← All articles

The Cold Email Deliverability Checklist (2026)

July 28, 2026 · 9 min read · by the 0effort team

TL;DR: Deliverability is three separate systems, not one list. Authentication (SPF/DKIM/DMARC) is binary and fixed once, in an afternoon. Reputation is a budget you spend with every send and refill with every genuine reply — never "done." Content is where most "spam trigger word" advice is 2015 folklore. Run the 10-minute diagnostic below before touching a single setting, because most people fix the tier that isn't broken.

Most deliverability checklists are one undifferentiated list — fix your SPF record, avoid the word "free," warm up your domain — as if it's all the same category of problem. It isn't. Some of it you fix once and never revisit. Some of it you spend or earn daily. And some of it is inherited advice from an era when filters actually cared about the word "free."

We build an AI SDR that sends cold email at volume, so we watch placement data daily. Here's the checklist split by what it actually is, in order.

Is your problem actually deliverability? (the 10-minute diagnostic)

Before you touch a DNS record, find out which tier is broken. Most people assume "deliverability" and start rewriting subject lines, when the real issue is a DMARC record set to p=reject without checking alignment first.

Run these checks in order and stop at the first failure. Seed test: email yourself, or a seed-test service, from your sending domain into Gmail, Outlook, and Yahoo accounts you control. Landing in spam means a reputation or authentication problem — skip to Tier 1. Postmaster data: Google Postmaster Tools and Microsoft SNDS give domain reputation, spam rate, and authentication pass rates for free; a reputation dip with passing authentication is Tier 2. Reply rate vs. bounce rate: if mail authenticates, seed tests land in the inbox, bounce rate stays under 2%, but replies have gone quiet, that's genuinely Tier 3 — rarer than most checklists imply.

Most people who land here have a Tier 1 or Tier 2 problem and only think it's Tier 3, because content is what every guide talks about and the easiest thing to blame.

Tier 1 — Authentication: what SPF, DKIM, and DMARC must actually say

Authentication is table stakes, not an advantage. Get it wrong and nothing else here matters, because your mail never reaches a filter sophisticated enough to judge content. Get it right and you've earned the right to be evaluated on the tiers that follow — nothing more.

The alignment detail trips up more senders than anything else here: SPF and DKIM can each pass independently while DMARC still fails, because the domain in your visible From address doesn't match either closely enough. Set DMARC to p=none first and watch the aggregate reports for two to three weeks. Only move to quarantine once nothing legitimate — your own transactional mail, a forwarded copy, a forgotten third-party sender — is failing alignment. Going straight to p=reject before watching the reports is the most common self-inflicted outage we see.

What do Gmail, Yahoo, and Microsoft actually require in 2026?

The 2024 bulk-sender rules get misquoted constantly, usually by dropping the qualifier that makes them tractable. Gmail and Yahoo's requirements, effective February 2024, apply once you send roughly 5,000 or more messages per day to that provider's addresses specifically — not 5,000 total sends across every domain you email. A cold email operation sending 200 messages a day split across Gmail, Outlook, and a dozen smaller providers isn't a "bulk sender" under either policy.

Cross that threshold and you need authenticated mail (SPF and DKIM, aligned under DMARC), a working one-click unsubscribe header (RFC 8058), and a low complaint rate. Microsoft extended comparable requirements to high-volume Outlook and Hotmail senders starting in 2025, with different thresholds — check Microsoft's current SNDS docs directly, since these pages get revised.

Below that volume, still authenticate and keep complaints low as Tier 1 hygiene — these enforcement mechanisms simply aren't aimed at you.

Tier 2 — Reputation: which numbers do mailbox providers actually watch?

Reputation isn't a score you check once. It's a running balance: every send is a small withdrawal, every genuine reply is a deposit, and providers watch the trend more than any single number.

The metric that governs whether you can send at all is spam-complaint rate — the share who hit "report spam." Google's guidance: stay well under 0.3%, treating 0.1% as the number you manage to, not a ceiling to graze. No single SLA applies to every provider identically — anyone quoting one universal "industry standard" is simplifying past the point of being true. Read your own numbers in Google Postmaster Tools and Microsoft SNDS, both free and both the real source of truth.

Bounce rate matters almost as much: keep it under roughly 2% by verifying addresses first. A rising bounce trend warns that list quality, not infrastructure, is the leak.

How should you split domains, subdomains, and mailboxes?

Isolate risk. Send cold outreach from a dedicated sending domain — a subdomain or close variant of your primary — never your main corporate domain, so a reputation problem doesn't take down the invoices and password resets your business depends on. Split volume across several mailboxes and, at real scale, across a few domains, so no single account becomes a point of failure.

