Sponsored: A deliverability checkup beyond open rates

Sponsored by our sponsor, an email deliverability consultancy that advertises on Email Vox.

A campaign can record opens without earning human attention. A separate sending domain may not keep the main brand out of a blocklist dispute. And an inbox logo starts with authentication work, not artwork. Those are different problems, so your email checkup needs more than one dashboard.

The recent stories span purchased data, authentication, workflow controls, alerts and compromised infrastructure. Use the six checks below to turn those themes into a practical review. Keep one working document with the evidence, the person responsible and the next decision for each issue; otherwise, a finding can become nobody’s job.

1. Check the audience before buying another domain

Word to the Wise’s reporting connects bad purchased data with blocklist pressure and describes a SURBL dispute involving a sender’s main domain. As the lookalike-domain and blocklist coverage makes clear, that is specific evidence—not proof of an industry-wide crackdown. The useful lesson is narrower: do not treat a separate domain as a guaranteed shield.

Start by documenting where each audience came from. Separate direct signups, customer records and purchased contacts rather than treating them as one list. For each source, record what recipients were told they would receive. This makes it possible to investigate a troubled campaign without guessing which acquisition route supplied its addresses.

Next, map the domains recipients encounter: the visible sender, reply address, website links and tracking links. Record which belong to the main brand and which were introduced for outreach. This inventory does not predict a blocklist decision; it exposes the relationships your “separate” campaign still presents to recipients.

If a listing or provider rejection appears, preserve the exact notice and identify the domain or address it names. Pause the affected activity while you investigate rather than immediately moving the same audience elsewhere. Changing the sending address does not resolve uncertainty about how those contacts were acquired.

2. Make the dashboard say what it measures

Mailgun argues that open tracking still has value, but privacy proxies, security scanners and reporting math complicate it. The distinction in the email open-rate explainer matters: a tracking pixel loading is an observed event, not confirmation that a person read or understood the message.

Write a short measurement definition beside every campaign metric. For opens, record whether the report counts total events or unique recipients and what denominator it uses. Also note whether the platform filters activity it considers automated. Two reports can disagree because their counting rules differ, not because one campaign suddenly performed better.

Pair open trends with outcomes that match the message’s purpose. For a sales message, inspect substantive replies; for a confirmation email, check whether the intended process completed. Keep those outcomes separate rather than combining them into a vague engagement score that conceals which behavior actually changed.

Review any automation that treats an open as permission for the next step. A pixel load alone is a weak reason to accelerate a sales sequence or declare a subscriber active. Where the decision has consequences for recipients, require an additional signal or route the case for review.

3. Put authentication ahead of the logo

Mailgun and Red Sift’s webinar puts Domain-based Message Authentication, Reporting and Conformance (DMARC) enforcement before Brand Indicators for Message Identification (BIMI) logo preparation. Their certificate-preparation tool addresses part of the process, not the whole job. The BIMI and DMARC background is a useful starting point before anyone commissions new artwork.

Build an inventory of legitimate sending services first: marketing platforms, support tools, billing systems and any application that sends as your domain. Ask each owner for a recent message sample. An authentication change made with only the newsletter platform in mind can overlook operational email that customers depend on.

In those samples, inspect Sender Policy Framework (SPF), which checks authorized sending infrastructure, and DomainKeys Identified Mail (DKIM), which uses a cryptographic signature. DMARC adds alignment with the visible sender domain and a policy for failures. Merely finding an SPF or DKIM result is not the same as confirming DMARC passes.

Treat enforcement as a controlled change: identify legitimate failures, correct their configuration and review results before tightening policy. Keep logo eligibility and inbox placement as separate questions. BIMI is not evidence that an audience wants a campaign, and authentication does not turn an unwanted message into a welcome one.

4. Give workflows boundaries and alerts a purpose

Google’s Workspace Studio update adds Gmail reply filtering, nested logic, document search and more meeting data. For an email team, the practical opportunity is more selective automation. Draw the intended workflow before enabling it: what starts the process, which replies qualify and what condition stops further action?

Test branches with messages that should take different paths. Include a genuine reply, an automated response and a case missing information the workflow expects. Record the expected result before running each test. That gives you a way to distinguish a rule defect from an unexpected but valid input.

Mailgun’s Python walkthrough routes email events into Discord and covers setup and testing. The remaining operational question is which events deserve an interruption. Choose alerts that lead to a defined response, name the person who handles them and decide where unresolved cases go after the first notification.

Keep alert content minimal. A useful notification can contain an event type, timestamp and a reference to the restricted investigation record instead of a full message body. Test repeated events too: an alert channel that fills with duplicates makes the important exception harder to spot.

5. Bring security into the deliverability review

The Cisco email gateway report describes active exploitation of an attachment-scanner flaw and a patch. Its operational priorities are specific: check the scanner version, mail policies and signs of compromise. If your organization uses the affected equipment, give the security administrator that task rather than treating it as a campaign-performance issue.

Record who verifies the installed version and who investigates suspicious activity. A completed update and an assessment of possible earlier compromise answer different questions. Keep both outcomes in the review so “patched” does not silently become shorthand for “nothing happened.”

The separate phishing takedown targeted cloud accounts behind infrastructure linked to more than a billion malicious messages. That reported scale concerns the disrupted infrastructure, not every legitimate cloud customer. The relevant lesson is that familiar cloud tools can be used as attack machinery; a recognizable platform is not sufficient evidence of a trustworthy sender.

Review access to sending platforms, cloud accounts and automation credentials with their owners. Remove access that no longer has a business purpose and establish an escalation contact for suspected misuse. An account sending unauthorized mail needs a security response, not just revised campaign copy.

6. Finish with decisions, not a vanity score

Turn the findings into a small decision log: issue, evidence, owner, next action and verification method. Prioritize suspected compromise and broken operational mail ahead of cosmetic work. Then address audience provenance, authentication gaps and misleading workflow triggers according to their actual consequences.

Keep a baseline before changing anything, and compare the same definitions afterward. Where practical, change one variable at a time so the result remains interpretable. Use the deliverability coverage hub for ongoing context, but keep local evidence—message samples, notices and test results—as the basis for decisions about your own program.