Cold email deliverability: the complete playbook

Deliverability is whether your email reaches the inbox. For cold email it decides more than the copy does: the best email in the world gets no replies from the spam folder. After six years and around 12 million cold emails, these are the five things I check, in this order, and what I do when mail starts landing in spam.

In one paragraph: authenticate every sending domain (SPF, DKIM, DMARC), send from warmed-up mailboxes at a modest pace (about 30 a day each), verify every list, write plain emails, and watch bounces, complaints and blocklists. Each of the five is explained below.

Deliverability and delivery are not the same thing

Most tools count an email as "delivered" once the receiving server accepts it. That says nothing about the folder. What matters is inbox placement: the primary inbox, a tab such as Promotions, or spam. A campaign can show 99% delivered and still sit almost entirely in spam, which is why falling replies are often the first sign of trouble.

1. Authentication

Receivers first ask whether the email is really from you. Three DNS records answer that, and since 2024 they're not optional:

• SPF lists the servers allowed to send for your domain. One record per domain, under 10 lookups.
• DKIM signs each email so it can't be changed or faked. Publish the key and switch signing on in your provider.
• DMARC ties both to the From address and says what to do when they fail. Start at p=none with a report address.

Gmail and Yahoo require SPF or DKIM from everyone, and all three, aligned, from anyone sending in volume, plus one-click unsubscribe for marketing mail and a spam complaint rate under 0.3%. Microsoft announced similar rules for Outlook.com in 2025. Add an MX record too, so replies arrive.

Check every domain in one go with the domain health checker. The most common fault I find on domains that suddenly slip: DKIM published but signing never switched on, or a second SPF record added by another tool.

2. Reputation

Next, receivers ask whether email from you is usually wanted. That reputation belongs mostly to your domain and your mailboxes, and it's built by:

• Age and history. New domains and mailboxes have none, which is why they need warm-up.
• Volume patterns. Steady, modest sending looks like a person; sudden jumps look like spam.
• Reactions. Replies, opens and moving email out of spam help; deleting unread, spam reports and bounces hurt.

My numbers

Setting	What I use
Mailboxes per domain	3
Cold emails per mailbox per day	About 30, after warm-up
Warm-up before the first campaign	About 14 days, and it keeps running after
Bounce rate	Under 2%
Spam complaints	Well under 0.1%

Google Workspace allows far more than 30 a day per mailbox. The technical limit isn't the one that matters: cold email at hundreds a day from one mailbox gets it filtered long before it reaches Google's cap. To reach more people, add mailboxes and domains, not volume per mailbox.

3. List quality

Bounces are the fastest way to damage a reputation, and old lists are full of addresses that bounce. Contact data decays every month as people change jobs.

• Verify every list right before sending it, even one that was verified when you bought it.
• Keep bounces under 2%. Above that, stop and fix the source.
• Treat catch-all addresses carefully: they can't be confirmed, so send to them in small numbers.
• Skip role-based and disposable addresses.

Spam traps, old addresses reused to catch careless senders, live in stale lists too. Verification won't catch every trap, but it removes the dead addresses they're made from.

4. Content

Content matters less than people think, but it matters. A cold email should look like a note from a person:

• Plain text, no images, no designed layout.
• One link at most, and ideally none in the first email.
• No link tracking on a new domain; if you track, use a custom tracking domain.
• No hype in the subject line, no all caps, no strings of exclamation marks.
• Small natural variations between emails, so thousands of copies aren't identical.

The spam word checker catches the obvious problems. A good sender with a plain email reaches the inbox; the same email from a cold, unwarmed domain may not, which is why reputation comes before content in this list.

5. Blocklists and gateways

If a domain or sending IP lands on a major blocklist, mail to many company inboxes stops. Check your domains on a schedule with the blacklist checker. If one is listed: stop sending from it, find the cause (usually a list or a volume spike), then request removal.

Some companies sit behind a secure email gateway such as Proofpoint or Mimecast, which is far stricter with cold email. Their MX records give them away; sending to them burns daily volume for little return.

How to measure deliverability

• Placement tests: send your real email to test inboxes at the main providers and see the folder at each.
• Warm-up figures: each mailbox's warm-up inbox and spam rates, day by day.
• Replies: a campaign whose replies suddenly stop is often in spam.
• Bounces and opt-outs per campaign.

Open rates are no longer a reliable signal: Apple Mail Privacy Protection opens emails automatically, and many companies block tracking images.

When mail starts landing in spam

1. Pause the affected mailboxes' campaigns. Leave warm-up running.
2. Check authentication on the domain: a broken DKIM key or a duplicate SPF record is the commonest cause.
3. Check blocklists.
4. Look at the last campaign's bounces, complaints and the list it used.
5. Let warm-up rebuild the mailboxes for one to two weeks, then resume at a lower volume and ramp up slowly.

Run a placement test before and after, and change one thing at a time so you know what fixed it. For a domain that's badly damaged, see rescuing a domain that lands in spam.

Questions people ask

Does warm-up guarantee the inbox?

No. Warm-up builds a history so a new mailbox isn't judged as unknown. A bad list, broken authentication or spam-like volume will still land you in spam.

Should I use a dedicated IP?

Not for cold email from Google Workspace or Microsoft 365 mailboxes. You send from the provider's well-kept shared IPs, and your domain reputation does the work. See dedicated IP.

How many domains should I have?

Enough that each mailbox stays around 30 a day at your target volume, three mailboxes per domain, plus a spare or two warming in reserve.

mailzy checks every sending domain's records and blocklists, warms every mailbox, shows inbox and spam rates for each, runs placement tests, and gives each domain a reputation label, so a problem shows up before replies dry up. See deliverability.