Cold Email Deliverability: How to Land in the Inbox

2026-07-19

Deliverability is the part of cold email nobody budgets time for and everybody eventually pays for. You write a decent sequence, you load 800 contacts, you send — and three weeks later the reply rate quietly collapses from 4% to 0.6%. Nothing in your dashboard says "spam". Your sending tool still reports 98% delivered. But the mail is landing in a folder nobody opens.

This guide is about the part that actually decides that outcome. Not the DNS records — those are table stakes and take an afternoon — but the reputation math, the content signals, the list quality, and the pacing that determine whether Gmail and Outlook treat your mail as wanted or as noise. Written for a founder or solo marketer who is not a sysadmin and does not want to become one.

What "delivered" actually means (and why it lies)

Your tool reports "delivered" when the receiving server accepted the message at the SMTP handshake. That says nothing about placement. Gmail accepts almost everything and then decides, in a second pass, whether the message goes to Primary, Promotions, or Spam. So the metric you care about is inbox placement, and no ESP reports it directly — you infer it from reply rate, from open rate broken down by recipient domain, and from seed tests. "My deliverability is fine, I have a 99% delivery rate" is a number that would look identical if 100% of the mail went to spam.

How spam filtering actually decides

Modern filtering is not a keyword blacklist. It is a scoring system with three broad inputs, weighted roughly in this order:

1. Sender reputation

Reputation attaches to your sending domain, your subdomain, and the IP you send from. On shared infrastructure — which is what nearly every SMTP relay and cold email tool gives you — the IP is diluted across many senders, so domain reputation carries most of the weight in your case. It is built from history: how much you send, how consistently, and what recipients do with it.

Reputation is slow to build and fast to lose. A domain with six months of clean history absorbs a bad week. A domain that started sending three weeks ago has no buffer at all — one campaign with 12% bounces and a spam complaint or two can push it into filtering for months.

2. Engagement signals

This is the dominant lever most people ignore. Receiving providers watch what recipients do:

Positive: replies (the strongest signal by far), opens followed by time in the message, moving mail out of spam, adding you to contacts, forwarding.
Negative: marking as spam, deleting without opening, and — subtly — never engaging at all. Sustained silence from a whole segment reads as "unwanted" even without a single complaint.

One real reply is worth more than a hundred opens. This is the mechanical reason why 30 researched messages a day beat 500 templated ones: the researched batch generates replies, and replies teach the filter that people want mail from you.

3. Content and structure

Content matters least of the three, but it is the tiebreaker — and it is the one thing you can fix in ten minutes. Filters look at links, HTML structure, image-to-text ratio, tracking behaviour, and phrasing patterns common in bulk mail.

The key insight: these three inputs interact. Clean content from a trusted domain sails through. The same content from a cold domain gets scrutinised. That is why "this exact email worked for my friend" is a meaningless data point.

The authentication minimum, in one section

You need three DNS records on the domain you send from, and then you can stop thinking about it:

SPF — a TXT record listing which servers may send as your domain. One SPF record per domain, and keep it under 10 DNS lookups or it fails silently.
DKIM — a cryptographic signature so the receiver can verify the message was not altered. Your sending provider gives you the key to publish.
DMARC — a policy record telling receivers what to do when SPF/DKIM fail. Start at p=none with a reporting address, then move to p=quarantine once reports look clean.

Two additions that are no longer optional at any real volume: a working one-click unsubscribe header on bulk-style sends, and a dedicated sending domain. Never send cold outreach from your primary company domain. Buy a lookalike — getacme.com or acme-hq.com next to acme.com — and send from that. If it burns, your invoices and support mail still reach people.

That is genuinely the whole authentication story for a non-sysadmin. Records right, dedicated domain, warmed gradually. Everything below is where campaigns actually die.

Content triggers that get you filtered

Ranked by how often I see them cause damage:

Links

The single biggest content-side risk. Rules that hold up:

One link maximum in a first-touch cold email. Zero is often better — ask a question, put the link in the follow-up once they have replied.
Never use a shortener. bit.ly and friends carry the aggregate reputation of everyone else using them, which includes actual spammers.
Avoid click-tracking redirect domains on cold sends. A tracked link rewrites your URL to a third-party tracking domain shared with thousands of other senders. It is one of the most common invisible causes of spam placement. Turn click tracking off for cold outreach; you lose a vanity metric and gain placement.
If you must link, link to a real page on the same domain you send from. Alignment between sender and link is a positive signal.
Open-tracking pixels are the same problem at smaller magnitude — a remote image from a shared tracking domain. Gmail proxies images so the data is mush anyway. Turn it off on first touches and judge by replies.

