What's in this guide
Most cold email campaigns do not fail because the copy was bad. They fail because nobody read them.
A message that lands in spam has a 0% reply rate no matter how good the first line is. Yet almost every team debugs in the wrong order — rewriting subject lines for a week before checking whether their DMARC record was ever published.
Since February 2024, Google and Yahoo have enforced authentication requirements on bulk senders. Microsoft followed with its own enforcement for high-volume senders. The practical effect is that deliverability moved from "nice to have" to a gate: fail the checks and your mail is rejected or foldered before a human sees it.
This guide is the pre-send audit — 18 checks, in the order they should be run. Run them once before a campaign launches, then re-run checks 10–15 monthly.
Quotarider runs 18 deliverability checks automatically before every send, through your own connected mailboxes — so a misconfigured domain is caught before the campaign goes out, not after the reply rate collapses.
See the deliverability checks →Checks 1–5: Authentication
Authentication is how a receiving server decides whether you are who your email claims to be. Get this wrong and nothing downstream matters.
1. SPF record published and resolving
SPF lists which servers are allowed to send on behalf of your domain. Publish a TXT record at your root domain.
The failure most people hit: the 10-lookup limit. Every include: in your SPF record costs a DNS lookup, and nested includes count too. Exceed ten and the record returns permerror, which many receivers treat as a fail.
A working SPF record
v=spf1 include:_spf.google.com include:sendgrid.net -all
Note the -all at the end — a hard fail. ~all (soft fail) is the more forgiving option while you are still testing, but move to -all once you are confident the list is complete.
2. DKIM signing enabled, 2048-bit
DKIM cryptographically signs your message so the receiver can verify it was not altered in transit. Enable it in your mail provider, publish the public key at the selector they give you, and use a 2048-bit key — 1024-bit is still accepted but increasingly treated as weak.
Check the signature is actually being applied. Enabling DKIM in a dashboard and publishing the DNS record are two separate steps, and teams routinely do one and not the other.
3. DMARC record published
DMARC tells receivers what to do when SPF and DKIM fail, and where to send reports. Start in monitor mode.
Start here, then tighten
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100
Run p=none for two to four weeks and read the aggregate reports. Once you can see every legitimate sending source passing, move to p=quarantine, then p=reject.
Side note: going straight to p=reject without a monitoring period is the fastest way to silently kill your invoicing emails, your support notifications and your calendar invites. Monitor first.
4. Alignment — the check almost everyone skips
SPF and DKIM can both pass and DMARC can still fail. Why?
Because DMARC requires alignment: the domain in the visible From: header has to match the domain that SPF authorised or the domain that signed with DKIM.
If you send from you@company.com but your sending platform authenticates as bounce.platform.io, you have passing SPF and failing DMARC. Fix it by configuring a custom return-path or custom tracking domain on your sending platform.
5. Reverse DNS (PTR) resolves
If you send on dedicated IPs, the IP should resolve back to a hostname, and that hostname should resolve forward to the same IP. Missing PTR records are a common cause of outright rejection at the connection stage. On shared infrastructure your provider handles this.
Checks 6–9: Domain and mailbox infrastructure
6. Send from a secondary domain, never your primary
This is the single highest-leverage decision on the list.
If your company is acme.com, do your cold outreach from tryacme.com or acme-hq.com. Buy it, authenticate it, and redirect it to your main site.
Why?
Because domain reputation is not recoverable on a useful timescale. If a cold campaign damages the reputation of your primary domain, you are not just losing outreach — you are losing password resets, contracts, invoices and support replies. A burned secondary domain costs you $12 and a two-week warmup. A burned primary domain can cost you the quarter.
7. Domain age — at least 30 days before first send
Brand new domains are treated with suspicion. Register the domain, set up authentication, point it at a real page, and let it sit. Two to four weeks is the usual guidance before the first cold send.
8. Multiple mailboxes, not one
Per-mailbox sending limits are the constraint, not per-domain limits. A single Google Workspace mailbox realistically supports 30–50 cold emails a day once warmed. If you need 300 a day, that is six to ten mailboxes, spread across two or three secondary domains.
9. A real website at the sending domain
Filters check whether the domain resolves to something. A parked page or a registrar placeholder is a negative signal. A one-page site with your logo, a description and a contact link is enough.
Checks 10–12: Volume, ramp and rotation
10. Warm up before you ramp
A mailbox that sends nothing for a month and then sends 200 messages in a day is behaving like a compromised account, and it gets treated like one.
Start at roughly 10 sends a day per mailbox and increase by about 20% every two or three days until you reach your target. Mix in real replies where you can — conversations are a stronger positive signal than one-way sends.
