Cold Email Deliverability: The Basics for Small Senders
What decides whether a cold email reaches the inbox, explained with Google's own sender rules and one real sending sample.
Robbert Veer, Founder
8 min read
Cold email deliverability is the share of your cold emails that reach the inbox instead of the spam folder. Three things decide it. Mailbox providers check that your domain is authenticated, that few recipients report you as spam and that you send at a steady volume. Google publishes its rules, and this guide follows them.
It is written for an agency that sends tens of emails a day to local businesses. When we searched this topic on Nov 10, 2026, the first five results all came from companies that sell sending, warm-up or verification software. Leadodo sells outreach software too, so weigh this page the same way and check the sources.
What is cold email deliverability?
Cold email deliverability is whether a first email to a business that never asked for it lands in the inbox. Delivered and deliverable are different things. Delivered means the receiving server accepted the message. Deliverability asks where it went next.
The mailbox provider decides that, and Google publishes its rules for senders. Its email sender guidelines cover authentication, spam rate, sending volume and unsubscribing. The sections below take them in that order.
What does Google require from every sender?
SPF or DKIM, valid DNS records, an encrypted connection and a spam rate below 0.3%. Those have applied since February 1, 2024 to anyone who emails personal Gmail accounts. Senders of 5,000 or more messages a day get a longer list.
| Area | All senders | 5,000 or more a day |
|---|---|---|
| Authentication | SPF or DKIM | SPF, DKIM and DMARC |
| From address | Don't impersonate Gmail From headers | The From domain aligns with the SPF or DKIM domain |
| DNS | Valid forward and reverse DNS records | Same |
| Encryption | A TLS connection | Same |
| Spam rate in Postmaster Tools | Below 0.3% | Below 0.30% |
| Unsubscribe | "Always give recipients an easy way to unsubscribe" | One-click unsubscribe on marketing messages, plus a visible link |
Two points matter for an agency.
First, Google's sender guidelines FAQ says the rules apply to mail sent to personal Gmail accounts and don't apply to messages sent to Google Workspace accounts. Many owner-run businesses publish an @gmail.com address. We have no figure for the share, so count them in your own list.
Second, you are a long way from the bulk line. The FAQ defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. Set up all three records anyway. It is a one-time job, and the FAQ says Gmail has been ramping up enforcement since November 2025.
What do SPF, DKIM and DMARC do?
Each one is a DNS record on your sending domain, and each answers one question for the server that receives your email.
| Record | The question it answers | In plain words | In Google's words |
|---|---|---|---|
| SPF | Is this server allowed to send for this domain? | A public list of the servers that may send your mail | "SPF prevents spammers from sending unauthorized messages that appear to be from your domain." |
| DKIM | Did the domain owner send this message? | A signature on every message, checked against a key published on your domain | "Receiving servers use DKIM to verify that the domain owner actually sent the message." |
| DMARC | What should happen when a check fails? | Your instruction to receivers for mail that fails the first two | "DMARC tells receiving servers what to do with your messages that don't pass SPF or DKIM." |
You add the records where your domain is registered. Your mailbox provider, such as Google Workspace or Microsoft 365, gives you the values to paste in. Google says the DMARC policy can be set to none, which asks receivers to take no action on failures while you watch what happens.
Skipping this step has a named cost. Google says unauthenticated messages "might be marked as spam or rejected with a 5.7.26 error."
To check your work, send an email from the new address to a Gmail account you own. Open the message menu, choose Show original and look for PASS next to SPF, DKIM and DMARC.
What spam rate is too high?
0.30%. Google's guidance is to "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher."
Put those in whole numbers. 0.10% is 1 spam report per 1,000 emails. 0.30% is 3 per 1,000. The FAQ says the rate is calculated daily.
Now run it at agency scale. If 100 of your emails reach Gmail users in a day and one person reports you, that is 1 in 100, or 1%. This is our arithmetic, and Google's own calculation may differ in detail. The lesson holds either way. A small sender has no room for a single careless email.
That makes the list your first deliverability decision. When we sent 3,570 cold emails to Dutch companies, the businesses with the weakest 20% of websites replied positively about 3.2 times as often as a random sample of the rest. The full test is in our write-up. We did not measure spam reports in that test, so we cannot say the same group reported us less. A business with a reason to hear from you is still the safer bet.
