Cold Email Deliverability: Why Outreach Lands in Spam and What Actually Helps

Why does cold email land in spam?

Cold email lands in spam mainly because recipients don’t expect it and some of them react badly: they mark it as spam, ignore it, or never existed in the first place (the address bounces). Mailbox providers such as Gmail and Outlook watch those reactions closely and judge the sending domain by them. Authentication problems and aggressive volume make it worse, but the root cause is usually the combination of who you’re emailing and how many of them don’t want it.

That’s the uncomfortable starting point for cold email deliverability. Marketing email to subscribers starts with permission and some goodwill. Cold email starts with neither, so there’s very little margin for error.

How mailbox providers judge a sender

Providers don’t publish their filtering logic, but their sender guidelines are consistent about what they look at.

Authentication. Is the message really from the domain it claims to be from? SPF, DKIM and DMARC answer that. Google, Yahoo and Microsoft now require all three for high-volume senders, and Microsoft began filtering and rejecting non-compliant mail to Outlook.com, Hotmail.com and Live.com addresses from May 2025. A cold email domain that fails authentication is starting from behind regardless of volume.

Complaints. When a recipient clicks “Report spam,” that’s the strongest negative signal a sender can get. Google asks bulk senders to keep the user-reported spam rate below 0.1% and never reach 0.3%. Cold senders rarely hit the 5,000-a-day bulk threshold per domain, but the same signal still feeds filtering at lower volumes.

Bounces and unknown users. Sending to addresses that don’t exist suggests a bought or scraped list. A burst of “user unknown” responses is one of the fastest ways to damage a new domain.

Engagement. Replies, messages moved out of spam, contacts added to address books: all of these help. Messages deleted unread don’t.

Consistency. Sudden volume spikes, new domains sending at full speed on day one, and mismatched sending patterns (a mailbox that sends 200 emails and receives none) all look unlike normal human email.

The signals you control

List quality comes first

If we could change one thing in most outbound programs, it would be the data. Verify addresses before every import, not once per quarter. Treat catch-all domains with caution, since they accept mail at the server and may never deliver it. Avoid role addresses unless the role is genuinely your audience. Record where every contact came from.

Then narrow the audience. A list of 3,000 people who match a specific profile and a specific reason for reaching out will outperform a list of 30,000 loosely related titles, and it will generate far fewer complaints. Relevance is a deliverability control, not only a copywriting one.

Authentication on every sending domain

Each domain that sends needs an SPF record that includes the mailbox provider, DKIM signing with the provider’s key (2048-bit where available), and a DMARC record. DMARC should align with the From domain through SPF or DKIM. The outbound domain setup guide walks through the records, and our SPF, DKIM and DMARC guides cover each one in depth.

Volume and pacing

There’s no universally safe number of cold emails per mailbox per day. It depends on the domain’s age and history, the quality of the list and how recipients respond. Start low, increase gradually, and spread sends across the working day rather than in one burst. When bounce or complaint signals rise, reduce volume first and investigate second.

A rule of thumb we use: if a campaign’s hard bounce rate is high enough that someone noticed it without running a report, stop the campaign and check the data source before sending anything else from that domain.

Opt-outs that actually work

An easy, honored opt-out is a deliverability tool as well as a legal requirement. People who can’t find a way out will use the spam button instead. Include a clear opt-out line or link, honor plain-language requests such as “please remove me,” and suppress the person everywhere, not only in the current sequence. Google requires one-click unsubscribe (the List-Unsubscribe headers defined in RFC 8058) for marketing and promotional messages from bulk senders and asks for requests to be processed within 48 hours. Many cold emails won’t fall into the bulk sender category, but the principle is the same: removal should be immediate and reliable.

Content and tracking

Content matters less than most people assume, but some choices still cost you. Heavy HTML, image-only emails, link shorteners and multiple tracked links all make a one-to-one email look like a campaign. Open tracking relies on a pixel and is distorted by privacy features anyway, so many teams turn it off for cold email and measure replies instead. If you do track clicks, use a custom tracking domain rather than a shared one.

Deceptive tactics are both a deliverability and a compliance problem. Fake “Re:” or “Fwd:” subject lines, misleading sender names and hidden opt-outs all generate complaints, and CAN-SPAM specifically prohibits misleading headers and subject lines.

What about warmup?

Warmup means increasing a new mailbox’s volume gradually so providers see a history of normal sending before real campaigns begin. The gradual increase is sound advice. Automated warmup networks, where mailboxes exchange emails and automatically open, reply and rescue each other from spam, are more debatable. They create engagement that isn’t real, and they can’t compensate for a weak list. We treat warmup as a way to establish a baseline, not as protection, and our domain warmup guide explains the difference.

How do I know if my cold emails are going to spam?

You usually find out from a drop in replies before anything else, which makes diagnosis harder. Check these in order:

1. Bounce and error messages. Look at the actual bounce text, not just the count. Codes in the 5.7.x range often point to authentication or policy blocks. Microsoft’s high-volume sender enforcement, for example, returns a 550 5.7.515 error when authentication doesn’t meet its requirements.
2. Authentication results. Send a test to a Gmail and an Outlook address you control and read the message headers. Confirm SPF, DKIM and DMARC all pass and that DMARC aligns with your From domain.
3. Seed or placement tests. Useful as a rough indicator, with caution. Seed accounts don’t behave like real recipients, so a clean test doesn’t prove placement for your actual audience.
4. Google Postmaster Tools. Worth setting up for each sending domain. In 2025 Google retired its domain and IP reputation dashboards, but spam rate, authentication and compliance status are still reported, though data only appears once a domain sends enough Gmail volume.
5. Segment-level reply rates. If one segment’s replies collapsed while another’s held up, the problem may be the data or the message for that audience rather than the domain.

Here’s a realistic case. A team running four sending domains sees positive replies fall by half over three weeks. Authentication passes everywhere. The bounce logs, though, show one domain sending to a new data export with a far higher bounce rate than the others, and its reply rate is close to zero. A new domain won’t fix it. The fix is pausing that domain, removing the bad data source, suppressing the bounced addresses, and resuming at lower volume once replies recover.

Recovering from a deliverability problem

Recovery is mostly patience and subtraction. Pause or sharply reduce volume on the affected domain. Find the cause (usually a data source, a volume jump or a broken opt-out process) and fix it. Resume with your most relevant, best-verified segment, at low volume, and watch bounces, replies and opt-outs before increasing.

What doesn’t work is rotating to fresh domains and carrying on with the same list. Providers can associate domains through shared infrastructure, sender names, content and links, and the underlying problem moves with you. We won’t help build a setup that depends on burning through domains, because it’s a sign the program needs to change rather than its infrastructure.

Measuring cold email deliverability honestly

Track these per domain and per segment, weekly:

• Hard bounce rate, and which data source produced the bounces.
• Positive reply rate, separate from total replies.
• Opt-out rate, including plain-language requests.
• Spam complaints where you can see them (Postmaster Tools spam rate once volume allows).
• Meetings booked and pipeline created in the CRM.

The last item matters more than it looks. A domain with healthy placement and a segment that produces no pipeline is still a problem, just not a deliverability one. Making sure replies and meetings reach the CRM with a reliable source is covered in our outbound CRM handoff guide.