Cold email deliverability isn't one problem. It's eight, in order: the domain, the records, the warmup, the SMTP host, the list, the cadence, the content, and the response loop. Skip any of them and your inbox rate craters. This is the pipeline, end to end.
1. The sending domain
Don't send cold email from your main domain. If yourcompany.com gets flagged as a spam source, your billing emails, password resets, and Stripe receipts go with it. Founders learn this the hard way.
Register a cousin domain — getyourcompany.com, yourcompanyhq.com, tryyourcompany.com. Set it up fully (website that redirects to your main one, mailboxes, the three records below), and send cold outreach from there. Treat the new domain's reputation as a separate, expendable thing.
2. The records — SPF, DKIM, DMARC
Three DNS records. They're table stakes; without them, nothing else matters. Full walkthrough in the SPF / DKIM / DMARC guide.
The short version:
- SPF: one TXT record listing every host that can send as your domain. End with
-all. - DKIM: a public key per selector per provider. Your provider gives you the value; you publish it.
- DMARC: ramp from
p=nonetop=quarantinetop=rejectover 4–6 weeks. Read the aggregate reports.
3. Warmup — the part everyone skips
A brand-new domain with brand-new mailboxes looks identical to a spammer to receivers. The fix is warmup: 2–4 weeks of low-volume, conversational-looking traffic before the first real campaign.
Two practical paths:
Manual warmup
Set up the mailbox like a real person would. Subscribe to a few newsletters. Sign in via OAuth to a couple of SaaS tools. Send a handful of emails to colleagues each day. Reply, open, mark as important. Over 2 weeks, the mailbox accumulates a normal engagement footprint.
Automated warmup networks
Tools like Mailwarm, Warmup Inbox, Lemwarm exchange messages between users to build engagement signals. They work, but receivers know what they are and the value has eroded since 2023 — they should supplement manual setup, not replace it.
The volume ramp
After warmup, ramp daily volume gradually: 20 the first week, 35 the second, 50 the third, etc. Never double day-over-day on a new domain. A new mailbox safely sustains around 50 outbound/day after a month of careful ramping.
4. The SMTP host
Your choice of SMTP shapes how receivers treat your messages. Three live tiers, from highest reputation to lowest:
- Google Workspace / Microsoft 365 directly.Best reputation. Daily caps (~500–2000 depending on plan and account age) make this fine for any cold-outreach scale a founder personally runs.
- Transactional providers (Postmark, SES, Resend).Designed for transactional traffic, but excellent IP reputation and clean abuse desks. SES is the cheapest at scale. Postmark is the most operator-friendly. Resend has a clean modern API.
- Shared-pool senders (Lemlist, Instantly, Smartlead).Easy onboarding, but your reputation is shared with everyone else on the same pool. One bad actor tanks the IP and you go down with them. Skip.
ProspectFlow is built for the first two tiers — bring your own SMTP credentials and your domain's reputation stays yours.
5. The list — quality, freshness, segmentation
The most expensive way to ruin a domain's reputation:
- Bought lists. The data is stale, the addresses were scraped from places people don't want to be contacted, and the seller has resold the same list to dozens of competitors. Don't.
- Old in-house lists. An email older than 12 months has a 25–40% bounce rate. Re-verify before sending. The cheap consumer tools (NeverBounce, ZeroBounce) are fine for this.
- Role addresses.
contact@,info@,sales@almost never reply and complain at high rates. Strip them; or send to them only as a last resort.
ProspectFlow's AI prospect finder scans live company websites and only accepts emails on the same registrable domain as the page they were found on — that eliminates 95% of the stale and mislabelled addresses you'd get from a database.
6. The cadence
Spread sends in time. Receivers flag "100 messages from the same domain to 100 different recipients in 60 seconds" even when the content is fine.
Per-mailbox daily limit
New mailbox: 20–50/day. Warmed mailbox (3+ months): 100–150/day. Workspace caps depend on your plan and account age — Google won't tell you the exact ceiling, but exceeding it for a few days drops you to 500/day for a week as punishment.
Inter-message delay
Randomise the gap between sends. 30–120 seconds is plenty. Sending a campaign in "burst mode" is one of the strongest single signals to a receiver that you're automated.
Follow-up spacing
5–7 days between follow-ups. Two follow-ups maximum. Stop the moment the recipient replies (positively or negatively).
7. The content — what receivers actually weight
- Subject line under 50 characters. No ALL CAPS, no emojis, no "RE:" or "Fwd:" on a fresh thread.
- Plaintext-ish HTML. Skip images, complex layouts, tracking pixels in the body. A cold email that looks like a real email (HTML so simple it could be plaintext) gets placed better.
- One link, maximum. Two links double your spam score. Multiple links from a non-warmed domain triple it.
- No spam-trigger words. The old list (FREE! URGENT! 100% guaranteed!) still applies. Less obviously: avoid "don't miss out", "limited time", and over-bolded text.
- A real signature with name, role, company, and a phone number or LinkedIn URL — a present, complete signature signals legitimacy.
8. The response loop — unsubscribes and bounces
Two things destroy a domain's reputation faster than anything else: ignored unsubscribes, and continued sends to bouncing addresses.
- Unsubscribe requests have to be honoured in seconds, tenant-wide. Not just for the current campaign — for every campaign you ever run again. We cover Gmail+Yahoo's one-click requirements in the bulk sender requirements post.
- Hard bounces need to be parsed and the address quarantined. Continuing to send to
5.x.xbounce addresses is treated as "you're not paying attention" — and receivers throttle you accordingly. - Soft bounces (4.x.x — mailbox full, temporary failure) can be retried, but cap retries at 3 over 5 days. After that, treat as hard.
- Replies mean the recipient is engaged — drop them from any follow-up sequence immediately.
What ProspectFlow does on this pipeline
- You pick the domain and run SPF/DKIM/DMARC — that part stays with you.
- Sends are paced with jittered 30–120s delays per SMTP, with a configurable daily cap per mailbox.
- Multi-SMTP rotation on Pro and Ultra plans, so a single mailbox doesn't carry the full volume.
- RFC 8058 one-click unsubscribe headers + visible Unsubscribe footer on every message, opt-outs honoured tenant-wide.
- IMAP-based bounce + reply detection: hard bounces flag the prospect, repliers are dropped from follow-ups.
- AI prospect finder pulls verified emails from live company pages, not stale databases.