- Deliverability is inbox placement, not delivery. A 99 percent delivery rate can still mean 40 percent of your volume sitting in spam.
- SPF, DKIM, and DMARC are required above 5,000 messages a day at Google, Yahoo, and Microsoft, and are checked on every message below that threshold too.
- Keep reported spam complaints under 0.10 percent and hard bounces under 2 percent, measured per sending domain rather than per campaign.
- Warm up for three to four weeks, then cap each mailbox at 30 to 50 a day and add mailboxes rather than raising the cap.
- Send outbound only from dedicated secondary domains, which is how our cold email agency service protects a client primary domain.
Email deliverability best practices are the technical and behavioral controls that decide whether a message reaches the inbox or the spam folder. In 2026 the bar is specific: any domain sending more than 5,000 messages a day to Gmail, Yahoo, or Outlook has to publish SPF, DKIM, and DMARC records, support one-click unsubscribe, and hold reported spam complaints below 0.30 percent. Domains that miss those requirements are rejected at the gateway, before anyone reads the subject line.
Most guides on this topic are written by email service providers for newsletter senders. The rules below are written from the other side of the problem, from running cold outbound where every domain is new, every recipient is a stranger, and there is no opt-in list to fall back on. That is the hardest version of deliverability, and the controls that survive it work everywhere else.
TL;DR: Summary
- Deliverability is inbox placement, not delivery. A 99 percent delivery rate can still mean 40 percent of your volume sitting in spam.
- Authentication is the entry ticket. SPF, DKIM, and DMARC are required above 5,000 messages a day at Google, Yahoo, and Microsoft, and they are checked on every message below that threshold too.
- Keep reported spam complaints under 0.10 percent and hard bounces under 2 percent. At 0.30 percent complaints Google treats the domain as a problem sender.
- Never send outbound from your primary company domain. Use dedicated secondary domains so a bad campaign cannot reach your invoices or your support inbox.
- Warm up for three to four weeks before real volume, then cap each mailbox in the 30 to 50 per day range and add mailboxes rather than raising the cap.
- Watch reply rate as the leading indicator. It falls before open rate does, and long before anyone tells you the domain is burned.
What is email deliverability, and how is it different from delivery rate?
Delivery rate measures whether the receiving server accepted the message. Deliverability measures where that message went after it was accepted. A server can accept 99 percent of what you send and file most of it in spam, which is why a clean delivery report tells you very little on its own.
Three separate numbers get called deliverability in casual conversation, and separating them is the first practical step, because each one has a different fix.
| Metric | What it measures | Where you see it | What a bad number means |
|---|---|---|---|
| Delivery rate | The receiving server accepted the message rather than rejecting it | Your sending platform | Bad addresses, blocklisting, or a failed authentication check |
| Inbox placement | The accepted message landed in the primary inbox rather than spam or promotions | Seed testing and Google Postmaster Tools | Weak sender reputation or low recipient engagement |
| Reply rate | A human read it and responded | Your sending platform | Placement problems, weak targeting, or weak copy |
Delivery rate is reported by every sending tool and is close to useless as a health check. Inbox placement is the number that matters, and it is the one nobody hands you by default. Reply rate is the number that moves first when placement slips, which makes it the most practical daily signal for an outbound team.
Why do well-written emails still land in the spam folder?
Filtering decisions are made in a fixed order, and copy is the last input considered. A message is checked first for authentication, then for the reputation of the sending domain and IP, then for how recipients have behaved toward similar messages. A perfect subject line cannot rescue a domain that fails the first two.
That order explains the most common frustration in outbound. Teams rewrite copy for weeks while the actual cause sits in a DNS record or a sending volume that ramped too quickly. Work the order from the top.
- Authentication. Does the receiving server believe you are who the From address claims? This is a binary check and it is cheap to pass.
- Reputation. Has this domain and IP sent mail that people wanted? Reputation is earned over weeks and lost in days.
- Engagement. Do recipients open, reply, and move messages out of spam, or do they delete and complain? This is where list quality shows up.