What is email warm up, and do you need it?
Email warm up is the practice of starting a new address or domain at a low sending volume and raising it slowly. You need it for every new address.
Google describes it in two lines. "Start with a low sending volume to engaged users, and slowly increase the volume over time." And "Send email at a consistent rate. Avoid sending email in bursts."
Engaged users are people who open and answer. For an agency, that means clients, suppliers and colleagues. Use a new address for ordinary conversations before the first cold email goes out. We would give it two to four weeks. That range is our rule of thumb, and Google gives no number of days in the passages we read.
Warm-up tools automate the idea. They place your address in a pool of mailboxes that send each other messages and reply. Google's guidelines describe the manual kind, with real recipients. We have not tested any warm-up tool and make no claim about them.
How many cold emails can one address send a day?
There is no official number. Google's guidelines draw one line, at 5,000 messages a day, and we found no daily figure for cold email in them.
We can share what we did. Our October 2026 test sent 3,570 emails over 5 working days from 24 sending addresses.
- 3,570 emails divided by 24 addresses is about 149 emails per address.
- 149 divided by 5 working days is about 30 emails per address per day.
That is one test. Treat 30 as a data point. Google has approved no such limit.
The order of your outreach changes the volume too. In Leadodo, your Outbound Machine opens with a posted letter that arrives on day 1 and sends emails on days 4, 7 and 11, counted in working days, so each business gets three emails at most. The sequence stops for a business the moment it replies. Start 20 businesses each working day and, once the sequence is running, you send up to 60 emails a day, which is 20 for each of the three email steps. At about 30 per address, two addresses carry that.
How does a small sender stay out of spam?
Do eight things, in this order.
- Authenticate the domain. SPF, DKIM and DMARC, with PASS on all three.
- Give a new address real mail first. Weeks of ordinary conversations before any cold email.
- Send at a steady daily rate. The same number each working day, with no bursts.
- Send to fewer businesses, chosen better. Every email to a business with no reason to care is a chance of a spam report.
- Keep the subject honest. Google says not to start a subject with Re: or Fwd: unless the message is a real reply or forward. Our cold email subject lines follow that rule.
- Make stopping easy and act fast. The FTC's CAN-SPAM guide allows 10 business days to honor an opt-out. Google's FAQ recommends 48 hours. Aim for the shorter one. This is not legal advice. Our post on whether cold email is legal covers the eight US requirements.
- Don't let email carry the introduction. A letter that lands first means your first email refers to something the owner has already seen.
- Watch the numbers. Google's advice is to monitor your domain's spam rate in Postmaster Tools. Check bounces after every send as well.
Setup gets a message accepted. The words decide whether a person reports it, so read how to write a cold email next, or the full cold email guide.
Questions
Why are my cold emails going to spam?
Check the three things Google's guidelines ask for. Is the domain authenticated with SPF, DKIM and DMARC? Is your spam rate below 0.30%? Did your sending volume rise slowly, or did it jump? Fix them in that order.
Do I need DMARC if I send fewer than 5,000 emails a day?
Google requires SPF or DKIM from every sender and adds DMARC for senders of 5,000 or more messages a day. A small sender is not required to have it. Set it up anyway. It is one more DNS record, and Google allows a policy of none.
How long does email warm up take?
Google gives no number of days. Its guidance is to start with a low volume to engaged recipients and increase slowly. Our rule of thumb is two to four weeks of ordinary mail before the first cold email, then a slow rise.
Is email deliverability the same as delivery rate?
No. Delivery rate counts the emails a receiving server accepted. Email deliverability asks whether those emails reached the inbox or the spam folder. An email can be delivered and still never be seen.
Does sending a letter first improve deliverability?
We have no data that a letter changes where an email lands. What it changes is the plan. Each business gets three emails at most, and none of them is the first contact. Fewer emails, sent to people who may already know your name, is a sensible way to keep spam reports low.
Next step. See how your Outbound Machine posts the letter first, sends three emails after it and stops for every business that replies. Outbound Machine.

