Cold Email Deliverability: The Complete Guide for 2026

Most "deliverability problems" aren't one problem. They're a domain that was registered nine days ago, a list bought from a data vendor with a 9% bounce rate, a mailbox pushed to 80 sends a day in week one, and a template with three tracked links in the first paragraph. Any one of those is survivable. All four together and Gmail stops showing your mail to anyone.

This guide covers the whole stack in the order it actually breaks. If you only have ten minutes, skip to the thresholds table and the triage section — those are the parts you'll use again.

{"h2":"First, get the definition right"}

Deliverability is whether a receiving server accepted your message instead of bouncing it. Inbox placement is whether a human ever saw it. A campaign can have 99.4% deliverability and 20% inbox placement — accepted by Google, filed in spam, never opened. Your sending tool reports the first number. Only seed tests and replies tell you the second. If that distinction is new, read Email Deliverability vs. Inbox Placement before you spend money fixing the wrong thing.

Practically, this means you should never judge a campaign on "delivered" counts. Judge it on verified replies per 1,000 sent.

{"h2":"The 2026 baseline: what the big receivers now require"}

The bar moved twice in the last two years and it isn't moving back.

{"ul":["Authentication is table stakes. Google and Yahoo's bulk sender rules (in force since February 2024) require SPF and DKIM, a published DMARC record, and alignment between the From domain and the authenticated domain. Microsoft followed in 2025 with the same requirements for high-volume senders to Outlook.com and Hotmail addresses, routing non-compliant mail to junk.","One-click unsubscribe is expected. Bulk senders must support List-Unsubscribe with one-click processing. Cold senders below the 5,000/day threshold aren't formally covered, but filters increasingly treat its absence as a signal — and a visible opt-out reduces complaints more than it costs you replies.","Complaint rate is the hard ceiling. Google's stated limit is a 0.3% spam complaint rate, and they recommend staying under 0.1%. At cold-email volumes, 0.3% is three complaints per 1,000 sends. That is not a lot of angry people.","Encryption and PTR hygiene matter for self-hosted SMTP. If you're sending through your own server, you need TLS, a valid reverse DNS record, and a clean IP. This is the main reason most teams stay on Google Workspace or Microsoft 365 instead of running their own relay."]}

{"h2":"Layer 1: domain and DNS"}

Your domain is the identity filters score over months. Get this wrong and nothing downstream helps.

{"ul":"**Don't send cold email from your primary domain.** Use a separate lookalike domain (getacme.com, acme-hq.com, tryacme.io) so a filtering problem never touches invoices, password resets, or support mail. The trade-off: a fresh domain has no reputation, so it needs a real ramp. More on the decision in [Should You Use Your Main Domain for Cold Email?","Age the domain before you use it. Two to four weeks between registration and first cold send is a cheap insurance policy. Point it at a real one-page site, add a privacy page, and keep WHOIS privacy on — none of that is scored directly, but a domain with no web presence and 400 daily sends is a pattern filters know.","SPF, DKIM, DMARC, all three, aligned. SPF with one include and no more than ten DNS lookups. DKIM signing on every mailbox provider you use. DMARC starting at p=none with an rua address so you can read reports, moving to p=quarantine once you see clean alignment for two weeks. The plain-English setup guide walks through each record.","Keep the tracking domain on the sending domain. A CNAME'd tracking subdomain on your own domain beats a shared tool domain that thousands of other senders have already burned.","Don't run five domains through one tool and call it diversification. If they all resolve to the same registrar, the same site template, and the same copy, they get grouped. Spreading sends across throwaway domains delays detection; it doesn't prevent it."]}

{"h2":"Layer 2: mailboxes and volume"}

Mailboxes carry their own reputation, separate from the domain. A new mailbox on a good domain still has to earn trust.

