· 5 min read · deliverability
For most of the last decade, cold email deliverability was a set of best practices. You were told to authenticate your domain, warm up new mailboxes and keep volume sensible, and if you skipped those steps you usually got away with it for a while. That window has closed. The two providers that host most business inboxes now treat those practices as conditions of delivery, and they enforce them with filtering that is far less forgiving than it was.
This article covers what actually changed, why it matters more for cold outreach than for newsletters, and the setup we run for every campaign before a single email goes out.
What changed
In February 2024, Google and Yahoo began enforcing requirements for anyone sending more than about 5,000 messages a day to their consumer inboxes. Senders must authenticate with both SPF and DKIM, publish a DMARC record, keep the visible From domain aligned with the authenticated domain, support one-click unsubscribe on marketing mail, and keep their reported spam rate below 0.3 percent. Google's own guidance is to stay under 0.1 percent.
In May 2025, Microsoft followed with similar rules for high-volume senders to Outlook.com, Hotmail and Live addresses: SPF, DKIM and a DMARC record of at least p=none, aligned with one of the two. Mail that fails is routed to junk first and then rejected outright.
The formal thresholds are written for bulk senders to consumer inboxes, and a cold campaign sending 30 emails a day per mailbox is nowhere near 5,000. That is the part people misread. The business inboxes you are actually writing to sit on Google Workspace and Microsoft 365, and their filters weigh the same signals: authentication, alignment, complaint history and how predictable your sending looks. The rules made explicit what the filters were already rewarding.
Why cold email feels it first
A newsletter goes to people who asked for it. They open it, sometimes reply, rarely mark it as spam. Cold email reaches people who have never heard of you, so every signal starts at zero and the margin for error is thin. A handful of spam reports on a new domain carries more weight than thousands of opens on an established one.
Three patterns sink most first campaigns:
- Sending from the main domain. If your cold outreach and your invoices share a domain, a bad week of complaints affects both. We cover the alternative in how many mailboxes and domains you need for 10,000 emails.
- Launching on day one. New mailboxes have no history, and inbox providers treat mail without history as suspect until it proves otherwise.
- Unverified lists. Bounces are one of the clearest signals that a sender did not check who they were writing to. A five percent bounce rate on the first send can undo weeks of warmup.
The setup that works now
Deliverability is decided before the copy is written. The order matters, because each step depends on the one before it.
1. Separate sending domains
Register a few lookalike domains, such as getacme.com alongside acme.com, and send cold email only from those. Forward them to your main site so prospects who type the address land somewhere real. Your primary domain keeps its reputation for the mail that has to arrive. This is the first thing we do in domain and mailbox setup.
2. Authentication on every domain
Each sending domain needs three DNS records, and they need to agree with each other.
acme-mail.com. TXT "v=spf1 include:_spf.google.com -all"
google._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
_dmarc.acme-mail.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@acme.com"
SPF lists who may send for the domain. DKIM signs each message so the receiver can check it was not altered. DMARC tells receivers what to do when the first two fail, and sends you reports so you can see it happening. Start DMARC at p=quarantine with reports routed somewhere you read; move to p=reject once the reports are clean.
You can check what any domain looks like from the outside with our free deliverability checker on the home page, which scores SPF, DKIM, DMARC and MX records in a few seconds.
3. Warmup before volume
A new mailbox should ramp from a few emails a day to its working volume over roughly two weeks, while exchanging real conversations so that opens, replies and rescues from the spam folder build a history. We explain the mechanics, and why fourteen days is the floor rather than a nice-to-have, in email warmup explained. It is also the whole of our email warmup service.
4. Low, steady volume across mailboxes
Thirty emails a day per mailbox, spread across the working day, is a volume inbox providers see from ordinary people every day. Spreading 10,000 emails across twelve mailboxes and four weeks keeps every individual address comfortably inside that range and means no single mailbox carries the campaign.
5. Clean lists and a real opt-out
Verify every address before it is used, remove role addresses like info@ and sales@, and give every recipient a plain way to say no. Honour it immediately. A short line such as "If this is not relevant, reply and I will not write again" is enough for one-to-one B2B outreach and keeps complaints down far better than silence does.
A checklist before you send
- Cold email sends only from separate lookalike domains
- SPF, DKIM and DMARC published and passing on every sending domain
- DMARC reports routed to an inbox someone reads
- Every mailbox warmed for at least 14 days
- Placement tested on Gmail and Outlook before launch
- Daily volume capped at around 30 per mailbox
- List verified, role addresses removed, bounces under 2%
- A clear way to opt out, honoured the same day
What this means for you
None of this is exotic, but all of it has to be done, in order, before the first email is sent, and most of it is invisible when it is working. That is the work we take on for a flat price: separate domains, authentication, warmup, a verified list and monitored sending, so the only thing left for you is answering replies.
If you would rather do it yourself, the checklist above is the order we follow. If you would rather not, see what is included in Launch.