Cold Email Deliverability FAQ: The Questions Every Outbound Team Asks

This is the FAQ we wish existed before we started building sending infrastructure for clients. Every question below is one we've actually fielded mid-buildout. Cold email deliverability problems rarely show up in the planning meeting. They show up three weeks in, when open rates fall off a cliff and nobody agrees on why.

So we pulled the real questions and answered them straight, no pitch attached. If you haven't set up the sending infrastructure yet, the mechanics of domains, mailboxes, and tooling live in our cold email infrastructure setup guide; this piece assumes that part is done and something's already gone sideways. It's also how we approach GTM Engineering generally: build systems you can inspect, not ones you have to trust.

Foundations and authentication

What's the difference between "delivery" and "deliverability"?

Delivery means the receiving mail server accepted your message instead of bouncing it. Deliverability means where that accepted message actually landed: primary inbox, promotions tab, or spam folder. But you can have perfect delivery and terrible deliverability. A domain with no reputation problems can still get every message accepted and routed straight to spam, because acceptance and placement are two separate decisions made by two different parts of the receiving server. Most teams that say "our emails aren't delivering" actually mean the emails were delivered fine and are sitting unread in a folder nobody checks.

Do I need SPF, DKIM, and DMARC for cold email, or just marketing email?

You need all three, and cold email is arguably where they matter more than marketing email does. A marketing list is opted in and has some engagement history behind it. A brand-new cold-sending domain has none. SPF tells receiving servers which mail servers are allowed to send on your domain's behalf. DKIM cryptographically signs each message so the receiving server can confirm it wasn't altered in transit. DMARC ties the two together and tells receivers what to do when a message fails either check. And skip any one of them and you're asking Gmail and Outlook to trust an unfamiliar sender on faith. They won't. We walk through the actual setup in the infrastructure guide; here the point is just that this isn't optional.

Should I send cold email from my main business domain?

No. Flat answer, and it's not close. Cold outbound carries risk your main domain doesn't need to absorb: bounces from unverified addresses, occasional spam complaints, the volume patterns that trip filters while a domain is unproven. If any of that dents your reputation, it dents the same domain your invoices, support replies, and password resets ride on. So isolate the risk on a separate sending domain or subdomain instead. A bad week in outbound should never touch the mail that actually has to land.

What DMARC policy should a cold-sending subdomain use?

Start at p=none. That setting monitors and reports without rejecting or quarantining anything, which is what you want while a new subdomain is still establishing a sending pattern; you're watching, not enforcing yet. So move to p=quarantine once your reports show clean alignment. Most cold-sending subdomains never need p=reject, since there's no legitimate mail flow on that subdomain worth protecting from spoofing the way there is on a corporate domain. And jumping straight to a strict policy before your own records are clean is a common way teams accidentally bounce their own outbound. Worth knowing: Yahoo's published bulk-sender guidance requires at least a p=none DMARC record as the floor for anyone sending meaningful volume to Yahoo addresses, which tells you this isn't just internal best practice.

Do I need a dedicated IP for cold email?

Almost never. Not at typical cold-outbound volume, anyway. A shared IP pool run by a decent sending infrastructure provider actually builds reputation faster in most cases, because you inherit signal from every other well-behaved sender on that pool. A dedicated IP is only worth the setup once you're sending enough volume to build and control its reputation entirely yourself, and a dedicated IP with no sending history is a liability, not an asset. It has nothing to lean on yet.

Warm-up and sending volume

How long does domain and mailbox warm-up actually take?

There's no honest single number here, and every blog post that gives you one is guessing. Warm-up runs in stages, not on a calendar. Early on, volume stays low and sending patterns look nothing like a blast: real engagement, real replies, spread across the day rather than dumped all at once first thing in the morning. Over the following weeks, volume increases in steps, and each step only happens once the signals from the last one look healthy: bounce rate low, complaint rate near zero, opens holding steady. But if those signals wobble, you slow down or hold, regardless of what week it technically is. The honest answer to "how long" is "until the signals say you're ready," which is less satisfying than a fixed number but more true.

How many cold emails can one mailbox send per day?

Nobody publishes a credible, methodology-disclosed number for this, and that's worth saying plainly rather than papering over. ISP filters score sending behavior adaptively: engagement, complaint rate, bounce rate, and pattern consistency, not a hard count someone can publish. Vendor blogs love giving you one anyway, but those figures are self-reported from a single company's own client base with no disclosed methodology behind them, which makes them marketing copy dressed as a benchmark. The better question isn't "what's my ceiling," it's "what does my engagement data say as I increase." If replies and opens hold up and bounce and complaint rates stay low as volume climbs, keep climbing. But the moment any of those degrade, that's your real ceiling, for that mailbox, that week.

