deliverability-monitoring

Files (4)

• SKILL.md
• framework-notes.md · references/
• check-output.py · scripts/
• output-template.md · templates/

SKILL.md (first lines)

# Deliverability Monitoring

## Overview

Deliverability Monitoring provides continuous surveillance of email infrastructure health — the foundation on which all outbound GTM rests. The core principle is that deliverability problems compound silently: by the time you notice lower reply rates, reputation damage may already be weeks deep and require months to repair. This skill prevents the catastrophic mistake of discovering deliverability issues through pipeline decline rather than proactive monitoring.

The non-obvious rule: deliverability is not binary (delivered vs bounced). It exists on a spectrum — inbox vs spam folder vs promotions tab vs graymail vs blocked. A "delivered" email that lands in the spam folder is effectively undelivered. This skill measures inbox placement, not just delivery status.

This skill produces a Domain Health Dashboard with: real-time bounce tracking across all sending domains, spam placement rates by mailbox provider, blacklist status across 50+ blacklists, DMARC aggregate report analysis with forwarding source identification, authentication health scores (SPF/DKIM/DMARC), and predictive reputation trend alerts.

## When to Use

- User says "check my deliverability" or "domain health check" → activate this skill
- User mentions "bounce rate is high" or "emails going to spam" → use this skill for diagnosis
- User asks "is my domain blacklisted" or "blacklist check" → activate monitoring module
- User says "DMARC reports" or "who is sending as my domain" → run DMARC analysis
- User mentions "spam placement" or "inbox rate" → track placement by provider
- User asks "domain reputation" or "sender score" → check reputation scores
- Trigger phrases: email deliverability, bounce tracking, spam folder, sender reputation, email authentication, DKIM SPF, domain warming, inbox placement test

Do NOT use for:
- Setting up DNS authentication initially → use domain-infrastructure
- Writing relevant, permission-aware email content → use cold-email-copywriting
- Campaign performance analysis (opens, replies, meetings) → use campaign-analytics
- Choosing or configuring sending platforms → use sending-platforms
- Sequence design or cadence → use cold-email-strategy

## Authoritative Foundations

This skill draws from the following established methodologies:

- **M3AAWG (Messaging, Malware, Mobile Anti-Abuse Working Group)** — Industry best practices for email deliverability. M3AAWG publishes the authoritative guidance on complaint thresholds, authentication requirements, and sender reputation management that major mailbox providers (Google, Microsoft, Yahoo) implement.

- **Google Postmaster Tools** — Official Gmail deliverability data including IP reputation, domain reputation, spam rate, authentication status, and delivery errors. Google's February 2024 sender requirements (mandatory SPF/DKIM/DMARC, <0.3% spam complaint rate) are the new baseline.

- **Microsoft SNDS (Smart Network Data Services)** — Outlook/Hotmail deliverability data including spam complaint rates, trap hits, and delivery status by IP. Microsoft's filtering is distinct from Google's — a domain can be fine with Gmail and blocked by Microsoft.

- **Validity (Return Path)** — Inbox placement measurement across global mailbox providers. Seed-list-based testing confirms whether emails reach inbox, spam, or are missing entirely. Industry standard for placement benchmarking.

- **DMARC.org** — DMARC specification and aggregate report format (rua). DMARC reports are XML files sent by receiving mail servers showing authentication results for every email claiming your domain — the only way to detect unauthorized domain use.

## Prerequisites

- Access to DNS management for all sending domains (to check/modify SPF, DKIM, DMARC records)
- Google Postmaster Tools set up and verified for each sending domain (requires domain verification via DNS TXT record or HTML file)
- Microsoft SNDS access (requires Microsoft account and JMRP enrollment)
- DMARC aggregate report (rua) email address configured and receiving reports
- Sending platform analytics access (Smartlead, Instantly, Salesforge, Apollo) for bounce data
- Optional: Validity/Everest, MXToolbox, or GlockApps subscription for seed-list testing
- Optional: LeadMagic API key for email validation to pre-screen lists (referenced as optional tool for Email Validation endpoint)
- Recommended upstream skill: domain-infrastructure (if DNS setup is incomplete)

## Step-by-Step Process

### Phase 1: Intake

Gather required information from the user. Ask all questions at once. Do not proceed until all answers are received.

