Key takeaways
- Set up SPF, DKIM and DMARC on every domain you send from, with a From domain that aligns.
- Keep spam complaints very low, and make opting out simple in every cold email.
- Relevant, well-targeted email is the most durable deliverability habit you have.
Cold email deliverability requirements are the standards mailbox providers expect before they place your email in the inbox: an authenticated domain with SPF, DKIM and DMARC, low spam complaints and bounces, and an easy way to opt out. Deliverability itself is whether your email lands in a prospect’s inbox instead of their spam folder or nowhere at all, and providers judge it on who sent the message, how recipients reacted to that sender before, and whether the message looks wanted.
For outbound teams, this is not a technical side issue. If your domain’s reputation drops, every rep sending from it suffers, including the ones writing careful, relevant emails.
What the major mailbox providers now require
In February 2024, Google and Yahoo began enforcing new requirements for bulk senders. Google defines a bulk sender as one sending close to 5,000 or more messages a day to personal Gmail accounts. The core requirements are:
- Authentication. Messages must pass SPF and DKIM checks.
- A DMARC record. The domain must publish a DMARC policy. A policy of
p=noneis the minimum. - Alignment. The domain in the visible From address must align with the domain that passes authentication.
- Low spam complaints. The rate of messages users report as spam must stay below 0.3%. Google recommends staying under 0.1%.
- Easy unsubscribe. Marketing and subscribed messages must support one-click unsubscribe (defined in RFC 8058), and unsubscribe requests must be honored within two days.
Microsoft announced similar requirements for high-volume senders, meaning those sending over 5,000 messages a day to Outlook.com consumer addresses, with enforcement starting in May 2025.
Rules change, so check each mailbox provider’s current sender guidelines. This guide is general education, not legal advice.
SPF, DKIM and DMARC in plain English
These three records live in your domain’s DNS settings, the public directory that tells the internet how your domain works. Your IT team or email admin usually sets them up once per sending domain.
- SPF (Sender Policy Framework) is a list of the servers allowed to send email for your domain. When a message arrives, the receiving provider checks whether it came from a server on the list.
- DKIM (DomainKeys Identified Mail) adds a digital signature to each message. The receiver uses a public key in your DNS to confirm the message really came from your domain and was not changed in transit.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when a message fails SPF or DKIM: do nothing (
p=none), send it to spam (p=quarantine), or reject it (p=reject). It also lets you receive reports about who is sending email using your domain.
If you add a new sequencing tool or sending service, it needs to be included in SPF and set up for DKIM too. A common failure is a tool that sends on your behalf without being authenticated.
Why cold outbound should stay well below bulk thresholds
Most BDR teams never come close to the bulk sender volumes above. That does not mean the rules do not apply in spirit. Providers judge reputation for every sender, and cold email starts with a disadvantage: the recipient did not ask for it.
That means cold outbound should behave better than the minimum:
- Authenticate every sending domain, even if you send a small number of messages.
- Treat the complaint thresholds as a ceiling you never want to approach, not a target.
- Assume that one careless campaign can affect the whole team’s domain.
Many teams send outbound from a separate domain so that problems do not spill over to the company’s main domain. That reduces the blast radius, but it is not a license to send carelessly. The same habits still apply.
Volume and warm-up habits
A new mailbox or domain has no history, so providers watch it closely. Build a sending history slowly.
- Start small. Send a modest number of emails per mailbox per day at first, then increase gradually over several weeks. Any specific number is a starting point to tune against your own results.
- Avoid sudden spikes. Jumping from a handful of emails to hundreds in a day looks like a compromised account.
- Spread volume across reps, not across a single mailbox. Each rep sending a reasonable amount is healthier than one mailbox sending everything.
- Watch the signals. If bounces, complaints or inbox placement get worse, slow down before you scale up.
List quality and bounces
A bounce happens when an email cannot be delivered, usually because the address does not exist. High bounce rates tell providers you are sending to lists you have not checked.
- Verify addresses before you add them to a sequence.
- Remove hard bounces immediately and never retry them.
- Do not buy large lists of unknown origin.
- Re-check contacts on older lists, since people change jobs.
A clear opt-out in every cold email
The one-click unsubscribe requirement above applies to marketing and subscribed messages. Cold outbound should still make opting out simple, because a frustrated recipient who cannot find an exit will often click “report spam” instead.
Keep it short and human. For example:
If this isn’t relevant, just reply “no thanks” and I won’t follow up.
Then honor it. Mark the contact in your CRM and your sequencing tool so no one on the team contacts them again by mistake.
Relevance is a deliverability factor
Providers watch how recipients behave. Emails that get opened, read and replied to build a good reputation. Emails that get deleted unread or reported as spam damage it.
That makes relevance a technical advantage, not just a writing style. Consider a 150-person healthcare staffing company that just opened two new regional offices. An email that names that change and asks a specific question is far more likely to get a reply than a generic pitch sent to everyone in the industry. Fewer, better-targeted emails protect your domain and get more conversations. See cold email first lines for how to open with a real reason.
Deliverability checklist
- SPF, DKIM and DMARC set up for every sending domain
- From domain aligns with the authenticated domain
- Every sending tool is authenticated, not just your main mail server
- New mailboxes warmed up gradually, with no sudden volume spikes
- Addresses verified before sending; hard bounces removed
- Spam complaints monitored and kept far below provider limits
- A clear, simple opt-out in every cold email
- Opt-outs honored quickly and recorded everywhere
- Every email tied to a specific, relevant reason to reach out
The rule to remember
Prove who you are, send at a pace your domain can support, and only email people with a real reason. Authentication gets you through the door, but relevance keeps you in the inbox.
To build outreach around a specific, timely reason, see signal-based outbound.
Common questions
Do deliverability rules apply if I only send a few cold emails a day?
The formal bulk-sender thresholds may not apply to you, but mailbox providers judge every sender's reputation. Cold email starts at a disadvantage because the recipient didn't ask for it. Authenticate every sending domain, keep complaints and bounces low, and make opting out easy, whatever your volume.
Should cold email be sent from a separate domain?
Many teams do, so a problem with outbound reputation doesn't spill over to the company's main domain. It limits the damage but doesn't fix bad habits. A separate domain still needs SPF, DKIM and DMARC, a gradual warm-up, verified lists and relevant messages, or it will build a poor reputation of its own.
How long does it take to warm up a new mailbox?
There is no fixed timeline. The usual approach is to start with a small number of emails per mailbox per day and increase gradually over several weeks while watching bounces, complaints and inbox placement. Treat any specific daily number as a starting point, and slow down if those measures get worse.
What happens if my DMARC policy is set to none?
A DMARC policy of none tells receivers to take no special action when a message fails SPF or DKIM, but you still receive reports about who is sending with your domain. It meets the minimum requirement for bulk senders. Many teams start there, review the reports, then move toward a stricter policy.
