# The email deliverability guide for cold outreach in 2026 URL: https://warmerly.com/deliverability-guide > A practical, vendor-neutral guide to inbox placement: SPF, DKIM, DMARC, MTA-STS, domain warmup, sending volume, list hygiene, spam complaints, and the specific signals Gmail and Microsoft score in 2026. Everything we know about getting cold email into the primary inbox in 2026, condensed into a single readable guide. Vendor-neutral, written for senders who actually need to ship campaigns this quarter. ## 1. What deliverability actually means Deliverability is the probability that a sent message lands in the recipient's primary inbox, not the spam folder, not the promotions tab, and not silently dropped at the gateway. It is not the same as "sent successfully". SMTP can return 250 OK while Gmail quietly files your message under Spam, and your campaign tool will still report it as delivered. Every major provider — Gmail, Microsoft 365, Yahoo, AOL, ProtonMail — decides placement using a combination of authentication checks, content signals, behavioural signals, and sender reputation. Authentication and content are deterministic. Behaviour and reputation are probabilistic, scored over time, and they are where most cold senders lose the game. ## 2. The 2026 baseline: SPF, DKIM, DMARC, and MTA-STS Since February 2024, Gmail and Yahoo require bulk senders (5,000+ messages per day to their users) to pass SPF and DKIM, publish a DMARC policy of at least p=none, keep spam complaint rates under 0.30%, and offer one-click unsubscribe on marketing mail. Microsoft followed with similar enforcement in 2025. - **SPF** authorises which IPs may send on your behalf. - **DKIM** cryptographically signs your messages so receivers can verify they were not tampered with. - **DMARC** tells receivers what to do when SPF and DKIM fail, and where to report results. - **MTA-STS** forces TLS on inbound mail to your domain, which providers read as a signal of operational maturity. If you take nothing else from this guide: configure all four. ## 3. Why domain warmup matters more than IP warmup Five years ago, IP warmup was the conversation. In 2026, almost no cold sender controls their own IP, because they are on Gmail, Microsoft 365, or a shared sending platform. What matters now is domain reputation, which is mostly the cumulative behaviour of your sending domain over the trailing 90 days. A brand-new domain has zero reputation. Filters treat it as suspicious by default. Sending 200 cold messages on day one is the single most reliable way to get the domain flagged before you have even closed your first deal. ## 4. The signals Gmail's neural classifier actually weights Gmail's spam filter has been a neural network since 2017 and has been retrained continuously since. From public statements, ML conference talks, and a lot of testing, we know it weights (roughly, in this order): user actions, sender history, authentication, content embeddings, and link reputation. User actions dominate. A user moving your message from spam to inbox is the single strongest positive signal. A user marking as spam, or deleting without reading, is the strongest negative. ## 5. The Microsoft SmartScreen reality Microsoft is not Gmail and the differences matter. SmartScreen leans more heavily on bulk and complaint heuristics, IP reputation (via the Smart Network Data Services, SNDS, score), and content fingerprinting. Microsoft is also famously sensitive to volume spikes from new senders. Best practices for Outlook delivery in 2026: ramp volume slowly (no more than 2x previous-week volume), keep your spam complaint rate under 0.1% (lower than Gmail's threshold), set up the Junk Mail Reporting Program (JMRP) feedback loop if you control sending IPs, and use a consistent from address. ## 6. List hygiene, bounces, and the 2% complaint trap Anything above a 2% hard-bounce rate on a campaign will get you throttled. Anything above 5% will get you blacklisted. Verify before send: syntax check, MX lookup, SMTP RCPT TO probe, catch-all detector. Reject role accounts (info@, support@, sales@) from cold lists entirely. Complaints are worse than bounces. A 0.3% complaint rate over a 30-day rolling window is enough to put you on Gmail's bulk-sender probation. A 1% complaint rate, sustained, will end your sending career on that domain. ## 7. Content patterns to avoid (and which "rules" are myths) Modern filters do not care about the word "free". They do not care about exclamation marks. They do not, mostly, care about colour, font, or HTML weight. Those are 2008-era rules. What they do care about: the embedding similarity of your message to known spam clusters, the link-to-text ratio, the proportion of base64-encoded content, and the use of URL shorteners that resolve to redirect chains. Cap links per message at 2. Avoid images-only emails. Do not hide text. Do not stuff invisible keywords. Use one tracking domain and warm it the same way you warm your sending domain. ## 8. Cadence: how often to send, when to send, when to stop For a healthy mailbox with established reputation, a sustainable cold send rate is 30 to 50 personalised messages per day per mailbox. Send during the recipient's working hours, weighted toward Tuesday through Thursday between 8:00 and 11:00 local time. When health drops, throttle. Do not push through. ## 9. The cold-email-specific stack we recommend - Separate sending domain (e.g. yourbrand.io if your main is yourbrand.com) - 3 to 5 mailboxes per sending domain, each on its own forward-facing alias - Warm every mailbox for at least 14 days before its first cold send - Verify every list with a paid verifier before send - Campaign tool that supports per-mailbox rate limits and one-click unsubscribe headers - Monitor postmaster.google.com and SNDS weekly ## 10. What to do when reputation drops Stop sending. Pause the campaign. Throttle warmup down to 50% volume for 72 hours while you diagnose. Check postmaster.google.com for the domain reputation panel. Check SNDS for the IP. Check your bounce and complaint rates. Re-warm. Spend two weeks on warmup-only, ideally with peer-network reply and spam-recovery behaviour active. Then re-introduce campaigns at 25% of previous volume. If reputation holds for a week, return to full volume. If reputation does not recover after 30 days of clean behaviour, the domain is likely a write-off. Cut your losses, register a new one, and apply everything in this guide from day zero. ## TL;DR - Configure SPF, DKIM, DMARC, and MTA-STS before anything else. - Warm every mailbox for at least 14 days before cold sending. - Use a separate domain for cold outreach. - Verify every list. 0% tolerance for known-bad addresses. - Cap at 30–50 personalised sends per mailbox per day. - Stop sending the moment reputation drops, do not push through. - Spam recovery and reply behaviour beat any other warmup tactic. --- Source: https://warmerly.com/deliverability-guide Site index: https://warmerly.com/llms.txt Full content: https://warmerly.com/llms-full.txt