Cold Email Deliverability Checklist 2026: How to Avoid Spam Before Sending Campaigns

Updated June 2026 · 20 min read · By Marwene Amor

Most cold email campaigns that fail don't fail because of bad copy or a bad list. They fail because the sender setup was broken before the first email left the outbox. By the time an operator notices the open rate is collapsing, the sending domain's reputation is already hurt and recovery takes weeks. Our guide to email sender reputation covers how to check it, spot a blacklisting, and recover a burned domain if you're already past that point.

This checklist is the inverse: a set of fundamentals to lock down before you launch a campaign, so the only variables left to optimize are copy, targeting, and offer. None of these steps are clever or secret. They're boring. They're also the difference between landing in inbox and landing in spam.

Try Instantly Free →

The brutal truth about cold email deliverability

Deliverability isn't a single setting you flip on. It's the cumulative result of seven or eight variables that mailbox providers (Gmail, Outlook, Yahoo, ProtonMail) watch over time: domain age, authentication, sender reputation, volume curve, engagement signals, complaint rate, content patterns, and infrastructure quality.

Tools help with some of these variables. Tools cannot save a bad domain, a scraped list, spammy copy, or reckless sending volume. The goal of this checklist isn't to hack Gmail. Gmail and Outlook reward senders that look legitimate, and they punish senders that look like spammers. Your job is to look like a legitimate sender at every layer of the stack.

The checklist at a glance

Here is the full set of areas this guide covers, with the risk profile of each one if you skip it.

Area	What to check	Why it matters	Risk if ignored
Sending domain	Use a separate, dedicated domain, never your main domain	Isolates reputation risk from your business email	One bad campaign damages transactional and marketing email
SPF	Published TXT record listing authorized senders	Tells mailbox providers who can send for the domain	Emails fail authentication, land in spam
DKIM	Cryptographic signature from your sending service	Proves the message wasn't tampered with in transit	Failed checks trigger spam routing
DMARC	Policy that ties SPF and DKIM together	Tells providers what to do when authentication fails	Without it, spoofing risk and ranking penalties
Custom tracking domain	CNAME pointing to your sender's tracking host	Avoids shared-tracking-domain reputation pollution	Your tracking inherits other senders' bad reputation
Inbox warmup	14 to 28 days of automated simulated activity	Builds sender reputation before real volume	New inboxes land in spam at high rates
Sending volume	Gradual ramp, not bursts	Sustainable volume curve signals legitimacy	Volume spikes trigger spam filters
List quality	Verified emails, no catch-all-only addresses	Low bounce rate keeps reputation intact	Bounce rate above 5 percent damages reputation fast
Bounce rate	Under 3 percent per campaign	Mailbox providers track this closely	Persistent high bounce means blacklist risk
Copy quality	Plain text style, relevant, short	Engagement signals improve reputation	Spammy patterns trigger filters directly
Personalization	Real personalization, not template tokens	Higher reply rate improves sender score	Templated emails get archived or marked spam
Unsubscribe / compliance	Clear opt-out, physical address where required	CAN-SPAM, GDPR, and regional law alignment	Legal exposure and spam complaints
Reply monitoring	Watch positive replies, complaints, bounces daily	Catches problems before they spiral	Damage compounds while you're not looking
Analytics	Per-inbox and per-campaign visibility	Diagnose whether the problem is copy or infrastructure	Can't fix what you can't see

The rest of this guide goes through each area with practical advice.

Step 0: Choose your sending infrastructure

Before any DNS record or warmup, decide what you're actually sending from. This is the layer most beginners skip, and it shapes everything downstream.

Separate domain, not a subdomain of your main domain. Some guides suggest a subdomain like outreach.yourcompany.com. That still ties reputation back to your root domain in subtle ways. The safer pattern is a fully separate domain, often the same brand on a different TLD or with a prefix, such as getyourcompany.com or yourcompany.io. It keeps cold sending reputation completely isolated from the domain your business depends on.

How many inboxes per domain. A common, conservative setup is two to three sending inboxes per domain. Loading many inboxes onto one domain concentrates risk, since a problem with the domain affects every inbox on it. Spreading inboxes across several domains is the structural reason multi-domain rotation exists.