- Content. Does the message body look like mail that has been reported before? Real, but the smallest lever of the four.
Which DNS records does every sending domain need?
Three records, published on every domain you send from, including the secondary domains nobody visits. Each one answers a different question for the receiving server, and a domain missing any of them is treated as unauthenticated.
| Record | What it proves | What breaks without it | Common mistake |
|---|---|---|---|
| SPF | This IP address is allowed to send for this domain | Mail from your sending platform fails origin checks | Publishing two SPF records on one domain, which invalidates both |
| DKIM | The message body was not altered in transit and came from this domain | Messages cannot be tied back to you, so reputation never accrues | Rotating sending platforms and leaving the old selector in place |
| DMARC | What a receiver should do when SPF or DKIM fails, and where to report it | Above 5,000 messages a day, Google and Microsoft reject the mail outright | Jumping straight to p=reject before reading a single report |
Publish DMARC at p=none first and read the aggregate reports for two weeks. That policy changes nothing about how your mail is handled, and it tells you every source sending under your domain, which is usually more than you expect. Move to quarantine once the reports are clean, then to reject.
; 1. SPF - exactly ONE spf record per domain ; merge every sender into this single record example.com. IN TXT "v=spf1 include:_spf.google.com include:sendingplatform.com ~all" ; 2. DKIM - the selector and key come from your sending platform selector1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..." ; 3. DMARC - start at none, read reports, then tighten _dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; fo=1; pct=100" ; after two clean weeks _dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; pct=100" ; steady state _dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; pct=100"
The full record-by-record walkthrough, including how to verify each one resolves, is in our SPF, DKIM, and DMARC setup guide for cold email.
What do Google, Yahoo, and Microsoft require from bulk senders?
The three largest mailbox providers converged on effectively the same rulebook between 2024 and 2025, and enforcement is now active rather than advisory. Non-compliant mail is rejected with a permanent error rather than quietly filed in spam, which is better for you, because a rejection is visible in your logs.
| Requirement | Yahoo | Microsoft Outlook | Source | |
|---|---|---|---|---|
| Threshold | 5,000+ per day to Gmail | 5,000+ per day | 5,000+ per day to Outlook domains | Google Email sender guidelines; Yahoo Sender Hub; Microsoft 365 blog |
| SPF and DKIM | Both required | Both required | Both required | Provider sender guidelines |
| DMARC | Required, p=none minimum | Required, p=none minimum | Required, p=none minimum | Provider sender guidelines |
| Spam complaint rate | Below 0.10 percent, never at or above 0.30 percent | Below 0.30 percent | Low complaint volume expected | Google Email sender guidelines |
| One-click unsubscribe | Required for bulk mail | Required for bulk mail | Recommended | RFC 8058 |
| Enforcement | Permanent rejection | Permanent rejection | Rejection since May 2025 | Microsoft 365 blog |
Cold outbound rarely crosses 5,000 messages a day from one domain, so teams assume the rules do not apply. The authentication checks run on every message regardless of volume. The threshold governs when a provider will reject you for missing records, and passing those checks is what lets reputation accumulate at any volume.
We break the thresholds down further in our guide to the Gmail bulk sender requirements.
How long does a new sending domain need to warm up?
Three to four weeks before real campaign volume, and the ramp matters more than the total. A domain registered on Monday that sends 200 messages on Tuesday has told every receiving server that it exists only to send bulk mail. The same domain sending 5 on Tuesday and reaching 40 six weeks later reads as a normal business mailbox.
Buy domains at least 30 days before you need them. Age is one of the cheapest reputation inputs available and the only one you cannot buy back later.
Two details decide whether the ramp works. Warm-up traffic has to generate replies, not just opens, because reply behavior is weighted far more heavily than opens by every major provider. And the ramp cannot reset: a domain that sits idle for two weeks mid-warm-up starts most of the way over.
For the day-by-day schedule, see how long to warm up a cold email domain and our email warm-up guide.
