Add to Preferred Sources
An email marketing audit is a structured review of your sending setup, list, consent records, automations and reporting that ends in a ranked fix list, not a pile of observations. It is the practical side of running email marketing in South Africa, and the order matters: the published rules from Gmail and Yahoo and from POPIA carry real consequences, so they get checked before subject lines and design.
Most checklists give you forty equal tick-boxes. This email marketing audit checklist ranks seven areas by how much damage a failure can do, ties the pass or fail line to a published requirement wherever one exists, and marks the rest as judgement calls. You can run it yourself in an afternoon with admin access to your sending platform, your DNS host and Google Postmaster Tools.
Quick Answer
An email marketing audit checks seven areas in this order: sender authentication, complaint rate, list health and consent, unsubscribe handling, automations, content and mobile rendering, and revenue reporting. Score each red, amber or green, fix every red before touching an amber, and treat any red in the first four areas as urgent because those affect whether mail reaches the inbox and whether you are compliant with POPIA.
Jump to
Not sure which red to fix first?
Send us your sending domain and the platform you use, and we will tell you which part of this checklist to start with.
Ask for a priority checkWhat Does an Email Marketing Audit Cover, and in What Order?
A full review covers everything between your domain and your revenue report, and it is worth running in risk order because the first areas can silently stop every later improvement from mattering. A beautifully written welcome flow does nothing if the messages land in spam.
The table below is the whole audit on one page. Work down it and record red, amber or green against each row as you go. If you only have time for a quick email deliverability audit, rows one to four are that audit.
| Area | What you check | Why it ranks here | Best for |
|---|---|---|---|
| 1. Sender authentication | SPF, DKIM, DMARC and From-domain alignment | Mailbox providers publish requirements; falling short puts delivery at risk | Every sender |
| 2. Complaint rate | Spam rate in Postmaster Tools and platform reports | Gmail and Yahoo both name a 0.3% line | Anyone sending to Gmail or Yahoo addresses |
| 3. List health and consent | Bounces, silent contacts, source of every address, consent record | Drives complaints and creates POPIA exposure | Lists built over several years |
| 4. Unsubscribe handling | Visible link, one-click header (bulk senders), speed of removal, opt-out record | Set by Gmail and Yahoo for bulk senders, and by POPIA s69(4) for electronic marketing | Every sender; the one-click header is for bulk senders |
| 5. Automations | Triggers, exits, overlaps, broken links in each flow | Flows send without anyone watching them | Stores and service firms with flows running |
| 6. Content and mobile | Subject and preheader, rendering, plain-text version, link tracking | Affects results, not eligibility | Programmes with healthy 1–4 |
| 7. Revenue reporting | Tagging, attribution rules, what the dashboard counts | Decides whether you can prove any of the above worked | Anyone defending the budget |
Is Your Sender Authentication Set Up Correctly?
Sender authentication is the set of DNS records, SPF, DKIM and DMARC, that lets a receiving server confirm your sending platform is permitted to send mail in your domain's name. It is the first audit item because Google and Yahoo have published it as a requirement, not a preference.
Google's email sender guidelines set the baseline for bulk senders, and its sender requirements summary lists what applies to everyone. All senders need SPF or DKIM, a TLS connection and valid forward and reverse DNS records. Bulk senders need both SPF and DKIM plus a DMARC record, and the domain in the From header must align with the SPF or DKIM domain. The DMARC policy is allowed to be p=none, so a monitoring-only record satisfies the requirement. Google dates these rules from 1 February 2024.
Yahoo's sender best practices ask bulk senders for the same trio, with a DMARC policy of at least p=none.
Scope is where South African senders slip. Google defines a bulk sender as one sending close to 5,000 messages or more to personal Gmail accounts within 24 hours, and says bulk status is permanent once assigned. If you ever crossed that line on a Black Friday send, audit as a bulk sender from then on. The record-by-record setup is in the email domain authentication checklist.
For the audit, ask six questions and write the answers down:
- Does an SPF record exist for the domain, and does it include your sending platform? Check every tool that sends in your name: the marketing platform, the shop, the CRM and your helpdesk.
- Is DKIM signing switched on with your own domain, not the platform's shared one? Your platform's domain-setup screen shows the status.
