Cold email deliverability checklist for 2026

Cold email lands in the inbox when three things are true: the receiving server can prove the mail is really from you (SPF, DKIM, DMARC), your domain has a short, clean sending history, and recipients do not mark you as spam. Everything on this checklist serves one of those three. Gmail, Yahoo and Outlook publish their rules, so most of it is not guesswork.

Work through it before your first campaign, then keep monitoring weekly.

The checklist at a glance

1. Send from a separate domain, not your main one.
2. Publish SPF for that domain.
3. Sign every message with DKIM.
4. Publish a DMARC record and check alignment.
5. Use a provider that handles reverse DNS and TLS.
6. Add an unsubscribe option to every email, and one-click unsubscribe where it applies.
7. Set up Google Postmaster Tools and keep spam rate below 0.3%.
8. Warm up each mailbox and cap daily volume.
9. Verify every address before it enters a campaign.
10. Never send to bought lists.
11. Keep content and links plain.
12. Monitor bounces, complaints and replies, and pause on a spike.

1. Use a separate sending domain

Send cold outreach from a domain next to your main one, for example getacme.com next to acme.com, so a reputation problem cannot reach your invoices and support mail. Point its website at your main site and make the sender obvious in every email. A look-alike domain must never be used to hide who you are; see what a cold email footer must include.

2 to 4. SPF, DKIM and DMARC

These three are the entry ticket. Gmail's sender guidelines require every sender to set up SPF or DKIM, and senders of 5,000 or more messages a day to personal Gmail accounts to set up SPF, DKIM and DMARC, with the From domain aligned to the SPF or DKIM domain. The DMARC policy can be p=none.

Yahoo's sender best practices set the same split: SPF or DKIM for all senders, both plus a DMARC policy of at least p=none that passes for bulk senders. Yahoo also recommends a DKIM key of at least 1024 bits and an rua tag on DMARC so you get reports.

Microsoft applies similar rules to Outlook.com, Hotmail and Live. According to Microsoft's support page for error 550 5.7.515, senders of 5,000 or more messages to its consumer services need SPF and DKIM passing and a DMARC record, and messages must pass DMARC. Mail that does not is rejected with "550 5.7.515 Access denied, sending domain does not meet the required authentication level." Microsoft first set out the rules in its announcement for high-volume senders in 2025.

Your cold domain will almost certainly stay below 5,000 a day. Set up all three anyway; it is a few minutes of DNS work. Check with a DNS lookup, not just your provider's dashboard, and keep one SPF record per domain.

5. Reverse DNS and TLS

Google and Yahoo both require a valid reverse DNS (PTR) record for sending IPs, and Google requires TLS. Google Workspace and Microsoft 365 handle both; on your own server, check them first.

6. Unsubscribe and one-click unsubscribe

There are two separate things here.

A way to opt out, in every cold email. In the US, the FTC's CAN-SPAM guide requires every commercial email, B2B included, to explain how to opt out and to honor opt-outs within 10 business days, plus a valid postal address. A visible link is the easiest way to do it. This is general information, not legal advice.

One-click unsubscribe headers (RFC 8058). RFC 8058 defines a List-Unsubscribe header with an HTTPS URI and a List-Unsubscribe-Post: List-Unsubscribe=One-Click header, both covered by the DKIM signature, so the mailbox can unsubscribe the user with one POST request.

When does it apply? Gmail requires it for marketing and subscribed messages from senders of 5,000 or more messages a day to personal Gmail accounts. The Gmail sender FAQ adds three details that matter:

• Messages from the same primary domain count together, subdomains included.
• Once you meet the threshold, you are "permanently considered" a bulk sender.
• Transactional messages are excluded, and unsubscribe requests should be fulfilled within 48 hours.

Yahoo asks bulk senders for a working List-Unsubscribe header (RFC 8058 POST strongly recommended), a visible unsubscribe link in the body, and to honor unsubscribes within 2 days.

For a cold domain sending 150 emails a day, the header is not required by Gmail. If your tool supports it, turn it on anyway: a one-click unsubscribe is a cheaper outcome for you than a spam report.

