What is cold email deliverability?
Deliverability is whether your email reaches the inbox, not just the receiving server. A delivered message can still land in spam. Providers decide based on who sent it, how recipients react and what it looks like.
Cold email starts at a disadvantage, because the people you write to didn’t ask to hear from you. Each spam report counts against your domain.
What do SPF, DKIM and DMARC do?
They’re three DNS records that let a receiving server check a message really came from your domain. DMARC ties the other two to the address people see.
| Record | What it checks | Where it lives | Watch out for |
|---|---|---|---|
| SPF | Which servers may send mail for the domain in the envelope sender, also called the Return-Path. | A TXT record on the domain, starting v=spf1. | Publish one SPF record per domain. RFC 7208 caps DNS lookups at 10, so too many include: entries make SPF fail. |
| DKIM | A signature showing which domain signed the message (the d= tag) and that it wasn’t changed. | A public key in a TXT record at selector._domainkey.yourdomain. | Gmail and Yahoo require a key of at least 1024 bits and recommend 2048. |
| DMARC | Whether SPF or DKIM passed for a domain that matches the From: address, and what to do if neither did. | A TXT record at _dmarc.yourdomain. | p=none states no preference for failing mail. Add a rua address to receive reports. |
What does DMARC alignment mean?
Alignment means the domain that passed SPF or DKIM matches the domain in the From: address. Relaxed alignment accepts the same organizational domain, so mail.example.com aligns with example.com. Strict alignment needs an exact match.
If a sending tool signs mail with its own domain instead of yours, SPF and DKIM can pass while DMARC fails. Ask the provider to sign with your domain, and add its servers to your SPF record.
What do the records look like?
- SPF: v=spf1 include:_spf.example-provider.com ~all. Your email provider gives you the include: value. Ending with ~all marks other senders as a soft fail, and -all as a fail.
- DKIM: your provider generates the key. You publish it at a name like s1._domainkey.example.com.
- DMARC: v=DMARC1; p=none; rua=mailto:dmarc@example.com, published at _dmarc.example.com. Microsoft advises moving from none to quarantine to reject once every legitimate source is aligned.
What do Gmail and Yahoo require from senders?
Google announced its sender rules on October 3, 2023, and both Google and Yahoo began enforcing theirs in February 2024. Gmail’s cover mail to personal Gmail accounts. Yahoo’s cover every domain Yahoo Mail hosts, including AOL.
| Requirement | Gmail (personal accounts) | Yahoo and AOL |
|---|---|---|
| Who counts as a bulk sender | Anyone who sends close to 5,000 or more messages to personal Gmail accounts in 24 hours, counted across the primary domain. The status is permanent. | A sender of “a significant volume of mail”. Yahoo doesn’t give a number. |
| SPF and DKIM | All senders: SPF or DKIM. Bulk: both. | All senders: SPF or DKIM. Bulk: both. |
| DKIM key length | 1024 bits or longer, with 2048 recommended. | 1024 bits or longer, with 2048 recommended. |
| DMARC | Bulk: a DMARC record, with p=none as the minimum. | Bulk: a valid policy of at least p=none, and DMARC must pass. |
| From: alignment | Bulk: the From: domain must align with the SPF or DKIM domain. | Bulk: the same. Relaxed alignment is acceptable. |
| DNS and connection | All senders: valid forward and reverse DNS (PTR) for sending IPs, and a TLS connection. | All senders: valid forward and reverse DNS for sending IPs. |
| Message format | All senders: RFC 5322. | All senders: RFC 5321 and RFC 5322. |
| Spam complaint rate | All senders: below 0.3% in Postmaster Tools. Google advises staying below 0.1%. | All senders: below 0.3%, measured on mail delivered to the inbox. |
| Unsubscribe | Bulk: one-click unsubscribe using RFC 8058 headers on marketing and subscribed mail, plus a visible link in the body. | Bulk: a working one-click List-Unsubscribe header, plus a visible link in the body. The RFC 8058 POST method is highly recommended. |
| Honoring opt-outs | Bulk: within 48 hours. | Bulk: within 2 days. |
| Key dates | Rules from February 1, 2024. One-click unsubscribe by June 1, 2024 for senders who already had a link. Stronger enforcement, including rejections, from November 2025. | Enforcement from February 2024, rolled out gradually. List-Unsubscribe enforcement from June 2024. |
Gmail doesn’t count a mailto link as one-click unsubscribe, while Yahoo accepts one. Yahoo says its requirements are subject to change, and Google updates its FAQ periodically.
Microsoft added similar rules for Outlook.com, Hotmail and Live addresses. Since May 5, 2025, domains sending more than 5,000 emails a day must pass SPF and DKIM. They also need a DMARC record of at least p=none that aligns with SPF or DKIM.
Do these rules apply to B2B cold email?
Partly. Google says its requirements don’t apply to mail sent to Google Workspace accounts, only to personal Gmail. Cold email to company addresses falls outside them, even when the company uses Google Workspace.
Meet them anyway. Yahoo and Microsoft ask for the same records, and Google counts all your subdomains toward one bulk-sender total. Google also leaves recipients to decide what’s promotional, so give every cold email a clear opt-out.
