You sent a hundred emails and heard nothing. Then a customer mentioned your last invoice went to their junk folder. Somebody told you to “check your deliverability” and sent you a page full of acronyms, and you closed it.
Email deliverability for cold outreach is the set of things that decide whether a message lands in the inbox, the spam folder, or nowhere at all. It is not mysterious. Google and Microsoft publish what they expect, and most outreach fails because nobody on the sending side read it.
This article explains it in plain terms: why cold email must never come from your main domain, what SPF, DKIM and DMARC are, how a new mailbox earns the right to send, how fast volume can grow, what to do with bounces, and how to see where your messages land. You will be able to tell whether whoever sets it up has done it properly.
What this actually is
When your mailbox sends an email, it goes to the recipient’s mail provider, and the provider decides what to do with it based on a reputation score for your sending domain. High reputation, inbox. Low reputation, spam folder. Very low, silently dropped.
Reputation is built from a few signals. Are you who you claim to be (the technical records below)? How many of your emails bounce? How many recipients mark you as spam? How many reply? Is your volume steady, or did it jump from zero to five hundred a day overnight? A provider does not know your intentions, only your behavior.
The ordinary-business analogy is a credit score. A new company has no history, so it gets small limits. Pay on time and the limits grow. Miss payments and the score drops, and rebuilding takes far longer than the damage took. Your sending domain has a score like this at every major provider.
1. Never send cold email from your main domain
Everything else depends on this rule. The domain your customers know, the one on your invoices, support replies and website, must never send cold outreach. Cold email produces bounces and complaints even when done well, and those signals attach to the domain that sent them.
If that domain is your main one, the damage spreads to every email your business sends: invoices go to spam, appointment confirmations vanish. We have seen businesses send a few thousand cold emails from the main domain over a month and spend most of a quarter recovering. Buy a separate domain, a close variant of the company name, and set it to redirect in a browser to your real website. All cold mail goes from mailboxes on that domain. If it gets damaged, you retire it and start another.
2. Set up SPF, DKIM and DMARC before the first send
These are three records in your domain’s DNS (the public directory that says which servers handle your domain’s mail and website). They let a receiving provider verify that an email claiming to be from your domain really came from you.
SPF is a list of servers allowed to send mail for your domain. DKIM is a digital signature on each message that the receiver checks against a public key in your DNS, confirming it was not altered and came from your systems. DMARC tells receivers what to do when SPF or DKIM fail (nothing, quarantine, or reject) and where to send reports. Google and Microsoft now require all three for anyone sending in volume. Your mailbox provider gives you the values to paste in. Start DMARC at “none” so you get reports without blocking anything, move to “quarantine” once everything is signed, and confirm all three with a free online checker before the first send. It is a ten-minute job that is skipped astonishingly often.
3. Warm up every new mailbox before it works
A brand-new mailbox on a brand-new domain has no reputation. If it starts sending cold email on day one, it looks like a spammer’s throwaway account, because that is what spammers do. Warm-up builds a normal-looking history first.
Tools such as Instantly, Smartlead and dedicated warm-up services automate this by exchanging messages among a network of mailboxes, replying to them, and pulling them out of spam when they land there. Two to four weeks, starting at a handful a day, is a reasonable minimum before cold sending begins, and light warm-up should keep running afterward. Warm-up is not a substitute for the other rules; a warmed mailbox that sends garbage to a dirty list loses its reputation just as fast.
4. Ramp volume slowly and cap it hard
Once a mailbox is warmed, cold volume starts small and grows gradually: a few a day in the first week, a little more each week, watching bounces and complaints. The ceiling, in our view and that of every deliverability specialist we take seriously, is around fifty cold emails per mailbox per day, and many experienced senders stay well below it.
To reach more people, add mailboxes and domains rather than pushing any one harder: two or three mailboxes per domain, several domains, each at modest daily volume spread across the working day, with the sending tool rotating between them. Steady matters as much as total. Thirty a day every working day looks like a person doing their job; three hundred on Monday and nothing until Thursday looks like a campaign.
5. Verify addresses first and handle bounces immediately
A bounce is an email that could not be delivered, usually because the address does not exist. Providers treat a high bounce rate as strong evidence of a purchased list. Over two or three percent is a warning; over five, stop sending from that mailbox until you understand why.
Verify every address before it enters the sending tool. Verification services check whether a mailbox exists and accepts mail, and they flag catch-all domains (domains that accept mail to any address, so nothing can be confirmed). Send only to valid; set catch-all and risky aside (AI Lead Research and Enrichment for Business Outreach). Verify close to the time of sending, because people change jobs. When a bounce happens, the address must be removed from every list and sequence automatically. A sending tool does this; a spreadsheet does not.
6. Make spam complaints nearly impossible
A spam complaint, a recipient clicking “report spam”, is the most damaging signal there is. One on a small list is a warning; a handful in a week can get a mailbox blocked. Keeping complaints near zero is not a technical trick. It is sending short, relevant, honest messages to people who plausibly want them, with an obvious way to say no.
Include a plain opt-out. A line such as “if this is not relevant, reply and I will not write again” is enough, provided it works, meaning the reply is detected and the person removed the same day. Sequence length is the other lever: long chains of “just bumping this” generate complaints from people who would have ignored one email but resent six. Two follow-ups, three at most. The writing side is in AI Cold Email Outreach Best Practices for Business Owners and AI Personalization at Scale for Outreach That Reads as Human.