Do I need multiple mailboxes per domain, and how many?

It's not a fixed number. It's a tradeoff. Total send volume divided by whatever per-mailbox pace you're comfortable with gets you a rough floor. But the real driver is blast radius: if one mailbox gets flagged or lands in a spam trap, how much of your outbound capacity do you lose while you sort it out? More mailboxes reduce that risk and spread the volume thinner per mailbox, which filters generally reward. But they also multiply your monitoring load, since every mailbox needs its own warm-up and its own health checks. Tools like Mailreach and Warmy exist specifically to automate that ongoing warm-up and health monitoring across a growing mailbox fleet, which is often the actual reason teams add more mailboxes than the volume math alone would suggest.

What happens if I skip warm-up on a new domain?

You get the exact behavior spam filters are built to catch. A burst of unfamiliar volume from a domain with zero sending history looks, from the filter's point of view, indistinguishable from an abuse pattern. Most of it lands in spam or gets rejected outright, and the reputation that would have taken a few weeks to build gets damaged before you've sent a single email that mattered. And recovering from that is slower and less certain than warming up properly would have been. This is the setup for the next section: what to actually do once something's gone wrong.

Content and spam triggers

Is there a list of spam trigger words to avoid?

No. No vendor blog that publishes one is being fully honest about that. Modern filters at Gmail and Outlook score messages holistically with models trained on sender behavior, engagement history, and full content context, not a blacklist of individual words from a decade ago. So a word-list post is stale the moment it publishes, because the underlying models retrain constantly and what tripped a filter last year can do nothing this year, or the reverse.

Do links, images, or attachments hurt cold email deliverability?

Differently. Worth separating them. Attachments are the biggest risk: they trigger extra scanning, slow delivery, and pattern-match to phishing from an unfamiliar sender, so we avoid them on cold sends entirely. Images in moderation are fine, but a message that's mostly image with little real text reads as low-effort bulk mail to a filter, which is a pattern worth avoiding regardless of intent. But links themselves aren't the risk; the reputation of the domain you're linking to is. A shortened URL or a newly registered, low-reputation destination domain draws more scrutiny than the mere presence of a link ever would.

Does personalization affect inbox placement, or just reply rate?

Mostly reply rate. Conflating the two is a common mistake. Inbox placement is driven by sender reputation and aggregate engagement signals, not by whether a first name is correctly inserted. But personalization has an indirect effect worth naming: emails people actually open and reply to generate exactly the engagement signals that build sender reputation over time. So personalization helps deliverability, just not by the mechanism most people assume. It's not a filter rewarding good copy. It's engagement rewarding good copy, and engagement is one of the inputs the filter actually reads.

How short should a cold email be for deliverability specifically, not just reply rate?

Length itself isn't a direct deliverability lever the way people treat it. Filters don't measure word count and penalize you for crossing some threshold. What actually happens is indirect but real: shorter emails get read and replied to more often, which produces the engagement signals reputation is built from, and a long, dense message starts to pattern-match visually to a newsletter or marketing template, a category filters treat differently than a genuine one-to-one message. So keep it short because it gets read, not because some line count trips a switch somewhere.

List hygiene and compliance

How do bounce rates affect sender reputation, and what's a dangerous threshold?

Every hard bounce tells the receiving server you sent to an address that doesn't exist, and a repeated pattern of that reads as poor list hygiene, which factors directly into how your sending reputation gets scored. For scale, one large-scale agency dataset is useful here: Belkins, a cold-email agency, published 2026 figures from 7,530,489 client emails sent between January and December 2025, reporting a 1.71 percent overall bounce rate against 98.29 percent deliverability. That's one real reference point from one agency's book of business. Not an industry-wide standard, since no independently verified universal threshold exists across every sending setup and ESP. So the practical rule holds regardless of the exact number: a bounce rate meaningfully above what your own well-maintained list normally produces is the signal to stop and investigate before it drags your broader reputation down.

Do I need to verify or validate my list before every send?

Yes, and "once at import" isn't the same thing. Contact lists decay continuously, not on a schedule. People change jobs, mailboxes get deprecated, role accounts get retired, and an address that verified cleanly two months ago can bounce today. So pre-send verification catches that drift before it hits your bounce rate instead of after. This matters more the more sources feed your list; if you're pulling contacts through a waterfall across providers like Clay, Apollo, or ZoomInfo, verification is the step that catches what each source's staleness introduced before it ever touches your sending domain's reputation.

