Hiring an Email Deliverability Consultant: The Questions That Expose a Bad One
Good deliverability consultants answer technical questions precisely. The interview questions that separate them from someone selling a warmup subscription.
Vet a deliverability consultant with questions that have checkable technical answers: how DMARC alignment works, why a message can pass SPF and still fail DMARC, and what they would examine first in Postmaster Tools. Vague answers there indicate a reseller rather than an engineer.
Key takeaways
- Ask how a message can pass SPF and still fail DMARC. Someone who cannot answer that clearly does not understand alignment, which is the core of the discipline.
- Guaranteed inbox placement is the clearest red flag, because no vendor controls what a mailbox provider decides.
- A consultant whose primary tool is a spam-word list is working from folklore rather than from authentication and reputation data.
- Ask what they would refuse to do. A good answer includes raising volume before authentication is clean.
Reviewed and updated August 4, 2026
Ten minutes into the call, the consultant is talking about spam trigger words and offering to get you set up with a warm-up subscription. That is the entire diagnosis, and it arrived before anyone had looked at a single DNS record on your sending domains.
This happens because deliverability is unusually hard to vet from outside. The work is invisible, the feedback loop runs for weeks, and almost any intervention correlates with improvement when it ships alongside a volume reduction. Those three things protect a weak practitioner far longer than they would in most consulting.
The recovery is that the underlying subject is a published specification. Someone who genuinely understands authentication and reputation gives answers you can check against the RFCs and Google's own documentation in an afternoon, without needing to know the material yourself beforehand. Six questions do most of the work.
How can a message pass SPF and still fail DMARC
Ask this first. It is the single most efficient filter in the interview, because the answer requires understanding alignment, and alignment is the concept that separates people who have read the specification from people who have read blog posts about it.
- DMARC passes when either SPF or DKIM passes AND aligns with the From domain
- A third-party sender uses its own return path, so SPF passes for its domain and aligns with nothing you own
- Publishing the platform's DKIM records so signing aligns with your domain is the fix
- Volunteers that DMARC never requires both to pass
- Says you need SPF and DKIM to both pass
- Says an SPF pass means a DMARC pass
- Describes DMARC as a setting that improves inbox placement
- Cannot explain what the From domain has to do with any of it
A good answer usually arrives with an example attached, because anyone who has run a DMARC rollout has watched a payroll provider or a helpdesk fail alignment while passing SPF perfectly. The mechanics behind the question are set out in our guide to SPF, DKIM and DMARC for cold email if you want to read the answer before you ask it.
What is the SPF lookup limit, and what happens when you go over it
The second technical screen, and the most checkable thing in the entire field, because it is written into the specification as a number.
RFC 7208 states implementations MUST limit the total to 10 during evaluation. include, a, mx, ptr and exists mechanisms count, plus the redirect modifier.
Those mechanisms cost nothing against the limit, and neither does the exp modifier. Flattening a record works by trading includes for ip4 entries.
The specification says implementations SHOULD limit void lookups to two.
The record returns a permanent error rather than a soft fail, and an mx evaluation querying more than 10 address records produces the same result.
Someone who answers "about ten includes" is close enough to work with. Someone who cannot say what happens when you exceed it, or who thinks the result is a soft fail, has never debugged a record that broke because marketing added one more tool. The follow-up worth asking is how they would fix a record that is over the limit, since flattening trades maintainability for lookups and a good answer says so out loud.
What would you look at first in Postmaster Tools
This one tests whether they work from receiver data or from opinion. A strong answer goes to the spam rate immediately and knows the number that matters: Google's bulk sender requirements hold reported spam rates below 0.30%, and senders pushing 5,000 or more messages a day to Gmail are required to have SPF, DKIM and DMARC in place.
The better answers also volunteer the limits of the tool, which providers it reports on, and what it does not show you. Anyone who treats one dashboard as the whole picture will miss a problem that is specific to a different provider. What Google Postmaster Tools covers, and how to read it for cold outbound specifically, is worth knowing before the conversation so you can hear whether the answer is grounded.
