- Authenticate first. Google asks every sender to set up SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail to use SPF, DKIM and DMARC. A DMARC policy of
p=nonemeets that. - Warm each mailbox, then start cold sending low. Warmerly's warmup ramp runs 30 days, from 4 warmup messages a day to a ceiling of 50 (40 on Gmail, 30 on Outlook, 25 on Zoho).
- Keep your spam rate below 0.3% and aim for below 0.1%. That is Google's wording in Postmaster Tools. Yahoo says below 0.3%.
- Verify the list and stop on bounces. None of the three providers publishes a bounce limit, so set your own tripwire. Warmerly slows a mailbox from a 2% bounce rate and pauses sending at 7%.
- Watch Postmaster Tools, bounces and replies, not opens. Google says it does not track open rates, so a low open rate tells you little about spam placement.
- These rules do not mention cold email. Google's page says not to send to people who did not sign up and not to buy address lists. Cold outreach sits close to that line, so complaints matter more than any DNS record.
Cold email deliverability: a sourced checklist for 2026
Most cold email trouble comes down to five things: a domain that is not authenticated, mailboxes that were never warmed, a list nobody verified, volume that jumps, and nobody watching the numbers. This page puts them in the order to fix them, with the rules Google, Yahoo and Microsoft publish, read on 24 October 2026.
Updated
- Free plan, no time limit
- 7-day trial on paid plans
- 30-day inbox guarantee, with conditions
- Customer data is hosted in the EU
What Google, Yahoo and Microsoft publish
The three tables below are read from each company's own page on 24 October 2026. Where a page is unclear or contradicts itself, the cell says so.
| Google (Gmail) | Yahoo | Microsoft (Outlook) | |
|---|---|---|---|
| Who it covers | Mail to personal Gmail accounts (@gmail.com and @googlemail.com). Extra rules above 5,000 messages a day to Gmail. | All senders, with more rules for bulk senders. Yahoo says it will not specify a volume threshold. | Domains sending more than 5,000 emails a day (Microsoft's post, 2 April 2025). |
| All senders | SPF or DKIM. DKIM key of 1024 bits or longer (2048 recommended). Valid forward and reverse DNS. TLS. Messages in the RFC 5322 format. | SPF or DKIM at a minimum. A valid forward and reverse DNS record for sending IPs. RFCs 5321 and 5322. | The post sets requirements for high-volume senders only. |
| Bulk senders | SPF, DKIM and DMARC (p=none is enough), with the From: domain aligned to the SPF or DKIM domain. | SPF and DKIM both, and a valid DMARC policy of at least p=none that passes. A rua tag is strongly recommended. | SPF must pass. DKIM must pass. DMARC at least p=none, aligned with SPF or DKIM, preferably both. |
| Spam rate | Below 0.3% is the requirement. Google also says keep it below 0.10% and avoid ever reaching 0.30%. | Below 0.3%. Yahoo calculates it from mail delivered to the inbox. | The post gives no spam-rate figure. |
| Unsubscribe | Above 5,000 a day, marketing and subscribed messages must support one-click unsubscribe, plus a visible link. | One-click unsubscribe for marketing and subscribed messages. Honour unsubscribes within 2 days. | A working unsubscribe link, particularly for marketing or bulk mail (a recommendation). |
| Hygiene | Do not buy addresses. Do not send to people who did not sign up. | Keep complaint rates low. | A valid From or Reply-To address that can receive replies. Remove invalid addresses regularly. Manage bounces. |
| If you miss it | A high spam rate leads to more spam classification, and Google says improvement takes time to show. | Mail "may be sent to the spam folder or rejected". Yahoo may defer mail from domains with a high complaint rate. | The same post says non-compliant mail is rejected with error 550 5.7.515, and also that it goes to Junk first with rejection on a date to be announced. It contradicts itself, so check Microsoft's page. |
What these pages do not tell you
- None of them is about cold email. They cover bulk and marketing mail. They do not say whether one-to-one cold outreach counts as marketing for the one-click unsubscribe rule. Many senders add the header anyway, and Warmerly does: campaign emails carry the RFC 8058 one-click pair when the mailbox has a link domain, and a mailto address when it does not.
