Cold email deliverability: why cold emails end up in spam

The sender counts for more than the copy

Before a mailbox decides whether a message lands in the inbox or in spam, it looks at the sender, not the content. How old is the domain? Is it set up cleanly? How have recipients reacted to mail from there so far? Only after that does a filter look at the wording at all.

That is why the most expensive mistake is sending outreach from your main domain. If its reputation breaks, it does not only hit the campaign, it hits quotes, invoices and replies to existing clients. Outreach belongs on separate domains that point at the main brand but run apart from it.

In practice that means registering two to four extra domains that resemble your main one without imitating it. mycompany.com becomes mycompany-sales.com or get-mycompany.com. Each of them carries a plain page with an imprint and a pointer to the main brand. A domain with no website at all is a warning sign to a filter.

SPF, DKIM and DMARC in two minutes

These three DNS records decide whether a mailbox takes your mail seriously at all. They sound more technical than they are.

SPF is a list of the servers allowed to send for your domain. If your sending tool is not on it, the mail looks like a forgery. DKIM puts a signature under every message so the recipient can verify nothing was altered in transit. DMARC tells the mailbox what to do when one of those checks fails: ignore it, send it to spam, or reject it.

What decides the outcome is alignment: the domain in the visible sender address has to match the domain that SPF or DKIM confirms. A sending tool that signs with its own domain passes the DKIM check but fails DMARC. So always have DKIM sign with your own sending domain.

Start DMARC on p=none. That changes nothing about delivery but it gets you reports, so you can see who sends in your name. Only once those reports look clean for a few weeks do you move to quarantine and later reject. Jumping straight to reject usually blocks your own newsletters and invoice mail along with everything else.

What Google, Yahoo and Microsoft have required since 2024

Since February 2024 Google and Yahoo require these records from anyone sending to their users at volume, and since May 2025 Microsoft has followed for Outlook. What used to be good practice is now the entry ticket.

For every sender, Google and Yahoo require at least SPF or DKIM, valid forward and reverse DNS (PTR) for the sending IP address, messages that follow the standard RFCs, and a spam complaint rate below 0.3 per cent. Google also requires a TLS connection and explicitly recommends staying below 0.1 per cent. So 0.3 per cent is not a target, it is the line beyond which there are consequences.

A bulk sender, for Google and Microsoft, is anyone sending more than 5,000 messages a day to their users. Google counts all mail from the same primary domain together, subdomains included, and once a sender has been classified as bulk it stays that way permanently. These senders additionally need SPF and DKIM together, a DMARC record of at least p=none, alignment of the sender domain with SPF or DKIM, and for marketing mail one-click unsubscribe per RFC 8058 plus a visible unsubscribe link in the body. Yahoo also requires unsubscribes to be honoured within two days.

Enforcement has become strict. Since 5 May 2025 Microsoft rejects non-compliant mail from high-volume senders to Outlook.com, Hotmail.com and Live.com with error code 550 5.7.515. Google announced it would ramp up enforcement from November 2025, up to temporary and permanent rejections.

What does that mean for cold email? A clean outreach setup with a few mailboxes per domain stays far below 5,000 mails a day, so the bulk sender duties formally do not apply in most cases. The complaint limit applies to everyone, though, and it is exactly the risk in cold outreach: three spam reports per thousand mails are enough for 0.3 per cent. So treat the bulk sender rules as the standard, not the exception.

The technical checklist

Before the first mail goes out, every sending domain should tick these boxes.

After every DNS change, check the header of a test mail. It shows pass or fail for spf, dkim and dmarc. That is more reliable than any checking tool.

DACH specifics: T-Online, GMX and Web.de

Anyone sending in the German-speaking market is not only writing to Gmail and Outlook. A large share of mailboxes in Germany sits with T-Online, GMX and Web.de, especially at smaller companies, trades businesses and freelancers who never moved their business address to their own domain. These providers have their own rules, and they differ from those of the US giants.

