Cold Email Deliverability: Stay Out of Spam

The best cold email in the world does nothing if it lands in spam. And deliverability is the part of outbound most teams think about last — usually after reply rates have quietly fallen off a cliff and nobody can say why.

The rules also changed. Since February 2024, Google and Yahoo have required bulk senders to authenticate their mail, offer easy unsubscribes, and keep spam complaints low. Outbound that ignored authentication used to be slightly worse; now it's often simply filtered. This guide covers the setup, the sending habits, and the monitoring that keep cold email in the inbox.

The short answer

1. Authenticate your domain with SPF, DKIM, and DMARC.
2. Send from a domain you're prepared to protect — often a dedicated subdomain or secondary domain for outbound.
3. Warm up gradually and keep daily volume per mailbox modest.
4. Only email people who plausibly want to hear from you, and verify addresses before you send.
5. Make unsubscribing trivial and honour it immediately.
6. Watch bounces and complaints, and stop when they rise.

Step 1: Authenticate your domain

Authentication is how a receiving server knows an email claiming to be from your domain really is. There are three records, and you need all three.

A few things trip people up:

• One SPF record per domain. If you have two, merge them. Multiple SPF records cause failures.
• Alignment matters. DMARC passes only when the domain in your visible From address matches the domain authenticated by SPF or DKIM. Sending "from" your domain through a tool that signs with its own domain can fail DMARC even when every record looks fine.
• Start DMARC gently. A policy of p=none collects reports without affecting delivery. Once reports show your legitimate mail passing, you can tighten it. Moving straight to a strict policy can block mail you forgot you send — invoices, calendar invites, your help desk.

Most sending tools give you the exact records to paste into your DNS. Publish them, wait for them to propagate, and verify before you send a single campaign.

Step 2: Choose the sending domain carefully

Your main domain's reputation also carries your invoices, password resets, and conversations with customers. Many teams send cold outreach from a separate subdomain (like outreach.yourcompany.com) or a closely related secondary domain, so a bad week of outbound doesn't touch the mail that runs the business.

Whatever you choose:

• Authenticate it fully, exactly as above.
• Make it look legitimate: a real website or a redirect to your main site, and a real person's name on the mailbox.
• Don't treat it as disposable. Receivers notice domains that appear, blast, and vanish.

Step 3: Warm up and pace your sending

A brand-new mailbox or domain has no reputation, and sudden volume from nowhere looks exactly like spam. Start small and increase gradually over several weeks, watching bounces and replies as you go.

Even once warm, keep daily volume per mailbox moderate and spread sends through the working day rather than in one burst. If you need more volume, add mailboxes rather than pushing one mailbox harder — and remember each one needs its own warm-up.

Step 4: Protect your list quality

Deliverability is mostly a consequence of who you email. Sending to people who don't recognise you, don't need what you sell, or whose address no longer exists is what generates the bounces and complaints that filters punish.

• Verify addresses before sending. Hard bounces — addresses that don't exist — are one of the fastest ways to damage a sender's reputation.
• Target tightly. A precise ideal customer profile means fewer people ask "why am I getting this?" and hit the spam button.
• Remove non-responders after a sequence ends rather than re-mailing them forever.
• Never buy lists. They're full of stale addresses and people with no connection to you.

Step 5: Make opting out easy — and required

Google and Yahoo's bulk-sender requirements include a clear, one-click way to unsubscribe for marketing and promotional mail, handled promptly. Beyond the rules, an easy unsubscribe is a deliverability tool in its own right: someone who can't find the way out reaches for the spam button instead, and complaints hurt far more than unsubscribes.

• Include a visible unsubscribe line in every cold email.
• Support one-click unsubscribe headers (the List-Unsubscribe and List-Unsubscribe-Post headers described in RFC 8058) where your tool allows.
• Suppress unsubscribed addresses across every sequence and every teammate — an opt-out that only applies to one campaign isn't really an opt-out.
• If someone replies "please stop," treat it exactly like an unsubscribe.

Many regions also have their own rules for commercial email, such as CAN-SPAM in the US and GDPR and PECR in the UK and EU, including a valid physical postal address in some cases. Check what applies to the people you email.

Step 6: Write emails that look like one person talking to another

Filters and people both react to the same signals. The emails that land and get replies tend to be:

• Short and plain. Mostly text, few images, no heavy newsletter-style design.
• Light on links. One link or none in a first touch. Link shorteners and many tracking redirects can look suspicious.
• Specific. A real reason you're writing to this person, not a template with a first name dropped in. Our cold email templates show the shape.
• Free of spammy phrasing — urgent all-caps subject lines and exaggerated promises.

Open tracking relies on a hidden image and is less reliable than it used to be, because some mail clients preload images. Judge campaigns by replies and meetings rather than opens — see cold email subject lines for testing what actually moves replies.

Step 7: Monitor, and stop when the numbers turn

Deliverability problems build quietly. Watch these every week:

Google's Postmaster Tools shows how Gmail sees your domain's reputation and complaint rate, and it's free to set up. When a signal turns, the right move is almost always to slow down and fix the cause, not to send more to make up the numbers.

How Twin-Sales helps

Twin-Sales can send outreach from your own authenticated domain: it walks you through the DKIM and SPF records to publish, verifies them, and only sends from a domain once it's confirmed. Every email carries an unsubscribe link and one-click unsubscribe header, opt-outs and replies asking to stop are honoured across every sequence and teammate, and bounces and complaints feed back into suppression automatically. You can also connect your own mailbox so replies thread into real conversations.

Good deliverability isn't a trick. It's what happens when you send relevant email, to the right people, from a domain that proves it's yours.

Sources and further reading

On this blog

• Cold Email Templates That Actually Get Replies
• Cold Email Subject Lines That Get Opened
• Outbound Sales: Building a Repeatable Motion in 2026

External sources

• Email sender guidelines — Gmail Help
• Email sender guidelines FAQ — Google Workspace Admin Help
• RFC 8058: Signaling one-click functionality for list email headers — IETF
• Postmaster Tools dashboards — Gmail Help
• CAN-SPAM Act: A compliance guide for business — U.S. Federal Trade Commission
• Electronic mail marketing (PECR) — UK Information Commissioner's Office