How many emails per mailbox per day is actually safe?
Between 30 and 50 per mailbox per day for cold outbound on a warmed domain. When you need more volume, add mailboxes and domains rather than raising the per-mailbox cap. Reputation is tracked per domain and per mailbox, so spreading the same volume across more senders lowers the risk carried by each one.
The arithmetic is the part teams get wrong. Two setups can send exactly the same 200 messages a day and carry completely different risk.
The second configuration also fails safely. If one domain picks up a reputation problem, you lose a fifth of capacity and keep sending while it recovers. In the first configuration a single problem stops everything, and it stops the domain your invoices go out from if you made the mistake of sending from your primary.
Rotating across a pool without tripping provider limits has its own mechanics, covered in our guide to inbox rotation for cold email.
How do you keep a list clean enough to protect sender reputation?
Verify every address before it enters a sequence, and treat verification as a per-send step rather than a one-time import step. B2B data decays at roughly 2 to 3 percent a month as people change jobs, so a list verified in January is measurably worse by March.
Hard bounces are the fastest way to lose a domain. Keep them under 2 percent and pause the campaign at 5 percent rather than pushing through to the end of the send.
- Drop catch-all domains from cold campaigns, or segment them into their own low-volume sequence. Verification tools cannot confirm them, so they are unmeasured risk.
- Remove role addresses such as info, sales, support, and admin. They convert poorly and complain more.
- Suppress across every campaign, not per campaign. One person receiving the same offer from three of your domains is the single most reliable way to earn a complaint.
- Re-verify anything older than 60 days before it is sent again.
Recycled addresses that providers have converted into traps deserve particular attention, because hitting one can blocklist a domain outright. See what a spam trap is, and how soft and hard bounces differ for which ones to act on.
What in your copy actually triggers spam filters?
Less than most people think, and rarely the words. Filters are far more interested in structural signals than in whether you wrote the word free. The reliable content rules are short.
- One link at most in a first-touch cold email, and none at all performs better. Tracking links on a shared, unbranded domain are a common and invisible cause of filtering.
- No images, no attachments in a first touch. Plain text reads like a real person writing from a laptop, which is what you want it to look like.
- Turn off open tracking on cold sequences. It injects a remote pixel and a redirect domain for a metric that Apple Mail Privacy Protection has already made unreliable.
- Vary the body across the send. Thousands of byte-identical messages are trivially clustered, and real personalization changes the text anyway.
- Keep it short. Under 120 words holds up best in cold outbound, and it also happens to be what busy people answer.
Spam word lists circulate widely and are mostly obsolete. A message that passes authentication, comes from a warmed domain, and gets replies will survive vocabulary that a checker flags.
Which deliverability metrics should you review every week?
Five numbers, reviewed on the same day each week, per domain rather than per campaign. Reputation is a domain-level property, so campaign-level averages hide the domain that is quietly failing.
| Metric | Healthy | Investigate | Stop sending |
|---|---|---|---|
| Reply rate | 3 percent or higher | 1 to 3 percent | Below 1 percent with volume unchanged |
| Hard bounce rate | Under 2 percent | 2 to 5 percent | Above 5 percent |
| Spam complaint rate | Under 0.10 percent | 0.10 to 0.30 percent | Above 0.30 percent |
| Google Postmaster domain reputation | High | Medium | Low or Bad |
| Inbox placement in seed tests | Above 85 percent | 70 to 85 percent | Below 70 percent |
Reply rate falling while volume holds steady is the earliest reliable warning. It moves before open rate and well before anything appears in a blocklist, which gives you a week or two to act while the fix is still cheap.
Set up Google Postmaster Tools on every sending domain on the day you buy it. It is free, it is the only direct read on how Gmail sees you, and it needs history before it shows anything useful. Our guide to domain reputation in cold email covers reading those reports.
How do you recover a domain that is already sending to spam?
