January is the quiet window between peak seasons. The full-stack audit that catches drift in authentication, DNS, list hygiene, and monitoring before it costs mail.
Deliverability infrastructure decays without breaking. SPF records accumulate vendors nobody uses, CNAME delegations outlive their contracts, sunset policies spring leaks through CRM syncs, and alert thresholds calibrated for last year's volume quietly stop firing at this year's. None of it fails loudly until the week it matters. January, sitting in the trough between Q4 peak and spring campaigns, is the natural window for the audit that finds all of it, and this checklist is the one we run.
Authentication: verify, do not assume
Start where enforcement lives. Pull a week of DMARC aggregate reports and confirm every legitimate source passes with alignment; anything at spf=permerror or dkim=fail on your own infrastructure is finding number one. Count effective SPF lookups on every sending domain (the budget is 10, the working ceiling is 8) and delete includes for vendors that no longer appear in report traffic. Check DKIM key ages against the rotation policy, confirm 2048-bit keys everywhere, verify no signature carries an l= tag, and read one real delivered message per stream at Gmail with "Show original" as the end-to-end proof.
Authentication audit
- All legitimate sources aligned and passing in DMARC aggregate reports
- SPF lookup counts at 8 or below per domain; dead vendor includes removed
- DKIM keys 2048-bit, rotated on schedule, no l= tags, mutable headers oversigned
- DMARC policy at enforcement (or a dated plan to get there), sp= set deliberately, pct removed
- Parked and non-sending domains at v=spf1 -all, p=reject, null MX
DNS and infrastructure: the drift layer
Resolve every email-related CNAME end to end and delete delegations pointing at cancelled vendors; dangling DKIM and bounce-domain delegations are the takeover vector nobody notices until an incident report does. Confirm forward-confirmed reverse DNS on every sending IP, including any IPv6 paths, where Gmail rejects outright on missing rDNS. If MTA-STS is deployed, verify the policy host certificate, the mx list against current MX records, and that TLS-RPT reports are still arriving; a report stream that went silent is itself a finding. Check DNSSEC signature expiry monitoring if DANE is in play.
List hygiene: test the machine, then the policy
First the machine: send to a known-suppressed test address and confirm it is actually blocked, because the classic hygiene failure is a leaky enforcement path, an import route or CRM sync that resurrects suppressed records. Then the policy: check that the sunset rule is running (when did it last suppress anyone?), that its engagement definition still excludes machine opens, and that the Q4 disengaged cohort has been swept rather than carried into the new year. Finally the inputs: bounce webhook processing alive on every stream, FBL mail flowing from JMRP and the Yahoo CFL, and complaint suppression executing within minutes.
Compliance and monitoring: the meta-layer
Run the bulk sender checklist against every domain over or approaching the 5,000-a-day line, and remember the enforcement climate hardened again while you were shipping Q4: Gmail and Microsoft now both reject non-compliant bulk mail outright rather than foldering it. Verify one-click unsubscribe headers on every promotional stream by reading raw headers, and confirm the endpoint honors a bare POST. Then audit the watchers: alert thresholds against current volume (a 3x-baseline deferral alert tuned to last January's volume may never fire at this year's), dashboard registrations covering every active domain and IP, and the on-call runbook still matching reality after a year of infrastructure changes.
Running it without ceremony
The audit as a project
- 1
Timebox it to two days
One engineer-day for authentication and DNS, one shared day for hygiene, compliance, and monitoring. Perfectionism here is procrastination with a checklist.
- 2
Produce findings, not vibes
Every check yields pass, finding, or fix-now. Fix-nows get done during the audit; findings get owners and dates.
- 3
Snapshot the baseline
Record the January numbers: lookup counts, list size and engagement rates, complaint baselines, deferral rates per provider. Every incident this year will want them.
- 4
Diff against last year's audit
The second year is where this compounds: what drifted, what recurred, and which findings from last January never got fixed tell you where process is missing.
The audit is deliberately boring, which is its virtue: every item is a known failure mode from this publication's archive, checked before it becomes an incident. A day or two in January routinely surfaces two or three genuine problems, each cheaper to fix now than in the week a campaign depends on it.
Frequently Asked Questions
Why January rather than quarterly?
Who should own the audit?
What is the most common finding in practice?
Does this replace continuous monitoring?
Key Takeaways
- Deliverability infrastructure decays silently; a structured January audit resets the baseline for the year
- Verify authentication from DMARC report data and real delivered headers, never from configuration assumptions
- Test the suppression machine with a known-suppressed address before trusting any hygiene policy
- Audit the monitoring itself: thresholds drift from volume, report streams go silent, runbooks go stale
- Produce dated findings and a numbers snapshot; the diff against next January is where the practice compounds
Related articles
Half-Year Review: Email in the AI Inbox Era
Six months that rearranged the reading layer: Gemini in Gmail, Microsoft rejecting outright, DMARC finally a standard. What the first half of 2026 means for senders.
Deliverability Postmortems: Learning From Incidents
The incident is over, placement recovered, and the pressure to move on is enormous. The blameless postmortem practice that converts each incident into prevention.
Writing for AI Readers: Structure When Gemini Summarizes You
Five months of AI Overviews data shows opens up and clicks down: recipients read summaries. How to structure email so the model's version still does your job.