Link Building Checklist (2026)
Most link building checklists are lists of tactics. This one is the operational order of work, and the two steps people skip are both before the first email goes out.
Skipped step one: authentication and warmup. Sending from a cold, unauthenticated domain wastes the whole campaign no matter how good the pitch is.
Skipped step two: verification. Only 43.4% of the 17,164 addresses we verified came back clean. 17.3% were invalid.
The benchmark to hold yourself to: we ran 2.9% bounce across 11,198 sends. Under 3% is healthy.
Print it, or work down it once per campaign. Nothing here needs a tool you do not already have.
Every checklist on this topic tells you to find relevant sites and write a personal email. That is true and it is not the part that breaks. What breaks is the plumbing: a domain that is not authenticated, a list that is a sixth dead, a follow-up sequence that keeps running after someone has said no.
So this checklist is ordered the way the work actually runs, and where we have our own data on a step, the number is here.
From our own outreach between 7 March and 24 August 2026: 11,198 send attempts, 320 bounces, 2.9% overall, split 143 hard and 177 soft.
Monthly bounce rate moved a lot: March 5.3%, April 0.5%, May 1.3%, June 10.1%, July 2.8%, August 2.0%. The June spike and the recovery are both the point.
Verification results across 17,164 addresses: 43.4% ok, 34.7% catch-all, 17.3% invalid, 4.5% unknown. 26.6% were role inboxes.
Verification was run through MillionVerifier. Sends are deduplicated per message. These are our own campaigns, not a client benchmark study.
Stage 1: Sending setup (before any prospecting)
Do this first. Every hour spent on prospecting before the sending domain is ready is an hour you may have to repeat.
1. Use a separate domain for outreach. Not your main company domain. If outreach ever damages a reputation, you want it to be a domain your customers do not receive invoices from.
2. Set SPF, DKIM and DMARC. All three, verified as passing rather than merely present. A DNS record that exists but does not validate is worse than none, because you will assume it is handled.
3. Warm the mailbox before real sends. Weeks, not days, ramping volume gradually. Our email warmup guide covers the schedule.
4. Set a custom tracking domain, or turn tracking off. Shared tracking domains carry other senders' reputation. If you are not going to set one up, sending untracked is the better trade.
5. Decide your daily cap and hold it. A steady low number beats a burst. Volume spikes are one of the clearest spam signals available.
Stage 2: Prospecting
6. Prospect pages, not domains. The unit that earns a link is a specific article that would be better with your resource in it. A domain is not a reason to write to anyone, and "I love your blog" is what an email with no specific page sounds like.
7. Search the way a reader would. The queries your buyers type surface the pages your buyers read. That is a better prospecting list than a scraped index of high-authority domains.
8. Check the page is maintained. A post last updated four years ago on a site with no recent publishing is a low-probability target however strong the domain looks.
9. Judge the site by attribution, not by score. Ask whether a link from this page would be a real editorial mention that passes credit. A high authority score on a page that marks every outbound link as sponsored is worth less than a modest site that links plainly. See relevant backlinks.
10. Skip anything selling placements. If the site has a "write for us" page with a price list, you are buying advertising. That is a legitimate purchase and it is not this process. Our backlink cost guide covers that side.
Stage 3: Contacts and verification
This is the stage that quietly ruins campaigns, and it is where our data is most useful.
11. Find the author, not the company. The person who wrote the post has a reason to care about it. A generic contact form does not.
12. Verify every address before sending. Across 17,164 addresses we verified, 17.3% were invalid. Sending unverified means roughly one in six messages hits a dead mailbox, and bounces are what turn a warmed domain cold.
13. Decide your catch-all policy in advance. 34.7% of our verified addresses were catch-all, meaning the server accepts everything and tells you nothing. They are not invalid and they are not confirmed. Either send to them knowingly and watch the bounce rate, or exclude them, but decide before you are looking at a campaign report.
