Less boo. More booked. Halloween offer: 30 days free on any paid plan. Claim 30 days freeEvery new account gets one free mailbox for warmup and replies. No domain to buy. See how it works

Skip to content
Deliverability

Cold email deliverability: a sourced checklist for 2026

Most cold email trouble comes down to five things: a domain that is not authenticated, mailboxes that were never warmed, a list nobody verified, volume that jumps, and nobody watching the numbers. This page puts them in the order to fix them, with the rules Google, Yahoo and Microsoft publish, read on 24 October 2026.

Updated

Start freeSee pricing
  • Free plan, no time limit
  • 7-day trial on paid plans
  • 30-day inbox guarantee, with conditions
  • Customer data is hosted in the EU
The short answer
  • Authenticate first. Google asks every sender to set up SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail to use SPF, DKIM and DMARC. A DMARC policy of p=none meets that.
  • Warm each mailbox, then start cold sending low. Warmerly's warmup ramp runs 30 days, from 4 warmup messages a day to a ceiling of 50 (40 on Gmail, 30 on Outlook, 25 on Zoho).
  • Keep your spam rate below 0.3% and aim for below 0.1%. That is Google's wording in Postmaster Tools. Yahoo says below 0.3%.
  • Verify the list and stop on bounces. None of the three providers publishes a bounce limit, so set your own tripwire. Warmerly slows a mailbox from a 2% bounce rate and pauses sending at 7%.
  • Watch Postmaster Tools, bounces and replies, not opens. Google says it does not track open rates, so a low open rate tells you little about spam placement.
  • These rules do not mention cold email. Google's page says not to send to people who did not sign up and not to buy address lists. Cold outreach sits close to that line, so complaints matter more than any DNS record.
What the providers say

What Google, Yahoo and Microsoft publish

The three tables below are read from each company's own page on 24 October 2026. Where a page is unclear or contradicts itself, the cell says so.

Sender rules as published, read 24 October 2026
Google (Gmail)YahooMicrosoft (Outlook)
Who it coversMail to personal Gmail accounts (@gmail.com and @googlemail.com). Extra rules above 5,000 messages a day to Gmail.All senders, with more rules for bulk senders. Yahoo says it will not specify a volume threshold.Domains sending more than 5,000 emails a day (Microsoft's post, 2 April 2025).
All sendersSPF or DKIM. DKIM key of 1024 bits or longer (2048 recommended). Valid forward and reverse DNS. TLS. Messages in the RFC 5322 format.SPF or DKIM at a minimum. A valid forward and reverse DNS record for sending IPs. RFCs 5321 and 5322.The post sets requirements for high-volume senders only.
Bulk sendersSPF, DKIM and DMARC (p=none is enough), with the From: domain aligned to the SPF or DKIM domain.SPF and DKIM both, and a valid DMARC policy of at least p=none that passes. A rua tag is strongly recommended.SPF must pass. DKIM must pass. DMARC at least p=none, aligned with SPF or DKIM, preferably both.
Spam rateBelow 0.3% is the requirement. Google also says keep it below 0.10% and avoid ever reaching 0.30%.Below 0.3%. Yahoo calculates it from mail delivered to the inbox.The post gives no spam-rate figure.
UnsubscribeAbove 5,000 a day, marketing and subscribed messages must support one-click unsubscribe, plus a visible link.One-click unsubscribe for marketing and subscribed messages. Honour unsubscribes within 2 days.A working unsubscribe link, particularly for marketing or bulk mail (a recommendation).
HygieneDo not buy addresses. Do not send to people who did not sign up.Keep complaint rates low.A valid From or Reply-To address that can receive replies. Remove invalid addresses regularly. Manage bounces.
If you miss itA high spam rate leads to more spam classification, and Google says improvement takes time to show.Mail "may be sent to the spam folder or rejected". Yahoo may defer mail from domains with a high complaint rate.The same post says non-compliant mail is rejected with error 550 5.7.515, and also that it goes to Junk first with rejection on a date to be announced. It contradicts itself, so check Microsoft's page.

What these pages do not tell you

  • None of them is about cold email. They cover bulk and marketing mail. They do not say whether one-to-one cold outreach counts as marketing for the one-click unsubscribe rule. Many senders add the header anyway, and Warmerly does: campaign emails carry the RFC 8058 one-click pair when the mailbox has a link domain, and a mailto address when it does not.
  • Under 5,000 a day does not mean exempt. Google's all-sender rules still apply to mail going to Gmail, and the spam filters act on complaints at any volume.
  • Yahoo gives no volume threshold, so you cannot work out whether you count as bulk. Treat the bulk rules as the standard.
  • Nobody publishes an inbox placement rate or a safe daily volume. Google tells senders to increase volume slowly and does not give a number. Any figure you read elsewhere is an estimate.
Step 1

Authenticate the sending domain

Authentication proves who sent a message. It does not prove the message was wanted, but without it nothing else on this page works, and two of the three providers above ask for it by name.

