Cold email deliverability is whether your outreach reaches the inbox rather than the spam folder or a bounce. It comes down to four things: domains that prove who you are with SPF, DKIM and DMARC; mailboxes that build a sending history slowly and send at a modest, steady pace; lists that don’t bounce; and recipients who rarely mark you as spam — Google asks senders to keep that rate below 0.1% and never let it reach 0.3%. Get those right and wording matters at the margin. Get them wrong and no subject line will save the campaign.
Key takeaways
- Authenticate every sending domain with SPF, DKIM and DMARC, aligned with your From address. Gmail, Yahoo and Microsoft now require it of high-volume senders.
- Treat provider limits as ceilings, not targets. Ramp new mailboxes up gradually and keep cold volume to a few dozen emails per mailbox per day, follow-ups included.
- Bounces and spam complaints do the most damage. Verify every list, and make opting out easier than complaining.
- Write plain, specific, honest emails: few links or none, no attachments, no fake “Re:”.
- Measure inbox placement and replies, not opens.
The sections below follow the order you would set things up in, and the checklist at the end is made to print.
How filters decide where cold email lands
Delivery and inbox placement are different things. A message is delivered when the receiving server accepts it; where it lands next — the inbox, a tab such as Promotions, or spam — is the filter’s decision. Rejections come back as bounces you can see. Spam-folder placement is silent: nothing tells you, and the prospect never sees the email.
Filters judge a message by its sender’s history as much as by its content. Google’s email sender guidelines say Gmail tracks volume, feedback and limits per domain and per IP address. Through Google Workspace or Microsoft 365, the IP addresses are the provider’s and shared, so the reputation you control is your domain’s. It is built from what recipients do with your mail: whether they reply, ignore it, delete it unread or report it as spam.
Cold email starts at a disadvantage. Google’s guidelines are written for mail people signed up for, and the Google Workspace Acceptable Use Policy prohibits “unsolicited mass email”. Researched, relevant outreach to a few dozen businesses a day is a different activity — but the more your program looks like mass mail, the more filters and policies will treat it that way.
Why cold emails go to spam
When a cold campaign lands in spam, the cause is almost always one or more of these:
- Missing or broken authentication. No DKIM signature for your own domain, an SPF record that misses your sending service, or no DMARC record. Google says unauthenticated messages “might be marked as spam or rejected”.
- Too much, too soon. A new mailbox that jumps straight to hundreds of emails a day. Google warns that even “immediately doubling previously sent volumes” can cause rate limiting or a drop in reputation.
- Bounces. Unverified or stale lists produce hard bounces.
- Spam complaints. Every “Report spam” click counts against your domain, and strangers report more readily than subscribers.
- Bulk-looking content. Heavy HTML, many links, shorteners, attachments and misleading subjects.
- Bursty sending. Hundreds of messages in minutes instead of a steady pace.
- Bad neighbors. An abused link or tracking domain, or a blocklisted sending domain.
Authenticate every sending domain
Authentication proves that mail claiming to come from your domain really does. Three DNS records do the work:
- SPF
- A TXT record listing the servers allowed to send for your domain — for Google Workspace,
v=spf1 include:_spf.google.com ~all. - DKIM
- A public key in your DNS that receivers use to check the signature your provider adds to every message, for example at
google._domainkey.yourdomain.com. - DMARC
- A TXT record at
_dmarc.yourdomain.comthat asks receivers to confirm SPF or DKIM passed for the same domain as your From address — called alignment — and to send you reports. Start withv=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
All three are now expected. Since February 2024, Gmail has required everyone who sends to personal Gmail accounts to use SPF or DKIM, and anyone sending close to 5,000 messages a day to use SPF, DKIM and DMARC with alignment; Google began ramping up enforcement in November 2025, including temporary and permanent rejections. Yahoo’s requirements are similar. And since May 5, 2025, Outlook.com has rejected mail from high-volume domains that fail these checks, with the error 550 5.7.515.