Shared vs dedicated infrastructure. Most cold email at small scale runs on Google Workspace or Microsoft 365 mailboxes, which is fine and recommended for under a few thousand sends a day. Dedicated IPs and self-hosted SMTP only make sense at real volume and with the expertise to manage reputation yourself. For most operators, paid Workspace or Microsoft 365 inboxes on dedicated sending domains is the right answer, not a dedicated IP. One more timing note worth planning for: buy and configure sending domains a few weeks ahead of when you need them, because DNS changes and warmup both take real calendar time that you cannot compress on launch day.

Step 1: Do not use your main company domain

The most common mistake new cold emailers make is sending from their main company domain. It feels logical, since that's where the business lives. But cold email is inherently risky, and even careful campaigns generate some complaints, bounces, or temporary throttling. If those events happen on your main domain, three things suffer simultaneously: your transactional email (password resets, invoices, receipts), your marketing newsletters, and your sales outreach.

The standard pattern is to buy a separate sending domain that points to the same brand but uses a different TLD or variation. If your main domain is yourcompany.com, your sending domain might be getyourcompany.com, tryyourcompany.com, yourcompany.io, or hello-yourcompany.com. Recipients see the brand association without you exposing the main domain.

For higher-volume programs, operators run multiple sending domains in parallel, typically two to ten, and rotate sending across them. If one domain gets throttled, the others keep flowing.

Keep the main domain reserved for the website, customer support, billing, marketing newsletters, and any email that absolutely must reach inbox. Cold experiments don't belong there.

Step 2: Configure SPF, DKIM, and DMARC correctly

These three records are non-negotiable in 2026. Gmail and Yahoo formally require them for any sender doing more than a handful of emails per day, and Outlook's enforcement has tightened. Skipping any one of them puts your emails in the spam folder regardless of how good your copy is.

SPF: Sender Policy Framework

SPF is a DNS TXT record that lists which IP addresses or domains are allowed to send email on behalf of your domain. When a mailbox provider receives your email, it checks the SPF record to confirm the sending server is authorized.

Practical setup: your sending tool (Google Workspace, Microsoft 365, Mailgun, SendGrid, and so on) gives you the exact SPF string to publish. Don't write your own. Get the string from your provider's documentation and add it as a TXT record on the sending domain.

DKIM: DomainKeys Identified Mail

DKIM adds a cryptographic signature to outgoing emails. The receiving mailbox provider verifies that signature against a public key published in your DNS. If the signature matches, the email is proven to be authentic and unmodified in transit.

Practical setup: enable DKIM in your sending platform (Google Workspace, Microsoft 365, and similar) and publish the public key it generates as a TXT record on a specific subdomain (usually something like google._domainkey.yourdomain.com). Verify the record with a tool like MXToolbox before sending.

DMARC: Domain-based Message Authentication, Reporting and Conformance

DMARC ties SPF and DKIM together with a policy that tells mailbox providers what to do when authentication fails: do nothing (p=none), quarantine (p=quarantine), or reject (p=reject). It also enables reporting so you see authentication results.

Practical advice:

• Start with a monitoring policy (p=none) so you can see authentication results without breaking legitimate email.
• Watch the DMARC reports for one to two weeks.
• Move to p=quarantine once your reports show consistent authentication success.
• Move to p=reject only when you're confident every legitimate sender is properly authenticated.

Never copy DNS records blindly from a tutorial. Use the exact records your sending platform provides, and verify each one with an external tool before launching campaigns.

Step 3: Warm up your sending inboxes

A brand-new inbox has zero sending reputation. If you connect it on Monday and send 500 cold emails on Tuesday, Gmail and Outlook will treat it as suspicious and route most of those emails to spam. The fix is warmup: simulating legitimate sending activity over 14 to 28 days so your inbox builds a reputation before you start cold campaigns.

What warmup does in practice: your inbox sends and receives short messages with other warmup-network accounts, gets opens and replies, and occasionally gets messages moved from spam to inbox or marked as important. Over a few weeks, this signals to mailbox providers that you're a legitimate human with normal correspondence patterns.

Warmup is necessary but not sufficient. It helps you start with a clean reputation. It does not guarantee inbox placement once you ramp up cold sending. The other steps in this checklist matter just as much.

