The email marketing audit: a checklist and template in 3 layers

To do an email marketing audit, check 3 layers: inside the account (forms, flows, Smart Sending, segments, campaigns and attribution), deliverability (SPF, DKIM, DMARC, the Gmail, Yahoo and Microsoft sender rules, spam and bounce rates), and the customer’s view (what a new subscriber receives over 14 days, when, in which Gmail tab, beside 2 or 3 rivals). Give every failed check a priority and estimate its cost from the client’s own flow report.

An email marketing audit for a Shopify or DTC brand checks 3 layers: inside the account, deliverability, and what a new subscriber receives. Retention agencies run it when they onboard a client, and brand CRM leads before each season.

Layers 1 and 2 need the client’s login. For a prospect, run layer 3 alone, as an outside audit without a Klaviyo login.

The platform’s reports cover layer 1 and part of layer 2, and they can’t show layer 3. Klaviyo’s help centre counts an email as delivered once the recipient’s mail server accepts it, even if it goes to spam, and a flow that never starts sends nothing to count.

What an email marketing audit covers

• Inside the account: how the programme is built and what it earns, from the platform’s settings and reports.
• Deliverability: whether mailbox providers accept and trust the mail, from DNS records, Google Postmaster Tools and the platform’s deliverability reports.
• The customer’s view: what a new subscriber receives over 14 days, when and in which tab, beside 2 or 3 rivals, from the emails and texts themselves.

A finding in one layer often has its cause in another. A welcome email missing in layer 3 points to the flow’s trigger in layer 1, and a fall in opens at one mailbox provider points to layer 2.

The email marketing audit template

Mark each check pass or fail, and give every fail a priority.

• Priority 1, this week: a message that never arrives, a failed authentication check, a broken code, or a Gmail spam rate at 0.3% or above.
• Priority 2, this month: a late or wrong message, a spam rate between 0.1% and 0.3%, or a setting that changes later reports, such as attribution.
• Priority 3, next quarter: results below the peer range when everything else passes.

Layer 1: inside the account

Klaviyo Academy’s audit course covers settings, account health and deliverability, sign ups, flows and campaigns.

Sign up forms and list growth

Submit every live form on a phone with a new address. Klaviyo Academy’s acquisition lesson points to 3 reports, including the sign up forms report for each form’s submit rate and the growth report for where subscribers come from. A pass: every form submits, shows its offer and feeds the welcome flow’s list. If it fails, check the form’s list, its display rules on small screens and any recent site change.

Flows, triggers and filters

Klaviyo’s March 2026 checklist names the core flows as welcome, abandoned cart, abandoned browse, post purchase, and win back or sunset. It asks for metric triggers where possible, and for the basket flow to exclude anyone who ordered or started checkout after entering it. A pass: each core flow exists once and every message is Live. If it fails, read each message’s Skipped reasons in Recipient activity, then the causes in why a welcome or basket email never arrives.

Smart Sending and SMS rules

By default, Smart Sending skips a message when the profile received another within 16 hours for email or 24 hours for SMS, and Klaviyo’s help centre says skipped messages are not rescheduled. A pass: Smart Sending is set on purpose on each basket and checkout reminder, and last month’s skipped count is in the report. If it fails, put the skipped count into the revenue estimate in the report.

For texts, check the opt in confirmation, STOP and quiet hours. Postscript’s guide holds messages until waking hours, 8am to 9pm by default and 8am to 8pm in 5 states, and its Texas hours have to be switched on in compliance settings. Rules differ by country and by US state, and this is not legal advice.

Segments, campaigns and benchmarks

Check who each campaign goes to and how often. A pass: campaigns go to people who opted in and still engage. Klaviyo compares results with a peer group of roughly 100 similar companies, so check the industry in Organization settings first. Compare campaigns with campaigns, since flows had a 5.58% click rate against 1.69% in Klaviyo’s benchmarks, and use clicks and placed orders, because Klaviyo Academy warns that Apple Mail Privacy Protection may skew data.

Revenue attribution settings

Write the attribution settings down before you quote any revenue. Klaviyo’s attribution page gives new accounts a last touch model with 5 day windows for email opens and clicks. Apple Privacy opens and bot clicks can be removed, and a change recalculates past data. A pass: the model and windows sit beside every revenue figure in the report.

Layer 2: the deliverability audit

SPF, DKIM, DMARC and the sending domain

Read the DNS records and the Authentication dashboard in Postmaster Tools. A pass: SPF and DKIM pass, DMARC is published (p=none meets the minimum), and the From domain aligns with the SPF or DKIM domain. In Klaviyo, the sender requirements lesson asks for the branded sending domain to show Active under Settings, Account, Domains, and for a default sender on the brand’s own domain, never @gmail.com or @yahoo.com.

Gmail, Yahoo and Microsoft sender rules

• Gmail: a sender of close to 5,000 messages a day to personal Gmail accounts is a bulk sender permanently. Google’s guidelines require SPF, DKIM, aligned DMARC, one click unsubscribe with a visible link and a spam rate below 0.3%, and recommend keeping it below 0.1%. Google recommends honouring unsubscribes within 48 hours, and has been ramping up enforcement since November 2025.
• Yahoo: the same core rules, with unsubscribes honoured within 2 days and a spam rate below 0.3%.
• Outlook.com: domains sending over 5,000 emails a day need SPF and DKIM to pass and DMARC at p=none or stronger, aligned. Microsoft has rejected mail that fails since 5 May 2025.

Klaviyo adds one click unsubscribe to marketing emails automatically, so check that each template still shows a visible unsubscribe link.

