· 11 min read · Coldoutreach editorial
Cold Email Deliverability: the Complete Guide
Try the sequence composer
I do outreach as
Prospect industry
Tone
warmup active · unsubscribe included · suppression respected
Cold email deliverability comes down to four things: authenticate your domain with SPF, DKIM and DMARC, warm new inboxes up over 2 to 3 weeks, keep daily volume under provider thresholds, and watch bounce and complaint rates before they burn the domain. This guide covers each one, with the exact numbers, and ends with the recovery playbook for a domain that is already in trouble.
Everything below applies to permission-based B2B outreach. If the list is purchased or scraped, no technical setup will save it: the complaint rate itself will bury the domain within weeks, which is one reason compliant cold email and deliverable cold email are the same discipline.
The three DNS records, in plain English
Mailbox providers decide where your email lands mostly on the reputation of your sending domain, and reputation starts with proving the mail is really yours. Three DNS records do that:
- SPF (Sender Policy Framework) is a public list of the servers allowed to send email for your domain. If mail arrives from a server not on the list, providers treat it as suspect. One record, one line, five minutes to set up.
- DKIM (DomainKeys Identified Mail) is a cryptographic signature added to every message, proving it was not altered in transit and really came from you. Your email provider generates the key; you publish the public half in DNS.
- DMARC tells receiving servers what to do when SPF or DKIM fails (reject, quarantine or allow) and where to send reports. Since Google and Yahoo tightened bulk-sender rules in 2024, a DMARC record is effectively mandatory for anyone sending cold email at volume: without it, Gmail caps you long before your list runs out.
All three must pass. A domain with SPF and DKIM but no DMARC record loses several points of inbox placement at Gmail alone, and a hard SPF failure is close to an automatic spam verdict. Coldoutreach checks all three on every connected domain and refuses to start sequences until they pass, because sending even one day unauthenticated damages a reputation that takes weeks to build.
Warmup: the week-by-week ramp
A brand-new domain or inbox has no reputation, and mailbox providers treat sudden volume from an unknown sender as the signature of a spammer. Warmup fixes this by sending gradually increasing volumes of mail that gets opened, replied to and rescued from spam, which is exactly what a warmup network automates.
| Week | Daily sends per inbox | What is happening |
|---|---|---|
| Week 1 | 5 to 10 | Warmup-network mail only. Opens and replies establish a baseline. |
| Week 2 | 15 to 25 | Still mostly warmup traffic; spam placements are pulled out, teaching filters. |
| Week 3 | 30 to 50 | First real sequences at low volume, warmup continues underneath. |
| Week 4+ | 50 to 100 | Full sending. Warmup stays on at reduced volume as ballast. |
Two numbers matter more than the schedule: never jump volume more than roughly 40 percent day over day, and never stop warmup entirely on a domain that sends cold email. Reputation decays; the ballast traffic keeps it steady through weekends and list gaps.
Throttles: how much a warm inbox can send
Even fully warm, cold email volume per inbox should stay far below technical limits. The practical ceilings in 2026: 50 to 100 cold sends per day per Google Workspace inbox, similar for Microsoft 365, spaced out through the working day rather than fired in one burst at 9:00. Need more volume? Add inboxes and sending domains, not volume per inbox. Serious senders run outreach from a separate domain (yourcompany-hq.com, getyourcompany.com) so the main company domain never carries cold-email risk. That separation is standard practice, costs 12 dollars a year, and is the single cheapest insurance in outbound.
Content: what filters actually punish
Content matters less than reputation, but three patterns still hurt: spam-trigger vocabulary ("free", "guarantee", "act now", "limited time", ALL CAPS, exclamation marks in subjects), image-heavy or link-heavy bodies (more than one link in a first touch is a flag), and identical bodies sent hundreds of times. That last one is where research-grade personalization pays a deliverability dividend: when every email is genuinely different because the first line is written per prospect, bulk-similarity fingerprinting has nothing to match. It is a side effect of doing cold email personalization properly, and one reason personalized campaigns show both higher replies and higher inbox placement.
Monitoring: the numbers to watch weekly
| Metric | Healthy | Investigate | Stop sending |
|---|---|---|---|
| Bounce rate | under 2% | 2 to 5% | over 5% |
| Spam complaint rate | under 0.1% | 0.1 to 0.3% | over 0.3% |
| Open rate (proxy for placement) | over 40% | 25 to 40% | under 25% |
| Spam-folder placement (seed tests) | under 5% | 5 to 15% | over 15% |
Bounces are the earliest signal: they mean list quality slipped, and providers punish senders who keep mailing dead addresses. Verify every list before it enters a sequence and re-verify anything older than 90 days. Complaints are the deadliest signal: 3 complaints per 1,000 sends is Google's published cutoff, and recovering from complaint-driven damage takes far longer than bounce-driven damage.
The recovery playbook for a burned domain
Open rates fell off a cliff and seed tests show spam placement? In order:
- Stop all cold sending immediately. Every additional send while flagged digs deeper.
- Audit authentication. A surprising share of "burned domain" cases are a broken DKIM key or an SPF record that exceeded its 10-lookup limit after a tool was added.
- Clean the list. Re-verify everything; remove all previous bounces and non-openers.
- Run warmup-only for 2 to 4 weeks. Positive engagement is the only thing that rebuilds a reputation score.
- Re-enter at week-1 volumes to your most engaged segment first, and ramp on the same schedule as a new domain.
Recovery succeeds in most cases within 4 to 6 weeks. If placement has not moved after that, retire the domain for cold email: the cost of a fresh sending domain plus 3 weeks of warmup is lower than months of fighting a blacklisted reputation.
The short version
Authenticate everything, warm up for three weeks, cap volume per inbox, separate your sending domain, verify lists, watch bounces and complaints weekly, and make every email genuinely different. Or use cold email software that enforces all of it by default: Coldoutreach ships with warmup on, authentication checked, throttles applied and suppression enforced, so deliverability is the starting point rather than the postmortem. The response-rate benchmarks show what those fundamentals are worth in replies.