- Under 5,000 a day does not mean exempt. Google's all-sender rules still apply to mail going to Gmail, and the spam filters act on complaints at any volume.
- Yahoo gives no volume threshold, so you cannot work out whether you count as bulk. Treat the bulk rules as the standard.
- Nobody publishes an inbox placement rate or a safe daily volume. Google tells senders to increase volume slowly and does not give a number. Any figure you read elsewhere is an estimate.
Authenticate the sending domain
Authentication proves who sent a message. It does not prove the message was wanted, but without it nothing else on this page works, and two of the three providers above ask for it by name.
- SPF lists the servers allowed to send for your domain. Publish one SPF record per domain: RFC 7208 says a domain with more than one SPF record returns a permanent error, and the same RFC limits an SPF check to 10 DNS-lookup terms before it fails (both read at rfc-editor.org on 24 October 2026). A Google Workspace domain starts from
v=spf1 include:_spf.google.com ~all. - DKIM signs each message. Google requires a key of 1024 bits or longer for personal Gmail and recommends 2048 where your provider supports it. Sign with your own sending domain so DKIM aligns with the From: address.
- DMARC tells receivers what to do when SPF and DKIM fail, and where to send reports. Start at
p=nonewith aruaaddress you actually read (Yahoo strongly recommends the tag). Move toquarantineorrejectonly after the reports show every legitimate source passing. - Alignment matters as much as passing. Google and Yahoo both say the domain in the From: header must align with the SPF domain or the DKIM domain for DMARC to pass.
- Reverse DNS and TLS. Google and Yahoo both ask for valid forward and reverse DNS on sending IPs, and Google asks for TLS. If you send through Google Workspace, Microsoft 365 or another mailbox host, the host runs those for you. If you run your own server, they are yours to check.
Check all of it before the first warmup message, not after the first bounce:
A second test costs nothing: send a message from the mailbox to a Gmail address you control, open the original headers, and look for SPF, DKIM and DMARC all reading PASS.
Warmerly re-checks SPF, DKIM, DMARC and MX on the domain of every live mailbox every six hours and alerts you when a record fails, because records drift after DNS changes nobody connected to email. For report monitoring on top, see DMARC monitoring.
Set up the sending side so one mistake stays small
- Use a separate sending domain for cold outreach, not the domain your customers' mail comes from. This is practice rather than a provider rule: Google reports reputation by domain, so a bad week on your main domain reaches everything sent from it.
- Use a few mailboxes and spread the volume, instead of one mailbox at its limit. Mailboxes on one domain share the domain's reputation in Postmaster Tools, so more mailboxes spread the load but do not multiply a bad reputation into a good one.
- Keep the From: name and address consistent within a campaign, and use a Reply-To that can receive replies. Microsoft's post asks for a valid From or Reply-To address that can receive replies.
- Add an unsubscribe route. For cold email that means a one-line opt-out and a List-Unsubscribe header. Whoever opts out must stay out, and Yahoo asks senders to honour unsubscribes within 2 days.
Warm every mailbox before its first cold send
A new mailbox has no sending history, and a sudden start looks like a compromised account. Warmup builds history gradually with real replies between mailboxes. It does not repair missing authentication or a bad list, and it cannot make a message wanted.
Warmerly's ramp is fixed and counted in days a mailbox has actually warmed, not calendar age or domain age. Warmup messages a day, by host, on a healthy mailbox on a weekday:
| Ramp day | Other hosts | Gmail | Outlook | Zoho |
|---|---|---|---|---|
| Day 0 | 4 | 4 | 4 | 4 |
| Day 3 | 8 | 8 | 8 | 8 |
| Day 7 | 15 | 15 | 15 | 15 |
| Day 14 | 25 | 25 | 25 | 25 |
| Day 21 | 35 | 35 | 30 | 25 |
| Day 30 | 50 | 40 | 30 | 25 |
Gmail reaches its ceiling of 40 on day 24, Outlook reaches 30 on day 18, and Zoho reaches 25 on day 14. Other hosts go on to 50 on day 30. Weekends run at 60% of a weekday, and the day's volume is cut back if the mailbox's health score slips (to 75% below a score of 70, and to 40% below 50).
How fast a mailbox is ready depends on signals more than the calendar: authentication passing, a steady health score, and inbox placement at the providers you write to. See how long email warmup takes for the readiness signals, and the warmup calculator to plan a target volume.