For a broader comparison of warmup tools (including standalone options like Warmup Inbox and MailReach), see our best email warmup tools guide. For the full step-by-step warmup process, the timeline, and the DNS setup, follow our guide to warming up a cold email domain.

Step 4: Start with conservative sending volume

Even with full authentication and proper warmup, sending too much too fast triggers spam filters. The safe ramp depends on your inbox age, niche, and recipient engagement, but the conservative example below works as a starting point for most operators.

Phase	Conservative volume per inbox per day	Notes
Days 1 to 7	10 to 20 emails	Warmup continues alongside
Days 8 to 14	20 to 35 emails	Watch bounce and reply signals daily
Days 15 to 21	35 to 50 emails	Increase only if signals are healthy
Days 22 and beyond	Up to 50 emails per inbox	Beyond this, add more inboxes rather than pushing volume

This is a conservative example, not a universal rule. Some sending domains can handle more, some less. The signals to watch as you ramp: bounce rate (keep under 3 percent), reply rate (a sudden drop is a deliverability warning), and per-inbox Gmail and Outlook placement (if you start seeing spam placement, slow down or pause).

When you need more total volume, add more inboxes rather than pushing per-inbox limits. This is exactly the pattern unlimited-inbox tools are built for.

Step 5: Use clean lead data

List quality is upstream of every other deliverability variable. A campaign sent to a clean list of 200 verified contacts will outperform a campaign sent to 2,000 scraped, unverified addresses every time, both on deliverability and on outcomes.

What "clean" means in practice:

• Every email is verified live before sending, not just at scraping time
• Catch-all domains are flagged and de-prioritized, since they bounce silently
• Role-based addresses (info@, sales@, support@) are excluded for cold outreach
• Recently changed jobs are checked, since old contact data bounces fast
• The list is segmented by relevance, not blasted indiscriminately

For sourcing and verifying contacts, the standard tools are Hunter, Apollo, Snov.io, and Findymail. Each has trade-offs in accuracy, database size, and pricing. See our breakdown of the best email finder tools for cold email for a side-by-side comparison, the Hunter review for the cleanest dedicated finder, or the Snov.io review if you want a budget-friendly finder and verifier bundle.

Never use scraped lists from low-quality sources, leaked databases, or LinkedIn-only exports without verification. The bounce rate will damage your sender reputation faster than any other mistake on this checklist.

Step 6: Write copy that does not look like spam

Mailbox providers analyze message content for patterns that correlate with spam: certain phrases, image-to-text ratios, link density, formatting choices. Most spam filters use machine learning models trained on billions of examples, so they catch patterns well beyond a hand-coded keyword list.

Risky patterns to avoid in cold emails

• More than one or two links in the first email
• Attachments of any kind in the first email
• Overhyped claims ("guaranteed", "100%", "revolutionary", "limited time")
• Spam-trigger words (free, cash, winner, click here, urgent)
• Fake personalization (a merge tag that didn't merge correctly)
• Large HTML templates with images, buttons, and footers
• Subject lines that promise more than the body delivers
• Bullet lists of features that look like a marketing brochure

Better patterns that look like legitimate human email

• Plain text formatting, no HTML wrapper and no big logos
• A specific reason for reaching out, mentioning something concrete about the recipient or their company
• One clear call to action: a question, a reply request, or a single link
• Short, with 80 to 130 words as the sweet spot for cold outreach
• Honest subject lines that match the body
• A signature with a real name, title, company, and a way to unsubscribe

Step 7: Separate tracking from reputation risk

Most cold email tools default to enabling open tracking and click tracking. Both work by rewriting the email so opens and clicks pass through a tracking server. That tracking adds an extra layer that mailbox providers can use as a signal.

Two things to know:

• Open tracking is increasingly unreliable. Apple Mail Privacy Protection and similar features pre-fetch tracking pixels, so the open rate you see is inflated and partially fake.
• Shared tracking domains (the default for most tools) pool reputation across everyone using that tool. If other senders on the same shared tracking domain are spammy, your emails inherit the reputation penalty.

Two practical steps: configure a custom tracking domain (a CNAME on your sending domain pointing to your tool's tracking host), and consider disabling open tracking entirely for cold campaigns, since the data is noisy and the reputation cost may not be worth it. Keep click tracking only if you need to measure CTAs.

