Cold Email Deliverability: The Complete Guide (2026)

Most advice about cold email deliverability starts with words to avoid. That is the least important thing on the list.

Deliverability is decided almost entirely before you write a sentence: whether your domain is authenticated, whether it has sending history, how many mailboxes you are spreading volume across, and whether the addresses you are mailing actually exist. Copy matters at the margin. Everything below is ordered by how much difference it makes.

The order that actually matters

1. Authentication — SPF, DKIM and DMARC on the sending domain
2. Domain strategy — never send cold from your primary domain
3. Warmup — sending history before volume
4. Volume per mailbox — spread thin, not concentrated
5. List quality — bounces damage reputation fast
6. Engagement — replies help, deletions and complaints compound
7. Copy — the part everyone starts with

If you are landing in spam and you have not done 1 through 5, the answer is not in your subject line.

1. Authentication

Since 2024, Google and Yahoo require SPF, DKIM and DMARC for bulk senders. Cold outreach at any real volume falls inside that. These are DNS records, they take minutes to add, and missing them is the single most common cause of cold email failing before it has a chance.

• SPF lists which servers may send as your domain. Two failure modes matter: having more than one SPF record breaks it entirely — receivers return a permanent error rather than merging them — and ending in +all authorises the entire internet, which is worse than having no record at all.
• DKIM cryptographically signs each message. Note that a DKIM record with an empty public key (p=) means the key is revoked, not configured — it will fail every check while looking set up.
• DMARC ties the two together and tells receivers what to do on failure. Start at p=none with a reporting address, read the reports, then tighten to quarantine.

A reasonable starting DMARC record:

Type:  TXT
Name:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:you@yourdomain.com

p=none changes nothing about delivery — it only asks receivers to send reports — so it is safe to add today.

You can check all three at once with our SPF, DKIM & DMARC checker.

2. Domain strategy

Never send cold email from your primary domain. If it gets flagged, your actual company email — invoices, support, contracts — starts landing in spam. That is an unrecoverable-feeling problem for a completely avoidable reason.

Use separate lookalike sending domains. Split mailboxes across several of them, so one reputation problem does not take out your entire sending capacity. Three mailboxes per domain is a common split.

Sending domains also need MX records. A domain that cannot receive mail looks suspicious, and you will never see replies or bounce notifications.

3. Warmup

A new domain has no sending history. Going from zero to full volume on day one is the most reliable way to get filtered.

Warmup means ramping gradually over roughly three to four weeks while generating positive signals — opens, replies, messages moved out of spam. Every serious cold email platform automates this, which is a large part of what you are paying for.

There is no way to skip it. Buying an aged domain helps less than people expect, because reputation attaches to sending behaviour, not registration date.

4. Volume per mailbox

The instinct is to send more from one inbox. That burns domains.

Providers judge behaviour per account and per domain, so volume comes from many mailboxes sending a little, not few sending a lot. Experienced senders commonly plan around 20–50 cold emails per mailbox per day depending on how established the domain is and how confident they are in the list.

To be straight about it: there is no published safe number, and anyone quoting one as fact is guessing. The ceiling moves with domain age, reputation and list quality. Plan conservatively, watch your own bounce and reply data, and adjust.

Our mailbox calculator turns a daily target into the mailbox and domain count it implies, and shows the arithmetic so you can change the assumption.

This is also why per-mailbox pricing is worth checking before you buy a platform: charging per sending account penalises the exact architecture that makes cold email work.

5. List quality

Bounces damage sender reputation faster than almost anything else. A list with 10% invalid addresses will hurt you no matter how good everything upstream is.

Verify addresses before sending. Most platforms include verification or integrate a verifier; use it. Remove role addresses (info@, sales@, support@) — they convert poorly and complain more.

Scraped lists bought in bulk are the most common cause of catastrophic deliverability failure. There is no copy fix for a bad list.

6. Engagement

Filters watch what recipients do. Replies are the strongest positive signal. Deletions without opening are mildly negative; spam complaints are severely negative and compound.

This is the honest argument for relevance over volume: a tightly targeted campaign to 200 people who might genuinely care generates better engagement signals than 2,000 sends to a broad list, and those signals make the next campaign land better.

7. Copy

Last, and least — but not nothing.

The genuinely risky patterns are narrower than the folklore suggests: URL shorteners, several links in a first-touch email, fake Re: subject lines pretending to continue a conversation that never happened, and unfilled merge tags that send as {{firstName}}. Most "spam word" lists are folklore; you can send an email containing the word "free" from a well-warmed authenticated domain and land in the inbox every time.

You can check copy with our spam word checker, which explains why each flag matters rather than just colouring it red.

What we are not claiming

You will notice no inbox-placement percentages anywhere in this guide. That is deliberate. Any figure like "97% inbox rate" is meaningless without the domain age, warmup schedule, list source, volume and seed accounts behind it — and those are almost never disclosed. We publish performance numbers only when we have measured them ourselves, with the methodology attached.

Everything above is either a documented standard (the authentication records), a widely-held practice among experienced senders (domain splitting, warmup, volume ranges), or plain arithmetic. Where something is convention rather than measurement, we have said so.

A working checklist

• [ ] SPF record exists, appears exactly once, ends in ~all or -all
• [ ] DKIM configured with a non-empty public key
• [ ] DMARC published, starting at p=none with a reporting address
• [ ] Sending domains separate from your primary domain
• [ ] MX records present so replies and bounces arrive
• [ ] Mailboxes split across domains rather than concentrated
• [ ] Warmup run for three to four weeks before full volume
• [ ] Daily volume per mailbox set conservatively and monitored
• [ ] List verified, role addresses removed
• [ ] Copy free of shorteners, fake Re: lines and unfilled merge tags

Working through that list will do more for your results than any amount of subject-line testing.

Where to go next

• Which cold email tool fits you? — five questions, matched recommendation
• SPF, DKIM & DMARC checker — audit a sending domain now
• Mailbox calculator — capacity planning
• Spam word checker — review your copy
• Best AI cold email software — platform comparison