GMX and Web.de belong to the same company and apply the same rules. They require a valid DKIM signature whose domain matches the visible sender domain, a static IP address with valid reverse DNS, and neither the IP nor the domain may appear on known blocklists. SPF and DMARC are recommended on their postmaster pages, not mandatory. In practice: if DKIM is signed by the sending tool rather than your own domain, this is where it shows first.

T-Online takes its own route. Its postmaster guidelines say the hostname of the delivering server must make the operator's domain, and with it a website offering direct contact, easy to trace. By its own account T-Online largely does not evaluate SPF and DKIM. Sender identity is therefore checked more through server, hostname and a reachable website than through DNS records.

From our experience: a sending domain without a reachable website and imprint has poor chances at T-Online, and anyone requesting an unblock after a block is regularly asked for exactly that information. The plain page with an imprint on every extra domain is therefore not optional in the DACH market. It should be reachable over HTTPS and point clearly to the company behind it.

So always test with control mailboxes at T-Online, GMX and Web.de, not just Gmail and Outlook. A setup that delivers perfectly at Google can still be turned away at T-Online.

Google Workspace and Microsoft 365, or an SMTP service?

There are basically two routes for cold email: regular mailboxes on Google Workspace or Microsoft 365, or sending through an SMTP service or your own mail server.

Workspace and Microsoft 365 send from IP addresses with an established reputation, PTR and TLS are taken care of, and a mail from there looks technically like a mail from a person, because it is one. In exchange, volume per mailbox is limited and neither provider's terms are made for bulk sending. Overload a mailbox and you risk a suspension by the provider itself.

What has worked in our practice: several Workspace or Microsoft 365 mailboxes across several extra domains, connected to a sending tool that controls volumes, pauses and rotation. It is slower than bulk sending, but it is the setup that still delivers months later.

Warm-up is not a marketing term

A new domain that sends three hundred mails on day one looks like a spam sender to every filter, because it behaves exactly like one. Warm-up means volume rising slowly across several weeks, so the domain builds a history before it goes to work.

Warm-up tools automatically exchange mail between real mailboxes, open it, reply to it and pull it out of spam. That generates positive signals. It does not replace real replies, though, and no warm-up makes up for a bad list.

For a new domain with new mailboxes, a typical four-week plan looks like this. If anything looks off, hold for a week instead of increasing further.

So if you want two hundred meetings a quarter you do not need one mailbox at high volume, you need several mailboxes at unremarkable volume. That is exactly where most in-house attempts fail: the tool is bought, the domain is up, and then it is burned in the first week.

The list decides the reputation

Every mail to an address that no longer exists comes back as a bounce. A few of those are normal. A high bounce rate is the clearest signal to a mailbox that someone is working through a bought or outdated list, and it damages domain reputation for a long time.

As a rule of thumb: under two per cent bounces is unremarkable, above five per cent it gets dangerous. Verifying addresses before sending costs a fraction of what it costs to replace a burned domain and warm a new one up.

Exclusion lists matter just as much. Existing clients, open quotes, applicants and competitors come out before the first sequence starts. A cold email to a client who currently has a quote from you on the table costs more than it could ever bring in.

Content does count, just later

Once the sender has cleared the first hurdle, the filter looks at the message itself. A first-touch cold email needs no link and no attachment, and what a person reads in twenty seconds also reads like a person to a filter.

Spam words are less dangerous than their reputation, but taken together they shape the picture. Patterns are more dangerous: capitals in the subject line, several exclamation marks, prices and discounts, phrasing that sounds like a newsletter. A cold email should read like a message from one person to another.

Plain text over HTML. Elaborate HTML with colours, images and buttons is the hallmark of marketing mail. Plain text or very simple unstyled HTML is the right choice for cold outreach. Even a logo in the signature is an image, and so a signal in the wrong direction.

Tracking. Open tracking works with an invisible pixel, an image loaded from a third-party server. Click tracking rewrites every link to a redirect domain. Both are hallmarks of bulk sending. If you track anyway, you need at least a custom tracking domain. We switch off open tracking on first touches, because the number is unreliable anyway.