Stop sending on that domain the day you confirm the problem. Continuing to send while you diagnose is what turns a recoverable domain into a retired one. Then work the table below in order, because the cheap causes are also the most common.
| Symptom | Most likely cause | First fix |
|---|---|---|
| Sudden drop across every campaign on one domain | Authentication broke or the domain was blocklisted | Re-check SPF, DKIM, and DMARC resolve, then check the major blocklists |
| Gradual decline over two to three weeks | Volume ramped faster than reputation | Cut volume by half, extend the ramp, restart warm-up traffic |
| High bounces on a new list | Unverified or decayed data | Pause, re-verify the remaining list, drop catch-all domains |
| Fine at Google, filtered at Outlook | Missing DMARC alignment or IP reputation at Microsoft | Confirm DMARC alignment, then request delisting through Microsoft |
| One domain bad, the rest of the pool healthy | That domain carries the damage | Rest it for 30 days on warm-up traffic only, keep sending on the others |
| Every domain declining together | Shared IP pool, shared tracking domain, or list quality | Move to a different sending IP range and audit the list before anything else |
A rested domain can come back. Give it 30 days with warm-up traffic only, then restart at roughly a quarter of previous volume. If reputation has not moved after 60 days, retire it and keep the mailboxes on a new domain, which is cheaper than the time spent arguing with a filter.
What does running this consistently take?
Deliverability is not a project with an end date. Domains age, data decays, providers change thresholds, and a setup that worked in March drifts by September. The teams that hold inbox placement treat it as weekly maintenance with an owner.
We build this infrastructure for every client before a single campaign goes out. Sending runs on dedicated secondary domains so the client's primary domain is never exposed, warm-up runs for the first three weeks, and campaigns launch in week 4. LinkedIn replies typically arrive in weeks 2 to 3 while email infrastructure is still warming, and first qualified meetings land 5 to 7 weeks into an engagement.
What that produces when the infrastructure holds: for Primal, an 8 percent positive reply rate across campaigns, 85 or more sales qualified leads in 6 months, and a 4.57x return. For The Great Room, meetings moved from roughly two a quarter to two a month, and 250,000 US dollars or more in contract value closed about nine months in. Neither number is a copywriting result. Both depend on the mail arriving.
Our cold email agency service includes the domain setup, warm-up, list verification, and weekly monitoring described above, alongside campaign strategy and reply management.
DOMAINS [ ] Secondary domains only, primary domain never used for outbound [ ] Domains registered 30+ days before first send [ ] Redirect each secondary domain to the main site [ ] 3 to 5 mailboxes per domain, no more AUTHENTICATION [ ] Exactly one SPF record per domain, all senders merged [ ] DKIM published and verified for the current sending platform [ ] DMARC live at p=none, reports going to a monitored address [ ] All three confirmed resolving from an external DNS lookup WARM-UP [ ] 21 to 28 days of warm-up before campaign traffic [ ] Warm-up generates replies, not just opens [ ] No idle gaps longer than 3 days during the ramp [ ] Ramp to 30 to 50 per mailbox per day, then stop raising it LIST [ ] Every address verified within the last 30 days [ ] Catch-all domains removed or segmented separately [ ] Role addresses removed [ ] Global suppression list applied across all campaigns and domains CONTENT [ ] One link maximum in the first touch, zero preferred [ ] No images and no attachments in the first touch [ ] Open tracking disabled [ ] Body under 120 words MONITORING [ ] Google Postmaster Tools connected for every sending domain [ ] Seed test run before launch and weekly after [ ] Weekly review scheduled, per domain [ ] Pause thresholds agreed in advance: 5 percent bounces, 0.30 percent complaints
Cold email that reaches the inbox, built and run for you
We set up the domains, run the warm-up, verify the data, and monitor placement every week, so your campaigns are judged on the offer rather than the infrastructure.
Book the meeting
Frequently asked questions
What is a good email deliverability rate?
For cold outbound, inbox placement above 85 percent in seed testing is healthy, and anything below 70 percent needs action before the next send. Delivery rate is a separate number and should sit above 97 percent; a delivery rate below that usually points at unverified data rather than at reputation.
