Cold email deliverability: SPF, DKIM, DMARC, warm-up and volumes

What is email deliverability?

Deliverability is the share of your emails that reaches the inbox rather than spam (or nowhere). Mailbox providers like Gmail, Outlook and Yahoo decide based on several signals: is your domain authenticated? What’s its reputation? Do recipients open, reply, or report you as spam? Do your addresses exist? In cold email, where nobody is expecting you, every one of those signals counts double.

What Gmail, Yahoo and Outlook require since 2024

In February 2024, Google and Yahoo started enforcing new sender rules, with stricter ones for “bulk senders”. Microsoft announced similar requirements for Outlook in 2025.

Google defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours, and says the status is permanent once assigned. Yahoo gives no threshold. Even if you never reach those volumes, follow the bulk requirements: they’ve become the de facto baseline.

SPF, DKIM and DMARC, simply explained

1. 1
   SPF: who is allowed to send

   A TXT record on your domain lists the servers allowed to send on its behalf. Example for Google Workspace: v=spf1 include:_spf.google.com ~all. Only one SPF record per domain; if you use several services, add them to the same record and stay under the 10 DNS lookup limit.

2. 2
   DKIM: the signature

   Your email provider signs each message with a key; you publish the public key in a TXT record (selector._domainkey.yourdomain). In both Google Workspace and Microsoft 365, you generate the key from the admin console.

3. 3
   DMARC: the policy and the reports

   A TXT record at _dmarc.yourdomain says what to do with mail that fails SPF and DKIM, and where to send reports. Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain, read the reports for a few weeks, then move to p=quarantine or p=reject.

4. 4
   Check it

   Send yourself an email at a Gmail address and open “Show original”: SPF, DKIM and DMARC should all say PASS.

Should you use a separate sending domain?

Many teams send cold email from a domain close to their main one (for example yourcompany-mail.com or getyourcompany.com) rather than from the domain that carries their invoices and customer email. The idea: if the prospecting domain’s reputation suffers, the main domain stays safe.

• Set it up fully: SPF, DKIM, DMARC, and a redirect from its website to your main site.
• Stay transparent: real name, real company, real signature. A separate domain protects your reputation; it isn’t there to hide who you are.
• Let it mature: a brand-new domain has no reputation; start very slowly.
• No rotation to dodge filters: spinning up domains to send more unwanted mail always gets noticed eventually.

If you send little (a few dozen very targeted messages a day), sending from your well-configured main domain remains a reasonable option.

Warm-up and daily volumes

Google puts it simply: when you increase sending volume, start low, with engaged recipients, and increase slowly. A new mailbox sending 300 cold emails on day one looks like a hacked account.

• Weeks 1–2: normal email to contacts who reply (colleagues, partners, customers).
• Then: a few cold emails a day, increasing gradually as long as bounces and complaints stay low.
• Cruising speed: many practitioners stay at a few dozen cold emails per mailbox per day; there is no official number, and your email provider has its own daily sending limits too.
• Several mailboxes rather than one overloaded one if you need volume, each configured and warmed up separately.

List hygiene: half the job

• Don’t buy lists. Google’s guidelines say so in plain words, and those lists are full of dead addresses and spam traps.
• Verify addresses before sending and drop invalid ones; a high bounce rate damages reputation fast.
• Remove immediately bounces, unsubscribes and anyone who asks you to stop, and keep them on a suppression list.
• Avoid generic addresses (contact@, info@) when you can find the right person; they reply less and report more.
• Target narrowly: fewer, better-chosen recipients means fewer complaints.

Content that doesn’t look like spam

• Plain, short text, like an email written by hand; not a heavy HTML newsletter.
• At most one link in the first message, no URL shorteners, no attachments.
• Real personalisation in the first sentence, not just {{first_name}}.
• Wording variants (spintax) so you don’t send the exact same text to hundreds of people.
• A consistent sender name and signature, with the company name and a way to reach it.
• Some senders turn off open tracking on the first email to keep the message as plain as possible.

For the writing itself, see our cold message templates.

Unsubscribe and consent

Google’s and Yahoo’s one-click unsubscribe rule targets bulk senders’ marketing messages. For B2B cold email, include at least a clear way to opt out (“Reply ‘stop’ and I won’t write again”) and act on it fast: Yahoo requires 2 days, Google recommends 48 hours. The law comes on top: in the US, CAN-SPAM also applies to B2B and requires a postal address and an opt-out (FTC guide); in Europe, the GDPR and national rules govern prospecting. Check the rules for the countries you target.

Monitoring deliverability

• Google Postmaster Tools to track spam rate and domain reputation at Gmail (most useful above a certain volume).
• Bounce rate per campaign: if it climbs, stop and clean the list.
• Reply rate: if it collapses suddenly with no change in the message, suspect the spam folder.
• DMARC reports to spot unauthorised mail sent in your domain’s name.

Where Yalors fits in

Yalors’ email outreach sends from your own mailbox (Gmail, Outlook or any IMAP mailbox), so SPF, DKIM and DMARC are set up on your domain, with your email provider. On the sending side, Yalors applies daily caps per account, a 14-day warm-up for newly connected accounts, sending windows, random delays and a stop as soon as a prospect replies. Variables with fallbacks, spintax and A/B variants avoid identical texts, and per-step open and click stats show what works. Email can also be part of a multichannel sequence with LinkedIn and WhatsApp. Plans are on the pricing page.

Checklist before your first campaign

1. SPF, DKIM and DMARC published and passing on a test email.
2. Sending domain decided (main or dedicated), with a website redirect if dedicated.
3. Mailbox warmed up gradually.
4. List verified, no bought addresses, suppression list in place.
5. Short, personal message, one link at most, an opt-out line.
6. Modest daily volume and a sending window in business hours.
7. Bounces, replies and complaints reviewed every week.