  • SPF lists the servers allowed to send for your domain. Publish one SPF record per domain: RFC 7208 says a domain with more than one SPF record returns a permanent error, and the same RFC limits an SPF check to 10 DNS-lookup terms before it fails (both read at rfc-editor.org on 24 October 2026). A Google Workspace domain starts from v=spf1 include:_spf.google.com ~all.
  • DKIM signs each message. Google requires a key of 1024 bits or longer for personal Gmail and recommends 2048 where your provider supports it. Sign with your own sending domain so DKIM aligns with the From: address.
  • DMARC tells receivers what to do when SPF and DKIM fail, and where to send reports. Start at p=none with a rua address you actually read (Yahoo strongly recommends the tag). Move to quarantine or reject only after the reports show every legitimate source passing.
  • Alignment matters as much as passing. Google and Yahoo both say the domain in the From: header must align with the SPF domain or the DKIM domain for DMARC to pass.
  • Reverse DNS and TLS. Google and Yahoo both ask for valid forward and reverse DNS on sending IPs, and Google asks for TLS. If you send through Google Workspace, Microsoft 365 or another mailbox host, the host runs those for you. If you run your own server, they are yours to check.

Check all of it before the first warmup message, not after the first bounce:

A second test costs nothing: send a message from the mailbox to a Gmail address you control, open the original headers, and look for SPF, DKIM and DMARC all reading PASS.

Warmerly re-checks SPF, DKIM, DMARC and MX on the domain of every live mailbox every six hours and alerts you when a record fails, because records drift after DNS changes nobody connected to email. For report monitoring on top, see DMARC monitoring.

Step 2

Set up the sending side so one mistake stays small

  • Use a separate sending domain for cold outreach, not the domain your customers' mail comes from. This is practice rather than a provider rule: Google reports reputation by domain, so a bad week on your main domain reaches everything sent from it.
  • Use a few mailboxes and spread the volume, instead of one mailbox at its limit. Mailboxes on one domain share the domain's reputation in Postmaster Tools, so more mailboxes spread the load but do not multiply a bad reputation into a good one.
  • Keep the From: name and address consistent within a campaign, and use a Reply-To that can receive replies. Microsoft's post asks for a valid From or Reply-To address that can receive replies.
  • Add an unsubscribe route. For cold email that means a one-line opt-out and a List-Unsubscribe header. Whoever opts out must stay out, and Yahoo asks senders to honour unsubscribes within 2 days.
Step 3

Warm every mailbox before its first cold send

A new mailbox has no sending history, and a sudden start looks like a compromised account. Warmup builds history gradually with real replies between mailboxes. It does not repair missing authentication or a bad list, and it cannot make a message wanted.

Warmerly's ramp is fixed and counted in days a mailbox has actually warmed, not calendar age or domain age. Warmup messages a day, by host, on a healthy mailbox on a weekday:

Warmerly warmup messages a day by ramp day and mailbox host
Ramp dayOther hostsGmailOutlookZoho
Day 04444
Day 38888
Day 715151515
Day 1425252525
Day 2135353025
Day 3050403025

Gmail reaches its ceiling of 40 on day 24, Outlook reaches 30 on day 18, and Zoho reaches 25 on day 14. Other hosts go on to 50 on day 30. Weekends run at 60% of a weekday, and the day's volume is cut back if the mailbox's health score slips (to 75% below a score of 70, and to 40% below 50).

How fast a mailbox is ready depends on signals more than the calendar: authentication passing, a steady health score, and inbox placement at the providers you write to. See how long email warmup takes for the readiness signals, and the warmup calculator to plan a target volume.

Do not stop warmup when campaigns start

Warmup is cheap maintenance. Keep it running underneath your campaigns, and expect a short re-warm if a mailbox has been quiet for weeks.

Step 4

Clean the list before you send

A bad list is the fastest way to a bounce spike, and bounces are the number a campaign tool can measure directly. Microsoft's post asks senders to remove invalid addresses regularly and to manage bounces. Google asks senders not to buy addresses.