Whatever you choose, do not overload first emails with links. A first cold email with three or four links looks like a newsletter, not a personal message.

Engagement signals: the currency of reputation

Underneath all the technical setup sits one idea that mailbox providers care about more than any single record: do people actually want your email. Gmail and Outlook watch how recipients behave, and those behaviors are the strongest reputation signals you have. Positive signals are opens that lead to replies, messages moved out of spam into the inbox, emails marked as important, and replies themselves. Negative signals are deletions without opening, spam complaints, and emails that sit unread.

This is why targeting and relevance are deliverability features, not just conversion features. A tightly targeted list of people who plausibly want to hear from you generates replies, and replies are the single best signal you can send. A broad, irrelevant blast generates deletions and complaints, which teach the provider to route you to spam regardless of how clean your authentication is. The operators with the best inbox placement are usually the ones with the most relevant lists, not the ones with the cleverest technical tricks.

Two practical implications follow. First, a smaller, more relevant campaign often outperforms a larger generic one, because the engagement rate per send is higher and reputation compounds upward. Second, asking a simple question in the first email, one that invites a reply, does double duty: it improves your response rate and it feeds the positive engagement signal that protects placement. Write to earn a reply, and deliverability tends to follow.

Step 8: Seed test and check inbox placement

You can't fix what you can't see, and the open rate won't tell you where your emails actually land. Two tools close that gap.

Seed inbox placement tests. Services that maintain a panel of seed inboxes across Gmail, Outlook, Yahoo, and others let you send a test campaign and see exactly where it lands per provider: inbox, promotions, or spam. Run one before a major campaign and after any significant change to copy, volume, or infrastructure. A placement test catches a spam problem before you've burned it into a real audience.

Google Postmaster Tools. If you send any meaningful volume to Gmail addresses, set up Google Postmaster Tools for your sending domain. It reports domain and IP reputation, spam complaint rates, and authentication results straight from Google. A reputation that drifts from high to medium is an early warning to slow down before placement collapses. It's free and it's the closest thing to seeing your reputation through Gmail's own eyes.

Treat both as routine instrumentation, not a one-time check. The operators who maintain deliverability are the ones watching placement signals weekly, not the ones reacting after replies dry up.

Step 9: Monitor replies, bounces, and negative signals

Most deliverability problems are visible 48 to 72 hours before they become serious, if someone is watching. The signals to track daily during active campaigns:

• Bounce rate: total bounces divided by total sent. Under 3 percent is healthy. Above 5 percent is a warning. Above 10 percent, pause everything.
• Reply rate: includes positive, negative, and out-of-office. A sudden drop usually means deliverability issues, not bad copy.
• Positive reply rate: the signal that actually maps to business outcomes. Track it separately from total replies.
• Spam complaints: if any mailbox provider reports complaints, slow down immediately.
• Open rate trend: less reliable than before due to privacy features, but a sustained drop across many recipients still matters.
• Per-inbox health: some inboxes degrade faster than others. Per-inbox visibility lets you pause individual problem accounts without killing the whole campaign.

Analytics help monitor outbound activity, but replies and business outcomes matter more than vanity metrics.

Any modern cold email tool surfaces these metrics, but the per-inbox view is what matters most for diagnosing problems. Instantly's analytics dashboard makes this view simple, and competitor tools handle it differently. Whichever tool you pick, the discipline matters more than the dashboard, so check daily during active campaigns.

Step 10: Know when the problem is not the tool

When deliverability drops, the first instinct is often to blame the cold email software. In our experience reviewing operator forums and case studies, the tool is rarely the actual cause. Before you switch tools, check this list:

• Domain authentication: did SPF, DKIM, or DMARC break? Verify with MXToolbox or Google Postmaster Tools.
• List quality: did you import a fresh, unverified list recently? Bounce rate jumps right after.
• Sending volume: did you ramp up faster than your warmup ramp? Filters notice.
• Email copy: did you change subject lines or add new templates that may trigger filters?
• Offer relevance: did your reply rate drop because the offer is misaligned, not because of deliverability?
• Targeting: did the persona shift to a different industry or seniority that responds differently?
• Mailbox age: are you sending from newly added inboxes that haven't warmed up yet?
• Spam complaints: did a recent campaign generate complaints that are now affecting subsequent sends?

