Cold Email Deliverability: The Complete Setup Checklist (SPF, DKIM, DMARC in Plain English)

Here's the truth most cold email advice skips: deliverability is roughly 80% of the outcome. If your emails land in spam, your subject line, your offer, and your perfectly-researched personalization are all irrelevant: nobody sees them. Get the setup right first, then worry about copy.

This is the checklist we run on every campaign before a single prospecting email goes out. Bookmark it, work through it top to bottom, and don't send until every box is checked.

Why is deliverability 80% of cold email success?

Because the inbox is a filter before it's an audience. Email providers score every message and decide whether it reaches the inbox, the spam folder, or nowhere. A message in spam has a near-zero reply rate no matter how good it is.

In our campaigns, the single biggest lever on reply rate isn't the writing: it's whether the email arrives at all. It's also the most common reason campaigns quietly fail, which we cover in why cold email campaigns fail. Fix deliverability and mediocre copy still books meetings; ignore it and brilliant copy books nothing.

Step 1: Get your domain strategy right

Never send cold email from your primary domain. If cold sending damages your sending reputation, and early on it might, you do not want that damage attached to the domain your invoices, contracts, and internal email run on.

• Buy secondary domains. Register lookalike domains for sending only, for example a ".co" or "get-" variant of your main domain. These are the ones that absorb any reputation risk.
• Point them at your brand. Set up a basic redirect so the secondary domain forwards to your real website. It should resolve to something legitimate.
• Spread volume across domains and mailboxes. A few mailboxes per domain, a few domains per campaign. This keeps per-mailbox volume low and isolates risk.
• Keep your primary domain clean. Use it for replies and relationships once a conversation is warm, not for cold prospecting.

Step 2: SPF, DKIM, and DMARC in plain English

These are three DNS records that together prove your email is really from you. They're the email world's ID check. Skip them and providers treat you as a probable impersonator. Here's what each one actually does:

• SPF (Sender Policy Framework). A list of the servers allowed to send email for your domain. When a provider receives your email, it checks the sender against this list. Think of it as a guest list at the door.
• DKIM (DomainKeys Identified Mail). A cryptographic signature added to each email that proves the message wasn't tampered with in transit and genuinely came from your domain. Think of it as a tamper-proof seal.
• DMARC (Domain-based Message Authentication). A policy that tells providers what to do when SPF or DKIM fails, and where to send reports. Think of it as the rulebook that ties the first two together.

You configure all three as DNS records on each sending domain. Most email-sending platforms give you the exact values to paste in. This is non-negotiable in 2026: set them up before your first send, and verify they pass with any free authentication checker.

Step 3: Warm up your mailboxes

A brand-new mailbox that immediately sends 40 cold emails looks exactly like a spammer. Warm-up gradually builds a positive sending reputation so providers learn to trust the mailbox before you scale.

1. Let each new mailbox and domain age for a couple of weeks before real sending.
2. Run an automated warm-up tool that sends and receives small volumes of friendly email, opening and replying to build engagement signals.
3. Ramp sending volume slowly over 2–4 weeks rather than starting at full throttle.
4. Keep warm-up running quietly in the background even once campaigns are live.

Step 4: Respect sending volume limits

Keep it low: around 20–40 emails per mailbox per day on a warmed-up inbox. The instinct to blast thousands of emails from one account is the fastest route to the spam folder.

Scale by adding mailboxes and domains, not by pushing a single inbox harder. If you need to reach 500 prospects a day, that's roughly 12–15 mailboxes sending modest volume each, not one mailbox screaming into the void. And remember the goal isn't raw volume anyway: we walk through the real math in how many cold emails to get a meeting.

Step 5: Keep your list clean

Sending to bad addresses is one of the strongest negative signals there is. Bounces tell providers you don't know who you're emailing, which is precisely what spammers look like.

• Verify every email before sending. Run your list through a verification service and remove invalid, risky, and catch-all addresses.
• Keep your bounce rate low. Aim to stay under about 2–3%. A spike in bounces can tank a domain's reputation quickly.
• Remove role and generic addresses. Info@, sales@, and support@ inboxes hurt engagement metrics and rarely reply.
• Re-verify older lists. Data decays fast: a list from a few months ago has already gone stale in places.

Step 6: Avoid content that trips spam filters

Once infrastructure is solid, content still sends signals. Cold email should look like a plain message a real person typed to one other person, because that's what gets through.

• Go light on links. One link at most in a first email; zero is often better. Multiple links look promotional.
• Skip images, tracking pixels, and heavy HTML. Plain text performs best and looks personal. Fancy formatting reads as a marketing blast.
• Avoid spammy language. "Free," "guarantee," "act now," all-caps, and rows of exclamation points are classic triggers.
• Keep it short and specific. A few sentences that clearly come from a human. Length and vagueness both hurt.
• Always include a real, easy opt-out. It's expected, and it protects your reputation.

Step 7: Follow Google and Microsoft's bulk-sender rules

Google and Microsoft tightened their requirements for bulk senders, and the bar is now effectively mandatory. The core rules are straightforward and you should treat them as table stakes:

• Authenticate every message with SPF, DKIM, and DMARC. This is no longer optional.
• Keep spam complaints very low, under roughly 0.3%, and ideally near zero. Complaints are the metric providers weigh most heavily.
• Make unsubscribing easy and honor opt-outs promptly.
• Send from a consistent, authenticated domain rather than rotating through disposable infrastructure that looks evasive.

Step 8: Monitor the right metrics every week

Deliverability isn't set-and-forget: reputation drifts. Check these weekly and act the moment one moves the wrong way:

• Bounce rate. Rising bounces mean list-quality problems. Pause and re-verify.
• Spam complaint rate. The most dangerous metric. Any uptick means stop and diagnose immediately.
• Reply rate. A sudden drop with no copy change often signals a deliverability problem, not a messaging one.
• Inbox placement. Use seed-inbox tests to confirm you're landing in the primary inbox, not spam or promotions.
• Domain and IP reputation. Monitor with free reputation tools so you catch damage before it compounds.

Frequently asked questions

What is the most important factor in cold email deliverability?

Domain and sending infrastructure. Sending from a separate secondary domain with SPF, DKIM, and DMARC configured, warmed-up mailboxes, and low daily volume matters more than any single word in your copy. Get the infrastructure right and the rest follows; get it wrong and the best email still lands in spam.

How many cold emails can I send per mailbox per day?

Keep it conservative, around 20–40 per mailbox per day on a warmed-up inbox. Scale by adding mailboxes and domains, not by pushing a single inbox harder. High volume from one mailbox is one of the fastest ways to get flagged.

Do I need SPF, DKIM, and DMARC for cold email?

Yes, all three, on every sending domain. They're DNS records that prove your email is legitimately from you. Google and Microsoft now effectively require them for bulk senders, and without them a large share of your email won't reach the inbox regardless of content.

Want a second set of eyes on your setup?

If your reply rates are low and you suspect deliverability, we're glad to run a quick teardown of your domain setup, authentication, and sending patterns, the same audit we do before taking on a campaign. It's genuinely useful whether or not we work together. Book a deliverability teardown, or if you're weighing outside help, start with how to choose a sales outreach agency.