Cold Email Deliverability (2026): Setup, Rules and Limits

On this page 17 sections

A cold email can’t get a reply if it never reaches the inbox. When deliverability goes wrong, the cause is usually the setup: an unauthenticated domain, a new mailbox sending too much too soon, or a list full of dead addresses. Better copy won’t fix any of those. This guide walks through the setup, step by step, and ends with a launch checklist.

This is a research-based guide, not a report on our own sending. The rules and limits below come from mailbox providers’ official guidance and vendors’ help centers, checked in September 2026 and listed in the sources. These pages change often, so check the sources before relying on a specific number.

Quick answer

Send cold email from one or two secondary domains that redirect to your main site, not from your primary domain. Give each domain SPF, DKIM and DMARC, and create a few mailboxes under real names. Warm them up for at least two weeks, then ramp gradually. Sending tools suggest about 30 cold emails per mailbox per day, but that’s vendor guidance, not a provider rule. Verify every list, keep links and tracking to a minimum, and make opting out easy. Gmail requires a spam rate below 0.3% and recommends staying below 0.1%.

Why cold email deliverability fails

Cold outreach usually fails on the same few points:

Missing authentication. Without SPF, DKIM and DMARC, receiving servers can’t confirm you’re allowed to send for your domain.
Sudden volume. Google warns that suddenly doubling your usual volume “could result in rate limiting or reputation drops.”
Bad data. Invalid addresses bounce, and high bounce rates signal a careless list.
Complaints. Every “Report spam” click counts against you.
Heavy content. lemlist warns that links, and tracked redirect links in particular, hurt cold email deliverability, and lists too many images and large attachments among common spam triggers.

Cold email also starts at a disadvantage. Gmail’s FAQ asks large senders to avoid “unwanted or unsolicited email,” and cold outreach is unsolicited by definition. That doesn’t make it illegal (see compliance), but it leaves little margin for error. Tight targeting is a deliverability tool, not just good sales practice.

Use secondary domains (and redirect them)

Your primary domain carries customer email, invoices and support. If outreach damages its reputation, all of that suffers. lemlist’s help center recommends “purchasing a new domain” for cold outreach instead of a subdomain, warning that subdomains may still affect the root domain’s email trust. Instantly’s strategy guide also recommends secondary domains. Gmail counts mail from subdomains toward the primary domain’s bulk-sender volume, while a separately registered domain is a different primary domain.

Pick close variations of your brand, such as getacme.example. Instantly suggests .com where available. Never imitate another company’s brand.
Redirect each domain to your real site so anyone who visits lands somewhere real. Instantly lists forwarding as an optional setup step. lemlist lets you set redirects in its domain settings, but not for Google domains bought through lemlist.
Buy early. Warmup takes weeks.
Don’t overload a domain. Instantly suggests no more than 3–5 mailboxes per domain. Add domains to grow.

Mailbox setup: Google Workspace or Microsoft 365

A common setup for small teams is regular business mailboxes on Google Workspace or Microsoft 365, connected to a sending tool:

Use real people’s names ([email protected]), with a photo and a plain signature showing your company name and postal address.
Make sure replies work. Add your provider’s MX records. Microsoft recommends that the From or Reply-To address be valid and able to receive replies.
Send from a custom domain. Microsoft limits the default onmicrosoft.com domains to 100 external recipients per organization per 24 hours.

Both providers publish hard limits meant to stop abuse. Treat them as ceilings, not targets.

Provider	Published limit
Google Workspace	2,000 messages per user per day (500 on trial accounts), over a rolling 24 hours
Microsoft 365 (Exchange Online)	10,000 recipients per mailbox per day, plus a tenant-wide daily cap on external recipients that depends on your license count (5,000 on trial tenants). Microsoft says Exchange Online “isn’t suited” to bulk mailing.

As published by Google and Microsoft, checked September 2026. Google notes limits “can change without notice.”

