You can write the best cold email in the world β a killer subject line, a personalized opener, a compelling CTA. None of it matters if your email lands in spam. Yet deliverability is the most overlooked part of cold outreach. Most teams obsess over copy and never check whether their emails are even reaching inboxes. This guide covers everything you need to know to land in the inbox: technical setup, domain warmup, spam-triggering content to avoid, list hygiene, and how to test your deliverability before you send to real prospects.
If your deliverability is broken, nothing else works. You could have the world's best copy β if it lands in spam or promotions, your reply rate is zero. Period.
Email providers (Google, Microsoft, Yahoo) use dozens of signals to decide where your email goes: sender reputation, authentication, engagement history, content analysis, and list quality. They don't tell you which signal tipped the scale β you just see the results: inbox, promotions, spam, or (worst case) silently dropped.
Benchmarks: Good deliverability means 95%+ inbox placement to primary inbox. At 90%, you're losing 1 in 10 emails. Below 85%, your campaign is leaking leads faster than you can replace them β fix deliverability before you send another email.
The good news: deliverability is engineering, not magic. Follow the steps in this guide and your inbox placement will improve. Ignore them and no amount of copywriting will save your campaign.
These three DNS records tell email providers that your emails are genuinely from you, not a spammer impersonating your domain. If any one of them is missing or misconfigured, your deliverability will suffer.
SPF (Sender Policy Framework): A DNS TXT record that lists which servers are allowed to send email from your domain. Without SPF, spammers can spoof your domain and recipients' email providers will treat all mail from your domain as suspicious.
Example: v=spf1 include:_spf.google.com ~all means "only Google's mail servers can send email for this domain, soft-fail everything else."
DKIM (DomainKeys Identified Mail): A cryptographic signature added to every outgoing email that proves the email hasn't been tampered with in transit. DKIM uses public-key cryptography β you publish the public key in DNS, and receiving servers verify the signature.
DMARC (Domain-based Message Authentication, Reporting, and Conformance): Tells receiving servers what to do when SPF or DKIM fail. A policy of p=reject means "reject any email that fails authentication." A policy of p=none means "deliver it anyway but tell me about it."
Setup checklist:
1. Add an SPF record with your sending service's servers included
2. Generate a DKIM key pair, publish the public key in DNS, configure your sending service with the private key
3. Publish a DMARC record starting with p=none to monitor, then move to p=quarantine and eventually p=reject
4. Test with MXToolbox or Google's Check MX tool
5. Wait 24β48 hours for DNS propagation, then verify with a test email
A brand new domain sending 50 cold emails on day one will land in spam. Email providers don't trust unknown senders β they need to see a gradual, positive sending history before they route your emails to the inbox.
The warmup timeline:
β’ Week 1: 5β10 emails/day. Send to highly engaged recipients (colleagues, friends, existing customers who will open and reply). Use a warmup service (Warmbox, Mailwarm, lemwarm) to automate engagement.
β’ Week 2: 15β25 emails/day. Start mixing in a few cold prospects (1β2 per day max).
β’ Week 3: 30β50 emails/day. If bounce rates stay under 2% and complaint rates under 0.1%, you can start full campaigns.
Key rule: ramp slowly, never spike. Sending 10/day for 14 days then blasting 200 on day 15 is worse than not warming up at all β it looks like a compromised account.
Multi-domain strategy: Use 3β5 lookalike domains (get-yourbrand.com, try-yourbrand.com, yourbrand-mail.com) to spread volume. If one domain's reputation takes a hit, the others keep going. Each domain needs its own warmup.
Even with perfect technical setup, your email content can still trigger spam filters. Here's what the algorithms look for β and how to avoid getting flagged.
Spam trigger words to avoid: Words like "free," "guaranteed," "act now," "limited time," "click here," "exclusive deal," "no obligation," "100%," "$$$," "earn money," "risk-free," "this is not spam." These aren't banned β they just raise your spam score. Use sparingly, never clustered.
Formatting red flags:
β’ Heavy HTML (large images, complex tables, inline styles) β plain text emails consistently outperform HTML in cold outreach
β’ Image-only emails with no text β spam filters can't read images
β’ Too many links (3+) β each link is a trust signal debit
β’ ALL CAPS subject lines or excessive exclamation points
Technical red flags:
β’ Missing unsubscribe link β required by law (CAN-SPAM, GDPR) AND by Gmail/Yahoo's 2024 bulk sender guidelines
β’ Misleading subject lines β high complaint rates destroy reputation
β’ Broken HTML or invalid headers
Best practice for cold email content: Plain text, 50β100 words, one link max, personalized opener, soft CTA. This profile rarely triggers content-based spam filters.
Sending to bad addresses kills your sender reputation faster than any other mistake. Every hard bounce tells email providers "this sender doesn't know who they're emailing" β and each bounce pushes you closer to the spam folder.