If all eight check out and the problem persists, then the tool may actually be the bottleneck. Usually it's one of the eight above.

How to recover a burned sending domain

Sometimes the damage is already done: a domain is landing in spam and reply rates have cratered. Recovery is possible, but it's slow, and sometimes the honest answer is to retire the domain. Here's the realistic playbook.

Stop sending cold immediately. Continuing to send from a damaged domain deepens the hole. Pause all cold campaigns on it.

Diagnose the cause. Check authentication, recent bounce spikes, blacklist status (tools like MXToolbox list common blacklists), and complaint rates in Postmaster Tools. You can't fix what you can't name.

Re-warm slowly. If the domain is salvageable, return it to pure warmup for two to four weeks with no cold sending at all, letting positive engagement rebuild reputation. Then ramp far more conservatively than the first time.

Know when to abandon. If the domain is on multiple blacklists or reputation stays low after weeks of warmup, the time cost of recovery often exceeds the cost of a fresh sending domain. Sending domains are cheap. Retire the burned one, keep it parked, and start clean. The lesson to carry forward is that the warmup and ramp discipline above is far cheaper than recovery.

Where Instantly fits in the deliverability stack

Tools cannot fix bad fundamentals. They can make good fundamentals easier to maintain at scale. That's where Instantly is actually useful:

Instantly is useful when

• You're managing more than three to five sending inboxes
• You need warmup automated rather than manual
• You want inbox rotation handled across multiple sending domains
• You need per-inbox and per-campaign analytics in one dashboard
• You're scaling outbound past what one person can manually manage

Instantly is overkill or wrong when

• You only send a few manual emails per week, where any tool is fine, including just Gmail
• Your domain or authentication setup is broken, since fixing that comes first and no tool helps
• Your lead list is unverified, so clean the data first, then think about sending volume
• Your offer or copy is weak, because better tooling doesn't fix a campaign nobody wants to reply to

Instantly's email accounts screen shows the core workflow: connect sending inboxes before launching campaigns.

Campaign management is where Instantly centralizes sending status, progress, clicks, replies, and opportunities.

For a deeper look at Instantly's product surface, see our Instantly review. For how it compares to Lemlist and Apollo on different dimensions, see the side-by-side comparison.

Test Instantly for multi-inbox outreach →

Compliance: CAN-SPAM, GDPR, and CASL in practice

Deliverability and compliance overlap, because the behaviors that keep you legal also keep you out of spam. Here's the practical version for the three regimes most B2B senders touch. None of this is legal advice, so confirm with counsel for your situation.

CAN-SPAM (United States). Cold B2B email is allowed. The requirements are simple: don't use deceptive subject lines or headers, identify the message as an outreach where relevant, include a valid physical postal address, and honor opt-out requests promptly. A clear unsubscribe path is both a legal requirement and a spam-complaint reducer.

GDPR (European Union and UK). Stricter. Outreach to business contacts can rest on legitimate interest, but the bar is real: the message must be relevant to the person's professional role, you must be able to justify why you contacted them, and you must offer an easy opt-out. Sending generic blasts to EU contacts without role relevance is where senders get into trouble.

CASL (Canada). The strictest of the three, generally requiring consent, with narrow exceptions for existing business relationships and for messages to published business addresses that relate to the recipient's role. If you sell into Canada at any scale, get specific guidance.

The common thread across all three is relevance plus a clear opt-out. Tools handle the mechanics of unsubscribe links and physical-address footers, but the relevance and the consent posture are yours to get right.

The pre-flight checklist: before every campaign

Print this out, save it as a Notion page, or just review it before each launch. Every item below should be a green check before the first email goes out.

Frequently asked questions

What is cold email deliverability?

Cold email deliverability is the rate at which your cold emails reach the recipient's inbox rather than the spam folder or being blocked entirely. It depends on your sending domain reputation, authentication setup, warmup history, sending volume, list quality, copy patterns, and recipient engagement. There is no single setting that controls it. It's the cumulative result of every variable in this checklist.

Can a tool guarantee inbox placement?

No. No cold email tool can guarantee inbox placement. That decision is made by Gmail, Outlook, and other mailbox providers based on signals they don't fully disclose. What tools like Instantly do is make it easier to manage the variables you can control: warmup, inbox rotation, sending volume, and analytics. Setup, list quality, and copy still need to be right.