  • Verify every address before sending: syntax, a live mail server for the domain, a mailbox check, and a test for catch-all domains that accept everything.
  • Drop role addresses such as info@ and sales@ from cold lists. They reach shared inboxes, where a complaint costs the most.
  • Never buy a list. Google's page says not to purchase email addresses from other companies.
  • Suppress on bounce and on opt-out, across every campaign and mailbox, not only the one that bounced.
  • Write to people for a reason. A message that is relevant to its reader gets fewer complaints, and the spam rate is the number Google, Yahoo and Warmerly's own limits all come back to.

No provider publishes a bounce limit, so the tripwire is yours to choose. Here is Warmerly's own, which is a product setting and not a provider rule. It uses a rolling 7-day window and needs at least 25 sends before it acts, because two bounces from ten sends is not a trend:

What Warmerly does at each bounce rate (its own settings)
Bounce rate, 7 daysWhat happens to the mailbox's daily campaign sends
Under 2%Nothing. The mailbox keeps its normal cap.
2% to 3%Cap multiplied by 0.75.
3% to 5%Cap multiplied by 0.5.
5% or moreCap multiplied by 0.25.
7% or moreSending pauses and the owner is emailed with the reason.
Step 5

Send small, steady and boring

Google's guidance on volume is one idea said several ways: start with a low sending volume to engaged users, increase it slowly, avoid sudden spikes, and monitor server responses, spam rate and domain reputation as you go. Its example is that immediately doubling previously sent volumes could result in rate limiting or reputation drops. If messages start bouncing or being deferred, Google says to reduce volume until the error rate falls, then increase slowly again.

Google gives no number, so a number has to be your own. Warmerly's campaign ramp, which is on by default when a mailbox has fewer than 14 days of warmup, starts at 3 emails per mailbox on sending day 1, adds 1 for each sending day, and stops at 15 a mailbox. At that pace a mailbox reaches 15 a day on its 13th sending day. Weekends hold the number flat, and the ramp can be changed on the campaign's Settings tab.

  • Raise volume after a clean week, not on a schedule. If bounces, complaints or deferrals rise, hold or step back first.
  • Spread by time as well as by mailbox: send across the working day in the recipient's time zone, not in one burst.
  • Count a domain, not only a mailbox. Postmaster Tools shows reputation by domain, so five mailboxes sending 15 each is 75 a day from one domain.
  • Pause, do not push through, when a spam rate or a deferral message appears. A week of no sending costs less than a month of spam placement.
Step 6

Monitor the numbers that mean something

  • Google Postmaster Tools reports your domain's spam rate, reputation, authentication and delivery errors for mail sent to Gmail. Check it weekly, and register the sending domain before warmup so there is a baseline.
  • Spam rate: below 0.3% is Google's requirement and Yahoo's, and Google says to aim for below 0.10%. Yahoo calculates its figure from mail delivered to the inbox, so the same campaign can read differently in two systems.
  • Bounces and deferrals: every campaign tool logs them. A rising trend is the earliest warning you have. See SMTP bounce codes explained.
  • DMARC reports show every system sending as your domain, including ones you forgot. Read them for a few weeks before tightening the policy.
  • Seed or placement tests show where a message lands, inbox or spam, at the providers you write to. They are a sample, not a promise.
  • Replies, not opens. Google says it does not track open rates and cannot verify the accuracy of open rates reported by third parties, and that low open rates are not necessarily an accurate indicator of spam classification.

Warmerly shows where warmup mail landed, by provider, runs blocklist checks on your domains, and can run a placement test from your own mailbox on demand. See inbox placement and blocklist monitoring.

The checklist

The pre-send checklist

Tick every row before the first cold send from a mailbox
CheckHowPass looks like
SPF published onceSPF checkerOne record, under 10 lookups, your sender included.
DKIM signingDKIM checkerA 2048-bit key where your host supports it, signing with your own domain.
DMARC publishedDMARC checkerp=none or stricter, with a rua address you read.
AlignmentOpen the headers of a test messageSPF, DKIM and DMARC all read PASS for the From: domain.
MX and reverse DNSMX checkerA working mail server, and valid reverse DNS if you run your own.
BlocklistsBlacklist checkerDomain and IP not listed.
Postmaster registeredpostmaster.google.comDomain verified, baseline collected.
Mailbox warmedHow long warmup takesWarmup running, health steady, no auth failures.
List verifiedYour verifierNo role addresses, catch-alls flagged, no purchased lists.
Opt-out readyYour campaign toolOne-line opt-out, List-Unsubscribe header, suppression across campaigns.
Volume planWritten downStart low (Warmerly's default is 3 a day), raise after a clean week.
TripwiresWritten downA bounce rate and a spam rate at which you stop.
A first fortnight

A first fortnight for a new sending domain

  1. Day 1. Register or pick the sending domain. Publish SPF, DKIM and DMARC at p=none. Verify them with the checkers.
  2. Day 1. Add the domain to Postmaster Tools and add a rua mailbox you will read.
  3. Day 2. Create the mailboxes, connect them to your warmup tool, and start warmup. Do not send any campaign mail yet.
  4. Days 3 to 7. Send a test message from each mailbox to a Gmail address you control and read the headers. Fix any failure before moving on.
  5. Days 8 to 14. Verify the list. Write your tripwires. Prepare the sequence and the opt-out line.
  6. From about day 14. If the readiness signals are steady, start campaigns at a small share of target volume and raise it after a clean week. Keep warmup running.

