Cold email deliverability: what actually moves it

Four things move cold email deliverability in ways the mailbox providers document: valid authentication, a low spam-complaint rate, few bounces, and a sending pattern that grows gradually. Everything else, including subject-line tricks and warm-up tools, is secondary or unproven. No tactic guarantees inbox placement, and any vendor who promises a percentage is selling something the providers do not publish.

This article separates what Google, Yahoo and Microsoft actually say from folklore. It does not give inbox placement percentages, because no primary source provides them.

An honest starting point about cold email

Google’s sender guidelines say not to send messages to people who did not sign up to get messages from you, and not to purchase email addresses from other companies. Cold outreach, by definition, goes to people who did not sign up. That does not make it impossible, but it means your margin for error is smaller than a newsletter’s, and you should expect more complaints per message than a list of subscribers produces.

Whether outreach is lawful in your market, and on what legal basis, is a separate question that depends on the country of the sender and recipient. This article does not cover it. Ask a lawyer.

What the providers say they measure

“Bulk sender” means different things in each place. Google defines it as a sender of close to 5,000 messages or more to personal Gmail accounts within 24 hours, counted across subdomains of the same primary domain, and states that bulk sender status does not expire. Yahoo says it does not specify a volume threshold. Microsoft’s announcement targets domains sending more than 5,000 emails a day. If you send cold mail from many small mailboxes, you may stay under every count and still be judged by the same complaint signals.

1. Authentication: necessary, not sufficient

SPF, DKIM and DMARC tell a receiver that the message really comes from the domain it claims. Google, Yahoo and Microsoft all ask for them from larger senders, and Google says enforcement of non-compliant traffic is ramping up. Microsoft’s announcement describes non-compliant mail from high-volume domains being routed to Junk and, over time, rejected; check its current wording because the rollout was described in stages.

Authentication does not make a message wanted. A fully authenticated message that recipients mark as spam is still a bad message. Set the records up once, correctly, and move on: SPF, DKIM and DMARC for cold email has the practical steps.

2. Spam complaints: the number that matters most

The only quantitative thresholds that Google and Yahoo publish are about spam rate: Google below 0.10% with an upper limit of 0.30%, Yahoo below 0.3%. At 0.10% you get one complaint per 1,000 messages delivered to the inbox. A cold campaign of a few hundred messages can therefore look unhealthy after one or two reports.

How to keep complaints low, without any claim that it guarantees a result:

• Relevance. Send to people whose role plausibly matches your offer. A badly targeted list produces complaints no matter how good the infrastructure is.
• A short, honest first message. Say who you are and why this person. Avoid false urgency, a fake “Re:” subject or an implied prior relationship.
• An easy way out. People who cannot find an unsubscribe mark the message as spam instead. Include an unsubscribe link in the body and the one-click header described in one-click unsubscribe.
• Honour opt-outs at once. Yahoo asks bulk senders to process unsubscribes within 2 days. Process them faster, and never email an address that unsubscribed or complained again.
• Watch the signal. Google Postmaster Tools shows spam rate for Gmail traffic. Yahoo’s FAQ points to its Complaint Feedback Loop for monitoring complaints. Check both if you send to those domains in volume.

3. Bounces and list quality

A bounce is a rejection: the address does not exist, the mailbox is full, or the receiver refused the message. Sending to many invalid addresses looks like sending to a purchased or scraped list. Yahoo’s guidance tells senders to monitor bounces and remove inactive recipients; Microsoft’s announcement recommends removing invalid addresses regularly to reduce complaints and bounces.

In practice:

1. Verify addresses before the first send.
2. Stop sending to an address after a hard bounce, permanently.
3. Treat a rise in bounces on one mailbox as a signal about the list segment, not only about the mailbox.
4. Do not buy lists. Google says so explicitly.

4. Volume pattern

Google says to start with a low sending volume and increase it slowly, and gives an example: immediately doubling previously sent volumes could result in rate limiting or reputation drops. This is the closest thing to a primary source on “ramping”. It supports a per-mailbox cap that rises in steps. It does not say a specific number of days or messages, and no primary source does. Details on how to apply it are in cold email infrastructure guide.

What does not have primary-source support

• Specific spam-trigger words. I found no statement from Google, Yahoo or Microsoft that publishes a list of words that decide placement. Write plainly and you avoid the problem without needing one.
• Inbox placement percentages. Providers do not publish them. A test that sends to seed addresses shows a sample, not your campaign.
• Warm-up as a deliverability fix. Warm-up tools are vendor products. I found no Google, Yahoo or Microsoft page that endorses or condemns them. See cold email without warm-up for how to think about this.
• Open rate as a health metric. Opens depend on tracking images, which many clients load or block automatically. Reply rate and bounce rate are more reliable to act on.

A weekly check

1. Spam rate in Postmaster Tools for Gmail, if you send enough to see data.
2. Bounce rate per mailbox and per list segment.
3. Authentication results on a test message to each major provider.
4. The count of unsubscribes and complaints, and confirmation that each one was suppressed.
5. Any mailbox or domain you paused, and why.

Reading a rejection

Two kinds of failure look similar and need different fixes.

• Authentication rejection. Microsoft’s announcement says messages that do not meet its authentication requirements are rejected with the text 550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level. The fix is in DNS: SPF, DKIM and DMARC for the domain in the From address, with at least p=none and alignment on SPF or DKIM.
• Reputation or content filtering. The message is accepted and then placed in spam, or deferred. There is no error to fix. Look at complaints, bounces, the list segment and how fast volume grew.

Start with the first kind. It is deterministic, and you can check it by sending a test message and reading the Authentication-Results header.

How Dooxout handles this

Dooxout runs outreach through an agent, and the server, not a prompt, applies the limits. Caps apply per mailbox, per domain and per channel, and the cap for a mailbox rises with its age. When bounce or complaint thresholds you set are crossed, the platform freezes the affected sending. Unsubscribed and complaining addresses are suppressed workspace-wide, on every channel, and this cannot be turned off. Campaigns carry the one-click unsubscribe header.

Dooxout does not run warm-up and does not promise inbox placement. It warns and recommends; you decide. See guardrails and security and email deliverability.