Check the control.
Attach the proof.

Inspect representative delivered headers for DMARC pass and identify which authenticated identifier aligns with the RFC 5322 From domain.

Raw headers from each stream and receiver showing alignment, not merely SPF or DKIM pass in isolation.

Align DKIM d= or the authenticated return path with the visible From identity.

Confirm sending IP forward and reverse DNS, TLS use, one valid From mailbox, Message-ID, Date, and syntactically valid messages.

Provider configuration, live DNS evidence, TLS delivery evidence, and representative raw headers.

Escalate provider-owned DNS or TLS gaps and correct malformed message generation.

Test rate controls, confirmation, duplicate handling, typo feedback, disposable-risk policy, and abuse monitoring without blocking legitimate people blindly.

Abuse test results, form-event samples, alert thresholds, and the owner of the response process.

Add layered controls and use confirmation where unsolicited third-party signup risk is material.

Review imports, vendors, enrichment, partner transfers, sales workflows, and contract language for hidden list acquisition.

Policy, import approvals, source audit, and vendor obligations.

Quarantine questionable sources, stop sending, and preserve the investigation trail.

Verify available provider feedback loops and complaint events produce immediate durable suppression with idempotent processing.

Signed event sample, processing log, suppression record, and duplicate/replay test.

Repair complaint ingestion and stop affected traffic when complaint data is unavailable or rising.

Sample enhanced codes and raw replies across address, mailbox, routing, content, security, and policy outcomes.

Mapping table version, raw response samples, remote host, retry history, and final action.

Separate recipient invalidity from sender, policy, content, and temporary infrastructure failures.

Inspect retry eligibility, backoff, maximum age, receiver shaping, queue capacity, and terminal event generation.

Retry policy, queue configuration, incident sample, and terminal-state test.

Stop infinite or indiscriminate retry and align lifetime with each stream's usefulness.

Map domains, DKIM identities, return paths, pools, rate controls, and suppression policy by message stream.

Architecture diagram plus provider configuration and representative headers.

Separate traffic where consent, urgency, volume, or risk differs materially.

Review launch, migration, restart, and volume-increase procedures for authentication, audience quality, receiver mix, and live health gates.

Dated ramp plan, change approval, per-receiver metrics, pause rules, and owner.

Stage wanted traffic, monitor response, and pause on evidence rather than following a fixed calendar blindly.

Identify every outbound IP/pool, whether shared or dedicated, who controls neighbors and routing, and which monitoring is available.

Provider/pool inventory, allocation history, reverse DNS, traffic ownership, and escalation path.

Choose shared or dedicated infrastructure based on control and traffic needs—not a universal volume slogan.

Inspect raw messages for one valid From mailbox, stable identity, MIME alternatives, links, signed headers, list headers, and source-size risks.

Raw fixtures from every template family and automated regression results.

Turn message-format and required-header checks into pre-deployment tests.

Resolve every URL hop in representative templates and verify ownership, TLS, destination consistency, and compromise monitoring.

Link-domain inventory, redirect traces, certificate evidence, and alert ownership.

Remove unknown shorteners and stale destinations; isolate third-party domain risk.

Confirm dashboards preserve attempted counts, temporary and permanent failures, complaints, unsubscribe, and acceptance by actionable dimensions.

Dashboard/query links, field definitions, denominator contract, and sample incident view.

Replace account-wide averages with segments that can identify a cause and owner.

Retrieve representative evidence from a recent message and incident without relying on a transient dashboard.

Retention policy, storage location, redaction/access controls, and retrieval test.

Preserve enough normalized and raw evidence to reproduce classification and timeline.

Trigger or simulate alerts for event-pipeline lag, auth failure, bounce/complaint changes, receiver deferrals, and suppression failure.

Alert definitions, thresholds, routing, test events, acknowledgement, and escalation.

Create actionable alerts tied to denominators, baseline, receiver, stream, and runbook.

Take a recent delivery chart and identify deployments, DNS edits, imports, campaigns, vendor changes, and pool changes on the same timeline.

Change records with timestamp, owner, scope, before/after evidence, and rollback.

Connect deployment and marketing change records to delivery monitoring.

Find the previous audit, its evidence, closed gaps, accepted risks, and the event that schedules the next review.

Dated audit history, sign-off, exceptions, remediation tickets, and next review trigger.

Treat this checklist as a living control review, not a one-time launch ceremony.