SPF, DKIM and DMARC, explained plainly

All three are DNS records on your sending domain:

SPF lists the servers allowed to send for your domain. Publish one SPF record per domain. Microsoft notes that multiple records, or more than 10 DNS lookups, cause SPF to fail.
DKIM signs each message with a key whose public half lives in your DNS. In Google Workspace you generate it in the Admin console (default selector google, 2048-bit if your DNS host supports it), publish it, then click “Start authentication.”
DMARC tells receivers what to do when mail fails and where to send reports. It also checks alignment: the From: domain must match the domain that passed SPF or DKIM (relaxed alignment also accepts a subdomain of the same domain).

Example records for a sending domain. The SPF lines are Google’s and Microsoft’s documented examples, so use the one for your provider:

; SPF, Google Workspace
getacme.example.                    TXT  "v=spf1 include:_spf.google.com ~all"
; SPF, Microsoft 365 only
getacme.example.                    TXT  "v=spf1 include:spf.protection.outlook.com -all"
; DKIM, Google Workspace (public key shortened)
google._domainkey.getacme.example.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
; DMARC, monitoring mode
_dmarc.getacme.example.             TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Google’s rollout advice: start at p=none and read the reports. Then move to p=quarantine for a small percentage (its examples use pct=5), raise it gradually, and go to p=reject if needed. The rua address receives aggregate reports, which Google suggests reviewing daily during the rollout. One caveat: RFC 9989, the updated DMARC standard published in May 2026, retires the pct tag because receivers applied partial percentages inconsistently, so don’t count on a 5% step behaving exactly as written.

Check your work. Send a test to a Gmail address, open it, and choose “Show original.” SPF, DKIM and DMARC should all show PASS.

Gmail, Yahoo and Outlook.com sender requirements

Gmail and Yahoo began enforcing sender requirements in February 2024. Microsoft announced rules for Outlook.com in April 2025. Each provider describes its rules differently:

	Gmail	Yahoo	Outlook.com
Covers	Personal @gmail.com and @googlemail.com accounts	All domains and consumer brands hosted by Yahoo Mail, including AOL	Consumer outlook.com, hotmail.com and live.com addresses
“Bulk” threshold	“Close to 5,000 messages or more” to personal Gmail in 24 hours, counted per primary domain. Once you’re a bulk sender, the status is permanent.	“Significant volume.” Yahoo “will not specify a volume threshold.”	Domains “sending over 5,000 emails per day”
All senders	SPF or DKIM; valid forward and reverse DNS; TLS; spam rate below 0.3%	SPF or DKIM; valid forward and reverse DNS; spam rate below 0.3%	No separate list
Bulk authentication	SPF and DKIM; DMARC (`p=none` allowed); aligned From: domain	SPF and DKIM; DMARC of at least `p=none` that passes; aligned From: domain	SPF and DKIM must pass; DMARC of at least `p=none`, aligned with SPF or DKIM
Bulk unsubscribe	One-click (RFC 8058) plus a visible link, for marketing and subscribed messages. Google recommends honoring requests within 48 hours.	One-click header for marketing and subscribed messages, plus a visible link. Unsubscribes must be honored within 2 days.	Recommended: a “functional” unsubscribe link
Spam rate	Below 0.1% recommended, never 0.3% or higher. Bulk senders above 0.3% lose eligibility for mitigation.	Below 0.3%	No threshold stated
Enforcement	Since February 2024; “ramping up” from November 2025, including rejections	Since February 2024; unsubscribe since June 2024	Since May 5, 2025, non-compliant mail rejected with “550; 5.7.515” (per Microsoft’s April 29, 2025 update)

As stated on each provider’s official pages, checked September 2026. Quoted wording is the provider’s own.

Which of these apply to cold outreach?

Probably fewer than you’d think. A small team sending a few hundred emails a day is far below 5,000. Many B2B prospects also use company mailboxes rather than personal ones: Google says its guidelines “don’t apply to messages sent to Google Workspace accounts,” and Microsoft’s rules cover its consumer service.

Build to the bulk rules anyway. The all-sender rules still apply whenever you email a personal Gmail or Yahoo address, which some prospects, such as freelancers, use for work. Yahoo publishes no threshold, and Gmail’s bulk status never expires. Aligned SPF, DKIM and DMARC plus an easy opt-out cost almost nothing to set up.

