Cold Email Deliverability: The Technical Setup, in Launch Order

Cold email deliverability comes down to doing the technical steps in the right order: verify the list, send from secondary domains with SPF, DKIM and DMARC passing, turn off or isolate tracking, warm each new inbox, cap volume per inbox, spread load across inboxes and domains, and watch bounces and complaints from the first day. Each step protects the next. None of them, warm-up included, can rescue a list that bounces or a message people report.

This is the cold-specific, technical hub. If you want the whole campaign, including law, copy and follow-ups, start with the complete cold email guide. For deliverability in general, including newsletters and transactional mail, see the email deliverability guide. Below, every step links to a deeper post.

Why cold email is a special case

Cold mail starts with no consent and no engagement history, so every negative signal counts for more. Three things make it different from marketing email:

• No permission signal. Google's sender guidelines say plainly: "Don't send messages to people who didn't sign up to get messages from you." There is no officially sanctioned cold volume. You're operating where mailbox providers expect the least of you.
• Lists of unknown quality. Cold lists are scraped, exported from data vendors or guessed from patterns. Unverified, they bounce.
• Higher complaint risk. A stranger is more likely to press "Report spam" than a subscriber, and Google asks senders to keep the spam rate in Postmaster Tools below 0.3%, aiming for below 0.1%.

That's why the order below starts with the list, not the inboxes.

The launch order at a glance

Step	What you do	Why it comes here	Deeper guide
1	Verify the list	Bounces are the cheapest problem to remove	Why cold emails bounce
2	Buy and set up secondary domains	Keeps cold risk off your main domain	Cold email domain setup
3	Authenticate: SPF, DKIM, DMARC	Without it nothing else attaches to you	SPF, DKIM and DMARC explained
4	Custom tracking domain, or no tracking	Shared tracking domains carry other people's reputation	Custom tracking domain
5	Warm up each new inbox	New inboxes have no history	Email warm-up schedule
6	Cap volume per inbox	Provider limits are not safe cold volumes	Cold emails per day per inbox
7	Rotate inboxes	Spreads volume, not reputation	Inbox rotation
8	Monitor and enforce stop rules	Catch problems in days, not weeks	Bounce thresholds by platform

Domains and warm-up take weeks, so in practice you buy domains on day one and verify the list while the inboxes warm. The order above is the order of dependence: a warmed inbox sending to an unverified list is wasted warm-up.

Step 1: Verify the list before anything else

A hard bounce tells the receiving server you don't know who you're writing to, and cold lists are where most of them come from. Sending tools enforce this for you, bluntly. Instantly's auto-pause feature stops a campaign at a bounce rate it sets by default at 5%, once at least 200 emails have gone out. Other platforms' lines are collected in bounce rate thresholds by platform.

What to do:

1. Clean the file: dedupe, fix obvious typos, remove junk rows. The list health check does this for a CSV.
2. Verify every address with an SMTP-level check, not just a syntax check; see syntax check vs SMTP verification.
3. Decide on uncertain results. Catch-all domains can't be confirmed by anyone, and role addresses behave differently from personal ones. Send to them in small, separate batches or not at all.
4. Treat scraped and vendor data as unverified. See verifying scraped emails and whether to re-verify an Apollo export.
5. Keep spam traps out. They hide in old and harvested lists; see how spam traps get on your list.

The free email verifier checks single addresses, and the list health check finds duplicates, typos and dead domains in a CSV for free.

Step 2: Set up secondary domains

Send cold email from domains close to your brand but separate from the one your customers and invoices use. If outreach goes badly, the secondary domain takes the damage. Setting up secondary domains for cold email covers choosing names, redirects and DNS.

Three technical points that get missed:

• MX records. The domain needs to receive replies. Check with the MX lookup.
• Accounts per domain. No provider sets a number. Instantly's setup guide recommends "max 3-5 email accounts" per domain. Inboxes on one domain share its reputation, so scale by domains.
• Bulk-sender counting. Google counts all mail from a primary domain, subdomains included, towards its 5,000-a-day bulk-sender line (Google FAQ). A subdomain doesn't reset the count.

A separate domain isolates reputation. It doesn't hide a bad list, and providers can still link domains through shared content, links and infrastructure.

Step 3: Authenticate every sending domain

Every domain needs SPF, DKIM signed with your own domain, and a DMARC record, all aligned with the From address. Gmail and Yahoo require this of bulk senders, and Microsoft requires it of domains sending more than 5,000 emails a day to Outlook.com (Microsoft policy). Cold senders rarely hit those volumes per domain, but missing authentication still gets mail filtered or rejected. The rules are compared in Gmail and Yahoo bulk sender requirements and Microsoft Outlook's sender requirements.

• SPF: one record listing your mailbox provider and any sending tool. Watch the 10-lookup limit. Check with the SPF checker.
• DKIM: turn it on in the mailbox provider, for Google Workspace or Microsoft 365. Check with the DKIM checker.
• DMARC: start at p=none with a reporting address, then tighten; see DMARC record examples. Check with the DMARC checker.

The deliverability audit runs all of these at once. Run it on every domain before warm-up starts, because warming an inbox that fails DKIM builds history on a broken setup.