- Is there a DMARC record, and is the From domain aligned? A
p=nonerecord counts as present; whether to tighten it is a decision for later. - Do transactional messages and marketing messages come from the same authenticated domain? Mixed setups are common after a platform change.
- Is mail sent over TLS, and do your sending domain or IPs have valid forward and reverse DNS records? Your platform or host can confirm this; Google lists both for all senders.
- Does anything still send from an old tool? A forgotten sender is the usual source of unexplained failures.
Takeaway
For a bulk sender, authentication scores red if SPF, DKIM or a DMARC record is missing. For a smaller sender, Google asks for SPF or DKIM, so having neither is red and having only one is amber in this post's scoring. A DMARC record set to p=none meets Google's and Yahoo's published minimum for bulk senders, so it scores green on presence even before you decide on enforcement.
What Complaint Rate Should an Audit Flag?
The complaint rate is the share of delivered messages that recipients mark as spam, and, as of the pages checked in October 2026, Google and Yahoo both publish 0.3% as the line you must stay under. Google's own guidance goes further: aim below 0.10% and avoid ever reaching 0.30%.
Those percentages sound tiny until you convert them into people. The sum below uses a simple send of 10,000 messages to Gmail inboxes.
What 0.10% and 0.30% mean in spam reports
0.10% of 10,000 delivered messages is 10 spam reports. 0.30% of 10,000 is 30. Put another way, the recommended ceiling is one complaint per 1,000 messages, and the line you must not reach is three per 1,000. Postmaster Tools reports its own measured rate, so use this sum for scale, not as a prediction of your dashboard number.
Google's sender FAQ adds the cost of crossing the line: senders above 0.3% become ineligible for mitigation until they stay under it for 7 consecutive days. That 7-day window applies to Google's mitigation eligibility only; the page does not describe how long reputation takes to recover.
Audit this area by pulling three things: the Gmail spam rate from Postmaster Tools, the complaint figure in your sending platform's campaign reports, and the list of campaigns with the highest complaint rate.
Scoring rule: green below 0.10%, amber between 0.10% and 0.30%, red at or above 0.30%. The thresholds come from Google's guidance; the colour bands are this post's convention. If Postmaster Tools shows no data for your domain, score the area as unmeasured, not green, and rely on the platform's own complaint reporting until you have a figure.
How Healthy Is Your List, and Can You Prove Consent?
List health is the share of your database that can receive mail and wants it, and consent is your ability to show where each address came from. They belong in one audit item because the same weakness, addresses nobody chose to give you, causes both complaints and legal exposure.
An email list audit starts with the plumbing: how are hard bounces handled, are role addresses such as info@ in the marketing list, and how many contacts have been silent for longer than your own rule allows? The step-by-step order is in clean your list, fix your deliverability, so this audit only asks whether a clean-up rule exists and was followed.
Then audit consent, which is where South Africa differs from the global checklists. The Information Regulator issued its Guidance Note on Direct Marketing on 3 December 2024. As summarised by DLA Piper, it says electronic direct marketing generally requires consent, with a limited exception for existing customers under section 69(3) of POPIA.
That summary also records that a responsible party must keep a database of people who have withheld consent. We have read the Regulator's note through that summary, not the original document.
For each source of addresses, the audit asks five things:
- Where did it come from? Sign-up form, checkout, event list, purchased list, imported CRM export.
- What did the person agree to at that point? Wording and date, stored somewhere you can retrieve.
- Does the existing-customer exception honestly apply? Section 69(3) sets its own conditions, which this post has not verified against the Act's text, so read them in the Act or ask an adviser before relying on the exception.
- Was a re-permission campaign handled correctly? The guidance, as summarised, allows only one unsolicited message to request consent, and no further messages unless the person opts in. If you ever mailed an old list more than once to ask for consent, flag it.
- Is the opt-out record held outside the platform too? See email suppression lists explained.
Do not assume a B2B exemption: nothing in the sources read for this post establishes that business email addresses are treated differently from personal ones. The fuller picture is in POPIA email compliance. None of this is legal advice; if a source of addresses cannot be explained, flag it red and take advice before the next send.
