then you're explaining to stakeholders why they lost access to their ESP account. Preference center implementation is legally required in more jurisdictions now than it was two years ago. GDPR, CASL, PECR, and emerging state-level laws in the US all require explicit consent pathways. A checkbox that says "I agree to marketing emails" bundled with terms of service doesn't count anymore. You need an affirmative, granular opt-in that separates transactional from promotional consent. This isn't a nice-to-have. One complaint from a user who never clearly opted in can trigger regulatory review. Analytics and attribution has gotten harder because of iOS privacy changes and cookie restrictions. Open tracking is dead as a reliable metric. UTM parameters are your fallback, but even those get stripped by some privacy tools. Set up server-side tracking where possible. At minimum, ensure every outbound link has properly structured UTMs so your analytics platform can reconstruct the journey. Conversion attribution through email should rely on click-through data and revenue modeling, not open rates. Anyone still leading with open rate in 2026 is running outdated reports.
Get the Full Details
Testing protocols before any send should include a spam trigger scan. Tools like Mail-Tester or GlockApps give you a quick heuristic score, but they're not perfect. The real test is hitting your own inbox across Gmail, Outlook, Yahoo, and Apple Mail and checking placement, rendering, and link functionality. I once caught a CSS issue where a button looked fine in Litmus previews across every browser but rendered as invisible text in Outlook because a filter property we used didn't have the vendor prefix Outlook requires. The button was there. It just had zero contrast against the background. No one noticed in testing. Unsubscribe and preference management must be frictionless. One-click unsubscribe links are required by CAN-SPAM and recommended everywhere else. A four-click path to unsubscribing is a complaint waiting to happen. Process unsubscribes within 10 seconds. Any longer and the user clicks the spam report button instead. That single action does more damage to your domain reputation than thousands of unsubscribes ever would. Frequency and segmentation deserve more attention than they get. Sending to your entire list every time is the fastest way to desensitize engaged subscribers and amplify disengaged ones. Segment by engagement tier at minimum. Active subscribers, passive subscribers, and at-risk subscribers each need different cadences and content types. I've seen clients go from 2% to 18% engagement by simply stopping sends to subscribers who hadn't opened in 90 days and running a re-engagement campaign instead of silently suppressing them. The suppressed list drags down your sender score. The re-engagement campaign either wins them back or gives you clean data on who's actually gone.
Deliverability monitoring should run continuously, not just when things break. Set up alerts for daily bounce rate changes above 2%, complaint rate above 0.03%, and any sudden drop in inbox placement percentage. Most ESPs don't alert on these by default. You need to build or buy that visibility yourself. I use a combination of Google Postmaster Tools, MXToolbox, and a simple dashboard that aggregates inbox placement test results from multiple mail providers. It takes about 15 minutes to refresh and 2 minutes to scan. If you're doing it weekly, you're already behind. The checklist above covers the operational core. There are edge cases that won't appear on any template. A client of mine was sending through a third-party event platform that appended tracking parameters to every link in a way that conflicted with their ESP's own tracking. The result was double-encoded URLs that some providers flagged as suspicious. We found it by comparing raw HTML source between a direct send and a platform-forwarded send. The fix was coordinating with the event platform to disable their URL rewriting and handling all tracking through the ESP's native integration. It took two weeks of back-and-forth to get resolved. Another common failure point: multithreaded sending. If your ESP is distributing your list across multiple IPs or using concurrent connections to reduce send time, the reputation impact can be unpredictable. Some providers penalize domains that exhibit burst patterns. Slower, steadier sends from a single warmed IP often outperform aggressive multi-IP approaches for most mid-volume senders. Test both and compare inbox placement, not just send speed.
There's no comprehensive download file that fixes this. The value is in running through it methodically, understanding which items apply to your specific stack, and setting up the monitoring infrastructure so you catch problems before they become reputation damage. The checklist is a starting point, not a completion milestone.
