Cold email deliverability is the share of your outreach that reaches the recipient’s inbox instead of bouncing or landing in spam. It comes down to four things you control: a properly authenticated sending domain, a verified list of real business addresses, modest and steady volume per mailbox, and messages relevant enough that people don’t hit “Report spam.” Get those right and most of the spam-folder problem goes away.

The rest of this guide covers each of those areas in order, with the specific thresholds mailbox providers publish.

A newsletter goes to people who asked for it. Cold email goes to people who didn’t. Mailbox providers know the difference, and they judge your mail mostly by how recipients react to it.

That creates three disadvantages for cold outreach:

No engagement history. A new prospect has never opened, replied to, or moved your mail out of spam. You start with no positive signals.
Higher complaint risk. Recipients who don’t recognize you are more likely to mark the message as spam, and complaints are the signal providers weigh most heavily.
Unverified data. Prospect lists come from research, enrichment tools, and guesswork. Some share of those addresses won’t exist, and every one that doesn’t produces a bounce.

None of this means cold email can’t reach the inbox. It means the margin for error is smaller, so the basics matter more.

The rules the big mailbox providers publish

Gmail, Yahoo, and Microsoft all publish sender requirements. They were written for bulk senders, but they set the baseline for everyone.

Provider	Key requirements	Spam/complaint threshold
Gmail	SPF or DKIM for all senders; SPF, DKIM, and DMARC for senders of about 5,000+ messages a day to personal Gmail accounts; valid forward and reverse DNS; TLS	Keep spam rate below 0.30%, ideally below 0.10% (Google)
Yahoo	SPF or DKIM for all senders; SPF, DKIM, and DMARC (at least p=none) for bulk senders; valid forward and reverse DNS	Keep spam rate below 0.3% (Yahoo)
Microsoft (Outlook.com, Hotmail, Live)	SPF and DKIM passing, plus DMARC of at least p=none aligned with SPF or DKIM, for domains sending more than 5,000 emails a day to consumer addresses	Not stated as a single number in the announcement (Microsoft)

Two details matter for cold senders. First, Google counts all mail from the same primary domain together, so subdomains don’t reset the 5,000 count (Google FAQ). Second, Google’s own guidance says not to send messages to people who didn’t sign up for them and not to buy addresses (Google). Cold outreach sits in tension with that guidance, which is why it has to be targeted, low volume, and easy to opt out of.

For a fuller rundown of how the three providers’ rules compare, see our post on Gmail, Yahoo and Microsoft sender rules.

Step 1: Authenticate the domain you send from

Authentication proves the mail really comes from your domain. Without it, a cold message has almost no chance.

SPF. Publish a TXT record listing the services allowed to send for your domain (for example, Google Workspace or Microsoft 365, plus your outreach tool if it sends directly).
DKIM. Turn on DKIM signing in your mail platform and publish the public key in DNS. Google requires keys of at least 1024 bits and recommends 2048 (Google).
DMARC. Publish a DMARC record. Starting with p=none and a reporting address lets you see what’s passing before you tighten the policy.
Alignment. Make sure the domain in your From address matches the domain that SPF or DKIM authenticates. Passing SPF for a different domain doesn’t help.

If you need the step-by-step version, follow How to Set Up SPF, DKIM, and DMARC.

Step 2: Send only to verified, relevant addresses

Bounces are the most avoidable deliverability problem in cold email. A bounce tells the receiving server you’re mailing addresses you haven’t checked, and a high bounce rate looks like a purchased or scraped list.

Before any sequence goes out:

Remove addresses with broken syntax.
Remove addresses on domains with no mail server (no MX record).
Fix obvious domain typos such as gmial.com.
Remove disposable and temporary domains.
Decide how to treat role addresses (info@, sales@) and free-provider addresses (gmail.com, yahoo.com) for a B2B campaign.

You can run single addresses through our free email verifier to check syntax, domain and MX records, disposable domains, role-based addresses, free providers, and common typos. It doesn’t log in to the mailbox over SMTP, so it can’t confirm that a specific person’s inbox exists. Use it to catch the structural problems, and treat a clean result as “deliverable domain, plausible address” rather than a guarantee.

For the full argument on why this step comes before everything else, read Why You Should Verify Emails Before Cold Outreach.

Step 3: Keep volume low and steady

Mailbox providers watch for sudden spikes. Google’s guidance is to start with a low volume to engaged recipients, increase slowly, send at a consistent rate rather than in bursts, and cut volume if messages start bouncing or getting deferred (Google).

