SOVE7GN GTM
Cold email deliverability in 2026: the rules the providers actually publish
Updated 11 November 2026 · Written by Reyansh Juneja and Naman Dhiman, the co-founders of SOVE7GN, who run inbound, midbound and outbound for founders
Cold email lands in spam for three reasons: the sending domain is not authenticated the way the mailbox providers require, recipients mark it as spam above the published threshold, or the sending pattern looks like bulk mail from a mailbox not set up for bulk mail. All three are fixable, and the rules are published by Google, Yahoo and Microsoft rather than guessed at by consultants.
Short answer: authenticate with SPF, DKIM and DMARC, keep the From domain aligned with the SPF or DKIM domain, send over TLS, and keep your spam rate below 0.3% as reported in Google Postmaster Tools, which Google says to stay under while recommending below 0.10% (Google sender guidelines, checked November 2026). Send cold outreach from secondary domains, never your primary one, and warm them before volume.
Why does my cold email go to spam?
The mailbox provider decides to accept, junk or reject in milliseconds. These are the signals you control, in roughly the order they matter.
- Authentication and alignment. Can the receiver prove the mail came from a server your domain authorized, and does the From domain match the domain that passed SPF or DKIM?
- Complaint rate. How often do recipients press the spam button?
- Engagement. Replies are the strongest positive signal you can earn.
- Domain reputation. Built over weeks, destroyed in a day. A new mailbox sending 400 messages on a Tuesday looks exactly like a compromised account.
- List quality. Bounces tell the receiver you did not verify your list.
Content matters less than people think, infrastructure more. A plain, short, well-authenticated message from a warmed domain beats a clever one from a cold domain.
SPF, DKIM and DMARC in plain words
| Record | What it answers | What it looks like in practice | What breaks it |
|---|---|---|---|
| SPF | "Which servers may send mail for this domain?" | One TXT record listing the sending services | More than 10 DNS lookups, or forgetting a new sending tool |
| DKIM | "Was this really signed by that domain, and unchanged since?" | A public key in DNS, a signature on each message | No key published for the domain the tool sends from |
| DMARC | "What should a receiver do when SPF and DKIM do not line up with the From domain?" | A TXT record at _dmarc.yourdomain.com, starting at p=none | Publishing p=reject before you know who sends as you |
Alignment is the part that confuses founders. You can pass SPF and still fail DMARC, if the domain that passed SPF is your email tool's domain rather than the one in your From line. Google's guidance for senders above 5,000 messages a day says the From header domain "must be aligned with either the SPF domain or the DKIM domain". Start DMARC at p=none, read the reports for two weeks, then tighten.
What do Google, Yahoo and Microsoft require?
All three publish their own rules. These are theirs, not ours, all checked November 2026.
| Provider | Every sender | Senders above 5,000 a day | Spam rate |
|---|---|---|---|
| SPF or DKIM, valid forward and reverse DNS, TLS, RFC 5322 format, no Gmail From impersonation | SPF, DKIM and DMARC (p=none is enough), From alignment with the SPF or DKIM domain, one-click unsubscribe plus a visible unsubscribe link | Keep spam rates in Postmaster Tools below 0.3%, and Google recommends below 0.10% | |
| Yahoo | SPF or DKIM at a minimum | Both SPF and DKIM, a valid DMARC policy of at least p=none, one-click unsubscribe via List-Unsubscribe, unsubscribes honored within 2 days | Below 0.3%, calculated only from mail delivered to the inbox |
| Microsoft | SPF and DKIM that pass, DMARC of at least p=none aligned with SPF or DKIM | Same, for domains sending over 5,000 emails a day to Outlook.com. From 5 May 2025 non-compliant mail is routed to Junk, with rejection announced for a later date | Not published as a number. Microsoft asks for a clearly visible opt-out and list hygiene |
Two details worth sitting with. Yahoo computes that 0.3% from inbox-delivered mail only, so your own tool will look better than the figure the provider reacts to. And 0.3% is three complaints per thousand delivered, which a few hundred badly targeted sends can produce in a morning.
Microsoft also says plainly that "Exchange Online isn't designed for bulk mailing scenarios", and advises spreading sends over time, staying under 30 messages per minute per mailbox, and using a custom subdomain for bulk mail rather than the primary domain (Microsoft Learn, checked November 2026).
Why secondary domains, and how many?
Never send cold outreach from the domain your invoices, password resets and support mail come from. If that domain's reputation drops, your business email stops arriving, and no sales result is worth that.