7. Keep the message itself clean
Content matters less than reputation, but it counts. Avoid images, heavy formatting, and tracking links from unfamiliar domains. Plain text from a real person’s mailbox looks like a real person’s email; a message with tracking pixels, a logo and five links looks like a newsletter and is judged like one.
Open tracking has become a liability. It works by embedding a tiny invisible image, many mail clients now block or pre-load those images, so the data is unreliable anyway, and some filters treat the tracking domain as a signal. Our view is to turn it off for cold email and measure replies. If you must include a link, make it a plain link to your own domain, not a redirect through the tool’s shared tracking domain, which other senders may have damaged. Most first cold emails need no link at all.
8. Watch where mail actually lands with seed inboxes
You cannot fix what you cannot see. Keep seed inboxes, mailboxes you control at Gmail, Outlook and whichever providers your audience uses, on every list you send. If a message lands in spam there, it is landing in spam elsewhere, and you should pause and investigate before sending more.
Google Postmaster Tools, which is free, shows the reputation Google assigns your domain and any spam rate it has recorded; register every sending domain there. Watch the trend, not the day. A single message in spam happens. A whole mailbox shifting to spam over two days means reputation has dropped, and the response is to stop, lower volume, review the list and content, and let the mailbox recover.
9. Check the whole setup monthly
Deliverability is not a one-time configuration. DNS records get changed by accident during a website move. A domain quietly ends up on a blocklist. The tool that was removing bounces stops after an update. These are the failure modes every automation suffers, and the monthly review habit from Automation Error Handling for Businesses Tired of Silent Failures applies directly.
Once a month: confirm SPF, DKIM and DMARC still pass, read the DMARC reports, check each sending domain against the major blocklists, review bounce and complaint rates per mailbox, look at Postmaster Tools, and send yourself a test to confirm reply detection and opt-out removal still work. Write down what you found; when something goes wrong, the log tells you when it started.
Picture a business like this one
The business below is a composite of the kind of company that writes to us, not a client. The numbers describe the shape of the problem, not a case study.
Picture a business like this one: an accounting firm with fifteen staff that wants small-business clients in a new city. The managing partner sent two hundred introductory emails from her own firm mailbox. Within a week, three existing clients said her emails were going to junk, and a year-end tax reminder was missed by a client who never saw it. The outreach produced two replies, both asking to be removed.
What a firm like this would build instead:
- A separate domain, a close variant of the firm’s name, redirecting to the firm website, with SPF, DKIM and DMARC configured and verified before any mailbox is created.
- Two mailboxes on that domain, put through automated warm-up for three weeks before any cold email, and kept on light warm-up afterward.
- A hand-built list of about two hundred and fifty target businesses, every address verified, catch-alls set aside, existing clients and previous contacts excluded.
- A sending tool capped at twenty cold emails per mailbox per day, spread across working hours, with two follow-ups a week apart, automatic bounce removal, and reply detection that stops the sequence and alerts a person.
- Seed inboxes at Gmail and Outlook on every send, Postmaster Tools registered, and a monthly checklist on the calendar.
What changes: the main domain is untouched and client emails land normally again within weeks. Outreach goes out at forty messages a day across two mailboxes, and replies now come from people who read the message. When one mailbox’s seed messages start landing in spam in month three (a tool update had turned link tracking back on), it is caught the same day, paused, fixed, and resumed a week later.
What it costs to run
A sending domain is roughly ten to fifteen dollars a year. Mailboxes on Google Workspace or Microsoft 365 run a few dollars each per month on basic tiers; check the current pricing pages.
A sending tool with warm-up, rotation and bounce handling (Instantly, Smartlead and similar) is usually thirty to one hundred dollars a month at small volumes. Verification is fractions of a cent per address. Postmaster Tools and DNS checkers are free. The hidden cost is attention: someone has to check the seeds, run the monthly review, and act when a number moves, an hour or two a month. If nobody owns that hour, the setup drifts and you find out from a customer.
The mistakes we see most
Sending from the main domain “just for the first batch”. The first batch is when the list is dirtiest and the bounces are highest.
Skipping DMARC because SPF and DKIM “already work”. Google and Microsoft check for all three, and without DMARC you get no reports.
Warming up for three days and calling it done. Reputation takes weeks, whatever the warm-up dashboard says.
Treating a purchased list as verified. Run every address through a checker you control, right before it is used.
Turning on every tracking feature. Open pixels and shared tracking links hurt more than they inform.
When to bring in help
An owner or office manager can do all of this with off-the-shelf tools and a careful afternoon. The mailbox provider gives you the DNS values, the sending tool handles warm-up and bounces, free checkers confirm the records, and seed inboxes cost nothing. For a few hundred cold emails a month from one or two mailboxes, that is genuinely enough.
A developer earns their place when the pieces need to connect: verified lists flowing into the sender automatically, replies and bounces written back to your CRM (AI CRM Automation That Makes the CRM Do the Work for You), the do-not-contact list enforced across every tool, DMARC reports made readable, and a monitoring job that pauses a mailbox on its own when a seed inbox sees spam.
Levelbrook builds outreach infrastructure like this for businesses, at a fixed price from a written scope. Every domain, mailbox and tool account is created in accounts you own. The form below is how a conversation starts.