Most cold email campaigns fail before a single human reads them. The problem isn’t the copy — it’s the infrastructure. Spam filters, domain reputation scoring, and misconfigured DNS records kill deliverability at the server level, silently routing your carefully crafted outreach to spam folders or rejecting it outright. You can have the best subject lines in the world and it won’t matter if your sending domain has a reputation score of 30 or your DKIM signature is missing.
Cold email deliverability in 2026 is a technical discipline as much as a copywriting one. This guide covers the complete stack: DNS configuration, domain warming, sending infrastructure setup, content scoring, and frequency management. Implement all of it. Partial implementation produces partial results — deliverability is a system and every component matters.
Infrastructure Foundations: The Non-Negotiables
Before you send a single cold email, three infrastructure elements must be in place and verified. Skipping any of them will result in degraded deliverability regardless of how good everything else is.
SPF (Sender Policy Framework) is a DNS TXT record that authorizes which mail servers can send email from your domain. An example SPF record for a domain using Google Workspace and a cold email tool like Instantly: v=spf1 include:_spf.google.com include:sendgrid.net ~all. The ~all (softfail) is appropriate for most sending configurations; use -all (hardfail) only after you’ve confirmed all your sending services are included. Missing or incorrect SPF records cause immediate deliverability degradation — receiving servers treat emails without valid SPF as high-risk.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing emails that receiving servers verify against a public key in your DNS. Your email service provider generates the DKIM key pair and gives you the public key to add as a DNS TXT record at a selector subdomain (e.g., google._domainkey.yourdomain.com). Without DKIM, your emails are unsigned — many enterprise mail gateways automatically route unsigned external email to spam.
DMARC Configuration
DMARC (Domain-based Message Authentication, Reporting & Conformance) is the policy layer that ties SPF and DKIM together. It tells receiving servers what to do when your emails fail SPF or DKIM checks, and where to send failure reports. Start with a monitoring-only policy and graduate to enforcement:
- Phase 1 (monitoring):
v=DMARC1; p=none; rua=mailto:[email protected]— reports failures without taking action, gives you visibility into authentication issues before enforcing. - Phase 2 (quarantine):
v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]— quarantines 25% of failing emails, gradually increasing. - Phase 3 (enforcement):
v=DMARC1; p=reject; rua=mailto:[email protected]— rejects emails that fail authentication. This is the target state for all sending domains.
Enforced DMARC is a strong positive reputation signal. Google and Microsoft both give higher deliverability scores to domains with enforced DMARC policies. Run in monitoring mode for 2-4 weeks to identify any legitimate sending sources you missed in your SPF record, then graduate to enforcement.
Domain Separation Strategy
Never send cold email from your primary business domain. Cold email inherently generates some spam complaints and occasional blacklist events. If your primary domain gets blacklisted or its reputation degrades, that affects all your transactional email, marketing email, and every communication your company sends. Use dedicated sending domains — variations of your primary domain specifically for outreach (yourbrandoutreach.com, meetyourbrand.com, yourbrand-team.com).
Set up these domains with full DNS authentication (SPF, DKIM, DMARC), redirect them to your primary domain via 301 if anyone navigates directly, and treat each one as a reputation asset to be protected. If one gets burned, you retire it and warm a new one — without affecting your primary domain’s reputation.
Inbox Warming: Building Domain Reputation from Zero
A fresh domain has no sending reputation — it’s invisible to spam filters in the worst possible way. Spam filters treat zero-reputation domains as high-risk because spammers constantly register new domains to avoid reputation systems. Before you can send cold email at meaningful volumes, you need to build a positive sending history.
The warming process signals to mailbox providers (Google, Microsoft, Yahoo) that your domain is a legitimate sender: your emails are delivered to real inboxes, they’re opened, they’re replied to occasionally, and they’re not marked as spam. Building this signal takes time — there’s no shortcut, and trying to accelerate too aggressively backfires by generating suspicious sending patterns.
Manual Warming vs. Automated Warming Tools
Manual warming (sending real emails to real contacts who engage with them) is the highest-quality signal you can generate. If you have a network of colleagues, business contacts, or existing customers willing to receive and engage with warm-up emails, use them for your first two weeks of sending. Real human engagement is worth more than automated warming tool engagement in reputation systems.
Automated warming tools (Mailreach, Lemwarm, Instantly’s warmup, Smartlead’s warmup network) are practical for teams that don’t have large networks available. They work by connecting your sending account to a network of other warmed accounts, exchanging emails, and auto-generating positive engagement signals (opens, replies, “not spam” actions). They’re effective for establishing baseline reputation, but transition to real engagement as quickly as possible.