There's no universal safe daily send number — treating this as a fixed rule is the folklore this article avoids. It depends on domain age, warmup state, and list relevance. A well-warmed mailbox on a targeted list sustains far more volume than a fresh one on a cold-purchased list. Treat bounce and complaint rate as the speedometer: if either creeps up, slow down.

Does mailbox warmup still work, or is it theater?

Warmup tools that send real mail between real accounts you control, building volume gradually with genuine opens and replies, do something real: they give a new domain a sending history before you point cold traffic at it. Warmup tools that simulate engagement — bots opening and "replying" to manufacture fake signal — are a different product wearing the same name. Providers don't endorse either kind, and that's our read of the mechanism, not a quoted policy. Faking engagement doesn't change whether real recipients want your mail, and providers have gotten better at spotting patterns that don't look human. The real-account version is defensible hygiene; the simulated version is a bet against filters that has aged badly.

Tier 3 — Content: which "spam trigger" rules are real?

This tier has the least evidence and the most folklore, and it's the one every generic checklist spends the most time on — probably because content is the part a marketer can control without touching DNS.

What's real: excessive punctuation, ALL CAPS SUBJECT LINES, huge image-to-text ratios, and link-shortener domains with no history correlate with low-quality bulk mail, and filters weight them as signals among many, not instant kills. What's folklore: the banned-word lists — "free," "guarantee," "act now" — copy-pasted into blog posts for a decade. Filters moved to statistical, context-aware models years ago; a single word almost never triggers anything alone. It's the pattern across the whole message, sender history, and engagement that gets scored.

Content affects whether a human replies; reputation affects whether the message reaches them at all. If Tiers 1 and 2 are clean and you're still landing in spam, fix structure — shorter messages, real personalization, a working unsubscribe link — not word-swap a folklore blocklist.

How do you know you're in spam when open rates lie?

Don't use open rate. Apple Mail Privacy Protection pre-fetches tracking pixels for a large share of consumer inboxes, and corporate scanners do the same, so a chunk of your "opens" are a machine firing a pixel, not a human reading. An inflated open rate can coexist with near-total spam placement — the number is decorrelated from what you're measuring.

Use signals that don't depend on a pixel: seed tests show actual placement, reply-rate trend over time (not one campaign) shows whether real humans are reading, and Postmaster Tools plus SNDS show provider-reported spam rate directly — closer to ground truth than anything inferred from your own logs.

You're already in spam — what's the recovery order?

Fix causes before symptoms, in order: pause sending from the affected domain — continuing deepens the hole. Fix Tier 1 first (verify authentication is actually passing, not just configured). Then Tier 2: clean your list of anything bouncing or complaining, and resume at a fraction of prior volume, rebuilding like a fresh warmup. Expect weeks, not a weekend — reputation recovers on the same slow curve it degrades on.

Burn the domain only when placement still hasn't recovered after a sustained, low-volume, clean-list effort — usually a sign the reputation problem runs deep (a blocklist listing, a long high-complaint period) and new infrastructure beats waiting it out. That's a last resort; most fixable Tier 1 or 2 issues never need it.

For how deliverability fits into an AI-native outbound program end to end, see our cold email guide.

FAQ

How many cold emails can I send per day per mailbox without hurting deliverability?

No universal number — it depends on domain age, warmup state, and list relevance. A well-warmed mailbox on a targeted list sustains far more volume than a fresh domain on a cold list. Watch bounce rate and complaint rate: if either rises, you're sending too fast.

Do I need DMARC for cold email, and does the policy have to be p=reject?

Yes if you're sending meaningful volume to Gmail or Yahoo — both require it for bulk senders under their February 2024 policies. It doesn't need to start at p=reject: start at p=none, watch the reports for two to three weeks, then move toward quarantine. Jumping straight to p=reject is a common way to take down your own transactional mail.

Should I send cold email from my main company domain or a separate one?

A separate sending domain — a subdomain or close variant of your primary, not your corporate domain. This isolates reputation risk: cold-program trouble won't drag down invoices and password resets. Warm it before routing cold traffic through it.

What spam complaint rate is "too high," and how do I see mine?

Google's guidance is to stay well under 0.3%, treating 0.1% as a working ceiling, not a number you're allowed to approach. No single figure applies universally, so treat any claimed "industry standard" with skepticism. Read your actual rate in Google Postmaster Tools and Microsoft SNDS, both free.

Do email warmup tools actually improve deliverability?

Warmup that sends real mail between accounts you control, with genuine opens and replies, gives a domain real sending history. Warmup that simulates engagement with bots is a different product wearing the same name — providers don't endorse either approach, and faking engagement is a bet against filters that has aged badly.

How long does it take to recover a domain's sending reputation after landing in spam?

Typically weeks, not days — reputation recovers on roughly the same slow curve it degraded on. Pause sending, fix authentication, clean your list, then resume at a fraction of prior volume like a fresh warmup. Rushing volume back usually resets the clock rather than shortening it.