How would you diagnose a sudden placement drop
An open question, deliberately. You are listening for a sequence rather than a conclusion.
A good answer begins with what changed, because sudden drops almost always follow a change: volume went up, a new list source came in, a DNS record was edited, an integration was added, a domain got listed. It then separates the providers, since a drop at one receiver and a drop everywhere at once are different investigations. It checks the things with objective answers before the things with opinions, so authentication and blacklist status come before subject lines. And it establishes a measurement baseline early, because the alternative is changing six things and reporting that placement improved.
An answer that opens with content is the tell. Copy is the least measurable variable in the stack and the easiest one to have a view about, which is why it attracts people who cannot diagnose the rest.
What in your own advice from last year is now out of date
The currency test, and the one that catches people coasting on old knowledge.
The IETF published an updated DMARC specification on 20 May 2026: RFC 9989 for the core protocol, RFC 9990 for aggregate reporting and RFC 9991 for failure reporting. Together they obsolete RFC 7489 and RFC 9091. The pct= tag is deprecated along with rf= and ri=, np= for non-existent subdomains is new, psd= came across from RFC 9091, and DMARC SPF checking now uses only the MAIL FROM address with no fallback to the HELO identifier.
A consultant who proposes a percentage-stepped enforcement rollout, moving from pct=25 upward, is quoting a plan built on the obsolete specification. It will not break anything, since receivers ignore deprecated tags, and it tells you exactly how recently they read the source material. What the enforcement decision actually involves is covered in DMARC policy not enabled.
What would you refuse to do
The last question, and the most revealing, because it asks somebody to name work they turn down.
Strong answers exist and they sound like this: refuse to increase sending volume before authentication is clean, refuse to send campaign traffic from the primary company domain, refuse to promise a placement outcome, refuse to send to a list that has not been verified, refuse to keep a domain in service after it has been burned rather than nursing it back for months.
Someone with no refusals has either never been asked to do something unwise or does not intend to say no to you either. Both are the same problem from your side of the table.
Two questions about the person rather than the subject
Who actually does the work. Some of this category is solo practitioners and some of it is a recognisable name fronting a delivery team. Both models work. Find out which one you are buying before you sign, because the six answers above came from whoever happened to be on the call, and you want the person who gave them to be the person editing your DNS.
A reference where it went badly. Everyone has one. What you learn is how they describe a failure: whether they can name the specific thing that did not work, or whether the retelling ends at the client's list every time. Somebody who has never been at fault in their own account of events will not be at fault in yours either.
Red flags
- No: Guarantees a specific inbox placement rate
- No: Leads with a spam-word checklist as the primary tool
- No: Recommends increasing volume before authentication is verified clean
- No: Quotes tool pricing that does not match the vendor's own page
- No: Proposes a warm-up subscription before measuring where mail currently lands
- Yes: Has already looked up your public DNS records before the call
- Yes: Names the metric, the source and the frequency they will report on
- Yes: Asks for read access before asking for write access
- Yes: Says part of your problem is outside deliverability
The placement guarantee deserves its own line. Nobody controls a receiving provider's filter, the filters change without notice, and the variable with the largest influence on placement is how recipients respond to your mail, which sits outside a consultant's reach entirely. A guaranteed inbox rate is either a redefinition of the word inbox or a number that will be renegotiated in month two.
The spam-word checklist is the other classic. Filters weigh sender reputation, authentication, engagement history, infrastructure and content together, and content is the piece a consultant can perform expertise about without touching anything technical. Its presence in the pitch is fine. Its position at the front of the pitch is the signal.
The access question, before you sign anything
A competent consultant will have looked at your public records before the call, because SPF, DKIM and DMARC records, MX records and blacklist status are all publicly queryable and take about four minutes to pull. Someone who arrives without having done that is telling you how they will approach the engagement.
