Short answer: your cold email reaches the inbox when three DNS records are right (SPF, DKIM and DMARC), when you meet the sender rules Gmail and Yahoo have enforced since February 2024 (authentication, easy unsubscribe, spam rate under 0.3%), and when you grow volume slowly. Skip any of these and even a great message goes unread.
An SPF record that leaves out your sequencing tool is quietly costing you emails that land in spam (Gmail). You write a sharp first email, pick the right account and hit send. No reply. You don’t even know whether it landed. That’s what makes deliverability painful: it fails quietly. Nobody tells you “this went to spam”. Reply rates just drop, and you start rewriting subject lines that were never the problem.
This guide sits underneath your sequence. Here we look at the plumbing: the domain, the authentication and the sending pace.
Deliverability at a glance
| Piece | What it does | What Gmail and Yahoo require | Source |
|---|---|---|---|
| SPF | Lists the servers allowed to send for your domain | All senders: SPF or DKIM. Bulk senders: SPF and DKIM | Gmail · Yahoo |
| DKIM | Signs each message so receivers know it came from you, unchanged | Key of at least 1024 bits; Google recommends 2048 | Gmail · Yahoo |
| DMARC | Tells receivers what to do when SPF or DKIM fail, and sends you reports | Bulk senders: a published policy (p=none is fine) and From: alignment |
Gmail · Yahoo |
| Reverse DNS (PTR) | Ties your sending IP to a valid hostname | All senders | Gmail · Yahoo |
| One-click unsubscribe | Lets people opt out without logging in anywhere | Bulk senders, on marketing and subscribed mail. Yahoo asks you to honour it within 2 days | Gmail · Yahoo |
| Spam rate | Share of recipients who report you as spam | Below 0.3%. Gmail recommends staying below 0.1% | Gmail · Yahoo |
| Warm-up | Gradual increase in sending volume | Gmail asks for slow growth and no sudden spikes | Gmail |
| Our standard | How we apply it for every client | At least 10 mailboxes, 30 cold emails per mailbox per day, 3-week warm-up, bounce rate capped at 2% | HelloMrLead internal data |
What is cold email deliverability, and why does it fail silently?
Cold email deliverability is your ability to land in the inbox rather than in spam or a bounce. It rests on three things your prospect never sees: whether your domain proves who it is, whether your sender reputation holds up, and whether your sending pattern looks like a person or a blast.
It fails silently because mailbox providers decide on their side. Your tool says “sent”, and it’s right. It just can’t tell you where the message ended up. So deliverability is something you set up before the first send and keep an eye on for the whole campaign.
One warning about open rates. Google’s sender guidelines say it doesn’t track opens, can’t verify open rates reported by third parties, and that low open rates aren’t necessarily an accurate sign of delivery problems (Gmail sender guidelines). If opens are your only alarm, you’re flying blind.
How do SPF, DKIM and DMARC work, and how do you set them up?
SPF, DKIM and DMARC are DNS records you publish so receiving servers can check that mail from your domain really is yours. SPF and DKIM do the authenticating. DMARC ties them to the domain people see in the From: line.
SPF: who may send for you
SPF is a TXT record listing every server allowed to send with your domain. Google is clear that it must cover all your senders. If your cold email tool isn’t in the record, its messages are more likely to be flagged (Gmail).
To audit yours:
- List everything that sends as your domain: mailbox provider, sequencing tool, CRM, newsletter platform.
- Make sure your domain has exactly one SPF record. Two SPF records on one domain is an error.
- Add the
includeeach provider gives you. - Recheck whenever you add or drop a tool.
DKIM: a signature on every message
DKIM adds a cryptographic signature that receivers verify against a public key in your DNS. It shows the message came from your domain and wasn’t altered on the way.
Gmail requires a key of at least 1024 bits for mail to personal accounts and recommends 2048 where your provider supports it (Gmail). Yahoo sets the same 1024-bit floor (Yahoo). Turn DKIM on in every tool that sends for you, not just your main mailbox.
DMARC: policy plus reporting
DMARC tells the receiving server what to do with mail that fails SPF and DKIM, and sends you reports on everything using your domain. To pass, the authenticating domain has to match the one in the From: header (Gmail).
A sensible rollout:
- Start with
p=noneand anruaaddress for reports. Yahoo explicitly recommends theruatag during initial setup (Yahoo). - Read the reports for a few weeks and spot services sending as you without authentication.
- Fix SPF and DKIM for those services.
- Once all legitimate mail passes, consider moving to
quarantine, thenreject.
Both Gmail and Yahoo accept p=none as meeting the requirement. Tightening your policy is your security call; they don’t make it a condition for sending.
