Cold email deliverability guide

What deliverability means

Deliverability is the share of sent mail that reaches the inbox rather than the spam folder. A message can be accepted by the receiving server and still be filed where nobody will read it.

Mailbox providers do not judge one message at a time. They score the sender: the domain, the mailbox, the sending history, and how recipients have treated earlier mail from the same source. Content is an input, but the smallest one.

Each large provider keeps its own record of a sending domain, so the same campaign can land in the inbox at one provider and in the junk folder at another on the same afternoon.

The major mailbox providers' bulk sender requirements set the baseline: authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe, and keep spam complaints low. They were written for high-volume senders, but filters now apply the same expectations to everyone.

SDRclose sends through the customer's own connected mailboxes, never a shared pool, so the reputation being built belongs to the customer's domain alone.

The inputs, in roughly the order filters weigh them:

• Authentication: whether SPF, DKIM and DMARC pass, and whether the passing domain matches the one in the From address.
• Sender history: how long the domain and the mailbox have been sending, and how that mail was received.
• Engagement: replies, opens and messages rescued from spam, weighed against deletes without reading.
• Complaints: how often recipients press the spam button.
• Bounces: how much of the list does not exist.
• Volume pattern: steady and predictable, or a jump from nothing to hundreds in a day.
• Content: links, images, attachments, known spam phrasing, and how closely the message resembles mail already marked as spam.

Authentication: SPF, DKIM and DMARC

The three records answer three different questions, and providers check all three. DMARC passes only when SPF or DKIM passes on a domain that aligns with the address the recipient sees.

SPF is a public list of the servers allowed to send mail as your domain, published as a TXT record at the domain root. The receiving server checks the connecting machine against that list. A domain may carry only one SPF record, limited to ten DNS lookups; stacking too many include entries breaks it quietly.

DKIM is a signature. The mail provider signs each outgoing message with a private key, and the matching public key is published in DNS. The recipient verifies the signature, proving the message came from a server holding the key and was not altered in transit.

DMARC tells recipients what to do when the other two fail, and where to send reports. It also enforces alignment, the part most senders miss: SPF passing for an unrelated envelope domain does not help if it does not match the From header.

SDRclose checks SPF, DKIM and DMARC for each connected sending domain inside the app.

The records look like this. Take the exact values from the provider that will send your mail, such as Google Workspace, Microsoft 365 or Zoho, never from a blog post.

• SPF, a TXT record at yourdomain.com: v=spf1 include:_spf.google.com ~all. Replace the include with the value your own mail provider gives you. The ~all at the end is a soft fail and -all is a hard fail. Start on ~all.
• DKIM, a TXT record at selector._domainkey.yourdomain.com: both the selector and the long public key come from your mail provider. Some registrars require a 2048-bit key to be split into quoted chunks.
• DMARC, a TXT record at _dmarc.yourdomain.com: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The p=none policy means monitor only and change nothing. Use a mailbox in rua= that someone will actually open.
• Move DMARC from p=none to p=quarantine and then to p=reject once the reports show your real mail passing. Jumping straight to reject before reading a single report can silently kill mail you care about.

Warmup and the progressive ramp

A domain registered last week has no history. To a filter, no history and bad history look similar, because the cheapest way to send spam is to buy a fresh domain and use it before anyone notices. A new domain has to earn its way off thin ice.

Warming means sending a small and slowly growing amount of mail that gets opened, replied to and marked as not spam, so the domain builds the kind of record that gets delivered. Real replies from real people are worth far more than raw volume.

SDRclose runs mailbox warmup on a progressive daily ramp, archives the warmup mail automatically so it never clutters the inbox, and keeps a mailbox that is still warming out of cold sends.

Before the first cold send: register the domain, publish the three DNS records, put a real page at the web address so it is not a blank shell, and let it sit for about two weeks. A ramp that works looks roughly like this, per mailbox rather than per domain.

• Days 1 to 7: about 5 messages a day.
• Week 2: about 10 a day.
• Week 3: 15 to 20 a day.
• Week 4: 25 to 30 a day.
• Weeks 5 to 8: work up toward a ceiling of roughly 30 to 50 a day, then stop climbing.
• Keep a little warmup traffic running underneath the cold sending permanently, not only during the ramp.
• Grow by roughly a third each week rather than doubling, and keep weekday volume flat instead of batching everything into one day.
• After a pause of a few weeks, ramp back up. Do not restart at the old ceiling.

Volume: caps, gaps and rotation

Reputation is tracked per domain and per sending mailbox. One mailbox pushing 200 messages a day is an unusual pattern for a human and a single point of failure. Five mailboxes at 30 a day each is ordinary volume from every address, and one bad mailbox costs a fifth of the capacity instead of all of it.

Spread those mailboxes across more than one sending domain for the same reason, so a domain-level problem takes out one domain while sending continues from the others.