HTML vs plain text

Send plain text, or HTML so minimal it is indistinguishable from plain text. No templates, no header banner, no coloured buttons, no footer with six social icons. A one-to-one business email from a human contains none of those things, and filters are very good at telling a marketing template from correspondence. Skip images entirely in cold email — an image-heavy message with little text is a classic bulk-mail signature.

Attachments

Never in a first touch. Attachments from unknown senders trigger both filtering and human distrust. Offer the deck; send it after they reply.

Phrasing and length

The old "spam words" lists are mostly folklore — nobody filters the word "free" in isolation in 2026. What still hurts is the pattern: ALL CAPS subject lines, three exclamation marks, "act now", "limited time", "100% guaranteed", "Dear Sir/Madam", and a message shaped like a broadcast. Write the way you would to one person you actually want an answer from and the phrasing problem solves itself. Keep it to 50–125 words with a signature of name, company, one line — no legal block, no quotes, no banner.

List hygiene: the cheapest deliverability win

Bounce rate is the fastest way to destroy a young domain. The thresholds that matter in practice:

Under 2% hard bounces — healthy.
2–5% — you have a data quality problem; fix before scaling.
Over 5% — providers begin treating your sends as an unverified list dump. Above roughly 8–10% you can expect active filtering within days.

Complaint rate has a much tighter ceiling: keep it under 0.1%, which is one complaint per thousand messages. At 0.3% you are in trouble; at 0.5% you are effectively done on that domain.

Practical hygiene rules:

Verify every address before the first send. Bulk verification costs a fraction of a cent per address and is the highest-ROI spend in the whole channel.
Delete role addresses — info@, sales@, support@, admin@. They convert poorly, get marked as spam more often, and some are honeypot-prone. If your only contact for a business is info@, that is a low-priority send, not a core one.
Drop catch-all domains from early campaigns. A catch-all accepts everything, so verification cannot confirm the mailbox exists. Send to them later, as a separate segment, once your domain has history.
Purge on the first hard bounce. Never retry one. Ever.
Age matters. A list scraped eight months ago is 20–30% wrong by now — people change jobs. Freshness beats size.

This is where the sourcing step decides your deliverability before you write a word. Lists built by pulling live business data and validating contacts at collection time bounce far less than bought databases resold to a hundred buyers. If you are assembling lists by niche and city, building them fresh with JustLeadIt gives you verified, current contact channels rather than a CSV of unknown vintage — and a clean list is worth more to your placement than any subject line optimisation.

Volume caps and per-mailbox pacing

The mistake: one mailbox, 500 sends a day, straight from a standing start. The fix is boring arithmetic.

Sane steady-state limits per mailbox for cold outreach:

30–50 cold emails per day per mailbox is the safe operating band on Google Workspace or Microsoft 365.
Up to 80–100 is possible on a mature, well-engaged domain, but the risk curve steepens sharply and there is little upside if your replies are worth more than your volume.
Ramp: start around 10–15 a day in week one and add roughly 10 a day each week until you hit your target. Getting to 50/day takes about a month. There is no shortcut that does not cost you the domain.

To scale beyond that, add mailboxes, not volume per mailbox. Three or four mailboxes on two or three sending domains at 40/day each gets you 120–160 daily sends with the risk spread out. Each mailbox needs its own real name, its own signature, and its own warm-up. Do not run eight aliases off one mailbox — providers see the underlying account.

Other pacing details that matter more than people expect:

Randomise intervals. Spread the batch across a several-hour window with variable gaps, not 50 messages in six minutes at 09:00.
Weekdays, business hours, recipient's timezone. Tuesday to Thursday, 08:00–11:00 local, produces better replies and a more human sending pattern. A domain that fires 50 messages every Saturday at 03:00 looks like exactly what it is.
Keep volume steady. Sudden 5× spikes are themselves a spam signal. If you want to double, do it over two weeks.

