Cold email pre-send checklist

1. Check SPF, DKIM, DMARC, and MX

The domain in the From address needs SPF, DKIM, and DMARC, plus MX so replies have somewhere to land. SPF is one TXT record on that domain, starting with v=spf1. It names the servers allowed to send. Two SPF records are a permanent error: a receiver does not pick one. Every tool that sends has to share the single record.

DKIM publishes a public key at a selector such as google._domainkey or selector1._domainkey. The tool that sends the campaign has to sign with a key on this domain. A Google-only key does not cover a sequencer. DMARC is the TXT record on _dmarc. Start at p=none with a rua mailbox so you can read reports. p=none does not block forgery. Move to p=quarantine or p=reject only after real mail aligns. No MX means the reply bounces.

The commands are in the SPF, DKIM, and DMARC guide. ColdLint's checker explains the live lookup. It tries common selectors, including google, selector1, and selector2, and it follows CNAMEs. A custom selector is not found on that list, which is not proof the key is missing. A timeout is a lookup error, not a missing record. It does not walk SPF includes, so it will not catch the 10-lookup limit.

2. Send from a separate domain

Send the campaign from a domain you can afford to damage. Invoices, password resets, and customer mail should stay on a domain you are not pointing at a cold list. A separate registered domain is the clean split. Give it its own SPF, DKIM, DMARC, and MX, and use it in the From address.

A subdomain is weaker isolation than people expect. Parent DMARC applies to a subdomain that publishes none, and providers already tie the two names together. Publish DMARC on the subdomain anyway. Do not imitate another company's name. ColdLint checks the domain you type. It does not know if that domain is your primary one.

3. Warm the mailbox first

A new domain has no history. Do not open at the provider's daily ceiling. Publish the records, mail people who expect it, answer the replies, and raise the daily count only while bounces stay rare.

Google publishes a limit of 2,000 messages a day for most paid Google Workspace accounts, and a lower limit on trial accounts. Microsoft publishes a recipient rate limit of 10,000 recipients a day for Exchange Online. Those are ceilings for all mail from the mailbox, not a cold-email target. Stay well under them. ColdLint does not see mailbox age, warmup, or yesterday's volume.

4. Fix the merge tags

A broken tag is delivered as the characters you typed. Instantly and Smartlead use double braces with no spaces: {{firstName}}, {{companyName}}. ColdLint leaves that shape alone. It flags a missing brace, a single pair of braces, square brackets such as [First Name], and percent tags such as %FIRST_NAME%.

A correctly spelled tag still renders blank when the column is empty. Send one copy to yourself from a real row and read what arrived. ColdLint cannot see the spreadsheet.

5. Cut spam-trigger wording

Filters have weighed a familiar set of phrases for years: act now, limited time, click here, buy now, this isn't spam, guaranteed, and lines like 100 percent free. One mild phrase in a short note is rarely the whole problem. Several of them, next to a hard sell, is a pattern. Write the sentence you would say to one person.

Spam rules leave feel free alone. AI-phrase rules still flag feel free to reach out. The spam word checker uses a fixed list. It is not Gmail's filter. It will miss a new gimmick, and it will also flag a phrase you meant literally. Scoring does not call a model, so the same paste always gets the same result.

6. Keep links, tracking, and images in check

One link to a real page on a domain you control is enough for a first email. In ColdLint, two links is a warning and three or more is high risk. Shorteners hide the destination. The checker flags bit.ly, tinyurl.com, t.co, and a short list of similar hosts on their own.

Open tracking is a hidden image. Some inboxes prefetch images, so an open is not a person reading. Click tracking rewrites the URL onto another host. Use a tracking hostname you control, on the sending domain, usually a CNAME the sequencer documents. ColdLint counts links in the paste. It does not see a pixel added later, and it does not check that tracking host's DNS.

7. Prefer plain text

Write it as plain text, or the lightest HTML the tool will send. Skip the banner and the logo on the first touch. ColdLint flags an image in the paste. It does not render HTML.

8. Keep the sequence short

Three or four steps is enough for most campaigns. The first email carries one specific reason to write. Later emails are shorter and add a new fact, instead of repeating the opener. Step count alone does not produce replies. Follow-ups that only say bumping this or as per my last email are on ColdLint's AI-phrase list.

Separate steps with a line that contains only ---. Each step is scored, and the worst step sets the verdict. Under 20 words is thin for a first touch. Over 180 is long. The checker calls 40 to 130 words a comfortable length.

9. Put an opt-out in the email

End with one plain sentence that says how to stop, then honor it. If you send commercial email to people in the United States, the CAN-SPAM Act requires that opt-out, a valid physical postal address, and honest headers and subjects. It does not require permission first. Other countries often do. Under the GDPR, email to a person generally needs a lawful basis, and for a cold first touch that is often consent. This page is not legal advice.

Google's sender guidelines also ask for a one-click List-Unsubscribe header around 5,000 messages a day to personal Gmail accounts. That header is not the sentence in the body. ColdLint only reads the paste. It looks for unsubscribe, opt-out, stop emailing, remove me, or email preferences. A missing line is a small finding on a short note, and a heavier one when the copy already sounds like a promotion.

10. Cap how many you send

Set a daily cap per mailbox in the sequencer before you launch. New mailboxes stay low, and even a warmed one stays under the ceilings above. Stop when bounces rise. ColdLint cannot see that number.

11. What ColdLint does, and what it does not

Paste the email, or a sequence split on ---, plus the domain. Rules flag spam phrases, broken merge tags, and AI-sounding lines such as I wanted to reach out, empty compliments, leverage, synergy, and three or more em dashes. Each of those lines gets an edit. The same pass weighs links, shorteners, ALL CAPS, stacked punctuation, images, length, and a missing opt-out.

Free is 3 checks a day, with no account. Pro is $19 a month: unlimited checks, one saved domain, and a daily recheck when cron is configured. Rewrite appears only when the server has an API key. It is told to keep merge tags and not invent facts. The score does not predict inbox placement. Use the spam word checker, the AI email detector, or the domain checker for a single slice. Which domain you chose, whether the mailbox is warm, whether the tracking host is yours, and how many emails go out tomorrow are still your calls.

Questions