Caps do three jobs. A daily cap keeps a mailbox at a human volume. An hourly cap stops the day's volume from going out in one burst. A minimum gap between sends makes the pattern look like a person working through a list rather than a script.

SDRclose rotates sends across every connected mailbox, holds per-mailbox daily and hourly caps, enforces a minimum gap between sends, and treats mailboxes as account-wide so the same rotation serves every workspace.

• Give every mailbox a real person's name, a signature and a filled-in profile. An empty mailbox that only sends looks like exactly what it is.
• Set caps per mailbox, not per campaign. The campaign is not the thing being scored.
• Spread sends across the recipient's working hours instead of releasing the whole batch at nine in the morning.
• Watch each mailbox separately. An aggregate number hides the one address that has quietly started landing in spam.
• When more volume is needed, add mailboxes and a second sending domain rather than raising the per-mailbox ceiling.

List quality and verification status

A bad list hurts twice. The invalid addresses bounce, and the real people who had no business receiving the message complain. Both feed the same reputation score.

Verification status matters, and so does relevance. A perfectly written message sent to the wrong person still produces a complaint. The most reliable way to keep complaints near zero is to contact only people the message genuinely fits.

Spam traps are the worst case: dead addresses seeded by providers and blocklist operators to catch senders who did not check where their data came from. Hitting one can get a domain blocklisted outright, and scraped or purchased lists are thick with them.

SDRclose saves each mined lead with a work email and the verification status reported by our prospect data provider, and researches each prospect from public sources before anything is written. The status is the provider's rather than an independent check, so the rules below still apply.

• Use addresses with a verified status, and treat catch-all domains as unconfirmed. A catch-all accepts everything, so it says nothing about whether the person exists.
• Skip role addresses such as info@, sales@ and support@. They are forwarded to whoever complains fastest.
• Re-verify anything older than a few months. People change jobs constantly, and old data bounces.
• Never import a scraped or purchased list, and never re-import a list that has already been worked through.
• Cut the segment rather than widening it. A tighter list with a real reason behind it beats a broad one on every measure, deliverability included.

Writing that reaches the inbox

Content is the smallest reputation input, but the one the sender controls completely, and a first cold email carries the least trust of any message. Most of what follows is about looking like a person writing to another person, because that is what reliably passes.

Open tracking deserves a word here. An open is recorded when a transparent image loads from a server. Several mail clients now pre-load remote images through a proxy whether or not the recipient looked, so an individual open means little and the aggregate rate is inflated by an unknown amount. A tracking image is also exactly the shape filters examine, so on a first cold touch it can be a net negative.

Opens remain useful for comparing two variants sent to the same list in the same window, and for spotting a mailbox whose open rate collapses, which usually means it has started landing in spam. Replies and booked meetings are the measures that survive contact with reality.

SDRclose keeps open and click tracking off by default, with a per-sequence switch, and keeps marketing and booking links out of cold first touches. An outbound filter strips machine-writing tells and tool-fingerprint headers from product-written mail; replies typed by a person go out exactly as written.

• No links in the first email. A link from an unknown sender to an unknown domain is the most common single reason a cold email is filtered. Ask a question that can be answered by pressing reply; the unsubscribe link is the only URL a first touch should carry.
• No images, no logo, no HTML template. Plain text looks like normal mail because it is normal mail.
• No attachments on a first touch, under any circumstances.
• Keep it under 100 words. Long first emails from strangers do not get read anyway.
• Avoid the obvious trigger phrases: free, guaranteed, act now, limited time, risk free, make money. Skip all caps, colored text and rows of exclamation marks.
• Do not fake a reply. A subject line beginning with Re: on a first contact, or an invented quoted thread underneath, reads as deception to filters and to people.
• Cut the machine-writing tells: em dashes, stock openers about hoping the message finds the reader well, phrases like in today's landscape, three-item lists in perfect parallel, and a closing paragraph that restates the email. Recipients read these as machine-written and mark them accordingly.
• One clear ask, one question, one sentence, at the end.
• Send from a real name at a real mailbox with a plain-text signature. A no-reply address and a signature full of graphics both work against you.

Opt-out handling and complaint rates

Spam complaints are the number that gets a sender blocked. Google publishes the threshold in its sender guidelines: keep the spam complaint rate below three complaints per thousand delivered messages, and ideally below one per thousand. Cross it and filtering turns aggressive, and the damage outlasts the campaign that caused it.

Complaints are a lagging indicator. By the time the rate moves, the reputation hit has already landed. That is why list quality and honest targeting do more for deliverability than any amount of subject line tinkering.

The bulk sender requirements also expect commercial mail to carry one-click unsubscribe through the List-Unsubscribe headers, and expect opt-out requests to be honored within two days. Treat both as the floor for every cold campaign, whatever the volume.