Bounce rate targets: Under 2% is acceptable. Under 1% is good. Under 0.5% is excellent. Above 5%: stop sending immediately and rebuild your list.
Types of bounces:
β’ Hard bounce: Permanent failure β the address doesn't exist. Remove immediately. These destroy reputation.
β’ Soft bounce: Temporary failure β mailbox full, server down. Retry once, remove after second soft bounce.
List verification workflow:
1. Verify every address BEFORE sending β use ZeroBounce, NeverBounce, or Hunter's Email Verifier
2. Remove role-based addresses (info@, sales@, admin@) β they rarely reply and often generate complaints
3. Remove catch-all domains unless you're confident the address is valid
4. Track engagement: after 3 emails with no opens, suppress the address
5. Process bounces daily β remove hard bounces within 24 hours
Never buy email lists. Purchased lists are filled with spam traps, invalid addresses, and people who never opted in. One purchased list can destroy a domain's reputation permanently.
Don't guess whether you're landing in inbox. Test it.
Free testing methods:
β’ Send to your own Gmail, Outlook, and Yahoo addresses. Check where it lands (inbox vs. promotions vs. spam).
β’ Use Gmail's "Show Original" to check authentication results (SPF/DKIM/DMARC pass/fail).
β’ Create seed accounts across major providers and include them in every campaign.
Paid tools (recommended for serious outreach):
β’ GlockApps: Comprehensive inbox placement testing across 30+ providers. Shows where your email lands, spam score breakdown, and authentication checks. Free tier available.
β’ MailReach: Similar to GlockApps with a focus on cold email deliverability. Includes spam word analysis.
β’ MXToolbox: Free for checking SPF/DKIM/DMARC configuration. Paid for deliverability monitoring.
What to test:
1. Inbox placement rate (primary, promotions, spam, missing)
2. Spam score and which factors flagged it
3. Authentication pass/fail for all three protocols
4. Blacklist status of your sending IPs and domains
Test weekly, not once. Deliverability is dynamic β what lands in inbox today might land in spam next week if your reputation drifts.
Mistake 1: Sending from your primary domain. If your company domain (brand.com) gets blacklisted, your entire business email (invoices, customer support, internal) is affected. Always send cold outreach from separate domains.
Fix: Register 3β5 lookalike domains, warm them up, and use them exclusively for outreach.
Mistake 2: No unsubscribe link. Gmail and Yahoo now require one-click unsubscribe (RFC 8058) for bulk senders. Without it, your emails get throttled or blocked.
Fix: Add a clear, one-click unsubscribe link to every email. ColdCraft includes this automatically.
Mistake 3: Ignoring engagement signals. Email providers track opens, replies, and deletions-without-reading. Low engagement = degraded reputation. High engagement = boosted reputation.
Fix: Send to smaller, more targeted lists. Higher engagement on 20 emails/day beats zero engagement on 200.
Mistake 4: Using link shorteners. Bitly, TinyURL, and other shorteners are heavily abused by spammers. Email providers treat shortened links as high-risk.
Fix: Use full URLs or branded tracking domains. Never use public link shorteners in cold email.
Mistake 5: Sending too fast. Blasting 200 emails in one minute looks like a bot. Email providers throttle or block burst senders.
Fix: Spread sends over several hours. Most sending platforms handle this automatically β if you're doing it manually, pace yourself.
Mistake 6: Not monitoring blacklists. Your IP or domain can end up on a blacklist without you knowing β until your emails stop being delivered.
Fix: Check MXToolbox blacklist lookup monthly. If you're listed, identify the cause (usually spam complaints or hitting a spam trap), fix it, then request delisting.
ColdCraft generates cold emails that are deliverability-friendly by default: plain-text format (no heavy HTML that triggers filters), spam-safe language (proven templates that avoid trigger word clusters), clear unsubscribe support (every generated sequence respects opt-out best practices), and engagement-optimized content (subject lines, openers, and CTAs designed to get opens and replies β the engagement signals that boost your sender reputation).
Combine ColdCraft's deliverability-safe email generation with the technical setup and warmup practices in this guide, and you'll be landing in the inbox β not the spam folder.
Generate your first cold email sequence at coldshot.co β free to start, no credit card needed.
Deliverability isn't optional β it's the foundation everything else sits on. Set up SPF/DKIM/DMARC correctly. Warm up your domains over 3β4 weeks. Keep your list clean. Test inbox placement weekly. Avoid spam trigger words and heavy HTML. Use separate domains for outreach. If you do these things, you'll land in the inbox. And once you're in the inbox, ColdCraft makes sure the email itself is worth reading.
ColdCraft uses AI to write complete 3β5 email sequences tailored to your product and audience. Free to try, no credit card required.
Try ColdCraft Free β