Required intake questions:

1. **Domain inventory**: List all sending domains (primary + secondary cold outreach domains). How many total? How many mailboxes per domain?
2. **Sending volume**: Current daily send volume per domain and per mailbox. Total sends in the last 30 days.
3. **Sending platform**: Which platform(s) are being used? (Smartlead, Instantly, Salesforge, Apollo, custom SMTP?)
4. **Observed issues**: What deliverability problems have been noticed? (High bounce rate, low open rates, spam complaints, specific domains bouncing you, blacklisting?)
5. **Recent changes**: Any changes in the last 30 days? (New domain added, volume increased, sequence changed, new sending platform, DNS changes?)
6. **Monitoring access**: Do you have Google Postmaster Tools and Microsoft SNDS set up? Is DMARC reporting email configured? Credentials or access needed?
7. **Bounce data availability**: Can you export bounce data from your sending platform for the last 30-90 days?

### Phase 2: DNS Authentication Audit

Verify all three authentication mechanisms for every sending domain:

1. **SPF Check**:
   - Query TXT record for each domain: `dig TXT domain.com | grep "v=spf1"`
   - Verify it includes your sending platform's IPs or includes
   - Check for common errors: multiple SPF records (invalid), missing mechanism for sending service, `~all` or `-all` at end, no DNS lookup limit exceedances (10 max)
   - Validate SPF doesn't exceed 10 DNS lookups (each include, a, mx, ptr counts). Use SPF flattening if needed.

2. **DKIM Check**:
   - Query DKIM selector for each domain: `dig TXT selector._domainkey.domain.com`
   - Verify key length >= 1024 bits (2048 recommended)
   - Confirm selector matches what sending platform publishes
   - Check for expired or misconfigured keys
   - Multiple sending platforms require multiple DKIM selectors — ensure no conflicts

3. **DMARC Check**:
   - Query DMARC record: `dig TXT _dmarc.domain.com`
   - Verify policy: `p=none` (monitoring only), `p=quarantine` (partial enforcement), or `p=reject` (full enforcement)
   - Check `rua` tag is present for aggregate report delivery
   - Verify `ruf` tag for forensic reports (optional but useful)
   - Check `pct` tag if gradual enforcement is in use
   - Validate alignment mode: `adkim=r` vs `adkim=s` (strict recommended), `aspf=r` vs `aspf=s`

4. **BIMI Check** (optional, for brand display):
   - Query BIMI record: `dig TXT default._bimi.domain.com`
   - Verify VMC (Verified Mark Certificate) if logo display desired

5. **DNS propagation check**: Verify all records resolve from multiple geographic locations using a tool like `dig +trace` or MXToolbox DNS check.

### Phase 3: Bounce Rate Analysis

Analyze bounce patterns to identify root causes:

1. **Export bounce data** from sending platform: date, recipient email, bounce type (hard/soft/block), bounce reason/code, sending domain, sending mailbox, campaign/sequence.

2. **Categorize bounces** by type:
   - **Hard bounces (5xx codes)**: Mailbox doesn't exist (550), domain doesn't exist (NXDOMAIN), user unknown (551), mailbox full and no longer accepting (552). These are permanent failures.
   - **Soft bounces (4xx codes)**: Mailbox full (temporary), server temporarily unavailable (450/451), connection timed out, greylisting, rate limiting. These are transient.
   - **Blocks**: Connection refused (554), spam content detected, IP/domain on blocklist, policy rejection. These indicate reputation problems.
   - **Spam complaints**: Not a bounce but tracked via feedback loops (FBL). If platform provides complaint data, track separately.

3. **Calculate bounce metrics**:
   - Overall bounce rate: total bounces ÷ total sent
   - Hard bounce rate: hard bounces ÷ total sent (target: <2%)
   - Soft bounce rate: soft bounces ÷ total sent (target: <3%)
   - Block rate: blocks ÷ total sent (target: <1%)
   - Per-domain bounce rate: bounces by sending domain ÷ sends by domain
   - Per-mailbox bounce rate: bounces by mailbox ÷ sends by mailbox
   - Per-provider bounce rate: bounces at Gmail/Outlook/Yahoo ÷ sends to each

From LeadMagic/gtm-skills, MIT.

More from LeadMagic/gtm-skills