What do the 2024 Gmail and Yahoo sender requirements actually ask for?
Since February 2024, Gmail and Yahoo apply one set of rules to everyone who emails their users and a stricter set to bulk senders. Google draws the bulk line at more than 5,000 messages a day to Gmail accounts (Gmail). Yahoo gives no number: its FAQ defines a bulk sender as one sending “a significant volume of mail” and says it will not specify a threshold (Yahoo FAQ). Microsoft joined in 2025: since 5 May 2025, Outlook.com requires SPF, DKIM and DMARC from domains sending more than 5,000 emails a day to its accounts (Outlook.com sender policies).
Rules for every sender
According to both official pages, you, like every sender, must:
- Authenticate with at least SPF or DKIM.
- Have valid forward and reverse DNS (PTR) on sending IPs.
- Keep the spam rate below 0.3%.
- Format mail to the standards (RFC 5322; Yahoo adds RFC 5321).
Gmail also requires TLS in transit and forbids impersonating Gmail From: headers (Gmail).
Extra rules for bulk senders
If you’re a bulk sender, you must also:
- Authenticate with SPF and DKIM.
- Publish DMARC (
p=noneis enough) with the From: domain aligned to the SPF or DKIM domain. - Support one-click unsubscribe on marketing and subscribed mail, plus a visible unsubscribe link in the body. Both sources point to the RFC 8058 POST method, and Yahoo asks you to process opt-outs within 2 days (Yahoo).
Does this matter if you only send a few emails a day?
Yes. The every-sender rules apply from your first message. The bulk rules are, in practice, a picture of what providers expect from anyone who takes email seriously. Meeting them early is cheap. Rescuing a burned domain is not.
There’s one thing we won’t hide from you: Gmail’s guidelines say to send email only to people who have subscribed (Gmail). Cold email, by definition, writes to people who haven’t. We accept that: we meet every technical rule, keep the list clean and only write when there’s a clear reason. What the law says about it is the subject of our post on cold email legality, out on 12 November.
Keep the B2B angle in mind too. Google’s threshold counts mail to Gmail accounts, while Google Workspace applies its own sending limits for work accounts (Gmail). Most of your prospects sit on corporate domains hosted by Google Workspace or Microsoft 365, and that matters. Outlook.com’s 2025 rules cover Microsoft’s consumer email services (Outlook.com, Hotmail, Live): above 5,000 messages using the same From: domain, SPF and DKIM must pass and DMARC must be published (at least p=none) and aligned with SPF or DKIM. Non-compliant mail is rejected with error 550 5.7.515 (Microsoft Support). We haven’t found an equivalent published rule for Microsoft 365 business mailboxes, so meeting the same bar is the safe call.
What is email warm-up, and how long does a new domain need?
Warm-up means growing the sending volume of a new domain or mailbox gradually, so providers can build a reputation for it before it sends much. A domain that jumps from zero to hundreds of emails a day looks exactly like what spam filters are built to stop.
Google’s guidance is plain: start low, send to engaged recipients, grow slowly, keep a steady rate and avoid bursts. Its example is that suddenly doubling your usual volume can trigger rate limiting or hurt your reputation. It adds that the more you send, the slower you should grow, and that daily senders can ramp faster than weekly ones (Gmail).
How many weeks? Neither Google nor Yahoo publishes a schedule. The most concrete public reference we found is Amazon SES: its automatic warm-up for dedicated IPs ramps volume over 45 days (Amazon SES). That’s about dedicated IPs, not domains or mailboxes, so treat it as an order of magnitude. We warm up every mailbox for 3 weeks before it joins a campaign (HelloMrLead internal data), and within that window we let signals decide:
- Start small. A few sends per mailbox per day, to verified contacts that fit your ICP.
- Step up. Raise volume only when bounces, deferrals and spam rate stayed flat at the previous step.
- Read the SMTP codes. A 4.7.28 from Gmail means you hit a quota: stop for at least 10 minutes, then resume over a single connection (Gmail).
- Back off when things slip. If bounces or deferrals appear, cut volume until errors drop, then climb again slowly.
- Treat every big change as a fresh start. Google recommends ramping gradually after changing your email format or sending setup.
Automated warm-up tools swap emails between mailboxes to simulate engagement. Use them as an extra if you like. What really builds reputation is writing to people for whom your email makes sense.
Should you send cold email from your main domain or a secondary one?
Send cold email from a secondary domain (a close variant of your brand) and keep the main domain for day-to-day mail, invoices and notifications. If a campaign goes wrong, the reputation that takes the hit is the secondary one.