Gmail’s guidelines also say not to send messages to people who didn’t sign up for them. Cold email to a personal Gmail address goes against that, so write to work addresses only.
How fast can you increase sending volume?
Neither Google nor Yahoo publishes a safe daily number, so treat any fixed warm-up schedule as a rule of thumb. Here’s what they advise instead:
- Start small and steady. Begin with a low volume to engaged recipients, and send at a consistent rate rather than in bursts.
- Avoid sudden jumps. Google warns that doubling your volume at once can bring rate limiting or a drop in reputation. Yahoo says a spike can get you flagged as a compromised sender.
- Go slower as volume grows. The more you send, the more slowly you should increase. Sending daily lets you increase faster than sending weekly.
- Back off when errors rise. If messages bounce or are deferred, cut volume until the errors drop, then increase slowly again.
- Respect rate limits. Gmail usually answers with error 4.7.28 when you exceed its limits. Stop for at least 10 minutes, then resume on a single connection.
For cold email, a cautious approach is to start each new mailbox with a small daily number. Add volume week by week while bounces and complaints stay low.
What else affects cold email deliverability?
The message
- Keep it plain. Write short emails with few links. Google asks that every link be visible and easy to understand.
- Be honest in headers. Google says not to start a subject with Re: or Fwd: unless the email really is a reply or forward.
- Name yourself clearly. The display name should identify the sender, without emojis, urgency or the recipient’s name.
- Don’t hide content. Google says hiding text with HTML or CSS can get mail marked as spam.
- Accept replies. Microsoft asks for a From: or Reply-To: address that’s valid and can receive mail.
The list
- Write to the right people. Pick contacts with a clear business reason to hear from you; see how to build a B2B prospect list.
- Don’t buy lists. Google and Yahoo both tell senders not to purchase addresses.
- Check addresses first. Use the free email verifier and keep your bounce rate under 2%.
- Honor every opt-out. Remove people who opt out or complain, and never add them back.
The sending setup
Keep cold outreach apart from your company’s everyday mail. Yahoo advises separating mail types by IP or DKIM domain, and Google suggests one From: address per type of message. A subdomain with its own SPF, DKIM and DMARC records keeps them apart.
How do you monitor cold email deliverability?
- Google Postmaster Tools. Add your DKIM (d=) or SPF (Return-Path) domain and verify it in DNS. Dashboards cover spam rate, reputation, authentication, delivery errors and compliance status.
- Its limits. It covers only mail to personal Gmail accounts. Google’s API guide says only domains sending to at least 50 users a day get statistics.
- DMARC reports. The rua address receives aggregate reports showing who sent mail as your domain and whether it passed.
- Yahoo’s Complaint Feedback Loop. Enroll your DKIM domain in Yahoo Sender Hub to get a report each time a Yahoo user marks your mail as spam.
- Your own numbers. Track bounces, replies, opt-outs and SMTP errors. Rising 4.7.x deferrals or 5.7.x rejections usually mean a provider is pushing back on policy grounds.
Don’t judge deliverability by open rates. Google says it doesn’t track them, and that low open rates aren’t necessarily a sign of spam problems.
Frequently asked questions
Do I need DMARC if I send fewer than 5,000 emails a day?
Gmail doesn’t require it below that volume, but set it up anyway. Google recommends SPF, DKIM and DMARC for every domain, and Yahoo strongly urges all senders to publish DMARC. A p=none record with a rua address starts your reports without changing how mail is handled.
Which DMARC policy should I use for cold email?
Start with p=none and a rua address, and read the reports. Once every legitimate source passes, move to quarantine and then reject, the gradual path Microsoft recommends.
Why does my cold email go to spam when SPF, DKIM and DMARC pass?
Authentication proves the email came from you, not that people want it. Spam reports, sudden volume jumps and misleading subject lines can still send it to spam.
How long should I warm up a new domain?
Neither Google nor Yahoo sets a period. Raise volume gradually, watch bounces, deferrals and spam reports, and slow down when any of them rise.
Start with the right contacts
DataPit is a B2B contact data platform: search people and companies, reveal work email addresses and build prospect lists in one workspace. The Free plan includes 800 credits a month.
Sources
- Gmail Help: Email sender guidelines (checked September 28, 2026)
- Gmail Help: Email sender guidelines FAQ (checked September 28, 2026)
- Gmail Help: Set up Postmaster Tools (checked September 28, 2026)
- Google for Developers: Postmaster Tools API, retrieve email statistics (checked September 28, 2026)
- Google: New Gmail protections for a safer, less spammy inbox (October 3, 2023) (checked September 28, 2026)
- Yahoo Sender Hub: Sender Requirements & Recommendations (checked September 28, 2026)
- Yahoo Sender Hub: FAQs (checked September 28, 2026)
- Microsoft: Outlook’s new requirements for high-volume senders (checked September 28, 2026)
- RFC 7208: Sender Policy Framework (SPF) (checked September 28, 2026)
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures (checked September 28, 2026)
- RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) (checked September 28, 2026)
- RFC 8058: Signaling One-Click Functionality for List Email Headers (checked September 28, 2026)
- RFC 3463: Enhanced Mail System Status Codes (checked September 28, 2026)
Last updated