Buy lookalike domains instead: trygetharlow.com, harlow-grid.co, getharlowgrid.com for a made-up company called Harlow Grid. Each gets its own SPF, DKIM and DMARC records, mailboxes and warm-up. Keep per-mailbox volume low and spread it across mailboxes, for the reasons in how many cold emails per day. Redirect each secondary domain to your main site, and put a real name, signature and postal address on every message.
A pre-send checklist for a new sending domain
Run this before the first cold message goes out.
- Domain registered to your company, with privacy on and a redirect to your main site.
- Mailboxes created, one to three per domain, each with a real person's name and photo.
- SPF record published and tested, with every sending service listed and under the DNS lookup limit.
- DKIM key published, and a test message showing a pass.
- DMARC published at p=none with a reporting address you actually read.
- Reverse DNS checked, or confirmed as handled by your provider.
- A full signature and a plain-language opt-out line, honored the same day.
- Warm-up running for at least two to three weeks before real volume.
- Google Postmaster Tools set up so you can see the spam rate the provider sees.
- Every address verified, with a hard rule to stop if bounces climb.
- A seed test to your own Gmail, Outlook and Yahoo accounts, checking placement in each.
- A written 30-day ramp with daily per-mailbox caps, and one person who owns replies.
Steps 8 and 10 are the ones founders skip and the ones that cost a domain.
How do I tell whether I have a deliverability problem or a message problem?
Both show up as silence. Separate them before you rewrite anything.
| Symptom | More likely cause | What to check first |
|---|---|---|
| Near-zero opens and replies on a new domain | Deliverability | Postmaster Tools spam rate, authentication, seed tests |
| Normal opens, near-zero replies | Message or targeting | The first two lines, and whether the list matches your ICP |
| Replies from the wrong job titles | Targeting | The list rules, not the copy |
| Good week, then a sudden drop | Volume or complaints | Did per-mailbox volume jump? Did one segment complain? |
| Fine on Gmail, dead on Outlook | Provider-specific | Microsoft's authentication rules and your per-mailbox rate |
Open rates are unreliable on their own, because image proxies trigger them. The number worth managing is replies, and we collected the published benchmarks in cold email reply rate benchmarks.
This is infrastructure work, not sales work, which is why many founders hand it over. SOVE7GN GTM runs outbound as a daily motion for B2B founders at seed to Series C, alongside founder posts and fast follow-up on anyone who shows interest, with every message written for one person and every reply handled until the call is booked. Book 30 minutes if you want someone else owning the domains, the warm-up and the replies; pricing is shared on the call. To hire it out by the task, read how to choose a cold email agency. The rest is in the GTM guides hub.
Rules on commercial email differ by country and this page is general information, not legal advice. Check the requirements for every country on your list.
Questions people ask
Why does my cold email go to spam?
Usually because the sending domain is not authenticated the way the providers require, because recipients mark it as spam above the published threshold, or because a new mailbox is sending at a volume that looks automated. Fix authentication and warm-up first, then targeting, then copy.
What spam rate is acceptable?
Google says to keep spam rates reported in Postmaster Tools below 0.3% and recommends staying below 0.10%. Yahoo gives the same 0.3% threshold and calculates it from mail delivered to the inbox. Both were checked in November 2026.
Should I use a separate domain for cold email?
Yes. Keep cold outreach off the domain that carries your invoices, password resets and support mail, because a reputation problem there stops your business email. Microsoft's own guidance recommends a custom subdomain for bulk sending rather than the primary domain.
How long should I warm up a new sending domain?
Plan two to three weeks of gradual sending before real volume, ramping per-mailbox caps rather than jumping to the limit. That timing is our own planning rule: the providers publish authentication and complaint rules, not warm-up schedules.
Want calls on your calendar without hiring five people?
Book a 30-minute call. Tell us who buys from you and we'll show you what inbound, midbound and outbound would look like for your startup.
Book a call How SOVE7GN GTM works- How many cold emails per dayProvider limits, the number nobody can source, and the inbox math behind a plan.
- Cold email agency for startupsA buyer checklist: domains, deliverability, who writes, and who owns the data.
- Cold email reply rateFour named benchmark reports, their samples, and why the averages disagree.
- Outbound sequence templateSix steps over three weeks, what each message does, and a worked example.
- Is cold emailing illegal in the US?What CAN-SPAM requires, and how the UK, EU and Canada rules differ.