14. Use a role inbox as a fallback rather than a disqualifier. 26.6% of addresses we verified were role inboxes such as info@ or editor@. When we started falling back to a role address instead of skipping the site, bounce rates held at parity with named addresses. The standard advice to avoid them entirely gives up a lot of reachable sites for a cost we did not observe.
15. Deduplicate by domain, not just by address. Two people at the same publication receiving near-identical pitches in the same week reads as automation, because it is.
Stage 4: The message
16. Reference the specific page in the first line. Not the site, the page, and something that could only be true of that page. This is the whole game, and it is why prospecting pages rather than domains matters upstream.
17. Make the ask small and singular. One request. A link, a look at a resource, a quote. Two asks in one email reliably gets zero.
18. Say who you are in one line. Enough to establish you are a person with a reason to write, not a paragraph of positioning.
19. Send at a human size. No images, no tracking pixels if you can avoid them, no signature block with six links. Plain text sends and reads like a person wrote it.
Stage 5: Follow-up and stopping
20. One or two follow-ups, several days apart, only on delivered threads. Following up on a message that bounced compounds the original problem.
21. Stop properly. Stop on reply. Stop on an explicit no, permanently, and record it so a future campaign does not repeat it. Stop after the last planned follow-up rather than letting a sequence run on. This is the step that separates outreach from spam, and it is entirely a discipline question rather than a tooling one.
What the June spike taught us
Our own bounce rate ran at 0.5% in April and 10.1% in June. That is the same process, the same kind of targets, and a twentyfold difference.
What moved it was list quality, not the pitch. A worse-verified batch went out, bounces climbed, and the recovery to 2.8% in July and 2.0% in August came from tightening verification rather than from rewriting emails. It is a useful reminder that the visible, creative part of link building is rarely the part that is broken.
Watch bounce weekly, not per campaign. A monthly figure hides the week that caused it, and by the time a month closes at 10% the damage to the domain is already done.
If you would rather not run the checklist yourself
All 21 steps are doable by hand. The parts that get skipped are the boring ones, and they get skipped consistently because they are boring rather than because anyone disagrees they matter.
MentionAgent is $99/mo flat and runs the whole sequence. The agent finds relevant posts in your niche, looks up the author's verified email, writes a pitch tied to the specific article, and sends it once you approve it in Telegram. Follow-ups run until someone replies, and stop when they do. No credits, no per-contact fees, no minimum term.
The numbers on this page are from that system running on our own campaigns, which is why we can publish them.
The boring steps, done every time
Verification, sending discipline and follow-up that stops when it should. $99/mo flat, whatever the volume. No credits, no minimum term.
Start Getting Mentioned On AutopilotFrequently asked questions
What should be on a link building checklist?
Five stages in order: sending setup (authentication and warmup), prospecting pages rather than domains, contact finding and verification, the message itself, and follow-up with a proper stop rule. Skipping setup or verification is what turns a campaign into a bounce problem.
Do I need to verify emails before outreach?
Yes. Across 17,164 addresses we verified, only 43.4% were clean: 17.3% invalid, 34.7% catch-all, 4.5% unknown. Unverified sending means about one in six messages hits a dead mailbox, which is the fastest way to undo a warmed domain.
What is a good bounce rate for outreach?
Under 3% is healthy, under 2% is good. We recorded 320 bounces across 11,198 send attempts from March to August 2026, or 2.9%, split 143 hard and 177 soft. Our worst month was 10.1% and our best 0.5%, so a bad month is a signal to fix the list rather than a permanent state.
Should I email a role address like info@ or editor@?
Worth trying when there is no named contact. 26.6% of addresses we verified were role inboxes, and using them as a fallback rather than skipping the site kept bounce rates at parity with named addresses. Avoiding them entirely gives up a lot of reachable sites.
How many follow-ups should I send?
One or two, several days apart, and only where the first message was delivered. The discipline that matters is stopping: on reply, on an explicit no, and after the last planned follow-up. Following up on a bounced thread compounds the original problem.