Cold Email Deliverability Guide: How to Stay Out of Spam

Here's the thing nobody wants to hear about cold email: your copy doesn't matter if your emails land in spam. You could write the most compelling email in the history of B2B sales and it's worthless if the recipient never sees it.

Deliverability is the boring, technical foundation that makes everything else work. And most people either ignore it entirely or set it up wrong and wonder why their open rates are in the gutter.

This guide covers everything you need to know about cold email deliverability in 2026. Domain setup, authentication, warmup, sending limits, inbox rotation, and the things that will land you in spam if you're not careful. Related: Cold Email Infrastructure.

The Three Pillars of Email Authentication

Before you send a single cold email, your sending domains need three authentication records configured. These tell receiving email servers (Gmail, Outlook, etc.) that you are who you say you are. Without them, you're basically sending emails with a fake return address. Related: B2B Cold Email Best Practices.

SPF (Sender Policy Framework)

SPF is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. When a receiving server gets an email from your domain, it checks the SPF record to verify the sending server is authorized. Related: Cold Email Metrics.

• Add a TXT record to your domain's DNS
• Include all services that send email for you (Google Workspace, your sending tool, etc.)
• Only one SPF record per domain (combine multiple senders into one record)
• Use "-all" (hard fail) at the end, not "~all" (soft fail)

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to every email you send. The receiving server checks this signature against a public key in your DNS records. If the signature is valid, the email hasn't been tampered with in transit.

• Generate a DKIM key pair through your email provider
• Add the public key as a TXT record in your DNS
• Your email provider handles the signing automatically
• Use a 2048-bit key (1024-bit is being phased out)

DMARC (Domain-based Message Authentication)

DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. It also gives you reporting so you can see who's sending email using your domain.

• Start with a policy of "none" (monitoring mode) for 2-4 weeks
• Review DMARC reports to identify any legitimate senders you missed
• Gradually move to "quarantine" then "reject" policies
• Set up a reporting email to receive aggregate reports

Domain Warmup: Building Trust from Scratch

A brand new domain has zero sending history. Email providers don't trust it. Sending 500 emails on day one from a new domain is the fastest way to get blacklisted.

How Domain Warmup Works

Warming a domain means gradually increasing your sending volume while generating positive engagement signals (opens, replies, clicks). Here's what the process looks like:

• Week 1: Send 5-10 emails per day per inbox. These should be to real contacts who will open and reply (team members, friends, or a warming service).
• Week 2: Increase to 15-25 emails per day. Mix warming emails with a small number of cold sends.
• Week 3: Ramp to 30-50 emails per day. Start sending more cold emails while maintaining warming volume.
• Week 4+: Full capacity at 50-75 emails per day per inbox. Keep warming running in the background permanently.

Warming Tools

Manual warming is painful. Use a tool to automate it:

• Instantly has a built-in warm-up feature that sends emails between accounts in their network
• Warmup Inbox is a dedicated warming service
• Smartlead includes warming as part of their platform

Keep the warming tool running even after you start sending cold emails. It maintains positive engagement signals that help your overall sender reputation.

Inbox Rotation: Spreading the Load

Sending all your emails from one inbox is risky. If that inbox gets flagged, your entire campaign stops. Inbox rotation spreads your sending across multiple inboxes and domains, reducing risk and looking more natural to email providers.

How to Set Up Inbox Rotation

1. Buy 3-5 sending domains similar to your main domain (variations, not exact copies)
2. Create 2-3 inboxes per domain ([email protected], [email protected])
3. Warm all inboxes simultaneously for 2-3 weeks before sending
4. Configure your sending tool to rotate sends across all inboxes automatically
5. Monitor each inbox independently for deliverability issues

With 5 domains and 2 inboxes each, you have 10 inboxes sending 50 emails per day. That's 500 emails per day without any single inbox being overloaded.

Sending Limits: How Much Is Too Much?

Sending too many emails too fast is the number one way people destroy their deliverability. Here are the limits you should follow:

Per Inbox Limits

• Google Workspace: 500 emails per day maximum, but keep cold sends at 50-75 per inbox for safety
• Microsoft 365: 10,000 per day maximum, but same rule: keep cold sends at 50-75 per inbox
• New inboxes (first 30 days): Start at 20-30 and ramp up gradually

Time Spacing

• Wait 3-5 minutes between each email send (don't blast 50 emails in 2 minutes)
• Send during business hours in the recipient's timezone
• Vary your send times slightly each day (don't send at exactly 9:00am every day)

Weekly and Monthly Patterns

• Send Tuesday through Thursday for best results
• Monday and Friday are acceptable but typically see lower engagement
• Don't send on weekends (looks automated and engagement is low)
• Take breaks. Don't send 7 days a week, 365 days a year from the same inbox

Content Triggers: What Gets You Flagged

Even with perfect infrastructure, certain content patterns will trigger spam filters. Avoid these:

Spam Trigger Words

• "Free," "guarantee," "no obligation," "act now," "limited time"
• "Click here," "buy now," "order today"
• Excessive exclamation marks or ALL CAPS
• "Unsubscribe" in the subject line (ironically)

Formatting Red Flags

• HTML-heavy emails with images, banners, and colored text
• Multiple links (especially tracking links)
• Large email signatures with images and social icons
• Attachments of any kind

Behavioral Red Flags

• High bounce rates (above 3%)
• High spam complaint rates (above 0.1%)
• Low open rates (below 20%)
• Sending to catch-all or role-based emails (info@, sales@, admin@)

Monitoring Your Sender Reputation

You can't fix what you can't see. Set up monitoring so you catch deliverability issues before they tank your campaigns:

• Google Postmaster Tools: Free. Shows your domain reputation, spam rate, and authentication status for emails sent to Gmail
• Microsoft SNDS: Similar tool for emails sent to Outlook/Hotmail
• MxToolbox: Check if your domains or IPs are on any blacklists
• Mail-tester.com: Send a test email and get a spam score
• Your sending platform: Most tools (Instantly, Smartlead) show deliverability metrics per inbox

Check these at least weekly. Daily is better when you're ramping up new campaigns.

What to Do If You Land in Spam

It happens. Even to the best-run campaigns. Here's how to recover:

1. Stop sending immediately from the affected inboxes
2. Check your DNS records to make sure nothing is misconfigured
3. Check blacklists using MxToolbox and request removal if listed
4. Reduce volume dramatically when you resume (back to 10-20/day)
5. Increase warming to rebuild positive engagement signals
6. Review your content for spam triggers you might have missed
7. Clean your list and remove any addresses that bounced or complained

Recovery takes 1-3 weeks depending on the severity. In extreme cases, it might be easier to retire the domain and start with a fresh one.