How long should I warm up a new inbox?

14 to 28 days is the standard range. New inboxes with zero sending history need closer to 28 days for a clean reputation build. Existing inboxes that have been used for normal correspondence but never for cold outbound can sometimes be ready in 14 days. Stop warmup only when the warmup tool's dashboard shows consistently strong inbox placement across major providers.

Should I use my main domain for cold email?

No. Cold email, even when done carefully, carries reputation risk that can damage transactional email, marketing newsletters, and team communication if it happens on your main company domain. Always buy a separate sending domain and reserve the main one for business-critical email.

How many emails can I send per inbox per day?

The conservative cap for cold outbound is around 30 to 50 emails per inbox per day, ramped gradually over two to three weeks. Sending more than this from a single inbox increases the chance of throttling or spam routing. When you need more volume, add more inboxes rather than pushing per-inbox limits.

Do SPF, DKIM, and DMARC really matter?

Yes. In 2026 they're effectively mandatory. Gmail and Yahoo formally require them for senders above modest volumes, and Outlook's enforcement keeps tightening. Skipping any one of them dramatically increases the chance of spam routing regardless of how good your copy and list are.

Is open tracking bad for deliverability?

Open tracking isn't outright bad, but it has real trade-offs in 2026. Privacy features in Apple Mail and other clients pre-fetch tracking pixels, which inflates the metric and makes the data less reliable. The tracking itself adds a tracking-pixel image and a server lookup, both of which mailbox providers can use as one signal among many. Some operators disable open tracking for cold campaigns entirely, while click tracking is usually kept since CTA performance is more actionable. For the full picture on why the open rate broke and what to measure instead, see our guide to Apple Mail Privacy and cold email open rates.

What is a good bounce rate?

Under 2 percent is excellent. 2 to 5 percent is acceptable. Above 5 percent is a warning sign that your list quality is hurting your sender reputation. Above 10 percent, pause sending and clean the list before continuing, because every additional bounce at that rate accelerates reputation damage.

Should I use a finder like Hunter before a sender?

Yes. List quality from a finder such as Hunter, Apollo, or Snov.io upstream matters more than send tooling downstream. The standard pattern is to source verified emails with a finder, then send through a dedicated sender. See our guide to email finder tools for which finder fits which use case.

What is the fastest way to damage a sending domain?

Send 500 emails on day one from a brand-new inbox, with no warmup, no SPF, DKIM, or DMARC, to a purchased unverified list, with no personalization, from your main company domain. You'll be on multiple blacklists within 48 hours and recovery takes weeks. Every step in this checklist exists to prevent some part of that scenario.

Bottom line

Deliverability is not a tool problem. It's a setup problem, a reputation problem, a targeting problem, a copy problem, and a volume-control problem. Cold email tools help with some of these (warmup, inbox rotation, analytics, sending throttling) but cannot fix the others (domain authentication, list quality, offer relevance, copy patterns).

Beginners should fix domain setup and list quality before paying for software. Operators scaling past a handful of inboxes will get real leverage from a tool that handles warmup, rotation, and analytics in one workflow, and Instantly is the strongest fit we've found for that motion.

Whatever stack you pick, the principles in this checklist are constant. Tools change. Authentication standards change. Mailbox provider rules change. The underlying truth doesn't: look like a legitimate sender at every layer, and you'll be treated like one.

If you do only three things from this guide, do these: send from a dedicated domain you've warmed for at least two weeks, send only to a verified list, and watch your reply and bounce signals daily. Those three habits prevent the large majority of deliverability disasters. Everything else on this page is refinement on top of that foundation, and the foundation is what actually keeps you in the inbox.

See if Instantly fits your workflow →

Related reading on EmailToolsHub

• Best Cold Email Software 2026, the broader tool comparison
• Instantly Review 2026, the dedicated product review
• Instantly vs Lemlist vs Apollo, the head-to-head comparison
• Best Email Warmup Tools, standalone warmup options
• Best Email Finder Tools, list-building upstream of sending
• Hunter Review, the cleanest dedicated finder
• Our methodology, how we evaluate tools

Related Reviews & Guides

Other deep dives on EmailToolsHub that pair well with this one.

Browse all reviews →