Is cold email legal under CAN-SPAM and GDPR?

Under US CAN-SPAM, cold B2B email is generally permitted; the law is opt-out based, not opt-in based, provided you use accurate sender identification, avoid deceptive subject lines, include a physical address, and honor opt-out requests promptly. Under GDPR and adjacent EU frameworks, the picture is more jurisdiction-dependent. Legitimate interest can, in some circumstances, cover B2B outreach, but the specifics vary by member state and by whether you're contacting a natural person in a business role. This is not one-size-fits-all, and it isn't legal advice; if you're running anything beyond plain US B2B outbound, that's a question for counsel, not a blog post.

What is Google and Yahoo's bulk-sender requirement, and does it apply to cold outbound?

Since February 1, 2024, Google requires anyone sending more than 5,000 messages per day to Gmail addresses to authenticate with SPF and DKIM, publish a DMARC record, keep the spam rate reported in Postmaster Tools below 0.30 percent, and support one-click unsubscribe on marketing and subscribed messages. Yahoo's parallel bulk-sender guidance asks for the same authentication baseline, at least a p=none DMARC record, and a functioning one-click unsubscribe header. Does it apply to cold outbound? Directly, only once your daily Gmail-bound volume crosses that threshold, which happens faster than teams expect once several mailboxes are running at real scale. And the hygiene underneath the policy, real authentication, a low spam rate, an easy way out, is worth doing well below the threshold too. The rule just makes explicit what good sending already required.

Monitoring and recovery

How do I know if my emails are landing in spam instead of the inbox?

Watch the right tool for the mailbox type, because they don't all show you the same thing.

For everything Postmaster and SNDS don't cover, seed testing fills the gap: send to a controlled set of test inboxes across providers and check where messages actually land. Tools like GlockApps exist specifically for this. So corporate mail behind something like Proofpoint is the hardest case, since you get no aggregate dashboard at all. There, reply and open behavior from those domains is often the only real signal you have.

What do I do if my domain gets blacklisted?

Stop sending from that domain immediately, not just from the flagged campaign. Continuing to send while a listing is active compounds the problem instead of pausing it. Next, identify which specific blacklist flagged you, since each operator runs its own list and its own delisting process. Then fix the actual cause, whether that's list quality, a volume spike, or a content pattern, before requesting removal.

Expect the delisting process to take days, not hours, and keep that domain's sending paused for the duration.

Can one bad sending domain hurt my main company domain's reputation?

If you isolated it properly, as covered earlier, mostly no. A separate root domain or subdomain with its own DNS and DMARC record, on infrastructure that doesn't share an IP pool with your corporate mail, keeps the damage contained. That's the entire point of the isolation this piece opened with. But cut a corner, say you sent cold outbound from a subdomain of your actual company domain, or shared sending infrastructure between the two, and some signal does bleed upward, because DMARC alignment and shared infrastructure link the two domains in a receiving server's eyes whether you intended that or not.

Is deliverability a one-time setup or ongoing work?

Ongoing. Treating it as a launch checklist is how most of the failures above happen. Authentication gets configured once. But reputation does not. It's re-scored on every send, filter models retrain on their own schedule, and any new domain or mailbox you add starts back at zero and needs its own warm-up regardless of how well the rest of your setup is running. Monitoring has to be a routine, not a one-time task you check off before launch.

Agency vs. DIY

Can I fix deliverability myself, or does it require an agency or tool?

Mostly process discipline. Not a purchase. Most deliverability problems trace back to skipped fundamentals: missing authentication, no real warm-up, a list that hasn't been verified in months. A disciplined team can fix all of that directly without buying anything new. Where a tool or an agency actually earns its price is replacing guesswork with a process you can inspect, not running black-box warm-up automation you can't see inside and have to trust is doing something reasonable. And that distinction is most of what separates a useful vendor from an expensive one.

What should I ask a GTM agency about how they handle deliverability?

Ask them to explain the mechanism, specifically. What's their domain and mailbox architecture, and why that number of each. How does their warm-up ramp actually decide when to increase volume. What happens, step by step, the moment a domain gets flagged. "We have proprietary AI warm-up" is not an answer to any of those questions; it's a way of avoiding one. But if they can walk you through the logic instead of the pitch, that's the signal. That's also the difference between building a motion yourself and hiring it out, and it's the same question worth asking about the rest of your stack, not just the sending layer; we'll get into what a full GTM engineering stack looks like end to end in a separate piece.