11. Cap the daily send per mailbox and hold the cap
The temptation once things are working is to push volume. Resist it. Deliverability degrades slowly and then all at once, and by the time reply rate drops you are already three weeks into a reputation problem.
12. Rotate across mailboxes with a real delay
Distribute a campaign across your mailbox pool rather than draining one. Randomise the gap between sends — a message every 90 to 400 seconds looks like a person; a message every 12 seconds does not.
Pro tip: send during the recipient's working hours in their timezone, not yours. It improves reply rate for obvious reasons, and it also spreads volume across the day instead of firing everything into a two-hour block.
Checks 13–15: List hygiene
13. Verify every address before sending
Bounce rate is the fastest way to destroy a new domain. Keep hard bounces under 2%, and preferably under 1%.
Run the list through a verification service, and drop anything marked invalid. On catch-all domains, verification is inconclusive — either exclude them or hold them in a separate low-volume segment.
14. Suppress across every campaign, permanently
One suppression list, applied globally. It should include: unsubscribes, hard bounces, complaints, current customers, open deals, and anyone who has already been contacted in the last 90 days.
Emailing the same person from two campaigns because two sequences were built separately is a complaint waiting to happen — and complaints are the metric that gets you enforced against.
15. Cut the list until it is small enough to be uncomfortable
The instinct is to send more. The better move is to send less, to people who actually fit.
A list of 200 well-qualified prospects will outperform 4,000 loosely-filtered ones on every metric that matters — reply rate, complaint rate, and the only one that pays the bills, which is meetings booked.
Checks 16–18: The email itself
16. Plain text, no images, no tracking pixel on the first touch
A cold first email should look like something a person typed. HTML templates, logos, image headers and footers with social icons all read as bulk marketing to a filter and to a human.
Open tracking is worth reconsidering entirely. It requires an invisible image and a redirect domain, both of which are spam signals, and since Apple Mail Privacy Protection the open data is largely fiction anyway.
17. One link, or none
Multiple links, shortened links and shared link-shorteners are all negative signals. If you must include a link, use one, on your own domain, and never a bare bit.ly.
18. Working unsubscribe, honoured within 48 hours
One-click unsubscribe is a requirement for bulk senders at Google and Yahoo, and it is a legal requirement under CAN-SPAM and GDPR in most contexts. It also reduces complaints, because someone who cannot find an unsubscribe link will use the spam button instead.
A plain sentence at the bottom works fine: "If this isn't relevant, reply 'no' and I'll take you off my list."
The order that actually matters
If reply rate has dropped and you do not know why, debug in this sequence. Each step is cheaper than the one after it.
- Check authentication first. SPF, DKIM, DMARC, alignment. Five minutes, and it is the cause more often than anything else.
- Check bounce rate. Above 2% means a list problem, not a copy problem.
- Check complaint rate. Above 0.3% means a targeting problem.
- Check volume and ramp. Did someone increase the daily cap?
- Then, and only then, look at the copy.
Teams reliably do this backwards. They rewrite the email for two weeks, see no change, and eventually discover the DMARC record had a typo the whole time.
Deliverability is a pre-send problem, not a post-mortem. Quotarider checks authentication, list health and mailbox reputation before a campaign leaves the queue, then follows each message through to the paid invoice it produced.
Start free in 5 minutes →Frequently asked questions
How long should I warm up a new mailbox before sending cold email?
Two to four weeks. Start at roughly 10 sends a day and increase by about 20% every two or three days. The domain itself should also be at least 30 days old before the first cold send.
Can I send cold email from my main company domain?
You can, but it is a bad trade. Domain reputation is slow to recover, and a damaged primary domain affects invoices, contracts and password resets, not just outreach. Use a separate secondary domain that redirects to your main site.
What bounce rate is too high?
Above 2% is a problem and above 5% is an emergency. Verify every address before sending and drop anything flagged invalid. Catch-all domains should be segmented separately.
Does open tracking hurt deliverability?
It can. Open tracking requires an invisible image and a redirect domain, both of which are weak spam signals. Since Apple Mail Privacy Protection, open data is also unreliable enough that most teams lose little by turning it off.
How many emails per day can one mailbox send?
Realistically 30–50 cold sends per day once fully warmed. Scale by adding mailboxes and domains rather than by raising the per-mailbox cap.
What is DMARC alignment and why does it matter?
Alignment means the domain in the visible From: header matches the domain authenticated by SPF or signed by DKIM. Without it, SPF and DKIM can both pass while DMARC still fails — a common cause of unexplained spam foldering.
Know which email actually got paid
Quotarider holds the whole chain in one database — first touch, reply, deal, paid invoice — with 18 deliverability checks before every send, through your own connected mailboxes. No email credits, no AI markup.