Email Deliverability for Cold Outreach: A Practical Guide

Delivery and deliverability are different things. An email is delivered when the receiving server accepts it. It is deliverable, in the sense that matters, when it reaches the inbox and not the spam folder.

Receiving servers decide from signals they can check: whether the message is authenticated, how your domain and sending IP have behaved before, how recipients react (replies, deletions, spam reports) and whether you send in a steady pattern or in sudden bursts.

With cold outreach, reactions weigh the most. Nobody asked for your email, and a few spam reports from a badly chosen list do more harm than they would on a newsletter. Most deliverability work removes reasons for a recipient, or a filter, to distrust you.

Reputation builds slowly and falls fast. Weeks of steady, well-received sending can be undone by one rushed campaign to an unchecked list, and the recovery takes far longer than the damage did. Everything that follows leans toward caution for that reason.

Authentication is a set of DNS records that let a receiving server confirm an email came from you. Four of them matter for every domain you send from.

DMARC also checks alignment: the domain in your visible From address has to match the domain that passed SPF or DKIM. Google’s DMARC setup guide recommends starting with a policy of none, always including a reporting address, and allowing 48 hours after setting up SPF or DKIM before adding DMARC. Once the reports show only your own services sending as you, you can move to quarantine or reject.

Gmail, Yahoo and Outlook now require SPF, DKIM and DMARC from senders above certain volumes. Dates and thresholds are in our guide to bulk sender requirements in 2026.

Many teams send cold outreach from a second domain, such as a close variant of yourcompany.com, to keep a bad week of outreach away from the domain their invoices, support replies and internal mail depend on. That is a reasonable precaution, with three conditions.

1. 1Authenticate it as fully as your main domain: SPF, DKIM, DMARC and MX. A bare domain with no records looks like exactly what it is.
2. 2Make it recognizably yours. Point its website at your real site, and send from real names on mailboxes that can receive and answer replies. Microsoft’s guidance for large senders asks for a From or Reply-To address that is valid and can receive replies.
3. 3Don’t treat it as a shield. A separate domain limits the damage a mistake can do, but poor targeting is still poor targeting. Gmail also counts mail from the same primary domain, subdomains included, together when it decides who is a bulk sender.

A new domain or inbox has no history, and receivers are wary of senders they don’t know. Google’s email sender guidelines put it plainly: start with a low volume, increase it slowly over time, send at a consistent rate and avoid sending in bursts.

In practice:

1. 1Warm up before outreach. A new inbox should build ordinary activity, mail sent and received, opened and answered, before it carries any cold email.
2. 2Give each inbox a conservative daily cap. Hold it while bounces and complaints stay low, then raise it in small steps. Never double it overnight.
3. 3Spread volume across several warmed inboxes, each at a modest, human-looking level, instead of pushing one inbox hard.
4. 4Send inside the recipient’s business day, in their time zone, with irregular gaps between sends.

Warm-up isn’t a one-time task. An inbox that has gone quiet for weeks, or a domain you have just added, starts the ramp again. When you need more volume, add warmed inboxes rather than pushing existing ones past their caps.

Bounces are one of the clearest signs that a sender doesn’t know their recipients. Verify every address before it enters a sequence, and remove an address the first time it hard-bounces. Google’s guidelines go further for all senders: don’t buy email addresses from other companies, and automatically unsubscribe recipients whose messages bounce repeatedly.

Hygiene also covers who is on the list. Take out existing customers, open deals, competitors and anyone on your do-not-contact list before a campaign starts. A tight target is the best protection you have. People who match your ideal customer profile reply; people outside it are the ones who report you.

Content plays a part too. A plain, specific email written for one person, as in how to write a cold email, gives the recipient a reason to reply instead of report.

Gmail requires bulk senders to support one-click unsubscribe on marketing and promotional messages, using the List-Unsubscribe and List-Unsubscribe-Post email headers. Yahoo’s sender best practices ask bulk senders to support the same and to honor unsubscribes within two days.

Cold outreach is not a newsletter, but Google notes that recipients, not Google, decide what kind of message they received. Put the header and a short, visible opt-out line in every outreach email. If leaving is easier than reporting you as spam, the person who isn’t interested will usually leave.

An opt-out has to reach everything that sends. Someone who unsubscribes from one campaign should leave every campaign, every inbox and every channel straight away.

Watch reputation per inbox and per domain as well as per campaign. That is how you see where a problem starts. For Gmail recipients, Google Postmaster Tools reports your spam rate and domain reputation. Google asks senders to keep the user-reported spam rate below 0.1% and never reach 0.3%.

Set your pause rules before you need them. Write down the bounce and complaint levels at which an inbox stops sending, and who investigates. A pause costs a few days. A burned domain costs months.

When an inbox does pause, work through the causes in this order instead of guessing:

1. 1Authentication. Confirm SPF, DKIM and DMARC still pass. A new tool added to the stack, or a DNS change, can break a record that worked last month without anyone noticing.
2. 2Volume. Compare recent daily sends with the planned cap. A spike from a large import or a second campaign on the same inbox is a frequent cause.
3. 3List. Look at where the bounces and complaints came from. One unverified source or one segment outside your target market often explains most of the damage.
4. 4Message. Read the emails that drew complaints as the recipient would. Vague, generic or heavily promotional copy invites the spam button.

Fix the cause, then restart the inbox at a lower cap and ramp up again. Picking up at full volume repeats the problem.

A weekly deliverability check:

• SPF, DKIM, DMARC and MX pass on every sending domain
• Each inbox sits at or below its planned daily cap
• Bounce and complaint levels are within your pause rules for each inbox
• Every unsubscribe from the past week left every campaign and channel
• No new list was imported without verification and a duplicate check
• Postmaster Tools shows no drop in domain reputation