How to keep cold emails out of the spam folder

Cold email has a technical problem and a behavioural problem, and people usually try to fix the wrong one. They spend a week on DNS records, then send four hundred messages a day from a fresh domain to a list they never verified, and wonder why nothing arrives.

The technical setup gets you the right to be considered. What decides the outcome is how you send and who you send to.

Why does cold email end up in spam?

Mailbox providers are trying to answer one question: does the person receiving this want it?

They answer it with signals. Does the sending domain authenticate properly. Does this sender usually get opened and replied to, or deleted and reported. Do the addresses exist. Has the volume changed suddenly. Do other people who got the same message mark it as junk.

None of those are about your words. You can write a genuinely useful message and still land in spam because your list was dirty and your domain was new.

What has to be right technically?

Get these done before the first send. They are not optional any more.

SPF lists which servers may send for your domain. DKIM signs your messages so they can be verified. DMARC tells providers what to do when a message fails those checks, and where to send reports. All three are DNS records, and most sending platforms give you the exact values to paste.

A separate sending domain. Buy something close to your main domain, redirect it to your website, and send cold email only from there. This is the single most valuable thing on this list. Your main domain carries your invoices, your contracts and your support replies, and it should never be exposed to cold sending.

A real mailbox with a real signature. Full name, company, address, a working reply path. Messages from an address that cannot receive replies are treated accordingly.

Warm the domain up. A brand new domain that starts sending in volume looks exactly like a spammer. Start small and increase gradually over several weeks.

The specific limits, warm up periods and authentication requirements are set by the mailbox providers and they get tightened regularly. Follow your sending platform's current documentation rather than a checklist from a few years ago. [VERIFY: source, current authentication and warm up requirements from your sending platform]

What has to be right about the list?

This is where most damage happens.

Verify every address. Bounces are a direct signal that you are working from a bought or scraped list. Run addresses through a verification service and drop anything risky, unknown or catch all.

Stop guessing patterns. Sending to firstname@ and f.lastname@ and firstinitiallastname@ the same company means two of the three bounce. Providers notice.

Remove role addresses. info@, sales@, support@ and hello@ are more likely to be reported and less likely to be read by anyone who can buy.

Keep the list small. A small list of companies with a reason to hear from you outperforms a large one, and it protects the domain while it is doing it.

Take people off it properly. Someone who asked to be left alone and gets another sequence is someone who presses the junk button, which costs you far more than one lost prospect.

What has to be right about the message?

The content matters less than people think for filtering, and more than anything for the replies that build reputation.

Short. If it does not fit on a phone screen without scrolling, cut it.

One ask. A question is better than a meeting request in a first message.

Plain. No tracking pixel, no images, no logos in the signature, no link shorteners. A one link message from a real person is what normal email looks like.

Specific in the first line. This is the reply engine. A first line that could be sent to a thousand companies gets treated like it was.

Honest subject lines. "Re:" on a message that is not a reply, or "Quick question" when it is a pitch, is the kind of thing that gets marked as junk once and remembered.

Habits that keep the domain alive

Send slowly. Spread sends across the working day rather than firing a batch at nine in the morning.

Add mailboxes, not volume. Three mailboxes sending a small number each is safer than one sending three times as many.

Watch the numbers weekly. Bounce rate, reply rate, and any complaint reporting your provider gives you. A rising bounce rate means the list has gone stale. A falling reply rate usually means the message got lazy.

Pause when something looks wrong. The instinct is to send more to make up the shortfall. That is how a domain gets burned in a fortnight.

Keep a clean domain in reserve and never use your main one.

A sensible order of operations

1. Buy and redirect a separate sending domain.
2. Publish SPF, DKIM and DMARC for it.
3. Create one or two mailboxes with real signatures.
4. Warm them up gradually before any cold sending.
5. Build a small verified list, ideally with a real reason per company.
6. Send low volumes, spread through the day.
7. Watch bounce and reply rates weekly and fix the list before raising volume.

Steps one to four are a few hours of work and then a wait. Step five is where the effort actually lives.

What about AI writing the emails?

Drafting tools are fine for structure and for tightening a paragraph. They cause two specific problems in cold email.

They invent things. A model asked to personalise an opener will happily state something about a company that is not true, and the reader can tell.

They flatten the voice. Send five hundred messages that all sound like the same competent robot and recipients start recognising the shape before they read the words.

Use them to edit, not to fabricate. Every claim about a company in your first line should come from a page you can link to.

The honest summary

Deliverability is mostly operational discipline. Separate domain, correct records, verified list, low volume, real replies, and the willingness to stop when the numbers turn.

None of it is clever. All of it is skippable, which is why so many teams end up rebuilding from a new domain twice a year.

Common questions