Cold email / sender reputation
How to improve cold email deliverability in 2026, the boring way
Across 5 million-plus cold emails sent in the last 12 months, we have never once used open rate to judge deliverability. We do not track opens at all. The pixel that measures them is one of the things that hurts deliverability in the first place. If a "how to improve cold email deliverability" checklist starts with an open-rate target, throw it out.
Here is the answer up front. It comes down to 4 things: authentication, domain warmup, list hygiene, and sending volume, in that order. The two numbers to watch are bounce rate under 2% and spam complaints under 0.1%. Every other tactic is noise until those two are clean.
The cold email deliverability checklist we run before every send
Five gates, checked in this order, every single campaign:
- A sending domain separate from your brand root. Cold outreach never touches the domain your website and customer email run on.
- SPF, DKIM, and DMARC configured and aligned. Not just present, passing, and pointed at the sending domain, not a generic template.
- One-click unsubscribe on every send. Mandatory for bulk senders on Google, Yahoo, and Microsoft, and a broken or missing one drives complaints straight up.
- 14 days of warmup before the domain touches a real prospect. Starting at 5 a day per inbox and stepping up only on Google, where the ceiling is 10 to 15, never launching at full volume.
- A list verified within the last 30-60 days. Not verified once at purchase and reused for a year.
Skip any one of these and the rest of the checklist stops mattering. A perfectly warmed domain still burns on an unverified list. A clean list still bounces from an unwarmed domain.
Deliverability is not a setting. It is a daily habit, or it is a burned domain.
Authentication that passes is not the same as authentication that exists
SPF, DKIM, and DMARC records sitting in your DNS prove nothing on their own. What mailbox providers actually check is alignment: does the domain in the sender address match what SPF and DKIM authorize, and does your DMARC policy back that up instead of sitting on p=none forever. Google, Yahoo, and Microsoft's bulk sender rules require all three plus one-click unsubscribe, and Google's sender guidelines spell out the complaint ceiling that comes with them: 0.3% is the hard line, and we treat 0.1% as our own.
One-click unsubscribe is not optional anymore either. It is codified in RFC 8058, and a broken or missing unsubscribe link is one of the fastest ways to turn an uninterested prospect into a complaint instead of a quiet no.
A new domain needs 14 days of warmup before it touches a prospect, and then it sends at full volume
Once those 14 days are done the inbox sends at its provider number and holds there: 5 a day on Microsoft, 10 to 15 on Google. Skipping straight to campaign volume on day one is the single fastest way to burn a domain in its first month, before it ever gets the chance to prove anything to Google or Microsoft. We laid out the per-inbox numbers, and the math behind them, in how many cold emails to send per day. The warmup schedule there is not a suggestion, it is the same one every domain in our own infrastructure goes through before it sends a single prospecting email.
Sends per mailbox is a provider number, 5 on Microsoft and 10 to 15 on Google
Push a mailbox past its platform's rate and you are trading short-term volume for long-term reputation. The fix when you need more volume is never a higher per-mailbox number, it is more mailboxes and more domains. Our own infrastructure runs a large pool of dedicated, warmed inboxes split roughly 60/40 Microsoft and Google, which is how a mature campaign still sends around 10,000 emails a day without any single mailbox carrying more than it should. The full setup, including how many domains and inboxes that volume actually needs, is in cold email infrastructure.
| Metric | Healthy range | The line you do not cross |
|---|---|---|
| Bounce rate | Under 2%, under 1% on freshly verified lists | Over 3%: pause and re-verify before you burn the domain |
| Spam complaint rate | Under 0.1% | 0.3% is the mailbox providers' hard ceiling, not a target |
| Sends per mailbox per day | 5 on Microsoft, 10-15 on Google | Past your platform's rate: add mailboxes, never push one harder |
List hygiene is verifying before you send, not after you bounce
A verified list still ages. Titles change, people leave, inboxes get retired, and a list verified six months ago is not the list you think it is today. Re-verify anything older than 30-60 days before it goes back into rotation, and never buy a list outright, a purchased list is the fastest route to a spam-trap hit you will not see coming. A 15,000-person list built through cheap enrichment tools runs about $29. Verification costs less than that. There is no excuse for sending on stale or unverified data in 2026.