Recommended warming schedule for a new domain:
- Week 1: 10 emails/day, 100% open rate, occasional replies (automated tool + manual)
- Week 2: 25 emails/day, maintain positive engagement signals
- Week 3: 50 emails/day, begin mixing in first real prospect emails (highly targeted, small list)
- Week 4: 75-100 emails/day, expanding prospect outreach to warmed lists
- Week 5-6: 150-200 emails/day, full cold outreach operations
Monitoring Reputation During Warming
Track your domain reputation throughout the warming process using Google Postmaster Tools (free, shows Gmail-specific reputation) and Microsoft’s SNDS/JMRP for Outlook/Hotmail deliverability. A healthy reputation shows domain status as “High” or “Medium” in Google Postmaster Tools. If it shows “Low” or “Bad,” pause your outreach immediately, diagnose why (spam complaint rate too high, low engagement, blacklist appearance), and remediate before continuing.
MXToolbox’s blacklist monitoring will alert you if your domain or IP appears on any major blacklist. Set up automated daily checks. A blacklist appearance during warming is a signal to slow down and investigate — don’t power through it.
Content: Writing Cold Email That Passes Filters and Gets Replies
Modern spam filters use machine learning to evaluate email content in context, not just keyword matching. A subject line with “FREE STRATEGY SESSION” triggers filters regardless of how legitimate your offer is. But even sophisticated ML-based filters have identifiable patterns you can understand and work with.
The fundamental principle: write emails that look like they were written by one human to another specific human. Template-looking emails with merge tags, generic value propositions, and promotional language pattern-match to bulk commercial email in spam filter models. Personalization and specificity are deliverability assets as much as copywriting ones.
Subject Line Principles for Deliverability
High-deliverability subject lines share common characteristics: they’re short (4-7 words), they’re lowercase or sentence case (not ALL CAPS or Title Case Every Word), they don’t contain urgency language or promotional triggers, and they read like an email from a real person rather than a marketing campaign. Compare:
❌ Get 3X More Leads With Our Proven System — LIMITED TIME!
✅ quick question about [Company]’s outbound
The second subject line will outperform the first on deliverability even with identical body copy. Spam filters evaluate subject lines as the first classification signal. Give them a subject line that matches the pattern of legitimate personal correspondence, not commercial email.
Body Copy Structure for Inbox Delivery
Several content elements trigger spam filter escalations in email body copy. Avoid: excessive links (more than 1-2 per email), HTML-heavy formatting with buttons and styled CTAs, large images (especially in first contact), financial urgency language (“ROI,” “guaranteed results,” “risk-free”), excessive use of caps or exclamation marks, and unsubscribe links that look like bulk email footers (ironic but true — heavily templated unsubscribe language signals bulk commercial email to filters).
Use: plain text or minimal HTML, a single specific call to action (not multiple options), genuine personalization referencing something specific about the recipient’s company, short paragraphs (2-4 sentences), and a conversational tone that matches how actual business correspondence reads.
HTML vs. Plain Text
Plain text emails have higher deliverability rates than HTML emails for cold outreach — consistently and measurably. HTML email templates are the hallmark of marketing automation, which is exactly what spam filters are designed to catch. A plain-text email that looks like it was typed in Gmail is inherently more likely to pass filters and feel personal to the recipient.
If you must use HTML (for tracking opens, for light formatting), use minimal HTML — no tables, no background colors, no button elements, no inline CSS for styling. The closer your HTML email’s content structure is to a plain text email, the better its deliverability characteristics.
Sending Infrastructure and Frequency Management
Your sending infrastructure — the combination of ESP (email service provider), sending IP, sending domain, and sending volume — determines deliverability as much as authentication and content. Getting the infrastructure right prevents reputation damage before it happens.
For cold outreach specifically, dedicated cold email tools (Instantly, Smartlead, Apollo, Lemlist) outperform general marketing automation platforms (HubSpot, Mailchimp) because they’re designed for cold outreach sending patterns and have built-in deliverability features. General marketing automation platforms are optimized for warm list sending and their deliverability architecture reflects that.
Sending Volume and Rate Limits
Volume limits by infrastructure tier:
- New domain (weeks 1-4): Max 50-100 emails/day, sent over a 4-6 hour window
- Established domain (2-6 months old): 150-300 emails/day, spread across business hours
- Aged domain (6+ months, high reputation): 300-500 emails/day per sending account
- Multi-account setup: Multiple sending accounts on different subdomains, each at its own volume limit, for total campaign volumes of 1,000+ per day
Rate limits between sends are as important as daily volume limits. Sending 200 emails in a 10-minute burst looks like automated spam blasting. Use minimum 60-90 second delays between sends, with randomization (60-120 seconds is better than exactly 60 seconds). Most cold email tools have built-in send rate controls — use them.
