Guide · Deliverability
Cold email deliverability: landing in the inbox
The best message is worthless in the spam folder. Deliverability plays out on three levels: technical authentication, domain reputation and sending behaviour.
Updated 2026-10-05
In short
To get cold email into the inbox: authenticate your domain with SPF, DKIM and DMARC, send from a secondary domain to protect your main one, warm up every new mailbox, keep volumes low and steady, offer a simple unsubscribe and keep your spam complaint rate very low. Google and Yahoo publish these requirements for senders.
What mailbox providers check
Gmail, Outlook and Yahoo decide in milliseconds where an email goes. They first check that the sender is who it claims to be (authentication), then what they know about it (domain and IP reputation), then how recipients react (opens, replies, spam reports, deletions without reading).
Since 2024, Google and Yahoo have published explicit requirements: Google in its email sender guidelines and Yahoo in its sender best practices. They target high volumes first, but they are good practice for every sender.
The three authentication records
| Record | What it proves | How to set it up |
|---|---|---|
| SPF | Which servers may send for your domain | A TXT record in your DNS zone listing your sending services |
| DKIM | The message was not altered and comes from your domain | A public key in DNS, supplied by your email service |
| DMARC | What the receiver should do if SPF or DKIM fails, and where to send reports | A TXT record on _dmarc.yourdomain, starting with p=none |
Google requires at least SPF or DKIM from every sender, and SPF, DKIM and DMARC (p=none accepted) above 5,000 messages a day to Gmail, with an aligned From domain. Source: Google email sender guidelines.
Secondary domains: protect your main one
Cold email puts the sending domain’s reputation at stake. If your main domain (the one for invoices, support, customer conversations) gets penalised, all your mail suffers. Common practice is therefore to send prospecting from one or more secondary domains close to your brand: for example [yourbrand]-consulting.com or get[yourbrand].com.
These must be real domains: authenticated (SPF, DKIM, DMARC), with a web redirect to your main site and mailboxes in the names of real team members. A domain registered yesterday and used at full volume is a classic spam pattern.
Warming up a new mailbox
Wait and dress it
Let the domain age for a few weeks if you can, add a signature and a photo, send a few normal emails to colleagues and partners.
Ramp up gradually
A warmup service exchanges emails with other mailboxes, rescues them from spam and replies, which builds reputation. Raise the daily volume in small steps over several weeks.
Keep it running during campaigns
Warmup does not stop at launch: keep it running alongside to maintain a share of positive interactions.
Monitor
Register your domains in Google Postmaster Tools to follow their reputation and spam rate.
Volumes and sending behaviour
- Several mailboxes rather than one overloaded one: spread sending and keep a modest, steady daily volume per mailbox.
- No spikes: 500 emails on Monday and nothing the rest of the week looks like a mass campaign.
- Clean lists: verify addresses before sending; a high bounce rate quickly damages reputation.
- Plain text: few links, no attachment on first contact, no heavy images, no URL shorteners.
- Tight targeting: a relevant email gets replies; an off-topic one gets reported. Deliverability starts with your ICP.
Thresholds published by mailbox providers
| Requirement | Yahoo | |
|---|---|---|
| Spam complaint rate | Stay below 0.1% and never reach 0.3% | Stay below 0.3% |
| Bulk sender authentication | SPF, DKIM and DMARC above 5,000 messages a day | SPF, DKIM and DMARC (at least p=none) |
| One-click unsubscribe | Required for marketing messages from bulk senders | Required, honoured within 2 days |
Sources: Google sender guidelines and Yahoo sender best practices, checked on 5 October 2026.
One-click unsubscribe
One-click unsubscribe relies on two headers defined in RFC 8058: List-Unsubscribe and List-Unsubscribe-Post. Mail clients then show an “Unsubscribe” button next to the sender. Add a visible link or sentence in the body too.
It is also your best ally: someone who can unsubscribe easily has no reason to click “Report spam”. And it is a requirement of GDPR-compliant prospecting.
Deliverability checklist
- SPF, DKIM and DMARC set up and valid on every sending domain.
- Secondary domains redirected to the main site.
- Mailboxes warmed up for several weeks before the first campaign.
- Modest, steady daily volume per mailbox.
- Addresses verified before sending, bounces removed.
- Unsubscribe link in every email and one-click unsubscribe headers.
- Spam rate monitored in Postmaster Tools.
Diagnosing a drop in results
When replies fall with no change in target or message, deliverability is the first suspect.
| Symptom | Likely cause | What to do |
|---|---|---|
| Rising bounces | Unverified or old list | Pause, verify addresses, remove hard bounces |
| Replies dropping on one mailbox | That mailbox or its domain has lost reputation | Cut its volume, extend warmup, check authentication |
| Replies dropping on every mailbox | Message too salesy, links or targeting at fault | Simplify the copy, remove links, tighten the target |
| Your test emails land in spam | Incomplete authentication or suspicious content | Check SPF, DKIM and DMARC, test plain text |
| Rising complaint rate | Off-target recipients or too many follow-ups | Revisit the ICP, shorten the sequence, make unsubscribe more visible |
Content matters too
Filters read the message. A cold email that gets through looks like one person writing to another: a few sentences, a plain tone, no heavy formatting, no words in capitals, no unsourced numeric promises. A sober signature with name, role and company reassures more than a banner.
Vary messages from one prospect to the next through real personalisation rather than sending hundreds of identical copies: large volumes of strictly identical content are a pattern mailbox providers know how to spot.
What The Sales Engine does
The platform sends from mailboxes dedicated to prospecting, with a warmup you can control mailbox by mailbox. Addresses are looked up at enrolment, a daily cap paces each campaign, and every message carries an unsubscribe link. With our managed service, our team monitors mailbox health for you.
Frequently asked questions
How many emails per day per mailbox?
No mailbox provider publishes a figure for prospecting. The principle is to stay modest, steady and gradual, spread volume across several mailboxes and watch complaints. If replies drop or bounces rise, slow down.
Does the open rate reveal a deliverability problem?
Not really anymore: some clients preload images and inflate opens, others block tracking. Rely on replies, bounces, complaints and the providers’ reputation tools.
Should I move DMARC to p=reject?
Google accepts p=none for its requirements. A stricter policy better protects your domain from spoofing, but get there gradually after reading DMARC reports, so you don’t block your own legitimate mail.
Read next
Check your sending setup
We review your domains, mailboxes and sending pace together before your next campaign.