Cold Email Deliverability: The 2026 Playbook

Deliverability is the only part of outbound where you can do everything else perfectly and still get zero.

The list is clean, the offer is sharp, the copy is the best you've written. None of it matters, because the message was refused before a human saw it.

That word is doing real work now. For most of 2024, non-compliant mail got a soft bounce and a delay.

From November 2025, Gmail moved to hard enforcement. Non-compliant messages receive permanent rejections before reaching any mailbox. Microsoft had already followed suit in May 2025.

The grace period is over. What follows is what to build, what to watch, and which problems you can fix this afternoon versus which will take you two months.

What deliverability actually means

Cold email deliverability is the discipline of getting cold mail accepted by the receiving server and placed in the primary inbox rather than spam.

It depends on five things, roughly in order of impact. Authenticated infrastructure, verified recipient data, per-mailbox volume discipline, low complaint rates, and copy that doesn't trip content filters.

Notice what isn't on that list. Copy quality is last, and most deliverability failures are infrastructure failures wearing a copy costume.

The single most useful thing to know

Deliverability problems fall into two buckets with wildly different timelines, and knowing which one you're in changes what you do this week.

Authentication problems fix in hours. Publish corrected DNS records and the change takes effect almost immediately.

Reputation problems take four to twelve weeks. Recovery requires consistent, low-volume, high-engagement sending, and there is no shortcut.

That distinction is worth sitting with, because it tells you whether to pause a campaign or just fix a record and carry on.

Most teams treat every deliverability issue as catastrophic. Roughly half of them are DNS records you can fix before lunch.

Why cold email goes to spam

Six causes account for nearly all of it.

Authentication that's missing or misaligned. SPF, DKIM and DMARC all need to be published, with at least one of SPF or DKIM aligned to your From domain.

Misalignment is the most common failure, and it's subtle. You can authenticate successfully with your vendor's domain and still fail DMARC because the From domain doesn't match.

Bounces. Every hard bounce signals you're sending to a list you didn't check. Push past 2% and providers start treating your whole domain as suspect within days.

Complaints. All three major providers set the enforcement threshold at 0.3%, and 0.1% is the working ceiling for stable senders rather than an aspiration.

Context for how small that is. Deliver 10,000 emails and thirty complaints puts you at the threshold.

Volume per mailbox. A brand-new mailbox sending 200 emails on day one behaves like a compromised account. Providers read the pattern, not your intentions.

Content signals. Links, images, tracking pixels and spam vocabulary all suppress placement. Cold email should look like a person typed it.

Engagement. Mail nobody opens or replies to gets progressively deprioritised, which is why a dead list poisons a domain even when nothing bounces.

The rules that now apply

Google and Yahoo introduced shared requirements in February 2024. Microsoft joined on 5 May 2025, covering Outlook.com, Hotmail and Live.

They apply to any domain sending roughly 5,000 or more messages a day.

The practical assumption should be that they apply to you regardless of volume, since enforcement is heading toward universal.

Two details that catch people out.

The 5,000-a-day threshold is measured per sending domain, and once crossed the classification doesn't expire. One large campaign and you're treated as a bulk sender from then on.

Microsoft's rejection is absolute. Mail that fails the authentication bar gets a hard 550 5.7.515 rejection, and a recipient adding you to their Safe Senders list does not override it.

That second point matters more than it sounds. It means a warm relationship offers no protection against a DNS mistake.

Where cold senders honestly sit on unsubscribe

One-click unsubscribe was designed for bulk marketing mail. A genuinely one-to-one email at low per-domain volume sits in a different category, and adding a List-Unsubscribe header to plain-text prospecting isn't universal practice.

The defensible posture is to keep every domain well under the threshold, and give people a frictionless exit in the copy itself.

A plain line does it. "Not for you? Just reply no and I'll close the file."

It costs nothing, honours the spirit of the requirement, and converts would-be complaints into harmless replies.

Since complaint rate is what ends sending programmes, that trade is heavily in your favour.

The free diagnostic most people skip

Google Postmaster Tools takes about ten minutes to set up, costs nothing, and shows you your domain as Google actually sees it.

It also changed recently in ways that make it more useful for cold email specifically.

Reputation grades became compliance checks. Postmaster Tools v2 replaced the old subjective reputation scores with binary pass or fail compliance status. Less nuance, but far less ambiguity.

Reputation now shows at subdomain level, which matters if you're isolating campaign types across subdomains.

SPF and DKIM failure rates are surfaced directly. You can diagnose an authentication problem without waiting for bounce reports to tell you.

For Microsoft, the equivalent is SNDS, which covers IP-level reputation for Outlook.

If you send meaningful volume to Gmail addresses and you're not monitoring Postmaster Tools, you're guessing.

Never send from your primary domain

Sending domains degrade. A heavily used one might last two to three months, a carefully managed one eight or nine.

When one burns there's no recovery worth the wait. You buy fresh domains and warm them again.

If that happens on your main company domain, you've also taken out your invoices, your support replies and your team's normal correspondence.

Secondary domains exist because they're consumable. Buy lookalike variations, point them at your main site, and treat them as a running cost.

How many domains do you actually need?

This calculation determines your whole budget, and almost nobody publishes it.