Bounce Management and List Hygiene
Hard bounces (permanent delivery failures — invalid addresses) and soft bounces (temporary failures — full inbox, server timeout) both affect your sender reputation. A hard bounce rate above 3% is a strong spam signal. A hard bounce rate above 5% will get your sending account flagged or suspended by most ESPs.
Use an email verification service (NeverBounce, ZeroBounce, Hunter’s email verifier) to clean every list before first contact. Remove any address with a verification score below 85%. Run your lists through verification again after 90 days for stale data. The cost of email verification is trivial compared to the cost of a degraded sending reputation from high bounce rates.
Monitor your complaint rate in Google Postmaster Tools. Gmail’s spam button generates direct complaints back to your domain’s reputation score. A complaint rate above 0.1% is concerning; above 0.3% will trigger reputation degradation. If your complaint rate is rising, stop sending and audit your targeting — you’re reaching people who consider your email unwanted.
Reply Handling and Sequence Management
Deliverability doesn’t end at the first send. Follow-up sequences introduce additional deliverability risks that first-touch emails don’t have. Threading follow-ups in the same email thread (replying to your own first email) generally has better deliverability than sending fresh emails because it’s harder to classify as bulk outreach. Most modern cold email tools default to threaded follow-ups for this reason.
Sequence length should be governed by diminishing returns, not arbitrary maximums. A 2-3 step sequence (initial + 1-2 follow-ups) is appropriate for most cold outreach. Sequences of 7-10 steps are common but each additional touchpoint carries escalating spam risk and negative reply risk. Stop the sequence immediately when someone replies — regardless of whether the reply is positive or negative. Continuing to send to people who’ve responded, especially negatively, generates complaints.
Frequently Asked Questions
What DNS records are required for cold email deliverability?
Three DNS records are essential: SPF — a TXT record that specifies which mail servers are authorized to send from your domain; DKIM — a TXT record containing a public key that mail servers use to verify your email signatures; and DMARC — a policy record that tells receiving servers what to do when SPF or DKIM fail and where to send failure reports. All three must be properly configured before any cold outreach. Missing any one of them will result in degraded deliverability, and missing DKIM especially will cause many enterprise mail gateways to route your emails directly to spam.
How long does inbox warming take for a new cold email domain?
A new sending domain requires 4-6 weeks of inbox warming before it’s ready for cold outreach at meaningful volume. Start at 10 emails per day in week one, scaling to 25, 50, 100, and 150-200 over subsequent weeks. Automated warming tools like Mailreach, Lemwarm, and Instantly’s warmup network handle much of this by exchanging emails with other warmed accounts and generating positive engagement signals. Monitor your domain reputation in Google Postmaster Tools throughout — if reputation stays at “Medium” or better, continue scaling on schedule.
What spam trigger words should I avoid in cold email subject lines?
High-risk spam trigger words include: free, guarantee, 100%, no obligation, limited time, act now, click here, winner, congratulations, earn money, make money, risk-free, buy now, and any financial urgency language. But modern spam filters use ML-based contextual analysis rather than pure keyword matching. A short, lowercase, personalized subject line with no promotional patterns will outperform any template-style subject line regardless of specific word choices. Write subject lines that look like they came from one human to another specific human, not from a marketing campaign.
What is the ideal cold email sending frequency to maintain deliverability?
For a warmed sending domain, limit cold outreach to 150-300 emails per day per sending account, sent across business hours with 60-120 second randomized delays between sends. Never batch-send — a sudden spike in volume is a spam signal. For higher total volumes, use multiple sending accounts on separate subdomains, each operating within their own safe volume limits. The key is consistent daily volume that grows gradually rather than spiking unpredictably.
How do you check if your cold email domain is blacklisted?
Check your domain against major blacklists using MXToolbox (mxtoolbox.com/blacklists.aspx), which checks 100+ blacklists simultaneously. Also monitor your sending IP against Spamhaus and SpamCop. Google Postmaster Tools provides domain and IP reputation scores specifically for Gmail delivery. Set up automated daily monitoring via MXToolbox’s monitoring service so you’re notified of blacklist appearances within hours — catching a blacklisting early, before it compounds into full reputation damage, is the difference between a one-day fix and a weeks-long recovery.
-
By Guy Sheetrit
- Oct 27, 2026
By Guy Sheetrit