Takeaway
List health and consent score red if you cannot say where a block of addresses came from or what the person agreed to. A clean-up rule that exists but is never run scores amber. These bands are this post's convention, built on the consent guidance as summarised by DLA Piper.
How Should Unsubscribe Handling Be Audited?
Unsubscribe handling is the combination of a visible opt-out link, a mechanism that works, and removal that happens promptly, and it is the audit item where provider rules and POPIA both apply. It is quick to test by sending yourself a campaign.
For every sender, POPIA section 69(4), per the DLA Piper summary, requires each electronic marketing message to identify the sender and give an address where the recipient can ask for the messages to stop. Test that the link in the footer works and that the sender identity is shown.
For bulk senders, Google adds more. Its guidelines say marketing messages must support one-click unsubscribe and carry a clearly visible unsubscribe link in the message body. The FAQ adds that a header with only a mailto or plain URL link does not meet the one-click requirement; it needs an HTTPS URL in the List-Unsubscribe header. Transactional messages such as password resets and form confirmations are exempt from that one-click rule.
Speed is the other test. Yahoo asks bulk senders to honour unsubscribes within 2 days, and Google recommends 48 hours. POPIA gives no day count in the sources read here. Time a real opt-out from click to suppression.
Takeaway
Unsubscribe handling scores red if the link fails when tested, if the sender is not identified, or, for a bulk sender, if one-click is missing. A removal that takes longer than two days is red for a Yahoo bulk sender and amber for everyone else, because Google only recommends 48 hours and POPIA sets no day count. The two-day red line is this post's convention.
Running flows nobody has looked at in a year?
Send us a screenshot of your flow list and we will tell you which ones to check first.
Request a flow reviewWhich Automations Are Earning Their Place?
An automation audit lists every flow that sends without a human pressing a button and checks that each one still has a trigger, an exit and a purpose. Flows are the part of a programme most likely to rot, because a broken one keeps sending while nobody watches the report.
Build the inventory first: welcome, abandoned cart, post-purchase, win-back and any custom flows, with the platform's count of active and draft flows. For a shop, include the order and shipping notifications even if they sit in a different tool. A flow map drawn on one page, as described in email automation workflow mapping, makes overlaps visible.
For each flow, run this short test:
- Trigger. Does it still fire on the right event, and has the form, product feed or checkout change since it was built?
- Exit conditions. Does a buyer leave the abandoned-cart flow once they purchase, and does anyone who unsubscribes leave every flow?
- Overlap. Can one person sit in two flows and receive both on the same day?
- Links and offers. Do the links resolve, and is the discount or deadline still true?
- Sender and reply-to. Do replies reach a person?
Score a flow red if it sends a wrong offer, a broken link or a message after the person has unsubscribed; amber if it is simply outdated; green if it is current and has an owner. Send a test through each flow end to end instead of trusting the preview. A flow with no owner scores amber at best, whatever its results.
How Do You Audit Content and Revenue Reporting?
A content and reporting audit checks whether your messages read well on a phone and whether you can prove what they earned, and it comes last because it improves results and proof, not eligibility. A sensible content check is short: read the last ten sends the way a subscriber would on a phone, and test what you can change cheaply.
For content, check that the subject line and preheader work as a pair, which the post on preheader text covers, that the message renders in the Gmail app and in dark mode, that images carry alt text, and that a plain-text version exists. Look at whether each send has one clear action. Then look at whether you have ever tested anything; if not, email A/B testing is the lowest-effort addition.
For reporting, the audit question is whether you could defend the numbers to a finance director. Check that every link carries consistent campaign tagging so GA4 can separate email from other channels, that you know which attribution window your platform uses, and that the platform's revenue figure and your analytics figure are expected to differ. They count differently, so agree one source of truth. The methods are in email revenue attribution, and a one-page dashboard layout is in the reporting dashboard guide.
Takeaway
Content and reporting findings rarely score red. They score amber when sends cannot be read on a phone, when links are untagged, or when nobody can say which revenue number is the official one, and they are fixed after authentication, complaint rate, consent and unsubscribe handling are clean.
How Do You Score the Audit and Decide What to Fix First?