Step 4: Deal with tracking

Open and click tracking put a domain you didn't choose into every message, and open data is unreliable anyway. By default, your sending tool rewrites links through its shared tracking hostname, used by every customer who hasn't set up their own. If one of them is abusing it, your links carry that history. A custom tracking domain replaces the shared hostname with one only your mail uses.

The simpler option for many cold campaigns is to turn open tracking off. A tracking pixel turns a plain-text email into HTML with a remote image, and Apple Mail Privacy Protection inflates opens regardless. See does open tracking hurt cold email deliverability. Measure replies instead.

Step 5: Warm up new inboxes

A new inbox has no history, so start with a small daily volume and increase it gradually. Google's own advice is to "Start with a low sending volume to engaged users, and slowly increase the volume over time" (sender guidelines). Instantly's setup guide says to warm up "for at least 2 weeks before starting your campaigns". Our email warm-up schedule gives a step-by-step ramp with stop rules.

What warm-up can't fix

Warm-up networks send mail between participating inboxes and generate replies and "not spam" actions, so a new inbox has some activity before it emails strangers. That's all they do. Be clear about the limits:

Problem	Does warm-up help?	Why not
Invalid addresses on your list	No	Real servers still reject them, and the bounces are counted against you
Spam traps on your list	No	A trap hit is a trap hit, whatever else the inbox sends
Prospects reporting your email	No	Google's spam rate is measured on mail delivered to real recipients
Broken SPF, DKIM or DMARC	No	Authentication is checked on every message
Too much volume per inbox	Partly at best	Warm-up raises tolerance gradually; it doesn't remove limits
A brand-new inbox with no history	Yes	This is what it's for

If a vendor tells you warm-up will keep a dirty list out of spam, they're selling the wrong fix. Verify first; warm second.

Step 6: Cap volume per inbox

Mailbox provider limits are abuse ceilings, not safe cold volumes. Google Workspace's sending limits allow 2,000 messages a day per user, and Microsoft's Exchange Online limits set a recipient rate limit of 10,000 recipients a day. Cold email tools recommend far less: Instantly's setup guide says "only 30-50 emails a day" from each account.

The worked maths, and what to do with Microsoft's tenant-wide external recipient limit, are in how many cold emails per day per inbox. For personal Gmail accounts, see Gmail sending limits; they're not a sensible base for outreach.

Step 7: Rotate inboxes, carefully

Rotation spreads volume across inboxes; it doesn't spread domain reputation or fix list quality. Your tool sends from several inboxes per campaign, keeps each follow-up in the original sender's thread, and keeps each inbox under its cap. Inbox rotation for cold email covers sizing and what rotation doesn't protect, including bulk-sender classification, which Google counts per primary domain.

A practical sizing rule: daily prospects ÷ per-inbox cap = inboxes needed; inboxes ÷ three to five = domains needed. Then add spare warmed inboxes so you can rest one that shows trouble.

Step 8: Write for deliverability, briefly

Content matters less than infrastructure, but a few things do count. Plain text or very light HTML, at most one link on your own domain, no link shorteners, no hidden text and an honest subject line. Individual spam words carry little weight; see do spam trigger words still matter. The full pre-send checklist, split into marketing and cold email, is in how to avoid spam filters.

Step 9: Monitor from day one

Watch bounces per batch, replies and removal requests per step, and spam rate per domain. The useful numbers:

• Bounce rate per batch. Pause above your threshold and find the cause; how to calculate bounce rate shows which formula your tool uses.
• Spam rate in Google Postmaster Tools. Google calculates it daily. The caveat for cold senders is volume: Google notes the dashboard "might not include all data on days when outgoing email volume is low" (Postmaster Tools help), so treat gaps as missing data, not good news.
• Blocklists for your domains and tracking domain, using the blacklist check.
• Placement snapshots from seed tests, read with caution.
• Replies versus removal requests per step. When the last step of a sequence produces more removals than replies, shorten it; see cold email follow-up sequences.

When numbers go wrong, stop sending first. What to do after a high bounce rate, why emails go to spam in Gmail and the 30-day recovery plan cover the fixes. For keeping reputation healthy in the first place, see how to improve sender reputation.

A launch timeline

Most teams can follow this shape. The durations are planning estimates, not provider rules.

When	Task
Day 1	Buy secondary domains; create inboxes; set SPF, DKIM, DMARC and MX; run the audit
Day 1 to 3	Fix any failing records; set up a custom tracking domain or turn tracking off
Day 2 onwards	Warm each inbox gradually
During warm-up	Build the list accounts-first; verify it; decide on catch-all and role addresses
Week 3 or later	First campaign at low volume per inbox; check bounces after the first batch
Ongoing	Raise volume only while bounces, removals and spam rate stay flat

The short version

Verify the list, separate your domains, authenticate them, isolate or drop tracking, warm each inbox, keep volume per inbox low, rotate across domains, and monitor from the first batch. Of all these, list verification is the only step that removes a problem completely before you send. SimpleVerifier verifies full CSV lists of up to 100,000 rows; run a sample through the free verifier first, then see pricing for monthly plans.