Prepare a sending identity before the first real campaign leaves

Freeze the identity and sending inventory

List the organizational domain, visible From domains, envelope sender and return-path domains, DKIM signing selectors, sending subdomains, IPs or provider pools, reply handling, tracking and link domains, message categories, approximate volumes, mailbox-provider distribution, and operational owners. Record which systems can send on behalf of each domain, including commerce, support, product, and marketing platforms. Remove unknown legacy authorization only after verifying surviving flows. Decide which identity a recipient has actually seen during signup. A sender-readiness runbook needs one authoritative map because a correct record on one platform cannot compensate for a forgotten vendor transmitting with the same domain. Preserve current DNS and provider settings before changing them.

Evidence: Google Gmail Help; Yahoo

Publish authentication as a controlled DNS release

Configure SPF so authorized infrastructure is represented without exceeding lookup and syntax constraints. Generate DKIM keys and selectors according to provider capability and current security practice. Establish DMARC alignment and a staged policy appropriate to observed legitimate sources; collect and review reports before enforcement that could reject valid mail. Confirm reverse DNS and transport security where relevant. Gmail and Yahoo publish current sender and bulk-sender requirements, which can evolve. Use authoritative DNS checks after propagation, then inspect authentication results in messages actually received. Do not infer success from a provider setup screen. Document owner, timestamp, expected record, observed record, rollback, and next key-rotation review.

Evidence: Google Gmail Help; Yahoo

Create a production-like test packet

Send representative transactional, educational, and promotional templates only through their intended channels to controlled accounts across major providers. Capture raw headers, authentication results, provider response, From and reply behavior, HTML and plain-text rendering, accessibility, URLs, redirects, files, tracking, and message size. Use the exact unsubscribe and preference paths that real recipients receive. Test invalid and temporary-failure addresses in a safe manner supported by the provider rather than fabricating traffic. A seed inbox observation describes that test account at that moment; it does not predict population placement. Resolve identity, authentication, broken-resource, or unsafe-link defects before evaluating creative refinements.

Evidence: Google Gmail Help; Messaging, Malware and Mobile Anti-Abuse Working Group

Prove one-click and visible unsubscribe end to end

For covered list mail, verify List-Unsubscribe and List-Unsubscribe-Post headers, HTTPS endpoint behavior, DKIM protection, provider support, and a visible body unsubscribe route. RFC 8058 describes the one-click protocol and its POST semantics. Gmail and Yahoo specify applicability and timing in their current rules. Perform the action with a controlled identity, observe suppression in the source of truth, integration, provider, scheduled campaign, and any automation branches, then attempt a prohibited re-import. Keep necessary transactional messages correctly classified rather than suppressing them indiscriminately. A successful landing page is not proof if another queued marketing job continues to send.

Evidence: Yahoo; Internet Engineering Task Force

Set a bounded ramp and stop conditions

Forecast expected legitimate volume by stream and provider. Begin with recipients who recently and clearly requested the content, use a stable schedule, and avoid sudden imports or artificial engagement schemes. Define hard stops for authentication failure, abnormal invalid-address rate, provider blocks, complaint rise, broken unsubscribe, unexplained volume, or identity mismatch. Name the person who can pause each platform without a meeting. Monitor accepted, deferred, rejected, bounced, complained, unsubscribed, and support-feedback signals separately. Ramping reveals infrastructure and expectation problems under controlled volume; it does not sanitize an old or purchased list. Preserve daily versions and events so a change can be correlated without guessing.

Evidence: Google Gmail Help; Messaging, Malware and Mobile Anti-Abuse Working Group

Authorize one reversible send, then review the evidence

The next action is to complete the runbook for one sending stream and hold the campaign until identity, authentication, unsubscribe propagation, monitoring, and kill switch have all been rehearsed. Release only the bounded expected audience and retain the prior configuration. Limits remain: official requirements change, mailbox decisions are proprietary, a small test cannot guarantee placement, and this process is not jurisdiction-specific legal advice. Re-run after provider, DNS, domain, IP, template system, volume, acquisition, or unsubscribe changes. A tool may help publish records or aggregate reports, but the selection must follow the runbook's evidence needs and remain independent of affiliate payment. Readiness means the team can detect and stop harm, not that the first campaign is promised an inbox.