Warmup is cheap maintenance. Keep it running underneath your campaigns, and expect a short re-warm if a mailbox has been quiet for weeks.
Clean the list before you send
A bad list is the fastest way to a bounce spike, and bounces are the number a campaign tool can measure directly. Microsoft's post asks senders to remove invalid addresses regularly and to manage bounces. Google asks senders not to buy addresses.
- Verify every address before sending: syntax, a live mail server for the domain, a mailbox check, and a test for catch-all domains that accept everything.
- Drop role addresses such as info@ and sales@ from cold lists. They reach shared inboxes, where a complaint costs the most.
- Never buy a list. Google's page says not to purchase email addresses from other companies.
- Suppress on bounce and on opt-out, across every campaign and mailbox, not only the one that bounced.
- Write to people for a reason. A message that is relevant to its reader gets fewer complaints, and the spam rate is the number Google, Yahoo and Warmerly's own limits all come back to.
No provider publishes a bounce limit, so the tripwire is yours to choose. Here is Warmerly's own, which is a product setting and not a provider rule. It uses a rolling 7-day window and needs at least 25 sends before it acts, because two bounces from ten sends is not a trend:
| Bounce rate, 7 days | What happens to the mailbox's daily campaign sends |
|---|---|
| Under 2% | Nothing. The mailbox keeps its normal cap. |
| 2% to 3% | Cap multiplied by 0.75. |
| 3% to 5% | Cap multiplied by 0.5. |
| 5% or more | Cap multiplied by 0.25. |
| 7% or more | Sending pauses and the owner is emailed with the reason. |
Send small, steady and boring
Google's guidance on volume is one idea said several ways: start with a low sending volume to engaged users, increase it slowly, avoid sudden spikes, and monitor server responses, spam rate and domain reputation as you go. Its example is that immediately doubling previously sent volumes could result in rate limiting or reputation drops. If messages start bouncing or being deferred, Google says to reduce volume until the error rate falls, then increase slowly again.
Google gives no number, so a number has to be your own. Warmerly's campaign ramp, which is on by default when a mailbox has fewer than 14 days of warmup, starts at 3 emails per mailbox on sending day 1, adds 1 for each sending day, and stops at 15 a mailbox. At that pace a mailbox reaches 15 a day on its 13th sending day. Weekends hold the number flat, and the ramp can be changed on the campaign's Settings tab.
- Raise volume after a clean week, not on a schedule. If bounces, complaints or deferrals rise, hold or step back first.
- Spread by time as well as by mailbox: send across the working day in the recipient's time zone, not in one burst.
- Count a domain, not only a mailbox. Postmaster Tools shows reputation by domain, so five mailboxes sending 15 each is 75 a day from one domain.
- Pause, do not push through, when a spam rate or a deferral message appears. A week of no sending costs less than a month of spam placement.
Monitor the numbers that mean something
- Google Postmaster Tools reports your domain's spam rate, reputation, authentication and delivery errors for mail sent to Gmail. Check it weekly, and register the sending domain before warmup so there is a baseline.
- Spam rate: below 0.3% is Google's requirement and Yahoo's, and Google says to aim for below 0.10%. Yahoo calculates its figure from mail delivered to the inbox, so the same campaign can read differently in two systems.
- Bounces and deferrals: every campaign tool logs them. A rising trend is the earliest warning you have. See SMTP bounce codes explained.
- DMARC reports show every system sending as your domain, including ones you forgot. Read them for a few weeks before tightening the policy.
- Seed or placement tests show where a message lands, inbox or spam, at the providers you write to. They are a sample, not a promise.
- Replies, not opens. Google says it does not track open rates and cannot verify the accuracy of open rates reported by third parties, and that low open rates are not necessarily an accurate indicator of spam classification.
Warmerly shows where warmup mail landed, by provider, runs blocklist checks on your domains, and can run a placement test from your own mailbox on demand. See inbox placement and blocklist monitoring.