A small cold program may never reach 5,000 messages a day. Meet the bulk-sender rules anyway: the cost is three DNS records. The SPF, DKIM and DMARC guide has the exact records and a safe DMARC rollout.
Choose your sending domains and mailboxes
Your sending domain carries the reputation, so decide early whether cold email goes out from your main domain or a separate one.
| Option | Good for | Watch out for |
|---|---|---|
| Your main domain (you@acme.com) | Founders and small teams sending a few dozen personal emails a day. The most trustworthy-looking option. | A reputation problem affects invoices, support and everyone’s everyday mail. |
| A subdomain (you@mail.acme.com) | Separating mail streams while keeping your brand. Microsoft recommends a subdomain for bulk mail sent through services you don’t control. | Gmail counts subdomain mail toward the primary domain when it decides who is a bulk sender, and a subdomain follows the parent’s DMARC policy unless it publishes its own. |
| A separate domain (you@getacme.com) | Teams sending at volume who want to protect the main domain completely. | A new domain has no reputation and needs warming up. It must be obviously yours: same brand, real people, and a website or redirect to your main site. |
Whichever you choose:
- Send from mailboxes in real people’s names that receive replies. Microsoft recommends that large senders make sure the From or Reply-To address “can receive replies”.
- Use a paid Google Workspace or Microsoft 365 account on your own domain, not a personal @gmail.com address. Gmail’s program policies say not to use Gmail “to distribute spam or unsolicited commercial mail”, and you can’t publish authentication records for gmail.com.
- Keep mailboxes per domain small — we suggest about three — so a problem hits a slice of your sending, not all of it.
- Never use lookalike domains that could pass for someone else’s brand.
Warm up before you scale
A new domain or mailbox has no history, and filters are cautious with strangers. Google’s guidance is to “start with a low sending volume to engaged users, and slowly increase the volume over time”, sending at a consistent rate rather than in bursts.
A practical ramp starts around 20 emails a day per mailbox and grows about 30% a day: never doubling overnight, yet reaching a working volume in under two weeks. Begin with your warmest contacts before cold prospects. The email warmup guide has a day-by-day schedule and a fair comparison of warm-up tools with a real sending ramp.
Keep volume modest and pacing steady
| Mailbox | Provider’s published limit | Suggested cold volume |
|---|---|---|
| Personal Gmail | About 500 recipients a day | Not suitable for cold outreach |
| Google Workspace | 2,000 messages a day (1,500 with Gmail mail merge, 500 on a trial) | 30–50 a day per mailbox, follow-ups included |
| Microsoft 365 | 10,000 recipients a day, plus a tenant-wide limit on external recipients | 30–50 a day per mailbox, follow-ups included |
No provider publishes a “safe” number for cold email; these limits are abuse ceilings. Our 30–50 suggestion is a judgment call, not a rule: it keeps a mailbox looking like a busy person rather than a campaign, and limits the damage if a list turns out bad. Follow-ups count toward it: a four-step sequence that adds 10 new prospects a day settles at about 40 sends a day.
Spread each day’s sends across working hours in the recipient’s time zone, with minutes between messages. If receivers start deferring your mail — Gmail’s code for an unusual rate is 4.7.28 — Google’s advice is to pause for at least 10 minutes and resume gradually. The cold email capacity calculator works out how many mailboxes your volume needs.
Send only to verified, relevant contacts
Bounces tell a provider nobody maintains the list. Gmail’s help pages say that if many of your messages can’t be delivered, you may have to wait 24 hours to send again, and Google’s guidelines tell senders to cut volume when bounces rise. No provider publishes a bounce threshold, but a cleaned cold list should bounce at around 2% or less.
- Check every address before it enters a sequence: syntax, typos of big providers (
gmial.com), disposable domains, and whether the domain accepts mail at all. - Remove anyone who has bounced, unsubscribed or complained before.
- Don’t buy lists. Google and Yahoo both say so, and bought lists are where dead addresses and spam traps collect.