Neither provider says “secondary domain” in so many words, but both push you to separate mail types. Google recommends a distinct From: address per message category and, with several IPs, one IP per type (Gmail). Yahoo says not to send bulk or marketing mail from the IPs you use for user or transactional mail, because each IP and DKIM domain carries its own reputation (Yahoo).
If you go the secondary route:
- Set up SPF, DKIM and DMARC on it exactly as on the main domain.
- Redirect it to your website and send as a real, named person.
- Warm it up before any campaign.
- Be upfront. The display name should clearly identify the sender. Google says it shouldn’t fake a reply thread or include the recipient’s name (Gmail).
How can you tell whether your emails reach the inbox?
Look at provider-side data and your own campaign data, not open rates.
| Signal | Where to check | What it tells you |
|---|---|---|
| Spam rate | Google Postmaster Tools | Nearing 0.3%? Stop and review list and message |
| Authentication | Postmaster Tools and DMARC reports | Whether any service sends as you without passing SPF or DKIM |
| Bounces | Your sending tool | List quality. Amazon SES recommends staying below 2% and reviews accounts at 5% or more (Amazon SES) |
| SMTP codes | Sending logs | 4.7.28 (quota), 5.7.26 (unauthenticated), 5.7.1 (poor IP reputation), per Gmail |
| Replies per mailbox | Your CRM | One mailbox dropping while others hold? Check its domain |
Yahoo runs a Complaint Feedback Loop that sends you copies of spam complaints for DKIM-signed domains (Yahoo). If your list includes Yahoo users, sign up.
How we do it at HelloMrLead
Our job at HelloMrLead is booking meetings with decision makers, and deliverability is the part of that job nobody sees. We work with databases, buyer personas, calls and meeting setting, and email only pulls its weight if it lands. So before a campaign goes live, we check things in this order:
- List before domain. We validate who we’re writing to against the ICP and verify contacts first. A perfectly configured domain won’t survive a bad list. The groundwork is in how to validate your ICP with outbound before you scale [EN version pending in WPML; swap to the /en/ URL once live].
- Authentication per tool. We inventory everything that sends as the domain and check SPF, DKIM and DMARC for each one, not just the main mailbox.
- Volume that follows signals. We raise volume when the previous step’s signals are clean, not because the calendar says so.
- Replies leave the sequence. Any reply, including a “no” or a “talk to my colleague”, takes the contact out of automated sends.
- No tricks. Honest subject lines, no fake “Re:”, and a sender who is a real person.
And these are our numbers (HelloMrLead internal data):
- We run at least 10 mailboxes per client and send 30 cold emails per mailbox per day.
- We warm up every mailbox for 3 weeks before its first campaign.
- We verify contacts with MillionVerifier and BetterContact and send with Instantly. Our bounce rate never goes above 2%.
- 90% of what we send lands in the primary inbox, and our reply rate sits at 4% or higher.
- Every email is personalised. We’ve moved past snippets: we personalise whole paragraphs using the Perplexity API.
Which deliverability mistakes should you avoid?
- Trusting open rates. Google doesn’t measure them and can’t verify anyone else’s. Watch spam rate, bounces and replies.
- Leaving a tool out of SPF. The CRM or sequencer that isn’t listed sends unauthenticated mail.
- Launching from a fresh domain with no warm-up. It’s the sending profile that looks most like spam.
- Buying lists. Both Gmail and Yahoo advise against it in writing.
- Subject lines that fake a conversation. Gmail asks you not to use “Re:” or “Fwd:” unless the email really is a reply or forward.
FAQ
Do I need DMARC to send cold email?
If you’re a bulk sender, yes. Gmail and Yahoo have required it since February 2024 and accept a p=none policy (Gmail, Yahoo). Below that volume it isn’t mandatory, though Google recommends SPF, DKIM and DMARC for every domain.
When do I count as a bulk sender?
For Gmail, when you send more than 5,000 messages a day to Gmail accounts (Gmail). Yahoo gives no number and says it won’t specify one (Yahoo FAQ). Outlook.com sets its line at more than 5,000 emails a day (Outlook.com).
Does B2B cold email need one-click unsubscribe?
Gmail requires it from senders above 5,000 messages a day, on marketing and subscribed mail. Even below that, a clear way to opt out cuts spam complaints. We cover the legal side of cold email (GDPR and local rules) in our 12 November post, with legal review.
How long should I warm up a domain?
Neither Google nor Yahoo gives a figure. Google asks for slow, steady growth with no spikes. Amazon SES warms dedicated IPs over 45 days, as an order of magnitude. We warm up each mailbox for 3 weeks (HelloMrLead internal data) and base each step on bounces, spam rate and SMTP codes from the step before.
Want to put this to work this week? Grab B2B prospecting guides and checklists to get your next outbound campaign ready. Get the SDR Pack
