Cold Email Deliverability, Explained Without the Jargon
SPF, DKIM, DMARC, warm-up, spam triggers — what actually determines whether your cold email lands in the inbox or the void, in plain English.
You can write the best cold email in the world and it won't matter if it lands in spam. Deliverability is the unglamorous plumbing of outreach — invisible when it works, fatal when it doesn't.
The topic gets wrapped in acronyms that make it sound harder than it is. Here's the whole system in plain English.
How mailbox providers decide where your email goes
When your email arrives at Gmail or Outlook, the provider asks three questions:
- Is the sender who they claim to be? (Authentication)
- Does this sender have a history of sending mail people want? (Reputation)
- Does this specific message look like spam? (Content)
Fail the first and you may not be delivered at all. Fail the second and you land in spam regardless of content. The third matters least — which surprises people who spend hours avoiding the word "free."
Authentication: the ID check
Three DNS records prove you're allowed to send from your domain. You set them up once and mostly never touch them again.
- SPF is a public list of servers allowed to send email for your domain. If mail comes from a server not on the list, providers get suspicious.
- DKIM is a cryptographic signature attached to every message, proving it wasn't altered and really came from your domain.
- DMARC is the policy that tells providers what to do when SPF or DKIM fails — and since 2024, Gmail and Yahoo simply require it for anyone sending at volume.
If you send through Google Workspace, SPF and DKIM are nearly automatic; DMARC is one DNS record. Check all three at a free tool like MXToolbox before sending a single cold email. Ten minutes, once.
Reputation: the credit score
Every domain and sending address accumulates a reputation based on how recipients react. Replies, opens, and "not spam" clicks push it up. Spam reports, bounces, and mass deletions push it down.
Practical rules that follow from this:
- Warm up new domains. A fresh domain blasting 200 emails on day one looks exactly like a spammer. Start with a handful a day, mostly to people likely to reply, and ramp over 3–4 weeks.
- Protect your main domain. Many teams send outreach from a separate domain (yourcompany-hq.com) so a bad campaign can't hurt the domain your invoices and password resets come from.
- Verify addresses before sending. A bounce rate above 2–3% is one of the strongest spam signals there is. Guessed emails are expensive.
- Volume consistency beats volume size. 30 emails every weekday reads as a human. 500 every second Friday reads as a botnet.
Content: smaller than you think, but not nothing
Spam filters in 2026 are ML models scoring the whole message, not keyword lists. Still, a few things reliably hurt:
- Link and image soup. A first-touch cold email should have at most one link and no tracking-heavy HTML. Plain text — or nearly — performs better on both deliverability and replies.
- Open-tracking pixels. Increasingly detected, increasingly penalized, and open rates were always a soft metric. Track replies instead; replies are the metric that pays rent anyway.
- Deceptive subjects. "Re:" on a thread that doesn't exist might buy opens this week and spam-folder placement next month. Providers measure the delete-without-reading rate that follows.
And the biggest content factor isn't a trick: emails that people actually reply to train the filter that your mail belongs in the inbox. Relevance is a deliverability strategy — the personalized email and the deliverable email are the same email.
The 20-minute checklist
- SPF, DKIM, DMARC set up and passing (use MXToolbox or Google's checkmx).
- Sending from a warmed domain — ramped over weeks, not days.
- Every address verified before send; bounces under 2%.
- One link max, no pixel, mostly plain text.
- Daily volume a human could plausibly produce.
- A real unsubscribe path or opt-out sentence — legally required in most places, and a spam-report vaccine everywhere.
Deliverability determines whether you get seen at all — but what happens after depends on whether the email deserved the inbox placement. Since relevance now feeds directly back into reputation, the research-heavy, genuinely personal email isn't just better copy; it's better infrastructure. That's the part ColdSnap automates — reading a prospect's LinkedIn or website and producing the specific, reply-worthy email in seconds, then sending it through your own Gmail so you're building reputation on real conversations.