- Target people whose job makes your email relevant. Relevance keeps complaints low, and in several countries the law requires it — see cold email laws.
The email list verification guide explains what each check catches and what it misses.
Write like a person, not a campaign
Filters read content, but mostly to confirm what reputation already suggests. Aim for an email that looks and reads like one person writing to another.
- Plain text or very light HTML. No images or hidden text; Google says hidden content “might cause messages to be marked as spam”.
- One link at most in a first email, and no link shorteners. Google asks that links be “visible and easy to understand”; shorteners hide the destination and are widely abused.
- No attachments. Offer the deck and let the reply ask for it.
- Honest subject lines and display names. Google says not to start a subject with “Re:” or “Fwd:” unless the message really is a reply or forward.
- Real personalization. A first name in a merge tag isn’t personalization; a sentence that could only have been written to this company is.
- A clear identity and an easy way out. Say who you are, include your postal address (US law requires one in commercial email) and a short opt-out line.
There is no official list of “spam words”. Scam-style phrases (“risk-free”, “act now”) still add risk, but far less than authentication, list quality and complaints.
Decide what to track
Most outreach tools switch on open and click tracking by default. Each has a cost worth weighing.
| Tracking | What it tells you | What it costs |
|---|---|---|
| Opens (a hidden image) | Roughly who opened, unreliably. Apple’s Mail Privacy Protection “prevents senders from seeing if you’ve opened the email”, and Google says low open rates aren’t necessarily a deliverability problem. | An image and a tracking domain in every email; consent rules in the EU and UK. |
| Clicks (links rewritten through a redirect) | Who clicked — which can include security scanners that follow links automatically. | Your links point at a redirect domain whose reputation you share. |
| Replies | Who wrote back, and what they said. | Nothing. It’s the number that matters. |
A sensible default is to judge campaigns by replies, send first touches as plain text, and track clicks only when the link is the point. If you track, use a tracking domain of your own. In the EU and UK, check whether you need consent: the European Data Protection Board’s guidelines on Article 5(3) of the ePrivacy Directive treat tracking pixels and tracked links as accessing the user’s device, and the UK’s ICO says PECR’s cookie rules apply to tracking pixels in marketing emails that store or read information on the reader’s device.
Earn replies, and handle them fast
Engagement pulls a sender toward the inbox over time: Google’s Postmaster Tools bases some recommendations on whether recipients “didn’t open or interact with your email”. For cold email, the strongest positive signal is a reply, and the strongest negative one is a spam report.
- Ask one easy question rather than for a 30-minute meeting.
- Answer replies quickly, and stop every follow-up the moment someone replies, bounces or opts out.
- Honor opt-outs at once. Google expects unsubscribe requests to be honored within 48 hours and Yahoo within 2 days; US law sets an outer limit of 10 business days.
- Add one-click unsubscribe headers as defined in RFC 8058. Gmail and Yahoo require them of bulk senders, and someone who can leave in one click has less reason to press “Report spam”.
Complaint and bounce thresholds
| Metric | Gmail | Yahoo | Outlook.com | Suggested target |
|---|---|---|---|---|
| User-reported spam rate | Below 0.1%; never 0.3% or higher | Below 0.3% | No published threshold | As close to zero as you can get |
| Bounce rate | No published threshold | No published threshold | No published threshold | Under 2%; stop and clean above 5% |
| Honoring unsubscribes | Within 48 hours | Within 2 days | A working opt-out is recommended | Immediately |
Gmail calculates the spam rate daily from reports on mail that reached the inbox, and a bulk sender above 0.3% can’t get delivery help from Google until the rate stays below 0.3% for 7 consecutive days. If most of your mail already goes to spam, few people see it to report it, so a low rate can hide poor placement.