7. Spam rate below 0.3%, ideally below 0.1%

This is the number that matters most. Gmail asks senders to keep the spam rate reported in Postmaster Tools below 0.10% and to avoid ever reaching 0.30%. Yahoo's ceiling for bulk senders is 0.3%. At 0.3%, three complaints per thousand messages is enough.

Set up Google Postmaster Tools for your sending domain: add the DKIM or SPF domain, verify it with a DNS record, and watch the spam rate, reputation, authentication and delivery error dashboards. Google notes that data can be missing when a day's volume is too low, which is normal for a small cold program, so use replies and bounces as your daily signal too.

8. Warm-up and daily caps

Gmail's guidelines say to start with a low sending volume to engaged users and slowly increase it, and to avoid sudden spikes if you have no history of large volumes. For cold email that means a ramp per mailbox and a firm daily cap well below the provider's limit. Our guide to how many cold emails per day per mailbox has the published limits and a 14-day ramp.

9. Verify every address

Bounces on a new domain are a strong negative signal, and Gmail's guidelines tell senders to automatically unsubscribe recipients with multiple bounced messages. Verify before sending, drop invalid and risky addresses, and treat catch-all domains with care. See how to verify B2B email addresses before sending.

10. No bought lists

Gmail's guidelines say plainly: "Don't purchase email addresses from other companies." Bought lists are full of stale addresses, and the people on them have no idea who you are. Build your own list from sources you can name.

11. Content and link hygiene

Gmail's guidelines ask for links that are visible and easy to understand, no HTML or CSS used to hide content, and no mixing of different content types in the same message. For cold email we would add:

• Plain text or near-plain HTML, no images, no attachments in the first email.
• One link at most, to your own domain, written out so the reader can see where it goes.
• No open-tracking pixel and no link redirects through a shared tracking domain while the domain is new.
• A real person's name in the From field, the same one every time.
• One short ask. See how to write cold emails that sound human.

12. Monitor and pause

Check every sending day: hard bounces, spam complaints, unsubscribe replies and reply rate. Any hard bounce on a freshly verified list, a spam rate above 0.1% in Postmaster Tools, or replies falling to zero is a reason to pause that mailbox and look before you send more.

New domain email going straight to spam after only 8 emails: what went wrong?

Eight emails is too few to have earned a bad reputation, so the cause is almost always set-up, not volume. Check in this order:

1. Authentication. Is SPF passing, is DKIM signing with your domain (not the provider's default), and is there a DMARC record? Open the raw headers of a sent message and look for spf=pass, dkim=pass and dmarc=pass.
2. Domain age. A domain registered days ago has no history. Give it time and send real two-way mail first.
3. Links and tracking. A shared tracking domain or a link shortener can carry someone else's reputation into your email.
4. Content. An HTML template, images, a pitch in the first line and a calendar link look like bulk mail.
5. Recipients. If your test went to your own Gmail, a single spam folder result is not a verdict. Test with real replies from colleagues on different providers.

Why your outreach is landing in spam

If set-up is clean and it still lands in spam, look at three things: too much volume too soon for the mailbox's age, a list with bad addresses, or recipients reporting it because it reads like a mass template. Caps and verification fix the first two. Writing to fewer, better-chosen companies with a real reason for each fixes the third.

Are AI email warm-up tools effective?

Warm-up tools exchange messages between many mailboxes and mark them as important to build history. None of the big mailbox providers publish evidence that this helps, and Gmail's own guidance is to start with low volume to engaged users. The risk is that the engagement is artificial: it can make a new mailbox look healthy while your real recipients ignore or report your emails. Treat them as a minor supplement at best; a slow ramp and a clean list do the work.

How Outvori handles this

Outvori sends from warmed mailboxes, 5 per sending domain, with at most 30 cold emails per mailbox per day after a 14-day ramp. Every campaign email includes an unsubscribe link and your legal company name and postal address. Drafts wait for your approval; auto-approve can only be turned on after you have approved the first ones, and a spam complaint or a rise in hard bounces switches it back to manual. Replies are sorted into one inbox. See cold email and pricing for the mailboxes in each plan.

If you want to see which companies match your offer before you send anything, scan your website free.

Frequently asked questions