Notice what falls out at 3,000 a day. Thirty-three domains carrying about 90 messages each.

That's not a coincidence. The architecture exists precisely so no single domain approaches the 5,000-a-day threshold, and so no single domain burning takes out your whole capacity.

Three rules go with the math.

Buy mailboxes from a managed provider. Direct costs roughly double and leaves you configuring DNS yourself, where one missing record sinks a domain.

Split roughly 50/50 between Google and Microsoft, so one provider's policy change costs you half your capacity rather than all of it.

Budget infrastructure at 30 to 50% of outbound spend. Most teams spend 5% and wonder why their copy isn't working.

Warm-up, and what it doesn't tell you

Around 14 days per mailbox. Ramp +5 a day to a ceiling near 25, weekdays only, randomiser on at the top. Private SMTP needs 20 to 30 days.

A mailbox that skipped warm-up will land in spam on day one and stay there.

But here's what nobody says clearly enough. A healthy warm-up score does not mean you're inboxing.

Warm-up networks are cooperative. Everyone in the network is actively rescuing everyone else's mail from spam. A 98% warm-up reputation tells you very little about real Gmail.

One warm-up metric is worth watching, though. The seven-day "saved from spam" count.

Non-zero means peers had to rescue your mail, which is a live signal that a mailbox is going bad. Treat zero as the floor, not a bonus.

Keep warm-up traffic running in the background after campaigns go live, rather than switching it off the moment you start sending.

Testing inbox placement properly

Every other signal is a proxy. Reputation scores lag, warm-up stats are forgiving, open rates are distorted by privacy features.

Placement testing is direct measurement. You send from your actual mailboxes to seed inboxes across Gmail, Outlook, Yahoo and Apple, then see exactly where each one landed.

Run it weekly on a rotating sample of mailboxes. What to do with the result:

The other reason to test is isolation by provider. If a campaign sits in primary on Gmail but spam on Outlook, you have a Microsoft-specific authentication problem.

That's a completely different fix from a copy rewrite, and you'd never know from your sequencer's dashboard.

Verification, and why it's the cheapest insurance you'll buy

Only send to addresses that verify as valid. Not catch-all, not "risky," not unverified.

The asymmetry is absurd. Verification costs a fraction of a cent per address. A dirty list costs you every domain and mailbox you own, plus two weeks of re-warming, plus the campaign.

Verify close to send. B2B contact data decays fast enough that a list built six weeks ago is worth re-running before it goes out.

Never re-enter bounces, complaints or unsubscribes into rotation. Suppress them permanently rather than parking them for a future campaign.

And set bounce auto-pause at 2%. If a campaign trips it, stop and re-verify rather than pushing through.

The settings that quietly decide placement

• Plain text, no HTML. Cold email should look like a colleague typed it.
• No open tracking. It adds a pixel and a redirect domain for a metric you can't trust.
• No links or images in email one. Both suppress placement. Earn the link with a reply.
• Signature of two or three text-only lines. No logos, no phone banks, no social icons.
• Spintax on static lines only. Never on personalisation variables, which are already unique.
• Weekdays, spread across the working day, in the prospect's timezone.
• Company-level auto-pause on for SMB targets, so one reply stops emails to their colleagues.

Swap the spam words. Free audit becomes 5-minute review. Save money becomes trim the bill. Guarantee becomes "I'll cover it if it doesn't work."

Keep "free," the $ symbol, ALL CAPS and "act now" out of subject lines entirely.

When the setup is already burnt

Signs you're past repair: placement under 30%, complaint rate stuck above 0.3%, a bounce spike you didn't catch for days, or domains appearing on blocklists.

There's no clever fix. The process is:

1. Stop sending immediately. Every additional send deepens the hole.
2. Buy fresh domains. Don't reuse the burnt names.
3. Provision new mailboxes through a managed provider.
4. Warm for 14 days. No exceptions, no accelerated schedules.
5. Fix the cause before relaunching.

That last step is the one people skip. If bad data burnt it, verification discipline goes in first. If volume burnt it, the per-mailbox cap comes down.

Rebuilding into the same behaviour costs you the same money twice.

Budget three weeks and the price of a full rebuild, which is exactly why the checklist below is worth running every time.

The pre-launch checklist

• SPF, DKIM and DMARC published, passing and aligned on every domain
• Sending from secondary domains only, never the primary
• Postmaster Tools connected and compliance status checked
• Mailboxes warmed a full 14 days, warm-up still running
• Per-mailbox daily volume set at 10 to 30
• Every domain comfortably under 5,000 sends a day
• Full list verified, valid only, verified recently
• Bounce auto-pause set at 2%
• Plain text, no tracking, no links or images in email one
• Spam-word check run and clean
• Opt-out line in the copy
• Inbox placement test run in the last seven days

What this comes down to

Deliverability fails quietly and costs loudly. That's what makes it the hardest problem in outbound to notice and the easiest to misdiagnose.

The teams who scale cold outreach without placement problems aren't doing anything exotic in their copy.

They authenticate properly, warm every mailbox, verify every address, test placement weekly, and watch the complaint rate against the provider's own data.

None of that is clever. All of it is boring, and the boring part is the whole job.