Monitor inbox placement, not just sends
A sent count tells you nothing about where mail landed. Use several signals together:
| Signal | What it shows | Useful for cold email? |
|---|---|---|
| Inbox placement tests | Whether a test message reached the inbox, a tab or spam at test mailboxes you control | Yes — the most direct check, if test inboxes are on other domains |
| Google Postmaster Tools | Spam rate, authentication, delivery errors and compliance status for mail to personal Gmail accounts | Partly — personal Gmail recipients only, and only at enough volume; most B2B prospects use company accounts |
| Microsoft SNDS | Data and complaint reports for IP addresses you are responsible for | No — unless you run your own sending servers |
| Yahoo Complaint Feedback Loop | Copies of messages Yahoo users reported as spam | Partly — only for Yahoo recipients, and it requires DKIM |
| Bounce and deferral codes | Exactly why a receiver refused or delayed a message | Yes — read them, don’t just count them |
| Replies | Prospects saying they found you in spam, or replying less | Yes — often the first sign |
Postmaster Tools v2 centers on a compliance status dashboard; Google has said it will retire the old Domain and IP Reputation dashboards. Also check that your domains and link domains aren’t on blocklists such as Spamhaus, and — as Google’s sender guidelines recommend — that Google Safe Browsing doesn’t list your website as unsafe.
The cold email deliverability checklist
Set up once
- SPF: one record per domain, listing every service that sends as it, within 10 DNS lookups.
- DKIM: your provider signs with your own domain, with a 2048-bit key where supported.
- DMARC: a record at
_dmarcwith at leastp=noneand aruaaddress someone reads. - Sending domains chosen deliberately; any separate domain redirects to your main website.
- Mailboxes in real people’s names, with a signature, and able to receive replies.
- One suppression list shared by every mailbox and sequence.
Before each campaign
- Every address verified; past bounces, unsubscribes and complaints removed.
- Every recipient has a role your email is genuinely relevant to.
- Plain text, one link or none, no attachments, an honest subject line.
- Your name, company, postal address and a short opt-out line in the email.
- One-click unsubscribe headers present.
- Daily volume per mailbox within its warm-up stage, follow-ups included.
- A placement test sent, and it landed in the inbox.
While sending, and every week
- Sends paced through business hours in the recipient’s time zone.
- Bounce rate under 2%; pause and clean the list at 5%.
- Replies answered the same day; opt-outs honored immediately.
- Placement and reply rate reviewed by mailbox; any mailbox drifting toward spam rested.
- DMARC reports checked for sending sources you don’t recognize.
How SalesScope handles this
SalesScope builds these guardrails into the sending itself, so the safe path is the default:
- Sender domain checks. SPF, DKIM and DMARC are checked for every sending domain and explained in plain words with the fix, and a sequence warns before it sends from a domain whose SPF or DKIM is missing.
- One sending limit per mailbox. A warm-up ramp that starts at 20 emails a day and grows 30% a day until it levels off at 200 by default, inside the provider’s ceiling: 500 a day for Gmail, 1,500 for Google Workspace by default (an admin can set up to 2,000) and 300 for Outlook.com. A Microsoft 365 mailbox’s limit starts at 500 a day, and SalesScope warns before it goes past 2,000, because the tenant-wide limit on external recipients is shared across your organization. Automated sending stops 2% short of the ceiling so you can still answer a prospect by hand.
- Validation before any bulk send. A campaign or sequence won’t enroll addresses nobody has checked.
- A bounce circuit breaker. Each mailbox is judged on everything it sent in the past 7 days. Once it has at least 50 sends and its bounce rate passes the workspace limit (5% by default), the mailbox goes on hold for a 48-hour cooldown, every active sequence on it pauses, and its owner is emailed. The sequences stay paused until the rest of their audience is validated and someone resumes them.
- One-click unsubscribe headers and a visible link on every campaign email; an unsubscribe stops the person at every address and in every sequence.
- Inbox placement tests once a day from each mailbox to spare Gmail or Outlook.com accounts you connect as test inboxes, with each mailbox’s inbox rate over time.
- Pacing that spreads each day’s sends across your sending window, and a live spam-word check in the composer.
Read more about deliverability guardrails and email verification.