{"ul":"**Warm up gradually with real messages.** Start at 5–10 sends a day in week one and roughly double weekly until you hit your steady-state cap around day 25–30. A [30-day warm-up plan is the safe default; compressing it to ten days is where most burns happen.","Cap steady-state volume at 30–50 cold sends per mailbox per day. Some teams run higher on aged Google Workspace mailboxes with strong reply rates. Nobody should start there. Two mailboxes at 40/day is safer than one at 80.","Do the mailbox math before you promise a number. 1,000 sends a day at 40 per mailbox means 25 active mailboxes, which means real cost and real setup time. Rotation across mailboxes is a capacity tool, not a deliverability fix — mailbox rotation spreads load, it doesn't launder a bad list.","Send on a human schedule. Randomized intervals, business hours in the recipient's timezone, no weekend bursts, no 400 messages in four minutes.","Keep a real signature and a real mailbox. Reply-to that works, a name that matches the domain, and someone actually reading the inbox. Mailboxes that only send and never receive look exactly like what they are."]}

{"h2":"Layer 3: list quality"}

This is the layer people skip and the layer that kills domains fastest. A 6% bounce rate on a 3,000-send week is 180 hard bounces — a loud signal that you don't know who you're mailing.

{"ul":"**Verify every address before send, not once a quarter.** B2B data decays roughly 2–3% a month as people change jobs. Verification catches invalid syntax, dead domains, and known-bad mailboxes. See [why you should verify every lead for what verification can and can't detect.","Treat catch-all domains as a separate risk bucket. They accept everything, so verification can't confirm them. Send to them in small batches, not as 40% of a campaign.","Suppress aggressively. Past customers, open opportunities, competitors, anyone who replied \"not interested\", anyone who unsubscribed on any domain you own. One shared suppression list across all mailboxes and domains.","Narrow relevance beats volume. A 500-person list where the pitch is obviously for them will out-earn a 10,000-person list at a tenth of the risk. Complaint rate is almost entirely a relevance problem."]}

{"h2":"Layer 4: content"}

Content filtering is less about banned words than people assume and more about structure and consistency.

{"ul":["Score drafts before you send. SpamAssassin is still the most useful proxy: it flags missing text parts, sketchy HTML, link-to-text ratios, and header problems. Aim under 3.0 and read the rule names, not just the score.","One link maximum in the first email, none in the opener line. Zero images. Plain text or very light HTML. No tracking pixel if you're relying on replies as your signal anyway.","Skip the link shorteners and PDF attachments. Both are strong spam correlates in cold contexts.","Vary the template, not just the merge tags. 4,000 identical bodies with a swapped first name is a fingerprint. Rotate two or three genuinely different openings and subject lines per campaign.","Keep an unsubscribe line even when CAN-SPAM technically lets you get creative. It converts would-be complainers into quiet opt-outs, which is the single cheapest deliverability win available."]}

{"h2":"Layer 5: engagement signals"}

Modern filters weight recipient behavior heavily: replies, stars, moves out of spam, and — negatively — deletes-without-read and complaints. That's why reply-driven sequences outperform blast campaigns even with identical infrastructure.

It's also why open rates are a bad control metric. Apple Mail Privacy Protection pre-fetches images, and security gateways click links before the human does, so a 68% open rate can be mostly machines. Cold email open rates are lying to you covers how to separate bot activity from real engagement. Measure verified replies, positive replies, and meetings booked.

{"h2":"The thresholds worth monitoring"}

{"table":{"headers":["Metric","Healthy","Slow down","Stop sending"],"rows":[["Hard bounce rate","Under 2%","2–4%","Over 5%"],["Spam complaint rate","Under 0.05%","0.1–0.2%","Over 0.3%"],["Reply rate (verified)","3–8%","1–3%","Under 1%"],["Unsubscribe rate","Under 0.5%","0.5–1.5%","Over 2%"],["Sends per mailbox/day","30–50","50–80","Over 80 on a new mailbox"],["Seed inbox placement","Over 85%","60–85%","Under 50%"]]}}

Check Google Postmaster Tools weekly for any domain doing meaningful Gmail volume, and Microsoft SNDS if you send from your own IPs. Both are free and both show you data your sending tool cannot see.

