Cold email / deliverability
Why your cold emails are going to spam
Volume without deliverability infrastructure is self-sabotage. We've sent over 5 million cold emails in the past 12 months, and when a domain lands in spam it is never bad luck. It is one of five things breaking, and none of them is your subject line.
That is the honest answer to why your cold emails are going to spam: broken authentication, a bounce rate that already crossed 2%, no warmup ramp on a new domain, sending behavior that reads as spam regardless of your copy, or a domain reputation that was burned before you ever touched it. Fix the first two and most spam-folder problems disappear on their own.
The rest of this post is each one, in the order we actually see them break, plus how to check which one is yours before you rewrite a single email.
The 5 real reasons cold email lands in spam, in one table
None of these are copy problems, which is why swapping subject lines never fixes them.
| What you see | What is actually broken | Where to look first |
|---|---|---|
| Everything goes to spam, day one | Missing or misconfigured SPF, DKIM, or DMARC | DNS records for the sending domain |
| Placement was fine, now it isn't | Bounce rate crossed 2% | List verification, not the last email you sent |
| New domain, spam from the first send | No warmup period before cold volume | Warmup dashboard, days since domain purchase |
| Gmail fine, Outlook not, or the reverse | Sending behavior a specific provider flags | Volume per inbox, ramp speed, content patterns |
| Placement degrades over weeks, not days | Spam complaint rate creeping toward the cap | Google Postmaster Tools complaint graph |
Spam placement is not a copy problem. It's a trust problem, and trust is measured in bounces and complaints, not opens.
Missing SPF, DKIM, or DMARC sends you to spam before anyone reads a word
SPF lists which servers are allowed to send mail for your domain. DKIM signs every email cryptographically so a receiving server can confirm it wasn't altered or spoofed in transit. DMARC tells receiving servers what to do when SPF or DKIM fails, and reports back when someone tries to spoof you. All 3, correctly configured, before the first cold send. Not after.
Google's bulk sender guidelines require all 3 for any domain sending 5,000 or more messages a day to Gmail addresses. Since late 2025, Gmail doesn't just route non-compliant bulk mail to spam, it rejects it outright. Yahoo enforces the same baseline through its own sender best practices. We covered the exact DNS setup in cold email infrastructure; this post is about diagnosing what happens when it's wrong, not setting it up.
A bounce rate over 2% tells every provider you don't know who you're mailing
Keep bounces under 2%, and under 1% on freshly verified lists. At 3% or more, pause the campaign and re-verify the list before you damage the domain further. Providers read a hard bounce as proof you didn't check who you were mailing, and they discount your future mail accordingly, on every domain tied to the sender, not just the one that bounced.
The fix is boring on purpose: verify the list before you send, not after placement drops. A 15,000-person lead list costs about $29 to build without the enterprise data tools, and verification costs less than that. There is no excuse for a 6% bounce rate in 2026, and there is no subject line that fixes one.
Skipping the domain warmup treats you like a spam factory on day one
Most spammers send from brand-new domains, so mailbox providers treat a domain with no sending history as guilty until proven otherwise. Going from zero to full cold volume on day one is indistinguishable, from the provider's side, from what a spammer does.
The fix: automated warmup only for the first 14 to 21 days, zero cold sends, then a week 1 through 4 ramp per inbox before you hold steady volume. We published the exact schedule and the math behind it in how many cold emails to send per day. From domain purchase to full volume is about 6 weeks. Anyone promising full volume in a week is about to teach you an expensive lesson with your own domains.
Spam filters read behavior, not just trigger words
Every list of "spam trigger words" is missing the point. A filter in 2026 weighs sender reputation, engagement, and sending pattern far more than whether you typed "free" or "guaranteed." Trigger words are usually a symptom, not the disease: an email stuffed with promises and 3 exclamation points is also, reliably, the email sent to the worst list with the worst offer. That combination sinks placement. The wording is just what you notice first.
Two behaviors matter more than any word list. First, plain-text over heavy HTML, tracking pixels, and unbranded link shorteners; every extra tracking element is one more signal that reads as bulk mail. Second, one micro-action per email and a read-through length a real human would actually send, not a wall of formatting that looks automated because it was.
Google and Yahoo's 0.3% complaint cap is the line that ends your sending
This is the ceiling that actually ends sending careers, more than bounces do. Google's email sender guidelines set the complaint line at 0.3%, with under 0.1% as the stated target, plus mandatory authentication and one-click unsubscribe for bulk senders. Yahoo enforces the same rules. This is not a best practice. It is the condition for your mail being accepted at all.
