Cold email deliverability in 2026: the complete setup
Everything that decides whether your email lands in the inbox or dies in spam — with the exact records, schedules, and limits. Written from real debugging, not recycled blog posts.
Last updated: July 2026
The three walls between you and the inbox
Gmail and Outlook judge every incoming email on three levels, in order:
- Authentication — can your domain prove it sent this? (SPF, DKIM, DMARC — fixable in 30 minutes, covered below)
- Reputation — does your domain/IP have a history of wanted mail? (built over weeks with warm-up and steady volume)
- Content & behavior — does this look like spam, and do people mark it as spam?
Most "why is my cold email in spam?!" posts are a failure at wall #1 — the cheapest one to fix. Start there.
Wall 1: Authentication — SPF, DKIM, DMARC (30 minutes, once)
SPF is a DNS record listing which servers may send email for your domain. Add a TXT record on your root domain:
v=spf1 a mx include:_spf.google.com ~all (Google Workspace example — your email host's docs have the exact include for your provider)
DKIM cryptographically signs each message so receivers can verify it wasn't forged. Your email provider generates the key — you publish it as a TXT record on selector._domainkey.yourdomain.com. Where to find it: Google Workspace → Admin → Gmail → Authenticate email; cPanel → Email Deliverability; Zoho → Mail Admin → DKIM. If you skip DKIM, Gmail treats you as second-class regardless of everything else.
DMARC tells receivers what to do when a message fails those checks. Start gentle — a TXT record on _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:you@yourdomain.com
After 2–3 weeks of your own mail passing cleanly, tighten p=none to p=quarantine.
Check yourself right now — our free SPF/DKIM/DMARC checker reads your domain and tells you exactly what's missing, with fix-it snippets. No signup.
Two gotchas that cost us hours: (1) in Namecheap-style DNS panels the Host field for a root TXT record is @, not your domain name — and nothing saves until you hit "Save all changes"; (2) DKIM values are very long — a truncated paste fails silently.
Wall 2: Reputation — warm-up, or die on day one
A brand-new domain (or a domain that never sent bulk) has no reputation. Send 200 cold emails on day one and Gmail's models flag the pattern instantly — that domain can be effectively dead within a week.
The warm-up schedule that works:
- Week 1: ~10 emails/day
- Week 2: ~25/day
- Week 3: ~40/day
- Week 4+: your full cap — and keep a cap (25–50/day per mailbox is the sane zone)
During warm-up, replies matter more than volume — early back-and-forth conversations teach providers your mail is wanted. Send your first batches to your most promising leads, not your longest list.
Two structural rules that protect reputation permanently:
- Never cold-email from your main domain. Your primary domain carries your transactional and personal mail — one bad campaign can poison it. Buy a look-alike domain (~$10) for outreach, set up its DNS the same way, and point its website at your real site.
- Drip, don't blast. 10–20 emails per hour inside business hours looks human. 500 at 9:00 sharp looks like what it is.
Wall 3: Content — write like a person, get read like one
- Plain text beats HTML for cold email. One link maximum; no images or attachments.
- Kill trigger phrases ("risk-free", "act now", "100% free"), ALL-CAPS words, and !!!— filters weigh each one against you.
- Under 150 words. Personalized first line. One soft question as the ask.
- Always include a working unsubscribe link and honor it — it's the law (CAN-SPAM/GDPR) and it protects you: an unsubscribe click is harmless, a spam-button click is poison.
Paste any draft into our free spam checker — it flags exactly what filters will, in your browser, no signup.
Monitoring: know before your prospects do
- mail-tester.com — send one email, get a 0–10 score with specifics. Do this after any DNS change.
- Google Postmaster Tools — free domain-reputation dashboard from Gmail itself; set it up once you send steadily.
- Watch your own numbers — a sudden open-rate drop (say 45% → 15%) almost always means you slid into spam. Stop, halve volume, re-check DNS, and rebuild.
The 10-point checklist
- Separate outreach domain (never your main one)
- SPF record published
- DKIM signing enabled and published
- DMARC at p=none, tightened after 2–3 clean weeks
- MX + reverse-DNS sane (your host usually handles this)
- Warm-up ramp: 10 → 25 → 40 → cap
- Daily cap 25–50 per mailbox, 10–20/hour, business-hours window
- Plain text, ≤1 link, no trigger words, unsubscribe present
- Bounces removed automatically (over ~3% bounce rate kills domains)
- mail-tester 9+ before any real campaign
Outreach Studio ships with warm-up ramps, caps, windows, spam checks, DNS verification, and automatic bounce handling — on by default. Free plan, no card.