6 Deliverability Questions to Ask an Outbound Agency Before You Sign

The 6 questions, at a glance

I run cold email and LinkedIn as one sequence for B2B clients, with 2000+ meetings booked for B2B clients so far, and deliverability is the one part of an agency's pitch you don't have to take on faith. Most of it is checkable inside a single screen share.

Why deliverability is the claim you can actually check

Meeting counts, reply rates and "proprietary data" are hard to verify before you sign. Deliverability is different: it rests on a handful of DNS records and a dashboard that either exists or doesn't, and most agencies will share a screen rather than just a slide if you ask the right way. Inbox placement itself stays a grey zone, nobody outside Gmail and Microsoft sees the full picture, but the six things below are things an agency either has in place or doesn't, and you can tell the difference in the same call where they pitch you.

Is SPF, DKIM and DMARC enforced, or just present?

Almost every agency will say yes when you ask if they use SPF, DKIM and DMARC. The real question is whether DMARC is set to actually act on a failure. A domain can carry a DMARC record and still sit at p=none, which tells receiving mail servers to take no action and just report, the lowest setting on the policy, explained on DMARC.org's own overview. Enforcement means p=quarantine or p=reject. Google's own bulk sender guidelines require SPF, DKIM and DMARC for anyone sending more than 5,000 messages a day to Gmail addresses, so this isn't an optional extra at real volume, it's a baseline Google itself enforces.

• Ask: "What's your DMARC policy today, none, quarantine or reject, and can you show me the DNS record?"
• Good answer: A policy named without checking, and a live lookup if you ask.
• Red flag: "We have all three set up" with no policy level named.

Whose name are the sending domains in?

Cold volume should run from domains separate from your root domain, so a deliverability problem never touches the address your company actually trades on. The harder question is who owns that separate domain. If it's registered in the agency's name, leaving means starting warmup from zero on domains you never had. The longer version of this is in who owns your domains when you cancel an outbound agency.

• Ask: "Whose registrar account will the sending domains sit in, and can I see the WHOIS or registrar login myself?"
• Good answer: Yours, from the first domain purchased.
• Red flag: "Ours, we'll transfer them if you leave."

How long is the warmup, and what's the volume cap after it?

A new mailbox needs time to build a sending history before an inbox provider trusts it at volume. In my own practice, a new mailbox runs 3 to 4 weeks of warmup before it reaches 20 to 30 emails a day, and the cap stays there rather than climbing indefinitely. An agency doesn't need my exact numbers, but it should have its own and state them without checking a document first.

For the domain and mailbox side of this, the stack I run for clients is Mailforge and Infraforge for domains and mailboxes and Warmforge for warmup, a personal preference built on what I've used, not a verdict on anyone else's stack. No tool in this article pays me: no commission, affiliate or partner deal with any of them, and I've written guest articles for Salesforge's blog, a different product from the same company.

• Ask: "How many weeks of warmup before a mailbox goes live, and what's the daily send cap once it's live?"
• Good answer: A specific week count and a specific per-mailbox number.
• Red flag: Full volume inside the first week, or no cap named at all.

What spam rate do they commit to, and how do they watch it?

This is the number that turns "we're careful about deliverability" into something you can hold them to. Google's own guidelines ask bulk senders to keep the spam rate reported in Postmaster Tools under 0.30%, and treat that threshold as the line where increased spam classification kicks in. An agency with a real deliverability practice should be running meaningfully under that line, not aiming at it.

• Ask: "What spam rate do you target, and which tool do you watch it in?"
• Good answer: A specific percentage, named tool, offered to show live.
• Red flag: "We monitor deliverability closely" with no number and no tool named.

Can you see the one-click unsubscribe actually work?

Every send should carry a working one-click unsubscribe with immediate suppression, not a mailto link buried in a footer. This is cheap for an agency to demonstrate and easy for them to skip if nobody asks: send a test address through their system, unsubscribe it, and ask to see it drop out of the next send.

• Ask: "Can you add a test address to a sequence, unsubscribe it, and show me it's suppressed before the next send?"
• Good answer: Yes, on the call or within a day.
• Red flag: "It's built into the platform" with no offer to demonstrate it.

What happens when a domain starts to slip?

Deliverability degrades gradually, a bounce rate creeping up, a complaint rate ticking over a threshold, a domain reputation score dropping, before it becomes an obvious problem. An agency with a real process has a named trigger that pulls a domain out of rotation automatically rather than waiting for a client to notice replies have dried up.

• Ask: "What specific metric, at what threshold, makes you pull a domain out of sending?"
• Good answer: A named metric and number, with a plan for requalifying the list before resuming.
• Red flag: "We keep an eye on it and step in if needed," with no threshold named.

The one agency that put all six in writing

Most agency pitches describe deliverability in general terms: "we're careful," "we monitor closely," "we have a proprietary process." Leadium is a rare exception. Its own blog post on choosing a cold email marketing agency, checked 6 November 2026, lays out what it calls "the Leadium Deliverability Underwrite": SPF, DKIM and DMARC set to enforcement, separate sending domains registered in the client's name, 2 to 3 weeks of warmup before campaign volume, a spam rate under 0.10% monitored in Google Postmaster Tools, one-click unsubscribe with immediate suppression, and a named kill-switch that stops sending when the complaint rate, bounce rate or domain health degrades past a threshold.

That page doesn't prove Leadium meets its own bar on every account, and publishing a standard is not the same as an audited result. What it does prove is that an agency can write all six of these down in plain language instead of hiding behind "we take deliverability seriously." That's the bar to hold any agency to, this one included, whether or not they wrote it down first.

Copy quality is a deliverability variable too

Authentication, warmup and volume caps are the technical side. The content side matters too, and it's easy to miss when you're only asking about DNS records. I looked at two 2026 studies that found AI-generated cold email gets flagged as spam roughly two to three times more often than human-written copy, with bounce rates identical between the two groups, a sign the gap comes from content pattern rather than list quality or technical setup. If an agency leans on AI drafting at volume, ask how it breaks up repeated sentence structure across a batch, not just how it handles DNS.

• Ask: "If AI drafts the copy, who edits it before it sends, and how do you avoid the same three or four openers across a batch?"
• Good answer: A named human editing step, specifically to vary structure, not just fix tone.
• Red flag: Fully autonomous drafting with no human pass before volume sends.

Three answers that should end the call

Some answers are worse than a vague one, they're a direct signal to walk away:

• "We use our own domains" with no clarity on who owns or authenticates them. That phrasing usually means the domains stay in the agency's accounts indefinitely.
• DMARC at p=none, presented as if it were enforcement. It isn't, it's monitoring only.
• A volume promise with no complaint-rate commitment attached. "We can send 50,000 emails a month" without a stated spam-rate ceiling shifts the risk of a burned domain onto you.

How to run this before the second call

Send the six questions in writing before you get on a second call, and ask for a live Postmaster Tools screen share on an existing account, with client names removed, as part of that call. An agency with a real deliverability practice can show this without notice. One that can't is telling you something, even if nobody says it out loud.

This sits alongside the broader buying questions in how to vet an outbound agency, a 12-point checklist, and if you'd rather run deliverability yourself instead of outsourcing it, the mechanics are in the full deliverability guide.

FAQ