We audited 25 e-commerce email programs. The leak was almost never the emails.

1. Everyone gets everything

This was the most common finding by a distance. Campaigns went to the full list, or to lists uploaded once and never refreshed. People who had not opened in a year got the same email, on the same day, as last week's customers. Inbox providers watch how recipients react, so mailing the silent majority drags down placement for everyone, including your best buyers.

Fix: Build engagement tiers (30, 60, 90 and 180 days) and send most campaigns to the engaged tiers only. Open the full list for a handful of tentpole moments a year, if at all.

Read next: 10 Klaviyo segments that drive revenue →

2. Automations that exist on paper

Owners told us their flows were set up. The accounts told a different story. In 11 audits a core automation (welcome, abandoned cart or checkout, browse, post purchase) was missing or not sending. In 8, flows sat in draft, manual mode or error, or showed as live while sending nothing. In 8, flows had no exit filters, so people who had just bought, bounced or unsubscribed kept getting follow ups. In 5, two or more flows fought over the same trigger.

• One store had 18 automations and none of them live.
• A B2B parts brand had 9 of 14 "live" automations that never sent an email. They only moved people between lists.

Where the audit checked, winback was missing in 9 of 12 accounts and post purchase in 8 of 15. These are the flows that turn a first order into a second one.

Fix: List every automation with its trigger and status. Keep one flow per trigger. Add exit filters for purchase, bounce and unsubscribe. Then sign up and buy on your own site as a customer would, and check every email actually arrives.

Read next: How to build a Klaviyo winback flow →

3. A list that is mostly dead weight

Many lists looked big and were mostly silent. A fashion jewelry brand had more suppressed profiles than active ones. A home textiles brand had more than half of its list suppressed. One account of roughly 650K profiles had about 400K that were inactive, suppressed or invalid.

The rates follow. Of the 10 audits that recorded an unsubscribe rate, 8 were above 0.3%, with a median of 0.46%. Of the 8 that recorded a bounce rate, 5 were above 1%, and three were above 8%.

Fix: Run a sunset flow, build a never engaged segment, and suppress before you scale. A smaller list that opens is worth more to your sender reputation than a large one that does not.

Read next: How to clean your list with a sunset flow →

4. Authentication is not deliverability

Six brands had SPF, DKIM, DMARC or a branded sending domain missing or failing, and that needs fixing first. But the more useful finding is the opposite case. Two brands had all three records passing on their own domain and were still landing in Gmail spam, because their reputation had already been spent on mailing cold contacts.

Spam complaints were not the culprit. All 7 audits that recorded a complaint rate were under 0.1%, with a median of 0.014%. The damage came from bounces, unsubscribes and silence.

Fix: Treat authentication as the entry ticket, not the cure. Reputation is rebuilt by sending only to engaged people for several weeks and widening slowly.

Read next: How to build and repair sender reputation →

5. Opens flatter, clicks tell the truth

Median open rate was 38%, which looks healthy. Median click rate was 0.83%, and 7 of 10 brands were under 1%. Privacy features and security scanners now inflate opens, so an open rate on its own says very little. One luxury jewelry account showed a 79.7% open rate next to a 0.01% placed order rate.

Fix: Judge every send on click rate, placed order rate and revenue per recipient. Retire open rate as a success metric.

Read next: The Klaviyo metrics that actually matter →

6. The dashboard is not telling the truth

Store integrations switched off, on site tracking disabled, sign up forms running outside the email platform, order events missing. When the data is wrong, every decision built on it is wrong too. In 10 accounts automations earned nothing, or a single flow carried almost all the revenue. In one, the welcome series alone made 64% of flow revenue.

Fix: Before any strategy work, confirm that placed order events arrive, that attribution uses placed orders rather than fulfilment, and that every form feeds the email platform.

Read next: How to measure email revenue accurately →

7. The front door leaks

No pop up at all, pop ups that convert at zero, every form left in draft, pop ups that ask only for a phone number, and pop ups that reveal the discount code on screen so nobody needs to open the welcome email. One mobile pop up had 691 views and 0 submissions.

Fix: One clear offer, email first, code delivered by email, and a test sign up every month to make sure the welcome flow fires.

Read next: How to build sign up forms that convert →

And the details that compound

Calls to action below the first scroll, emails long enough to be clipped by Gmail, and headlines baked into images were found in 18 of 25. Erratic sending, either dormant for months or bursts of several emails in a few days, showed up in 16. Consent or footer gaps, such as never subscribed contacts receiving marketing or a missing unsubscribe link, showed up in 12. That last group is exposure for legal review, not legal advice.

None of these is fatal alone. Together they are why the median account carried 8 separate problems, and why 14 of the 25 carried 8 or more.

Read next: How often to email your customers →