Cold email deliverability: the complete 2026 guide

Here's the uncomfortable truth about cold email: the hardest part has nothing to do with what you write. You can have the perfect message for the perfect person and still get nothing back — because the email never reached them. It's sitting in a spam folder no one opens. Deliverability is the silent tax on every campaign, and most people don't pay attention to it until their numbers are already dead.

We've sent more than 38,500 cold emails building Otto, and the single biggest lever on results — bigger than copy, bigger than timing — is whether the thing lands in the inbox at all. So that's where any serious outbound effort starts. Not with a clever subject line. With plumbing.

Why deliverability comes first

Think of it as a gate. Before anyone reads your message, judges your offer, or decides whether to reply, an inbox provider — Gmail, Outlook, whoever — decides whether to show it to them at all. Route to spam and the rest of the funnel doesn't exist. Worse, you can't tell. There's no bounce, no error, no notification. Your reply rate just quietly craters and you blame the copy.

A campaign in the spam folder doesn't look like a failure. It looks like silence. That's what makes deliverability so dangerous — it fails invisibly, and you end up optimizing everything except the thing that's actually broken.

The rules changed in 2024 — and they're not going back

In February 2024, Gmail and Yahoo rolled out new requirements for bulk senders that reset the baseline for everyone. The headline rules: authenticate your domain (SPF, DKIM, and DMARC), make unsubscribing a one-click affair, and — the one with teeth — keep your spam complaint rate under 0.3%. Cross that line consistently and your delivery falls off a cliff.

This was a gift, oddly enough. It turned a murky dark art into a checklist. The senders who treat email like a system they maintain now have a structural edge over the ones who blast and pray.

Step 1: Authenticate every sending domain

SPF, DKIM, and DMARC are three DNS records that together tell the receiving server, "this email really is from who it claims to be." Skip them and modern inboxes distrust you by default — you're an unsigned letter from an unknown sender.

• SPF says which servers are allowed to send mail for your domain.
• DKIM adds a cryptographic signature, so the message can't be forged or tampered with in transit.
• DMARC ties the two together, tells receivers what to do when something doesn't check out, and gives you reporting.

You set these once, per sending domain, in your DNS. It's an afternoon of work that pays off on every email you'll ever send. There is no good reason to run cold email without all three in place.

Step 2: Don't send from your real domain

This is the rule people break and regret. Never run cold outreach from the domain you use for your actual business inbox. Cold email carries reputation risk — a bad list, a spammy stretch, a spike in complaints — and you do not want that risk anywhere near the address you use to talk to customers and close deals.

Buy separate domains for outbound, ideally close variants of your brand (yourbrand.co, getyourbrand.com, that sort of thing). Point them at your real site, authenticate them, and spread your sending across several inboxes on those domains. If one gets singed, your primary domain — and your business — stays clean.

Step 3: Warm up before you scale

A brand-new domain has no reputation, and inbox providers treat no-reputation senders with suspicion. Go from zero to hundreds of cold emails a day in week one and you'll torch the domain before it ever had a chance.

Warming up means starting small and ramping gradually — a handful of sends a day that get opened and replied to, building a track record of legitimate, engaged email over two to three weeks before you point the domain at a real campaign. Most teams automate this with warm-up tools that simulate genuine back-and-forth. It's boring, it's slow, and it's non-negotiable.

Step 4: Keep your volume human

Even a warm domain has limits. A human salesperson doesn't fire 500 identical emails before lunch, and sending patterns that don't look human get flagged. The safe shape is low volume per inbox — a few dozen sends per inbox per day — spread across multiple inboxes to reach the numbers you need.

Want to send 300 cold emails a day? Don't do it from one inbox. Do it from ten, at thirty each. The math is identical; the reputation profile is completely different.

Step 5: Protect the reputation you build

Reputation is slow to earn and fast to lose. Two things destroy it quickly: bounces and complaints.

• Bounces come from sending to dead or wrong addresses. Verify every list before you send — a high bounce rate reads as "this sender doesn't know who they're emailing," and it's poison.
• Complaints come from people hitting "report spam." Keep them under that 0.3% line by emailing relevant people, making your opt-out obvious and honest, and stopping the moment someone asks.

The flip side is that engagement builds reputation. Replies and opens tell providers you're a sender worth delivering. Which means the same things that make outbound work — tight targeting, relevant messages — also make it deliverable. They're not separate problems.

How to tell if you have a problem

Because deliverability fails quietly, you have to go looking. A few ways to check:

• Google Postmaster Tools shows your domain reputation and spam complaint rate straight from the source — set it up.
• Seed inboxes: send to a few of your own test accounts across Gmail, Outlook, and others, and see where you actually land.
• Your trend line: a sudden drop in replies with no change to your copy or list is almost always a deliverability problem, not a messaging one.

None of this is glamorous, and that's exactly why it's an edge. Most people want to argue about subject lines. The teams that win at outbound treat deliverability as the system it is — authenticate, separate, warm up, pace, protect — and then let their message do its job from inside the inbox instead of the spam folder.

Once your email reliably lands, the next question is what good results even look like — that's the cold email benchmarks post. It's also the kind of work that's mechanical, unforgiving, and easy to get wrong by hand, which is a big part of why we built Otto to run it for you. But whether software does it or you do, the rules are the same — and now you know them.