Scoring an audit means assigning each area red, amber or green against a stated rule, then fixing in a set order so effort goes where the downside is largest. The scheme here is this post's own convention, built on the published thresholds above, not an industry standard.
| Colour | Meaning | Example from this checklist | Fix window (working rule) |
|---|---|---|---|
| Red | Blocks delivery, breaks a published requirement or exposes you under POPIA | No SPF or DKIM on a sending tool; unsubscribe link fails; unexplained address source | Before the next campaign |
| Amber | Weakens results or leaves a gap that could turn red | Complaint rate between 0.10% and 0.30%; flow with no owner | Within the next planning cycle |
| Green | Meets the stated rule and can be shown to | DMARC present for a bulk sender, unsubscribe link tested, tagging consistent | Re-check at the next audit |
The fix windows are working rules of thumb, not requirements from any provider. Adjust them to your send calendar: a red found a week before a major sale justifies pausing the send, while a red found in a quiet month can be fixed properly.
Fix in this order: areas one to four first, any red before any amber, and within a colour, whatever touches the most subscribers. Then repeat the audit. As a working rule, re-check authentication and complaint rate each month and run the full seven-area pass twice a year or after any platform migration, because migrations are when authentication and flows quietly break.
Why South African Businesses Choose Growth Pulse Media
Growth Pulse Media is a Johannesburg agency founded by Dirk van Greuning, who built and scaled a large South African ecommerce business before starting it, so an audit here is judged on what it costs a business to leave a red unfixed, not on how long the report is. All work is executed in-house, with a limited client load for senior attention.
GPM is a registered Shopify Partner and an Omnisend Certified Partner, and our email marketing service is built around Shopify stores and Omnisend. If you would rather have a second person run this checklist against your account, ask for the free audit below.
Who This Checklist Is Not For
This checklist suits a sender with admin access and a few hours, and it is the wrong tool in three situations.
You need a legal opinion. The consent section reads a secondary summary of the Regulator's guidance, not the Act or the original note. It does not tell you whether your specific lists are lawful.
You send fewer than a handful of emails a month to people who know you. A one-person newsletter needs working unsubscribe handling and authentication, not a seven-area email programme audit.
You want a promised inbox rate or revenue lift. An audit finds and ranks problems. Fixing them improves your odds, but no checklist can promise placement, which depends on authentication, content and sending history together.
Want someone else to run this audit?
We will review your authentication, complaint rate, consent trail and flows, and tell you what to fix first.
Book a free auditFrequently Asked Questions
What is an email marketing audit?
An email marketing audit is a structured review of your sender authentication, complaint rate, list and consent records, unsubscribe handling, automations, content and reporting. It ends in a ranked fix list. Work in risk order, so anything that affects inbox delivery or POPIA compliance is fixed before design or copy.
How often should you run an email marketing audit?
As a working rule, check authentication and complaint rate monthly and run the full audit twice a year or after a platform migration. No provider publishes an audit schedule, so this is a practitioner heuristic. Run it immediately if your complaint rate approaches 0.10% or your open and click numbers drop suddenly.
What do Gmail and Yahoo require from bulk senders?
Both require SPF and DKIM plus a DMARC record, and both name a spam rate below 0.3%. Google requires bulk senders to support one-click unsubscribe with a visible unsubscribe link, and Yahoo asks bulk senders to honour unsubscribes within 2 days. Google treats senders sending close to 5,000 or more messages to personal Gmail accounts within 24 hours as bulk, and the status is permanent; Yahoo's page, as read here, gives no number.
Do I need DMARC if I send fewer than 5,000 emails a day?
Google's DMARC requirement applies to bulk senders, while all senders need SPF or DKIM. A DMARC record with a policy of none is accepted by Google and Yahoo, so publishing one is permitted even below bulk volume. If you may cross the bulk threshold, it is safer to audit as though you already have.
Does POPIA change how I audit my email list?
Yes. The Information Regulator's direct marketing guidance, as summarised by DLA Piper, says electronic marketing generally requires consent, with a limited existing-customer exception under section 69(3). Audit where each address came from and keep a record of people who opted out. Take legal advice on any block of addresses you cannot explain.
Want a Second Opinion on Your Email Programme?
Growth Pulse Media works from Johannesburg with Shopify and Omnisend and reviews sending setups against Gmail, Yahoo and POPIA requirements. No obligation — we'll get back to you within 24 hours.
Get Your Free Audit