What is the difference between delivery rate and deliverability?
Delivery rate is the share of messages the receiving server accepted rather than rejected. Deliverability, more precisely called inbox placement, is the share of accepted messages that reached the primary inbox rather than spam. A campaign can show 99 percent delivery and still have most of its volume filtered.
How long does it take to warm up a new sending domain?
Three to four weeks before real campaign volume, starting at around 5 messages a day and ramping gradually to 30 to 50. Buy the domain at least 30 days before you plan to send, because domain age is itself a reputation input and cannot be added retroactively.
How many cold emails can I send per mailbox per day?
Between 30 and 50 per mailbox per day on a warmed domain. To send more, add mailboxes and domains rather than raising the cap, because reputation is tracked per domain and per mailbox and spreading volume lowers the risk carried by each sender.
Do I need SPF, DKIM, and DMARC for cold email?
Yes, on every sending domain. Google, Yahoo, and Microsoft require all three above 5,000 messages a day and check them on every message below that threshold. A domain missing any of the three is treated as unauthenticated and cannot accumulate sender reputation.
What DMARC policy should I start with?
Start at p=none and read the aggregate reports for two weeks. That policy changes nothing about how receivers handle your mail while it shows you every source sending under your domain. Move to p=quarantine once reports are clean, then to p=reject.
Should I send cold email from my primary company domain?
No. Use dedicated secondary domains that redirect to your main site. A deliverability problem on a secondary domain costs you a campaign, while the same problem on your primary domain affects invoices, support, and every other business message you send.
What bounce rate is too high?
Keep hard bounces under 2 percent. Between 2 and 5 percent, pause and re-verify the list before continuing. Above 5 percent, stop the campaign immediately, because continuing to send into bad data is the fastest way to lose a domain.
What spam complaint rate will get me blocked?
Google asks bulk senders to stay below 0.10 percent and treats 0.30 percent or higher as a problem. Because complaint data is reported with a delay, treat 0.10 percent as your working ceiling rather than as a target to approach.
Do links and images hurt deliverability in cold email?
They carry real cost in a first touch. Use one link at most and none where possible, avoid images and attachments entirely, and turn off open tracking, since it adds a remote pixel and a redirect domain for a metric that Apple Mail Privacy Protection has already made unreliable.
What is a spam trap, and how do I avoid hitting one?
A spam trap is an address that receives no legitimate mail, either created by a provider or recycled from an abandoned account. Hitting one can blocklist a domain outright. Verifying every address before each send and removing anything not verified within 30 days is the practical defense.
Can I recover a domain that is already sending to spam?
Often, yes. Stop sending immediately, fix the underlying cause, then rest the domain for 30 days with warm-up traffic only before restarting at about a quarter of previous volume. If reputation has not improved after 60 days, retire the domain and move the mailboxes.
Do email warm-up tools still work in 2026?
They help establish a baseline on a new domain, and they do not substitute for real engagement. Warm-up networks generate reciprocal replies among participating mailboxes, which builds early signal, but a domain that never receives genuine human replies will plateau. Treat warm-up as the ramp rather than as ongoing maintenance.
How do I check whether my emails are landing in the inbox?
Use seed testing, which sends to a set of monitored mailboxes across Gmail, Outlook, and other providers and reports placement for each. Pair it with Google Postmaster Tools for a direct read on how Gmail rates your domain. Your sending platform's delivery report will not tell you this.
Does adding an unsubscribe link help or hurt a cold email?
It helps. A one-line opt-out gives an uninterested recipient an action other than the spam button, and one complaint costs far more than one unsubscribe. Google and Yahoo require one-click unsubscribe for bulk mail under RFC 8058, and honoring opt-outs across every domain you own is the part teams forget.
Recommended service
Cold Email Agency
Reachly runs cold email end to end: dedicated infrastructure, signal-led copy, and replies handled until a meeting is booked.