The pre-send checklist
| Check | How | Pass looks like |
|---|---|---|
| SPF published once | SPF checker | One record, under 10 lookups, your sender included. |
| DKIM signing | DKIM checker | A 2048-bit key where your host supports it, signing with your own domain. |
| DMARC published | DMARC checker | p=none or stricter, with a rua address you read. |
| Alignment | Open the headers of a test message | SPF, DKIM and DMARC all read PASS for the From: domain. |
| MX and reverse DNS | MX checker | A working mail server, and valid reverse DNS if you run your own. |
| Blocklists | Blacklist checker | Domain and IP not listed. |
| Postmaster registered | postmaster.google.com | Domain verified, baseline collected. |
| Mailbox warmed | How long warmup takes | Warmup running, health steady, no auth failures. |
| List verified | Your verifier | No role addresses, catch-alls flagged, no purchased lists. |
| Opt-out ready | Your campaign tool | One-line opt-out, List-Unsubscribe header, suppression across campaigns. |
| Volume plan | Written down | Start low (Warmerly's default is 3 a day), raise after a clean week. |
| Tripwires | Written down | A bounce rate and a spam rate at which you stop. |
A first fortnight for a new sending domain
- Day 1. Register or pick the sending domain. Publish SPF, DKIM and DMARC at
p=none. Verify them with the checkers. - Day 1. Add the domain to Postmaster Tools and add a
ruamailbox you will read. - Day 2. Create the mailboxes, connect them to your warmup tool, and start warmup. Do not send any campaign mail yet.
- Days 3 to 7. Send a test message from each mailbox to a Gmail address you control and read the headers. Fix any failure before moving on.
- Days 8 to 14. Verify the list. Write your tripwires. Prepare the sequence and the opt-out line.
- From about day 14. If the readiness signals are steady, start campaigns at a small share of target volume and raise it after a clean week. Keep warmup running.
This is a plan to adapt, not a promise. Warmerly's ramp takes 30 days to reach a full warmup volume, so keep early campaign volume well below the mailbox's ceiling for the first month.
If you see this, do this first
| Symptom | Likely cause | First move |
|---|---|---|
| Authentication failing in headers | A record missing, duplicated or misaligned | Run the checkers. One SPF record only. Fix alignment before anything else. |
| Bounces climbing | An unverified or old list | Pause. Verify the remaining list. Drop addresses that bounced. |
| Mail landing in spam at one provider | Reputation at that provider, or content | Pause cold sends to that provider. Check Postmaster for Gmail. Run a placement test. |
| Spam rate near 0.3% in Postmaster | Complaints from a poorly matched list or message | Stop the campaign. Rework the list and the first line before restarting. |
| Deferral or rate-limit messages | Volume rose too fast | Reduce volume until errors fall, then raise slowly (Google's advice). |
| Domain on a blocklist | A listing, often after a bounce or complaint spike | Find the listing with the checker and follow that list's removal steps. |
| Low replies but no errors | Targeting or copy, not deliverability | Check placement and spam rate before blaming the inbox. Open rate alone proves nothing. |
For a deeper read on the same topic see the deliverability guide and the email outreach deliverability chapter. This page is the sourced checklist, and those two are the longer explanations.
Where the outside figures come from
Every figure from another company on this page was read from that company's own page on the date shown. Pages change, so check the source before you rely on a number.
- Google, Email sender guidelines, read 24 October 2026
- Yahoo Sender Hub, best practices, read 24 October 2026
- Yahoo Sender Hub, FAQs, read 24 October 2026
- Microsoft, Outlook's new requirements for high-volume senders (2 April 2025, with the 29 April update), read 24 October 2026
- RFC 7208, Sender Policy Framework, read 24 October 2026
Questions
What is a good cold email deliverability rate?
+
Do I need DMARC if I send fewer than 5,000 emails a day?
+
Is warmup still needed if SPF, DKIM and DMARC pass?
+
How many cold emails can one mailbox send a day?
+
What spam rate is too high?
+
Does one-click unsubscribe apply to cold email?
+
Why does my mail go to spam when SPF, DKIM and DMARC all pass?
+
Does Gmail track open rates?
+
Should cold email come from my main domain?
+
Warm the mailboxes before the first send.
Connect a mailbox and Warmerly starts the warmup ramp, checks your records and shows where warmup mail lands. Start free.
- Free plan, no time limit
- 7-day trial on paid plans
- 30-day inbox guarantee, with conditions
- Customer data is hosted in the EU