Variation. A hundred identical mails in an hour are a pattern to a filter. Vary subject lines, openings and phrasing with several text variants per step, and personalise beyond the first name. A reference to the recipient's company helps delivery and reply rate at the same time.

And an opt-out belongs in there, even where it is not technically required. One sentence is enough. The alternative is that annoyed recipients hit the spam button, and those clicks are the most expensive signal a domain can collect.

• No link and no attachment in the first mail
• No images, not even a signature graphic
• Plain text or simple HTML
• Open tracking off, click tracking only with a custom domain
• Short enough for twenty seconds of reading
• Several text variants per sequence step
• One sentence on how to opt out

Measure the right thing

Open rates have lost most of their meaning since the big providers added their privacy features. Some opens are generated automatically by preview services, others are never reported at all. Steering a campaign by that number is steering by noise.

What holds up is delivery rate, bounce rate, reply rate and the share of qualified replies. That last number matters most: ten replies that produce no meeting at all are an audience problem, not a copy problem.

How that chain works through to the price of a single meeting is something we worked out in a separate piece: What may a B2B meeting cost?

Tools that make deliverability visible

Besides your own control mailboxes, there are four tools you should know.

• Google Postmaster Tools: free once you verify the domain. Shows spam complaint rate, authentication, delivery errors and whether you meet the sender guidelines, but only for mail to personal Gmail addresses and only above a certain daily volume. With small cold email volumes the charts often stay empty.
• Microsoft SNDS: Smart Network Data Services show reputation data and spam complaints for IP addresses at Outlook.com. Useful if you run your own IP addresses. With Workspace or Microsoft 365 the IPs are not yours.
• Blocklist checks: aggregators such as MXToolbox or a direct lookup at Spamhaus show whether a domain or IP is listed. Once a week is enough in normal operation, immediately when the reply rate drops.
• Inbox placement tests: you send a mail to a set of seed addresses at different providers and see where it lands. Many sending tools have this built in. Make sure T-Online, GMX and Web.de are part of the seed set.

How to tell you are in spam

The reply rate collapses without anything having changed in the copy or the audience. That is the first sign, and it often arrives late, because a domain does not tip over from one day to the next.

Do not rely on your gut. Put a few of your own mailboxes at the major providers on every send and check daily where the mail lands. It costs nothing and it is the most direct measurement available.

One thing to keep in mind: deliverability is not a property of your domain, it is a relationship between your domain and each individual provider. Landing in the inbox at one and in spam at the next is entirely normal. That is why the check needs several mailboxes, not one.

When it has already happened

A domain that has landed in spam does not recover by sending more. The way back runs through sharply reduced volume, a cleaned list and patience. In many cases it is faster and cheaper to build a new sending domain properly and let the old one rest.

The order matters: fix the cause first, then set up the new domain. If you do not clean the list and adjust the volume, you will burn the next domain in exactly the same way, just four weeks later.

The first two weeks, concretely

Week one: register the extra domains, put a plain page with an imprint on each, set SPF, DKIM and DMARC on p=none, create the mailboxes, start the warm-up. In parallel, build the target list and verify every address.

Week two: build the exclusion lists, write the first sequence, set up your own control mailboxes, including at T-Online, GMX and Web.de. You are not sending at volume yet, you are sending to a small test batch where delivery and reply quality get measured.

That sounds slow, and it is. The alternative takes longer: a burned domain costs four to six weeks in which nothing happens at all.

If you would rather not build and monitor this infrastructure yourself: domains, mailboxes, warm-up, list verification and ongoing checks are part of our B2B lead generation by email, through which we have booked more than 2,000 meetings since 2023. And before the first mail goes out, it pays to look at the legal side: B2B cold email in Germany: what section 7 UWG actually says.

Frequently asked questions

Sources

1. Google: Email sender guidelines
2. Yahoo: Sender best practices and requirements
3. Microsoft: Outlook's new requirements for high-volume senders (2025)
4. RFC 8058: One-click unsubscribe
5. GMX Postmaster: Requirements and recommendations
6. T-Online Postmaster: Sender guidelines