This is a plan to adapt, not a promise. Warmerly's ramp takes 30 days to reach a full warmup volume, so keep early campaign volume well below the mailbox's ceiling for the first month.

When it goes wrong

If you see this, do this first

First moves for common symptoms
SymptomLikely causeFirst move
Authentication failing in headersA record missing, duplicated or misalignedRun the checkers. One SPF record only. Fix alignment before anything else.
Bounces climbingAn unverified or old listPause. Verify the remaining list. Drop addresses that bounced.
Mail landing in spam at one providerReputation at that provider, or contentPause cold sends to that provider. Check Postmaster for Gmail. Run a placement test.
Spam rate near 0.3% in PostmasterComplaints from a poorly matched list or messageStop the campaign. Rework the list and the first line before restarting.
Deferral or rate-limit messagesVolume rose too fastReduce volume until errors fall, then raise slowly (Google's advice).
Domain on a blocklistA listing, often after a bounce or complaint spikeFind the listing with the checker and follow that list's removal steps.
Low replies but no errorsTargeting or copy, not deliverabilityCheck placement and spam rate before blaming the inbox. Open rate alone proves nothing.

For a deeper read on the same topic see the deliverability guide and the email outreach deliverability chapter. This page is the sourced checklist, and those two are the longer explanations.

Sources

Where the outside figures come from

Questions

What is a good cold email deliverability rate?

No sender publishes one, and we do not quote one. Measure your own: use Postmaster Tools for Gmail, placement tests for the providers you write to, and your bounce and reply rates over at least a few hundred sends. A single percentage from a blog post comes from someone else's list and domain.

Do I need DMARC if I send fewer than 5,000 emails a day?

Google and Yahoo only make DMARC a formal requirement for bulk senders, and Google says a policy of p=none is enough. A DMARC record is still worth publishing, because it gives you reports on who is sending as your domain and it is the setting both providers expect from larger senders.

Is warmup still needed if SPF, DKIM and DMARC pass?

Yes for a new mailbox. Authentication shows who sent a message. Warmup gives the mailbox a sending history, so a first campaign is not the first thing a provider sees from it. Neither fixes a bad list.

How many cold emails can one mailbox send a day?

Google, Yahoo and Microsoft publish no number. Google says to start low and increase slowly. Warmerly's default campaign ramp starts at 3 a mailbox on sending day 1 and stops at 15, and warmup runs underneath. Treat that as a cautious starting point, not a limit set by any provider.

What spam rate is too high?

Google asks for below 0.3% as a requirement, says to keep it below 0.10% and says to avoid ever reaching 0.30%. Yahoo says below 0.3%. Both measure it from recipients' own spam reports, so it moves with how well your list and message match the reader.

Does one-click unsubscribe apply to cold email?

The rules from Google and Yahoo name marketing and subscribed messages and do not mention cold email, so the pages do not settle it. Many senders add the header anyway. Warmerly adds the one-click List-Unsubscribe pair to campaign emails when the mailbox has a link domain, and a mailto address when it does not.

Why does my mail go to spam when SPF, DKIM and DMARC all pass?

Authentication shows who sent a message, not that anyone wanted it. Placement still depends on reputation, complaints, content, and how fast your volume grew. Check Postmaster Tools for Gmail, your bounce rate, and whether the list matches the message.

Does Gmail track open rates?

Google says it does not track open rates and cannot verify the accuracy of open rates that third parties report. It also says low open rates are not necessarily an accurate sign of spam classification. Use spam rate, reputation and replies instead.

Should cold email come from my main domain?

It is safer not to. This is practice, not a provider rule. A separate sending domain keeps a reputation problem away from the mail your customers depend on.

Warm the mailboxes before the first send.

Connect a mailbox and Warmerly starts the warmup ramp, checks your records and shows where warmup mail lands. Start free.

Start freeSee pricing
  • Free plan, no time limit
  • 7-day trial on paid plans
  • 30-day inbox guarantee, with conditions
  • Customer data is hosted in the EU