Google Postmaster Tools

Verify the domain in Postmaster Tools and read Compliance status, Spam Rate, Domain Reputation and Delivery Errors. The data covers personal Gmail accounts only. A pass: every requirement is met and spam stays below 0.1%. At 0.3%, Google’s FAQ says a bulk sender can’t get mitigation until the rate stays below it for 7 days in a row, so mark it priority 1.

Bounces, complaints and the deliverability score

Klaviyo’s deliverability hub scores the account each day from 30 days of open, click, bounce, unsubscribe and spam complaint rates, once it has sent 1,000 emails in 30 days, and raises alerts for high bounce, complaint and unsubscribe rates. A pass: Good (75 to 89) or Excellent (90 to 100), with no open alerts. If it fails, check the inbox provider breakdown for one provider behind the drop.

What an inbox placement test measures

A seed list test sends an email to test mailboxes at several providers and reports where it landed. GlockApps reports each result as Inbox, Tabs, Spam or Missing. The seeds have no history with the sender, and Suped’s guide calls the results directional and warns against treating them as a final deliverability score. A pass: inbox or a tab at every provider tested.

The Gmail tabs, as Google describes them

Gmail Help lists 5 inbox tabs, with Promotions for deals, offers and other promotional emails. Gmail sorts mail automatically and learns from where each person moves it, and Google’s sender FAQ doesn’t mention the tab. Record the tab each email reached in each test inbox, with the date, as what that inbox showed, and report it apart from spam placement.

Layer 3: the customer’s view

In a test of 362 ecommerce brands from new addresses, published in July 2026, Joy Joya found that 158 sent no welcome email and 20 sent an offer that didn’t match the pop up. Layer 3 runs the same test at the client for 14 days, beside 2 or 3 rivals.

Set up the test subscriber

• A new Gmail address for the client and for each rival, so Gmail shows the tab, plus a control address at the client, signed up through the footer form in the same minute.
• A phone number that has never opted in, and a private browser window on a phone.
• A sheet with the day, time, sender, subject, offer, code and tab, and a screenshot. Save each email itself too, since it carries its arrival time.
• The client’s OK, and the test addresses sent to whoever reports their numbers.

The first 14 days at the client

On day 1, sign up through the pop up, opt in to texts and try the welcome code on a phone. Leave a basket and a checkout from separate addresses, as in the outside audit. Then record every email and text for 14 days. A pass: every Live message arrives on time with working codes and links, and none lands in spam. If one is missing, go back to its flow status, Skipped reasons and Smart Sending in layer 1.

Email competitor analysis: 2 or 3 rivals

Sign the rival addresses up in the same minute, through the public sign up any customer can use. A Klaviyo Community guide to competitor research suggests 3 to 5 rivals, a separate inbox and a sheet kept over a few weeks. For an audit report, 2 or 3 rivals keep the comparison readable.

Clients ask for this comparison. MailCharts quotes an account manager whose clients would “constantly be asking us to produce a competitive analysis based on email”.

By hand, layer 3 costs little for 1 client. For 10 clients with 3 rivals each, it takes 50 new addresses and 14 days of reading inboxes, and the record lives only in your sheet. Obsession’s delivery monitoring sends AI test customers with real inboxes and numbers through the first 14 days and flags anything that never comes, and its email and SMS tracking subscribes an AI agent to each rival’s emails and texts.

The report the client reads

Keep the report to what the client can check and act on.

Findings, each with its evidence

Write each finding in 1 sentence with a time or a number in it, and put the evidence beside it: the email as it arrived, the setting or the dashboard. For example: opted in to texts at 09:01 on Monday, and no confirmation text arrived in 48 hours.

The revenue estimate, in their numbers

For each priority 1 finding, take 3 figures from a month when the flow worked: the people who entered it, its Placed Order rate, which Klaviyo’s flow analytics shows by default, and the average order. Multiply them and halve the result, since attributed revenue includes orders that would have happened anyway.

With invented figures: 1,840 entries × 3.1% × £48 is £2,738, so the estimate is about £1,369 a month while the welcome email is missing. For a Smart Sending finding, use the skipped count in place of the entries.

The fix order

1. Priority 1 this week, each fix with an owner and a date.
2. Priority 2 this month, starting with Smart Sending and attribution, since they change every later report.
3. Priority 3 as next quarter’s plan.
4. A retest for every fix: run layer 3 again once the fix is live, and attach the new email to the finding.

How the audit sets up the retainer

The first audit is the baseline. Run layer 3 again after each fix and every month, and the report shows each finding as found, fixed and checked again. That answers a problem an agency owner on r/agency described: losing clients who couldn’t see what they were paying for. The weekly format is in proof that every flow fired, and the rival addresses keep collecting for each monthly report.

Email audit tools compared

We make Obsession, which does some of this, so every line about another tool is taken from that tool’s own pages, checked on 23 October 2026.

For 1 to 5 clients audited at onboarding, Klaviyo’s reports, Postmaster Tools, a few new Gmail addresses and a sheet cover all 3 layers, and no paid tool is needed.

Limits and next steps

• A layer 3 result covers 1 inbox at 1 moment. Gmail may sort the same email differently for a long time customer.
• A missing email shows that nothing arrived. The cause sits in layer 1 or layer 2.
• Seed tests and Postmaster Tools describe providers in aggregate. Neither shows what a particular subscriber received.
• Every revenue figure is an estimate, halved because attribution includes orders that would have happened anyway.
• Rival history starts on the day you subscribe. Earlier emails can’t be recovered from a new address.

Black Friday is Friday 27 November 2026. Run the audit on each client before their code freeze, around 20 November for many stores, and sign the rival addresses up this week, so that 14 days of rival mail exist before the first Black Friday sends.

Questions