{"h2":"Triage: when placement drops, check in this order"}

Resist the urge to rewrite copy first. Copy is rarely the cause and always the slowest thing to test.

{"ul":["1. Authentication. Did a DNS change break SPF or DKIM? Send a test to a Gmail account and check the original headers for three PASS lines.","2. Bounces. Pull the last 500 sends. If hard bounces are over 4%, the list is the problem and no amount of warm-up fixes it.","3. Volume curve. Did someone add mailboxes or raise daily caps in the last ten days? Roll back to the previous level.","4. Complaints and unsubscribes. A spike means targeting drifted. Re-check who's actually on the list.","5. Placement, measured. Run a seed test across Gmail, Outlook, and a couple of corporate gateways so you know whether this is a Google problem, a Microsoft problem, or everything.","6. Content, last. Spam-score the current template and compare it to the one that worked."]}

Recovery is boring: pause the affected mailboxes for 48–72 hours, resume at 20–25% of previous volume, send only to your highest-relevance segment, and rebuild over two to three weeks. Domains that got badly burned sometimes never fully recover, which is the real argument for not pushing limits in the first place. For a longer list of specific causes, Why Are My Cold Emails Going to Spam? breaks out 15 of them.

{"h2":"How Sendvanta handles this"}

Sendvanta was built around the assumption that deliverability is a system, not a checkbox. It sends through your own Gmail, Microsoft 365, or SMTP/IMAP mailboxes — never a shared IP pool — and warms them up with real labeled messages inside your workspace. Health scoring runs across mailbox, domain, DKIM, and IP layers, and campaigns slow down or pause automatically when a risk threshold is crossed instead of after you notice the reply rate collapsed. Drafts get SpamAssassin-scored before send, seed mailboxes measure actual inbox placement, engagement classification separates verified visits and replies from scanner noise, and suppression plus one-click unsubscribe are on by default.

The free plan is $0 forever with 1,000 active leads, 3,000 emails a month, and up to 10 of your own SMTP mailboxes — enough to run the full checklist on a real campaign before paying anything. Paid plans are Starter $29, Growth $59, and Pro $99 a month, with Enterprise quoted; connecting your own mailboxes is free on every plan, managed mailboxes are $4/mo each on paid plans, and registering a sending domain is a one-time $20. The features page has the detail.

{"faq":[{"q":"How long does it take to fix bad deliverability?","a":"If the cause is authentication or a volume spike, one to two weeks of reduced sending usually restores placement. If the cause is months of high-bounce, high-complaint sending on the same domain, plan on a new sending domain and a fresh 30-day warm-up — that reputation generally doesn't come back on its own."},{"q":"Does warming up a mailbox with automated tools still work in 2026?","a":"Reciprocal warm-up pools that trade fake engagement between thousands of strangers are increasingly detectable and add risk. Warm-up that generates real labeled conversations inside your own workspace, plus a genuine slow volume ramp, is the version that still holds up."},{"q":"What's a safe daily sending volume per mailbox?","a":"30–50 cold sends per day on a fully warmed mailbox is the working range for most senders. New mailboxes should start at 5–10 and ramp over three to four weeks. Need more capacity? Add mailboxes rather than raising per-mailbox limits."},{"q":"Do I need DMARC for cold email?","a":"Yes. Google and Microsoft both expect a published DMARC record, and without one you have no visibility into alignment failures or spoofing. Start at p=none with reporting, then move to p=quarantine once reports look clean."},{"q":"Is inbox placement testing worth paying for?","a":"If you send more than a few hundred emails a week, yes. Seed tests are the only way to see per-provider placement rather than inferring it from reply rates weeks later. Just treat the result as a directional sample, not a precise percentage."}]}

This guide was written and last reviewed on February 8, 2026, based on the published bulk-sender requirements from Google, Yahoo, and Microsoft in force at that date, plus sending patterns observed across Sendvanta workspaces.