Complaints climb quietly. A campaign can look fine on reply rate for weeks while the complaint rate drifts toward the cap, and by the time placement visibly drops, you're already past the point where a quick fix works. Watch the number, not the symptom.
How to actually check if you're in spam before your reply rate tells you
Reply rate is the last thing to move, which makes it the worst way to find out. Two tools do the job properly:
- Google Postmaster Tools,set up for every sending domain. It reports domain and IP reputation, spam rate, and authentication pass rate straight from Gmail's own data, days before it shows up anywhere else.
- Seed test inboxes across Gmail, Outlook, and Yahoo that you check by hand before scaling volume on a new domain or a new campaign. Automated placement testers help, but nothing replaces looking at the actual inbox.
Check both before you add volume, not after placement complaints start coming in from the campaign itself.
The fix, in the order we'd actually run it
Stop guessing which of the 5 it is. Work the list in order:
- Confirm SPF, DKIM, and DMARC all pass on every sending domain, today, not from memory.
- Pull bounce rate for the last 7 days. Above 2%, stop sending and re-verify the list first.
- Check domain age against the warmup schedule. Under 3 weeks old and already at full volume is the problem, on its own.
- Pull the spam complaint rate from Google Postmaster Tools. Above 0.1%, cut volume before you do anything else.
- Only once the first 4 are clean, look at content and sending behavior. It is rarely where the problem started.
Volume without deliverability infrastructure is self-sabotage, and every domain that lands in spam is proof of the sentence, not an exception to it. We covered what the infrastructure behind 5M+ sends a year actually looks like in cold email infrastructure, and what reply rate should look like once placement is clean in cold email reply rate benchmarks.
tl;dr: check authentication, bounce rate, domain age, and complaint rate, in that order, before you touch a single word of copy. More field data like this lives on the blog index.
FAQ
Why are my cold emails suddenly going to spam?
Something changed in your sending behavior or your list, not your copy. The usual triggers: a bounce rate that crossed 2%, volume that jumped faster than your warmup allowed, a spam complaint rate creeping toward Google's 0.3% cap, or SPF, DKIM, or DMARC that broke after a DNS change. Check bounces and complaints first. They move before reply rate does.
What is a safe spam complaint rate for cold email?
Under 0.1% is the target we hold ourselves to. Google enforces a hard ceiling of 0.3% for any domain sending 5,000+ messages a day to Gmail addresses, and since late 2025 Gmail rejects non-compliant bulk mail outright instead of routing it to spam. Treat 0.1% as your real limit, not 0.3%.
How do I check if my cold emails are landing in spam?
Set up Google Postmaster Tools for every sending domain; it reports your domain and IP reputation, spam rate, and authentication pass rate directly from Gmail's data. Pair it with a handful of seed test inboxes across Gmail, Outlook, and Yahoo that you check by hand before scaling volume. Reply rate is a lagging indicator. Postmaster Tools is not.
Do SPF, DKIM, and DMARC actually stop spam filtering?
They are the entry fee, not a guarantee. Without all 3 correctly configured, receiving servers cannot confirm your mail is really from you, and a large share of it gets routed to spam or rejected before a filter even reads the content. With all 3 in place, you still have to earn placement through bounce rate, complaint rate, and sending behavior. Authentication gets you in the room. It does not keep you there.
Can spam trigger words alone send an email to spam?
Rarely, on their own, in 2026. Modern filters weigh sender reputation and engagement far more than a handful of flagged words. But trigger words are a symptom worth reading: an email stuffed with 'guaranteed,' free-money framing, and 3 exclamation points is usually also the email with the worst list and the worst offer, and those are what actually sink it.
How long does it take to fix a domain that is already in spam?
Longer than fixing whatever broke it. Pause all sending, fix the root cause (authentication, list quality, or volume), then re-warm the domain for 2 to 3 weeks before any cold send goes out again. A domain with a damaged reputation rarely recovers in under a month, which is the real cost of skipping the ramp the first time.
If a domain is already in spam and you're not sure which of the 5 broke, bring your Postmaster Tools data to a call and we'll tell you straight, including whether the fix is a DNS record or a system rebuilt from the ground up. Book a time here.
PS - the domain that taught us this lesson hardest was one we inherited mid-campaign with a bounce rate already past our own ceiling. Re-verifying the list, not touching a single template, was what actually fixed placement.