Why Cold Emails Land in Spam, and How to Fix It

Cold email lands in spam for a short list of reasons, and almost all of them are on the sender's side. Mailbox providers do not know or care that your message is well written. They look at whether the sending domain is authenticated, whether the sending IP and domain have a history, how many of your recipients exist and engage, and whether the message pattern looks like the last thousand spam campaigns they saw.

This is a checklist in the order we would work through it. Each step fixes one of those signals.

1. Authentication: SPF, DKIM and DMARC

Gmail and Yahoo both require bulk senders to pass SPF and DKIM, align with DMARC, and publish a DMARC record. Cold email tools that send through Google Workspace or Microsoft 365 handle DKIM for you, but SPF and DMARC are DNS records on your domain, and they are often wrong.

• Run the SPF checker. One record, under 10 DNS lookups, ending in ~all or -all. A PermError means you have no SPF at all as far as receivers are concerned.
• Run the DMARC checker. A record must exist. Start at p=none with a reporting address and move to quarantine once reports show your senders pass; the sequence is in DMARC p=none vs quarantine vs reject.
• Confirm DKIM is on in your mail provider. Send yourself a message and look for dkim=pass in the headers.

2. Bounces: verify the list before the first send

This is the step cold emailers skip most often, and the one with the biggest effect. Cold lists come from finders, scrapers and guessed name patterns, and a meaningful share of those addresses do not exist. Every one that bounces tells the mailbox provider that you are sending to people you do not know, which is the definition of spam from their side.

Keep the bounce rate under 2% per campaign. Above 5%, Google says it may start rejecting mail outright. Verify the list before the first send and again before any follow-up sequence to a list older than a few months. Our guide to cleaning a list before a cold campaign walks through what to remove and what to keep.

3. A separate domain, warmed up

Never send cold email from your main company domain. If the campaign damages the domain's reputation, your invoices and support replies go to spam with it. Use a lookalike domain, such as trycompany.com or company-team.com, with its own authentication, and point its website at your main site.

A new domain has no reputation, and mail from a domain with no history is treated with suspicion. Warm it up: start with a handful of messages a day to people who will reply, and increase the volume over three to four weeks. The schedule and the reasoning are in email warmup and sender reputation.

4. Volume and pacing

Mailbox providers watch for sudden spikes from a sender with little history. Practical limits for a warmed-up Google Workspace or Microsoft 365 mailbox used for cold outreach are well below the provider's technical cap: most experienced senders stay under 50 new contacts per mailbox per day and spread sends across the working day rather than in one batch. To send more, add mailboxes and domains rather than pushing one harder.

5. The message itself

Content filters matter less than reputation, but they matter. The patterns that trigger them are ones every spam campaign shares:

• Link shorteners and tracking domains with poor reputation. Use your own domain for links, or no links in the first message.
• Images, HTML templates and heavy formatting. Cold email that works looks like a plain personal message.
• Spam-trigger phrasing: "free", "guarantee", "act now", all-caps subject lines, exclamation marks.
• Identical messages to many recipients. Vary at least the opening line per recipient.
• Attachments in a first message.

Always include a way to opt out. Gmail requires one-click unsubscribe for bulk senders, and a plain "reply to stop" line costs nothing and keeps complaints down.

6. Complaints and engagement

Spam complaints are the signal providers trust most. Google's stated threshold for bulk senders is a complaint rate under 0.3%, with under 0.1% as the target. One complaint per thousand messages is enough to matter. The fixes are upstream: better targeting, so that fewer people are annoyed to hear from you, and an easy opt-out, so that annoyed people unsubscribe instead of reporting.

Positive engagement helps in the other direction. Replies, especially, tell the provider that recipients want this mail. A warm-up service simulates this; real replies from a well-targeted list do it better.

7. Check the sending IP

If you send through Google Workspace or Microsoft 365, the IP is theirs and this step does not apply. If you use a dedicated SMTP server or a VPS, the IP needs a reverse DNS record that matches the hostname the server announces, and it must not be on a block list. The clearest sign of a blocked IP is a bounce from Outlook addresses with 550 5.7.1, covered in why emails bounce from Outlook.

A note on email verification and sender reputation

A question we get: does verifying addresses hurt the domain you verify from? Verification connects to mail servers and asks about an address without sending, and it is the verifier's IP and hostname that the receiving server sees, not your domain. Using a verification service keeps that activity off your own infrastructure entirely. What it cannot do is repair a domain that has already been burned; for that, the only route is time and good behaviour.

Working through it

If your cold email is in spam today, do the steps in order. Authentication and bounces are the two that most often turn out to be the whole problem, and both can be checked in an afternoon. Pacing and content are the ones to adjust as you scale. Watch the bounce rate and the reply rate of every campaign; when either moves sharply, stop and find out why before the next send.