For cold outreach, that translates into a few habits:

Cap sends per mailbox. A common rule of thumb among cold email platforms is no more than about 50 cold emails per mailbox per day, and fewer for new mailboxes (Smartlead).
Spread sends across business hours. Let your tool send one message every few minutes, not 200 at 9:00 a.m.
Ramp new mailboxes gradually. A brand-new domain that sends hundreds of messages on day one looks like a compromised account.
Don’t use a platform that forbids it. Many email service providers only allow mail to people who opted in. Amazon SES, for example, defines unsolicited email as mail the recipient didn’t explicitly ask for and may pause accounts that send it (AWS).

The numbers behind these caps are covered in Cold Email Sending Limits per Day.

Step 4: Write messages people don’t report as spam

Content filters matter less than they used to. Recipient behavior matters more. The best content advice for cold email is to make it clearly worth reading for the specific person receiving it.

Be relevant. Write to a defined role and problem. A message that obviously wasn’t meant for the recipient gets reported.
Identify yourself honestly. Use your real name, company, and a From address that matches your brand. US law requires accurate header information, and misleading headers are a fast route to complaints.
Keep formatting simple. Plain text or light HTML, one link at most in the first message, no image-only emails, no attachments on first contact.
Make opting out easy. Include a plain sentence such as “Not the right person? Reply ‘no’ and I won’t follow up,” plus the opt-out mechanism CAN-SPAM requires. An easy exit lowers complaints because people use it instead of the spam button.
Avoid deceptive subject lines. “Re:” or “Fwd:” on a first message is misleading, and US law prohibits deceptive subject lines (FTC).

For the legal side, see CAN-SPAM and Cold Email.

Step 5: Protect your main domain

Most teams send cold email from a separate domain or from dedicated mailboxes so that a bad week doesn’t affect the company’s day-to-day mail. This is reasonable risk management, as long as the secondary domain is clearly yours, fully authenticated, and used honestly. It is not a way to dodge consequences: if your outreach generates complaints, the new domain will build a bad reputation too.

Using Secondary Domains for Cold Email covers how to set one up properly.

Step 6: Monitor and react quickly

Deliverability problems show up in data before they show up in your pipeline. Track these per mailbox and per campaign:

Metric	What it tells you	What to do if it rises
Hard bounce rate	List quality	Stop the campaign, re-verify the list, find the bad source
Spam complaint rate	Relevance and targeting	Narrow targeting, rewrite copy, shorten the sequence
Reply rate	Overall health	A sudden drop can mean you’re landing in spam
Deferrals (4xx responses)	Provider throttling	Reduce volume and slow the send rate

Free tools help here. Google Postmaster Tools shows Gmail spam rates and authentication results for your domain once you have enough volume, and providers’ published requirements tell you where the lines are.

A pre-launch cold email deliverability checklist

Run through this before every new campaign:

SPF, DKIM, and DMARC are published and passing for the sending domain.
The From name and address are real and identify your company.
The list has been verified, deduplicated, and checked against your suppression list.
Disposable, invalid, and no-MX addresses are removed.
Daily volume per mailbox is capped and sends are spread out.
The message is relevant to the recipient’s role and has no deceptive elements.
Every message includes a working opt-out and your physical postal address.
Opt-outs and “not interested” replies are added to suppression immediately.
Someone checks bounce and complaint data within the first day.

Before you load your next list, check a sample in the verifier on this site to spot obvious problems such as dead domains or disposable addresses.

FAQ

What is a good deliverability rate for cold email?

There’s no official benchmark, because providers don’t publish inbox placement rates. What you can measure is bounce rate and complaint rate. Keep spam complaints well below the 0.3% ceiling Gmail and Yahoo publish, and keep hard bounces low; a widely cited cold email benchmark is under 2% (Hunter).

Do I need DMARC for cold email if I send small volumes?

Gmail’s DMARC requirement formally applies to senders of about 5,000 or more messages a day to personal Gmail accounts. In practice, every sending domain should have SPF, DKIM, and a DMARC record. They’re free, they help recipients trust your mail, and they protect your domain from being spoofed.

Why do my cold emails go to spam even with authentication set up?

Authentication is necessary but not sufficient. The usual causes are low relevance (and therefore complaints), bounces from an unverified list, sudden volume spikes, or a new domain with no sending history. Fix list quality and targeting first.

Can warm-up tools fix poor cold email deliverability?

Warm-up tools that generate fake engagement don’t fix the underlying issue and may conflict with providers’ terms. A gradual, honest ramp to real prospects who are a good fit is the reliable route. If real recipients complain, no warm-up will offset that.

Cold Email Deliverability: How to Stay Out of Spam

Why cold email deliverability is harder than newsletter deliverability