How to Audit SaaS Email Sending Paths & Delivery Evidence

Updated 14 November 2026 · Standard formula, shown below

This guide walks you through auditing your SaaS email sending paths and verifying delivery evidence, so you can confirm that transactional and marketing emails actually reach inboxes and meet compliance standards. You’ll map every sending route, check authentication records, and review delivery logs to identify gaps that could hurt deliverability or trust. Start with access to your email service provider (ESP) and DNS settings, then follow the steps to build a clear picture of your email infrastructure.

What You’ll Need

Admin access to your SaaS application’s email sending code (or the team that owns it)
Access to your email service provider’s dashboard (e.g., SendGrid, SES, Postmark, or similar)
DNS management access (to check SPF, DKIM, DMARC records)
A log aggregation tool or access to your ESP’s event logs (optional but recommended)
A spreadsheet or documentation tool to record findings

Step-by-Step

Inventory all email sending sources. List every place your SaaS sends email: transactional (password resets, invoices), marketing (newsletters, onboarding), and system notifications. Include the sending method (API, SMTP, or third-party integrations) and the ESP used for each.
Map each sending path. For each source, trace the route: from your app’s code → ESP API/SMTP → recipient’s mail server. Note any intermediate services (e.g., email forwarding, relay hosts) that could alter headers or delivery.
Check SPF records. Log into your DNS provider and verify that each sending domain has an SPF record listing the IPs or hostnames of your ESPs. Use a tool like MXToolbox or dig to confirm the record is syntactically valid and not too long (max 10 lookups).
Verify DKIM signing. For each sending domain, ensure DKIM is enabled in your ESP and that the public key exists in DNS. Check that the DKIM signature in a test email passes alignment with the From domain.
Confirm DMARC policy. Ensure a DMARC record exists for each sending domain, with a policy of at least none initially, then move to quarantine or reject once monitoring shows no failures. Check that SPF and DKIM alignment are set correctly (strict or relaxed).
Review ESP delivery logs. In your ESP dashboard, pull event logs for the last 30 days: accepted, delivered, bounced, opened, clicked, and complained. Filter by sending path to see which routes have high bounce or complaint rates.
Analyze bounce types. Categorize bounces: hard (invalid address) vs. soft (temporary issues). For each sending path, note the percentage of hard bounces—above 2% may indicate list hygiene problems.
Check complaint rates. In your ESP, review the complaint rate per sending path. A rate above 0.1% (or 1 per 1,000 emails) is a red flag for spam complaints. Record which paths are highest.
Test authentication with a real email. Send a test email from each sending path to a mailbox you control. Inspect the full headers to verify SPF, DKIM, and DMARC pass. Look for the Authentication-Results header.
Verify sender reputation. Check your sending IPs and domains against public blacklists (e.g., Spamhaus, Barracuda) using a lookup tool. Note any listings and whether they match the sending path.
Document findings. Create a table for each sending path: source, ESP, domain, SPF pass/fail, DKIM pass/fail, DMARC pass/fail, bounce rate, complaint rate, and any blacklist hits. Include the date of the audit.
Create an action plan. Prioritize fixes: missing authentication records, high bounce rates, or blacklistings. Assign owners and deadlines for remediation.

Common Mistakes

Only checking SPF, not DKIM or DMARC. SPF alone doesn’t protect against spoofing if an attacker uses a different sending path.
Ignoring subdomains. If you send from mail.yourdomain.com but only have SPF/DKIM on the root domain, authentication fails.
Using a shared IP without monitoring reputation. Shared IPs can be tainted by other senders; check your ESP’s IP pool health.
Not reviewing bounces for a long period. A one-day snapshot may miss intermittent issues.
Overlooking third-party services. If you use a helpdesk or CRM that sends on your behalf, those paths also need authentication and monitoring.
Assuming DMARC pass means delivery. DMARC only affects authentication; delivery also depends on content and reputation.

Tips

Automate the audit. Use scripts or monitoring tools to check SPF/DKIM/DMARC records periodically, not just once.
Use a dedicated subdomain for transactional emails. This isolates reputation from marketing sends and simplifies authentication.
Set up feedback loops. Register with major ISPs (Gmail, Yahoo, etc.) to receive spam complaint data directly.
Keep DNS records clean. Remove obsolete SPF mechanisms to avoid hitting the 10-lookup limit.
Monitor DMARC reports. If you have a DMARC reporting address, review aggregate and forensic reports to spot unauthorized use of your domain.
Document your sending infrastructure. Keep a current diagram of all paths, including IPs and domains, to make future audits faster.

Troubleshooting

If emails are not being delivered:

Check your ESP’s dashboard for error messages (e.g., “blocked”, “deferred”).
Verify that your sending domain is not on a blacklist using a lookup tool.
Review the email content for spammy keywords or broken links that could trigger filters.
Confirm that your IP isn’t exceeding rate limits set by the ESP or recipient.

If SPF fails:

Check for typos in the SPF record (e.g., missing include:).
Ensure you haven’t exceeded the 10-DNS-lookup limit; consolidate mechanisms if needed.
Verify that the sending IP is actually listed in the SPF record.

If DKIM fails:

Confirm the DKIM selector matches what your ESP uses.
Check that the public key in DNS is complete and correctly formatted (no extra spaces).
Test with a fresh email; some email clients cache headers.

If DMARC fails:

Check alignment: the From domain must match the domain used in SPF or DKIM (or be a subdomain).
Ensure your DMARC record is properly formatted (e.g., v=DMARC1; p=none; rua=mailto:...).
Use a DMARC analyzer to see which authentication method is failing.

If bounce rate is high:

Clean your email list: remove invalid addresses and consider a double opt-in.
Check if a specific sending path is using an outdated list.
Review your signup forms for typos or missing validation.

Frequently Asked Questions

How often should I audit my email sending paths?

At least quarterly, or whenever you change ESPs, add a new sending domain, or notice deliverability drops.

What is the difference between SPF, DKIM, and DMARC?

SPF verifies the sending server is authorized, DKIM adds a digital signature, and DMARC tells receivers what to do if SPF or DKIM fail.

Can I use the same domain for marketing and transactional emails?

Technically yes, but it’s risky because marketing complaints can hurt transactional deliverability. Use a subdomain like tx.yourdomain.com.

What is a good bounce rate for SaaS emails?

Below 2% for hard bounces is typical. Higher rates suggest list hygiene issues.

Do I need to set up DMARC if I use a third-party ESP?

Yes, because DMARC protects your domain from spoofing, even if your ESP handles sending.

How do I check if my emails are landing in spam?

Send test emails to major providers (Gmail, Outlook, Yahoo) and check the spam folder. Also use a deliverability tool like GlockApps or Mail-Tester.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.