Why Email Deliverability Due Diligence Gets Skipped — and Shouldn't
When you're evaluating an online business built on email revenue — a DTC brand running 25-30% of revenue through flows and campaigns, a newsletter monetized by sponsorships, or a SaaS product with a nurture-driven funnel — most buyers check two things: list size and the open rate the seller reports in a screenshot. That's not due diligence. It's trusting a number you can't verify.
Deliverability is the layer that determines whether that list actually reaches an inbox after you take ownership. A 40,000-subscriber list with a decayed sender reputation, a missing DMARC policy, and a 0.4% spam complaint rate is not the same asset as a 40,000-subscriber list with clean authentication and a 0.03% complaint rate — even if both show identical open rates on the seller's dashboard screenshot. One keeps generating revenue after closing. The other lands in spam within weeks of a domain or ESP change, and there's often no fast way back.
This is separate from the list-ownership and GDPR-consent questions you should already be asking (who legally owns the list, what consent was captured, what the data processing agreement says). Deliverability due diligence is a technical health check on the infrastructure that gets that list into an inbox at all.
1. Authentication Records: SPF, DKIM, DMARC
What to request: DNS zone file access or a screenshot of the TXT records for the sending domain(s), plus ESP-side authentication settings. What "healthy" looks like:- An SPF record listing every authorized sending source, ending in "~all" or "-all" — not a record that's missing entirely or exceeds the 10 DNS-lookup limit (a silent failure mode most sellers don't know exists).
- DKIM keys configured and passing for every ESP and transactional sender in use (marketing platform, transactional email service, helpdesk, invoicing tool — sellers often run 3-4 senders under one domain).
- A DMARC record with a policy beyond "p=none". "p=none" means DMARC is only monitoring, not enforcing — the domain is more exposed to spoofing and, increasingly, gets deprioritized by Gmail and Yahoo's bulk-sender rules.
2. Sender and Domain Reputation
Authentication tells you the mail is legitimate. Reputation tells you whether mailbox providers trust it.
What to check:- Blocklist status for the sending domain and IP ranges (a five-minute check against the major blocklists).
- Google Postmaster Tools history, if the seller has access — domain reputation trend, spam-rate trend, and IP reputation over the past 90 days.
- Bounce classification — is the ESP separating hard bounces (suppress immediately) from soft bounces (retry, then suppress after a threshold)? Sellers who never clean hard bounces are quietly training mailbox providers to distrust the domain.
A domain with a "low" or "bad" Postmaster Tools reputation doesn't recover in days — expect weeks of reduced sending volume and manual rebuilding after closing, a real integration cost that should factor into your timeline, not just your price.
3. List Hygiene and Engagement Decay
Lists decay 20-30% a year even when well maintained. The question isn't whether the list has decayed — it's whether the seller has been managing that decay or ignoring it.
Ask for a cohort breakdown, not an aggregate open rate:- Engaged (opened or clicked in the last 90 days)
- Lapsing (no engagement in 90-180 days)
- Dormant (180+ days, never suppressed)
A list where 60% sits in the dormant bucket and still gets mailed on every campaign is actively damaging sender reputation on every send — and it inflates the subscriber count you're valuing the list against.
Also check: double opt-in vs. single opt-in acquisition sources, whether purchased or scraped lists were ever merged in (a common and hard-to-reverse mistake), and unsubscribe processing time.4. Spam Complaint Rate and Inbox Placement
Ask for the complaint rate by campaign, not a lifetime average. Gmail's threshold for penalizing bulk senders sits at a fraction of a percent — sustained complaint rates above that trigger inbox placement problems that compound over time, independent of content quality.
If the seller can't produce this data from their ESP, that's itself a signal: complaint monitoring isn't part of their process, and you're buying blind on the metric most likely to sink deliverability post-close.
Independent inbox-placement testing (seed-list tools that show where a campaign actually lands across Gmail, Outlook, and Yahoo) is worth running once during due diligence if the list is a meaningful share of the valuation — a cheap way to verify seller-reported metrics against reality.
5. The Acquisition-Specific Risk: Closing-Day Migration
This is the part generic deliverability guides don't cover, because it only applies to a change of ownership.
Domain or ESP migration on closing day is the single highest-risk moment for the list's deliverability. Moving a list to a new sending domain, or moving the same domain to a new ESP, resets a meaningful part of the reputation signal mailbox providers have built up. Send at the old volume from day one and you risk a sharp, visible drop in inbox placement right when you need the list to perform. Plan for:- A warm-up schedule if you're changing sending domain or ESP — ramping volume over 2-4 weeks rather than blasting the full list immediately.
- Keeping DNS records in place during any transition window so authentication doesn't break mid-migration.
- Segmenting the first sends to the most engaged cohort, not the full list, to protect early reputation signals during the handover.
Budget this into your first-30-days plan the same way you'd budget for ad account transfer friction — it's a real, temporary revenue dip, not a hypothetical one.
Red Flags That Should Pause the Deal
- No DMARC record, or "p=none" with no plan to move to enforcement.
- Seller can't or won't share Google Postmaster Tools or complaint-rate data.
- Aggregate list metrics only — no cohort or engagement segmentation available.
- Evidence of purchased or scraped list segments merged into the main list.
- A recent, unexplained drop in open rate the seller attributes to "seasonality" without data to back it.
FAQ
Does this replace GDPR or list-ownership due diligence?
No — treat it as a separate, additional layer. Ownership and consent tell you whether you're legally allowed to email the list. Deliverability tells you whether those emails will actually be seen.
Can I check any of this without seller cooperation?
Partially. Blocklist status and a basic DNS/authentication check (SPF, DKIM, DMARC records) are public and can be verified independently before you even sign an LOI. Complaint rate and Postmaster Tools history require seller-side access.
How long does this take?
A basic authentication and blocklist pass takes under an hour. A full audit with cohort analysis and inbox-placement testing is closer to a half-day — reasonable to run in parallel with financial due diligence.
What if the seller refuses to share complaint-rate data?
Treat it the same as refusing GSC access on an SEO-driven asset: a hard stop until resolved, not a minor omission.
Ready to put this checklist to work? Browse deals across marketplaces, filter listings from Flippa and Empire Flippers, or set up deal alerts for email-driven businesses in your niche.