Cold Email Deliverability: The Setup That Keeps You Out of Spam

Cold email deliverability is now a compliance problem with a technical surface, not a copywriting problem. Gmail publishes explicit requirements for anyone sending at volume, and since late 2025 it has been enforcing them with rejections rather than warnings. If your authentication is incomplete or your complaint rate drifts, the failure mode is not lower open rates. It is bounced mail.

This is for revenue teams running outbound from their own domains who would like to still have those domains next quarter.

The Rules Gmail Actually Enforces

Google's sender guidelines set a bright line at 5,000 messages per day to Gmail addresses, and the requirements above that line are specific:

• SPF and DKIM configured for the sending domain, plus a DMARC record; the policy may be p=none, but the record must exist and align.
• Valid forward and reverse DNS (PTR) for sending IPs, and TLS on transmission.
• One-click unsubscribe meeting RFC 8058 on marketing and promotional mail, with requests honored within two days.
• User-reported spam rate kept below 0.3%, monitored in Postmaster Tools.

Treat 0.3% as the cliff, not the target. Google's own guidance is to stay under 0.1%. At 0.3% you lose access to mitigation support until you hold below it for a week straight, which in practice means a bad fortnight costs you a month.

One clarifying number: 0.1% is one complaint per thousand delivered. If you send 2,000 cold emails and three people hit the spam button, you are already over the good line. Cold outbound has almost no margin here, which is why list quality is a deliverability control and not a marketing preference.

Never Send Cold Mail From Your Primary Domain

The single highest-consequence decision. Reputation attaches to the domain. If grobotlabs.com is both where our invoices come from and where 3,000 cold emails a week come from, one bad campaign takes down billing, support, and recruiting mail with it.

The standard structure: register two to four lookalike domains, point them at the same brand, and send outbound only from those. grobotlabs.com stays clean. If a secondary domain burns, you retire it and the business does not notice.

Each secondary domain should carry its own SPF, DKIM, and DMARC, a real website that redirects to the brand (not a parked page) and mailboxes that look like people, not like departments.

Mailbox Math Beats Clever Copy

A mailbox on a healthy domain sends roughly 30 to 50 cold emails a day without stress. That is the unit. Everything scales from it.

So 600 sends a day is not one mailbox working hard, it is twelve to twenty mailboxes working normally, spread across three or four domains. Teams that try to make one mailbox do the work of fifteen end up in spam with a perfectly good offer.

New mailboxes need three to four weeks of warmup before they carry campaign volume; gradually increasing send counts with genuine reply activity. Warmup is not optional and it cannot be compressed. The cost of skipping it is the domain.

This is the infrastructure Blitz handles inside grobot Command Center: domain and mailbox provisioning, warmup, rotation across mailboxes, and throttling, so the sending shape stays inside these limits without anyone maintaining a spreadsheet of which inbox sent what. Sends are included in the license; we do not meter them.

Verify Every List, Every Time

Bounce rate is the fastest way to destroy a new domain. Mailbox providers read a high hard-bounce rate as list purchasing, and they are usually right.

Keep hard bounces under 2% and preferably under 1%. That means verification immediately before send, not at import. B2B email decays at roughly 2 to 3% per month as people change jobs, so a list verified in March is meaningfully rotten by September.

Drop catch-all domains from cold campaigns or segment them separately. They accept everything and tell you nothing, so they quietly inflate your apparent delivery while contributing complaints.

The Content Signals That Still Matter

Filters got better, which means most old tricks are noise. What still moves placement:

• Links. One, at most, and ideally none in the first email. A cold message with three tracked links and an image signature looks like a newsletter.
• Open tracking pixels. They add a remote image to a message that otherwise has none, and their deliverability cost now often exceeds the value of a metric Apple Mail Privacy Protection already broke.
• Plain text. Send text, not HTML templates. It matches what a real person sends and it renders everywhere.
• Reply rate. It is the strongest positive signal available to you. A campaign that gets replies is a campaign that keeps landing, which means relevance is a technical control too.

Monitor Three Things Weekly

Postmaster Tools for Gmail spam rate and domain reputation; this is the authoritative view and it is free. Your sending tool's bounce rate by domain, which localizes problems to a specific mailbox before they spread. And a seed inbox test across Gmail, Outlook, and one corporate Microsoft 365 tenant, because Microsoft filtering behaves differently enough that Gmail-only testing will mislead you.

If reputation slips, cut volume by half immediately and hold for a week. Recovery is slow and it is the only lever that reliably works.

The Short Version

Separate domains, authenticated properly. Many mailboxes at low volume rather than few at high volume. Warm up for a month before you scale. Verify right before send. Keep complaints under one in a thousand and bounces under one in a hundred. Watch Postmaster weekly.

None of this is clever. All of it is load-bearing, and the teams that skip it spend the following quarter rebuilding sending infrastructure instead of running pipeline.