Seed testing and checking placement for real

You cannot fix what you cannot see. Two ways to see placement:

A seed list. Create real mailboxes on the providers your prospects use — Gmail, Outlook/Hotmail, Yahoo, and if you sell in Europe or Russia, a local provider your market actually uses. Add each seed to your campaign as a normal contact, then check by hand where the message landed. Ten to fifteen seeds is enough to spot a systemic problem. Do this before every new campaign and after any change to your template, tracking, or sending domain.

Placement testing services. Commercial seed tools automate the same thing across dozens of providers and return a report per mailbox provider. Worth the subscription once you send a few thousand a month; before that, a manual seed list is fine.

One caution: an inbox that has never replied to anything and receives only your test mail is not a perfect proxy for a real recipient. Use seeds to detect disasters — spam folder across the board, DKIM failing, tracking domain flagged — not to fine-tune. Reply rate segmented by recipient domain is your true placement gauge: if Gmail recipients reply at 4% and Outlook recipients at 0.2%, you have a Microsoft placement problem, not a copy problem.

Diagnosing a campaign that suddenly went to spam

Reply rate drops off a cliff. Work through this in order — it takes about twenty minutes and usually finds the culprit in the first four steps.

Segment replies by recipient domain. All providers down, or just one? A single-provider collapse points at that provider's filter and a recent change on your side. Across the board means domain reputation.
Check what changed in the last 7–14 days. New template? Turned tracking on? New link? Added a mailbox? Doubled volume? Reputation damage lags the cause by roughly a week, so look back further than feels natural.
Check your bounce and complaint numbers for the previous campaign, not the current one. A batch with 9% bounces last week is very likely why this week is failing.
Verify authentication still passes. Send to a Gmail account you control and inspect the original message headers: SPF, DKIM and DMARC should all read pass. Expired DKIM keys and a second SPF record added by some marketing tool are common silent breakages.
Check blocklists and content changes. Look up your sending domain on the major public blocklists — a listing explains a hard block, absence rules it out cheaply. Then ask whether anyone added a footer image, a calendar link, a shortener, or a PDF.
Run a seed test to confirm where mail lands now, so you can measure recovery.

Nine times out of ten the answer is one of: tracking turned on, a dirty batch of addresses, a volume spike, or a link to a domain with poor reputation.

Recovering after a reputation hit

Recovery is possible but slow, and the instinct to "send more to prove we're legitimate" makes it permanently worse. The sequence that works:

Stop sending on that domain immediately. Not reduce — stop, for at least 3 to 7 days. Continuing to send while filtered reinforces the negative pattern.
Fix the actual cause. Purge the list and re-verify it, kill tracking, strip the template back to plain text, correct the DNS records.
Restart at 10–15 a day to your best segment — the most relevant prospects with the highest chance of a reply. You are buying engagement signals, not coverage.
Prioritise replies over volume for two to three weeks. If you have existing customers or warm contacts on that domain, mail them normally; genuine two-way conversation rebuilds reputation faster than anything else.
Ramp back over four to six weeks. Full recovery of a moderately damaged domain typically takes 4–8 weeks. Severe damage — sustained complaints, a blocklist entry that keeps recurring — can take months, and at that point retiring the domain and starting fresh on a new one is often cheaper than the wait.

This is exactly why the dedicated sending domain matters. A burned outreach domain is a $12 loss and a month of warm-up. A burned primary domain means your invoices stop arriving.

A weekly routine that keeps this from happening

Before each campaign: verify the list, strip role and catch-all addresses, send to your seed inboxes, confirm placement.
Weekly: check bounce rate (target under 2%), complaint rate (under 0.1%), and reply rate segmented by recipient domain.
Monthly: read your DMARC reports, confirm SPF/DKIM still pass, and check blocklists.
Always: one link or none, no attachments, no tracking on first touch, plain text, 30–50 a day per mailbox, weekdays only.

None of this is clever. Deliverability rewards discipline, not tactics — the senders who consistently reach the inbox are the ones sending fewer, better-targeted messages to addresses they actually verified, at a pace that looks like a person doing their job.

If you take one thing from this: your list quality and your reply rate are your deliverability strategy. Everything else — records, caps, plain text — just keeps you from throwing away the reputation those two things earn you.