Going the other way, be careful about write access to DNS ahead of a written diagnosis. Read access first, a documented list of the changes they intend to make, then the change window. This is normal change control rather than distrust, and someone who has run these engagements will expect it.
Scope is the other pre-signature conversation. What the category can and cannot repair, and how to tell whether you have a delivery problem at all before you hire anyone, is in what deliverability services fix and what they cannot. Once you have chosen somebody, what to expect from a deliverability expert covers how the engagement itself should run.
The short version
Six questions separate a deliverability consultant from a subscription reseller, and all six have answers you can verify against published sources. Ask how a message passes SPF and fails DMARC, and listen for alignment. Ask for the SPF lookup limit, which RFC 7208 sets at 10 DNS-querying terms with a permerror when exceeded. Ask what they check first in Postmaster Tools, where Google's own threshold is a 0.30% spam rate. Ask how they would diagnose a sudden placement drop, and expect a sequence starting from what changed. Ask what in their advice is now out of date, since the DMARC specification was replaced on 20 May 2026 and pct= rollouts are built on the old one. Ask what they refuse to do. Then walk away from guaranteed placement, spam-word checklists at the front of the pitch, and any recommendation to send more before the authentication is clean.
RevenueFlow runs sending infrastructure on separated domains inside its outbound engagements, so this layer is operated rather than advised on. You can see what a campaign would look like for your market.
Specification details are per RFC 7208 and per RFC 9989, 9990 and 9991, published 20 May 2026. Google sender requirements are per Google's published guidelines as of August 2026. Verify current requirements with the official sources before making DNS changes.
Sources: RFC 7208, Sender Policy Framework, IETF publishes updated DMARC specification, dmarc.org, Google email sender guidelines
DATA-TODO: Across client sending domains we have audited, what share were over the SPF ten-lookup limit or missing aligned DKIM, which would show how often question two finds something. DATA-TODO: The most common first finding in our own onboarding audits, to tell readers what a competent diagnosis usually turns up first. DATA-TODO: An anonymised example of a placement drop we diagnosed and the sequence we followed, to make the question-four answer concrete.
Frequently asked questions.
Frequently asked questions- What should I ask an email deliverability consultant?
- Ask how DMARC alignment works and why a message can pass SPF yet fail DMARC, what they would check first in Google Postmaster Tools, how they would diagnose a sudden placement drop, and what work they would refuse to take on. Each has a specific correct answer that a genuine practitioner gives easily.
- What are the red flags with deliverability consultants?
- Guaranteed inbox placement, since nobody controls provider filtering decisions. Spam-word checklists presented as a primary method. Recommending volume increases before authentication is verified clean. And any diagnosis offered before they have looked at your authentication records or Postmaster Tools data.
- How much does an email deliverability consultant cost?
- Pricing is rarely published and varies with scope, from a fixed-fee audit to an ongoing retainer covering monitoring and remediation. Ask what the engagement includes after the initial fixes, because reputation work is continuous and an audit alone leaves you maintaining the result yourself.
- Do I need a consultant or a tool?
- A tool tells you what is happening; a consultant tells you why and what to change. If your authentication is unconfigured or you are diagnosing a problem you do not understand, the human is worth more. If you already know the mechanics and need continuous visibility, monitoring software is the cheaper answer.
About the author.
Tim Carden is CMO / CTO at RevenueFlow, which builds and operates outbound revenue engines for B2B companies. Studied at McGill University.
Tim Carden · CMO / CTO
Connect on LinkedIn →Explore more.
Ready to scale your outreach?
We build GTM engines that book real meetings. See the receipts.
Related articles.
Smartlead Review: Unlimited Mailboxes, Rotation, and What the Plans Cap
Smartlead includes unlimited mailboxes on every plan and bundles verification on the upper tiers. What rotation does, what it cannot do, and where the ceilings bite.
Why Your DMARC Is Failing: The Six Causes in Order of Likelihood
Six causes of DMARC failure, ordered by how often they occur, with the symptom in reports and the fix for each. Alignment accounts for most of them.