/email-deliverability-audit

name: email-deliverability-audit
description: Diagnostic audit for a running cold email program. Checks domain authentication (SPF/DKIM/DMARC), inbox health/reputation from Smartlead, bounce rate by inbox type, and optionally runs a spam placement test via Smartlead's Smart Delivery API. Outputs markdown report + CSV with per-domain/per-inbox scores and concrete action items. Use when reply rates drop, when bounces spike, when onboarding someone else's account, or as a weekly/monthly health check.

Email Deliverability Audit

**If your positive reply rate is dropping and you don't know why, start here.** Most of the time the problem is deliverability — your emails aren't reaching inboxes. This skill tells you what's broken.

What it checks

| Layer | What | How | |---|---|---| | DNS auth | SPF, DKIM, DMARC present on each sending domain | `dig` commands | | Inbox health | Warmup status, reputation, blocks, connection failures | Smartlead email-accounts API | | Volume health | Daily sent trending, capacity utilization | Smartlead analytics | | Send + reply rate per inbox | Sent count, reply count, reply rate % over lookback period | Smartlead campaign analytics | | Bounce rate | Per-inbox and per-domain bounce rate over last 30 days | Smartlead campaign analytics | | Spam placement | Real inbox-vs-spam test via Smartlead Smart Delivery | optional |

The 1% rule — and the floors that gate it

**A healthy domain replies at 1% or better after 200 emails sent.** Below 1% on a fair sample, something is broken, and if it stays broken the domain gets cancelled.

The 1% rule is **one number**: the same 1% that flags a domain here is the line that retires it in `/inbox-lifecycle-manager`. What separates "flag" from "cancel" is not a softer second threshold — it is the **floors**. Below a floor, the answer is "we don't know yet", which is a legitimate output rather than a failure.

| Judgment | Floor before it counts | |---|---| | Reply rate | **200 sends** in the window | | Bounce rate | **50 sends** | | Bounce *composition* (which bucket) | **30 classified bounces for that domain** | | Any cancel decision | **30 days of domain age**; unknown age counts as young | | Placement test | 100-300 senders per test |

Reporting `0.00% reply` on 14 sends as a failure, or condemning a three-week-old domain that has not finished ramping, is how healthy domains get killed.

| Reply rate (≥200 sends) | Reading | |---|---| | **≥ 1.5%** | Genuinely good. Leave it alone. | | **1.0 - 1.5%** | Healthy. The rule passes. | | **< 1.0%** | Burned. Hand to `/inbox-lifecycle-manager` — but only if it also clears the 200-send and 30-day floors. | | **0 replies on ≥150 sends** | Decisive. A flat zero needs less sample than a low-but-nonzero rate. |

Possible causes when a domain is below the line (the audit's root-cause suggestions try to pinpoint which):

• Emails landing in spam — run the spam placement test
• Domain reputation damaged — check DMARC reports and the bounce codes
• Copy is broken — re-run `/spam-word-checker`; confirm with a control-fleet placement test
• List is cold or wrong ICP — check bounce rate; if >3%, the list is the problem, not the domain
• Inbox hasn't warmed enough — check warmup status and domain age

The domain-vs-copy isolation test

Low placement alone does not tell you whether the domain is burned or the copy is toxic. Run the same copy from a known-good control fleet:

| Your fleet | Control fleet | Verdict | |---|---|---| | < 100% | ~100% | **Domain-side.** Your sending infrastructure is the problem. | | < 100% | < 100% | **Copy.** Rewrite before you replace a single domain. | | ≥ 85% | ≥ 85% | Neither. Infrastructure is fine — this is targeting or offer. | | control untestable | — | Assume copy. It is cheaper to fix and reversible. |

When to use

• Reply rate dropped by >30% week-over-week → run the full audit
• Bounces spiked above 2% → run auth + spam-placement checks
• Before scaling a campaign (make sure infrastructure is ready)
• Monthly as routine hygiene
• When taking over a Smartlead account you didn't set up

Inputs

• `SMARTLEAD_API_KEY` (env)
• Optional: scope the audit
• `--client-id=X` (for sub-clients)
• `--campaign-id=X` (audit only one campaign's inboxes)
• `--domain=example.com` (audit only one domain)
• `--tag=active` (audit only inboxes tagged active)

Steps

1. Pull the inbox inventory

npx tsx scripts/audit-inboxes.ts --all --out=/tmp/audit/inboxes.csv

Outputs per inbox: id, email, domain, warmup_status, reputation, max_warmup/day, sent_today, smtp_ok, imap_ok, is_blocked, tags.

2. Check domain authentication

npx tsx scripts/check-domain-auth.ts --from-csv=/tmp/audit/inboxes.csv --out=/tmp/audit/auth.csv

For each unique domain, runs:

dig TXT <domain> +short                             # SPF
dig TXT _dmarc.<domain> +short                      # DMARC

# DKIM has NO single selector. Present if ANY of these resolves:
dig TXT   google._domainkey.<domain>    +short      # Google / Gmail-backed — the common one
dig CNAME selector1._domainkey.<domain> +short      # Microsoft 365 — a CNAME, TXT returns nothing
dig CNAME selector2._domainkey.<domain> +short      # Microsoft 365, second key
dig TXT   default._domainkey.<domain>   +short      # generic fallback, frequently empty

⛔ **Never check `default._domainkey` alone.** It is empty on most real fleets, and a `default`-only check reports every domain as "missing DKIM" — which routes genuinely burned domains to "fix your DNS" and wastes a week republishing records that already exist. The script tries all four and reports which one resolved.

Outputs: domain, spf_present, spf_strict, dkim_present, dmarc_present, dmarc_policy (none/quarantine/reject).

3. Pull sent + reply + bounce metrics per campaign/inbox

npx tsx scripts/audit-performance.ts --days=30 --out=/tmp/audit/performance.csv

Walks all active campaigns, pulls per-