SDRclose adds a one-click List-Unsubscribe header and an opt-out link to outbound mail, keeps a permanent do-not-contact list that spans every sequence and every connected mailbox, and removes a prospect from a sequence the moment a reply, an unsubscribe or a bounce arrives. Suppression records are retained even after account deletion, so an opt-out is never lost.

• Make the unsubscribe obvious. Someone who cannot find an opt-out uses the spam button instead, and that costs far more than the lost contact.
• Honor opt-outs permanently, across every sequence and every mailbox, not only the campaign they came from.
• Stop follow-ups the moment someone replies. Messaging a person who has already answered is one of the fastest ways to earn a complaint.
• Treat a reply that says stop, remove or unsubscribe as an opt-out even when the link was not used.
• Register with the postmaster tools each major provider offers; that is where the published complaint rate is measured.

Bounces, health monitoring and alerts

Bounces are the second number. A hard bounce says the address does not exist, and a run of them says the data is stale or invented. Heavy bouncing is one of the clearest spam signals there is.

Providers do not publish a bounce threshold for cold senders, so treat any run of hard bounces as a stop signal. Pause the sequence, find where the bad addresses came from, and clean the list before sending anything else.

Soft bounces are different. A full mailbox, a temporary rejection or a short deferral is not a data problem. Retry those later, and treat an address as dead only when the rejection is permanent.

Health monitoring catches a problem before the rates confirm it. The early signs are a reply rate that drops to zero from one mailbox while others are fine, an open rate that collapses where tracking is on, a sudden rise in deferrals, or the provider rejecting logins. Any one of those means stop sending from that mailbox and investigate.

SDRclose detects hard bounces in the connected mailbox, marks the address and stops sending to it, keeps bounces, out-of-office notices and auto-replies out of the reply count, and monitors the health of each connected mailbox with an alert in the app when one starts failing.

• Reconnect a mailbox promptly if its provider reports a failed login or an expired app password, so sending and reply detection do not stall.
• When a mailbox is throttled or its reputation falls, rest it for at least a week at warmup volume before returning it to the rotation.
• If a whole domain is affected, stop every mailbox on it at once. Continuing from a damaged domain deepens the damage.
• Keep a written note of what changed before any drop: a new list, a new template, a higher cap. The cause is almost always one of those.

Mailbox provider rules

Reputation is judged by the receiving provider, but the sending provider has rules too. Every business mail provider caps what a single mailbox may send per day, sometimes per hour, and suspends mailboxes that exceed the cap or trip its abuse filters. Those caps sit far above the warmup ceiling in this guide: a mailbox running near its provider limit is already behaving unlike a person.

The major mailbox providers' bulk sender requirements set the receiving-side baseline: SPF and DKIM authentication, a DMARC policy with an aligned From domain, delivery over TLS, spam complaints below the published threshold, one-click unsubscribe honored within two days, and valid forward and reverse DNS. Senders above a published daily volume are held to the full set; everyone else is measured against the same signals.

Outbound from a free consumer mail address is a poor idea, because those services apply the strictest limits and offer no domain-level authentication control. And an app password that expires or is revoked silently stops both sending and reply detection until it is renewed.

SDRclose sends through the customer's own connected mailboxes, with one-click presets for Google Workspace, Microsoft 365, Zoho and other providers over standard SMTP and IMAP, so provider rules apply exactly as they would to a person sending from that account. The Acceptable Use Policy sets the same expectations for mail sent through the platform.

• Know the sending limit for each provider and keep the per-mailbox cap well below it.
• Review the provider's acceptable use terms for outbound. Cold outreach is permitted by most business providers within their limits and prohibited outright by some consumer services.
• Use the provider's admin reporting for domain reputation and complaint rate alongside the mailbox health alerts in the app.

Checklist

Most deliverability problems are one of these steps skipped. Do them in this order.

SDRclose enforces the platform-side items automatically: authentication checks, warmup, caps and gaps, rotation, opt-out handling, bounce handling and health alerts. The domain, the list and the writing remain the sender's job, and the Sequences page shows where each control lives.

1. Register a separate sending domain. Not the company domain.
2. Publish SPF, DKIM and DMARC on it, then confirm all three pass by sending yourself a message and reading the headers.
3. Put a real page at the domain root so it is not an empty shell.
4. Wait about two weeks, then start each mailbox at roughly 5 sends a day.
5. Ramp to a ceiling of around 30 to 50 a day per mailbox over four to eight weeks, and stay there.
6. When more volume is needed, add mailboxes and a second sending domain rather than raising the per-mailbox ceiling.
7. Keep spam complaints below three per thousand delivered messages, and check complaints and bounces per mailbox every week.
8. Send plain text, no links on the first touch, under 100 words, one ask.
9. Stop the sequence the moment someone replies, and honor every opt-out permanently.
10. Judge campaigns on replies and meetings booked, not on opens.