Engagement signals now matter as much as authentication does
Passing SPF, DKIM, and DMARC gets your mail evaluated. It does not get it delivered. Google, Yahoo, and Microsoft all weigh what happens after the message lands: replies, clicks, and whether a recipient drags it to spam. A perfectly authenticated domain still sinks if nobody engages with what it actually sends.
Two things move that signal in your favor. Length: a short, plain-text email reads as a human wrote it, not as a mail-merge blast, and it gets read and replied to more often because of it. And real personalization, not a first-name token stitched into a template. A line built off something specific, a funding round, a hiring signal, a leadership change, a technology shift, reads as a human noticing something. A category is a bucket, and a mailbox provider can smell a bucket the same way a prospect can.
The hype around hyper-personalization software is complete BS in my experience. Dozens of enriched fields feeding one paragraph nobody reads twice does not beat a plain email built on a precise list and a real reason to write. It also happens to be the same habit that keeps your complaint rate low, because a prospect who feels seen reports you far less often than one who feels processed.
What a good cold email deliverability rate actually looks like
Nobody publishes a single "deliverability rate" the way benchmark reports publish reply rate, so the question deserves a straight answer instead of a made-up number. Judge it by the two ceilings that gate everything above: bounce rate under 2% and spam complaints under 0.1%. Hold those and inbox placement testers will generally put you in the 85-95% range. Drift below 80% and the problem is your list or your warmup, never your subject lines.
tl;dr: authentication, warmup, list hygiene, and sending volume, checked in that order, on every campaign. Bounce rate under 2%, spam complaints under 0.1%. Everything else on a deliverability checklist is downstream of getting those two numbers right. More field notes like this live on the blog index.
FAQ
What is a good cold email deliverability rate?
There is no single published "deliverability rate" the way there is a reply rate. What matters is two ceilings: keep bounces under 2% (under 1% on a freshly verified list) and spam complaints under 0.1%. Inbox placement testers commonly report 85-95% for a healthy sender. Below 80%, treat it as a list or warmup problem, not a copy problem.
What is the cold email deliverability checklist you actually run?
Five gates, in order: a sending domain separate from your brand root, SPF/DKIM/DMARC configured and aligned, one-click unsubscribe on every send, a new domain given at least 14 days of warmup before its first cold send, and a list verified within the last 30-60 days. Skip any one of them and the rest of the checklist stops mattering.
How long does a new domain need to warm up before cold email?
At least 14 days of automated warmup before the first cold send, and then the inbox goes straight to its platform's steady state: 10 to 15 per inbox per day on Google, 5 on Microsoft. There is no gradual ramp afterward. From domain purchase to full volume is about two weeks, and all of it is warmup. Shortcutting it to hit a launch date is the single fastest way to burn a domain in its first month.
How many cold emails can I send per mailbox per day?
It depends on the platform, and the gap is wide: 5 per inbox per day on Microsoft, but 10 to 15 on Google. Providers technically allow far more, but spam filters react to sending behavior long before the official caps do. When you need more volume, add mailboxes and domains instead of pushing one mailbox past its limit. A mature campaign of ours still sends around 10,000 emails a day, spread across a large pool of inboxes, never stacked onto a few.
Do I need SPF, DKIM, and DMARC for cold email?
Yes, and having the records exist is not the same as having them pass and align. Google, Yahoo, and Microsoft now enforce bulk sender rules that require all three plus one-click unsubscribe. Without them, a growing share of your mail never reaches an inbox to be judged on anything else.
Does open tracking hurt cold email deliverability?
Yes. The tracking pixel itself is a signal mailbox providers weigh, and Apple's Mail Privacy Protection pre-fires it for a large share of opens anyway, so the data is unreliable on top of the risk. We run cold campaigns in plain text with zero open tracking and judge everything by bounce rate, spam complaints, and replies instead.
If you want a second set of eyes on your own sending setup, bring your bounce and complaint numbers to a call and we will tell you honestly which gate is the one costing you inbox placement. Book a time here. Or see how we build the infrastructure behind it from the ground up.
PS - the domain that skips warmup to hit a launch date is the domain we get called in to fix months later, at a much higher cost than the two weeks it would have taken to do it right.