Warmup and ramp-up

A new mailbox has no history. Warmup tools build one by exchanging emails with a network of other mailboxes and raising volume gradually. As of September 2026:

Instantly’s recommended defaults start a new account at 1 warmup email on day one and add 1 a day up to a daily warmup limit of 10, with a 30% reply rate. It recommends at least 2 weeks of warmup and a health score above 90% before campaigns, and its strategy guide says to keep warmup on permanently.
lemlist (lemwarm) is more conservative. Set the target to the mailbox’s eventual volume (30–40 a day for a new mailbox) and ramp by 1 a day, which takes about 40 days, with no campaigns sent in the meantime. Then hold for 14 days, and launch once the score is 90+ with inbox rate above 90%.

Keep expectations realistic. The Gmail, Yahoo and Outlook.com sender guidelines don’t mention warmup networks, so everything published about their effect comes from vendors. Warmup traffic is also automated engagement: Instantly’s settings, for example, include auto-replies, “read emulation” and moving warmup emails out of spam. None of the provider guidelines above endorse it, and it can’t make up for a bad list. Google’s own advice is about behavior: start low, increase slowly, send at a consistent rate, and avoid bursts. After warmup, launch below your target and raise volume only while bounces and complaints stay low.

How many cold emails per mailbox per day?

No mailbox provider publishes a “safe” cold email number. The common figures come from sending tools:

Source	Guidance
Instantly (account limits)	30 campaign emails per account per day; warmup emails don’t count
Instantly (strategy guide)	3–5 accounts per domain, 30–50 emails a day each
lemlist	30–40 a day for a new mailbox, starting at 30. Total sends (lemlist, lemwarm and manual replies) under 70 a day per provider. A domain under a month old stays under 100 a day across all its mailboxes.

Vendor help-center guidance, checked September 2026. Common practice, not provider rules.

For a rough capacity plan using Instantly’s 30-per-account figure, divide your daily target by 30. Sending about 150 emails a day, follow-ups included, means roughly five warmed mailboxes, for example two or three on each of two domains.

More mailboxes doesn’t mean more reputation. lemlist treats its ceiling as per provider, not per mailbox: “six Google mailboxes share one Google-side reputation.” Rotation spreads a safe volume across senders, but it doesn’t multiply what one provider will accept from you, so lemlist suggests spreading larger volumes across providers and warmed domains.

List hygiene and verification

Verify every list, including leads from databases like Apollo (see our Apollo.io pricing guide). Contact data goes stale as people change jobs. Instantly can verify on upload (using Instantly credits) and skips invalid and risky leads by default. lemlist integrates with the Bouncer verification service, which needs its own Bouncer account.
Set a bounce ceiling. lemlist recommends staying “below 5% (ideally under 3%),” but its own safeguards are looser: it alerts at 10% and auto-pauses a campaign at 50% once 100 leads have been contacted. Instantly auto-pauses campaigns above 5% by default (adjustable), once a campaign has sent at least 200 emails.
Keep one suppression list of unsubscribes, hard bounces and “not interested” replies across every domain and tool. The UK’s ICO recommends screening new lists against a “do not email” list.
Collect data lawfully. Don’t scrape sites against their terms or buy untraceable lists.

Content and tracking choices

For a first email from an unknown sender, less is better: short plain text, no attachments or images, and few links.

Links. lemlist advises limiting links to one per email, “ideally 0 in your initial cold outreach,” and says tracked redirect links hurt deliverability.
Open tracking. Opens are tracked with an invisible image, and the data is unreliable. With Apple’s Mail Privacy Protection on, remote content is “privately downloaded in the background when you receive a message.” lemlist recommends turning off open and click tracking and measuring replies instead.
Custom tracking domain. If you do track, use your own domain. Instantly explains that its default tracking links are “shared among Instantly customers,” and lemlist now blocks sending on campaigns with tracking turned on until a custom tracking domain is verified. Both are set up with a CNAME record, and lemlist also asks for a TXT record.
Opt-out. Include a plain opt-out line or link. Instantly can add a List-Unsubscribe header (Campaign Options, Advanced options), and lemlist’s unsubscribe link removes the lead from all campaigns permanently.

Monitoring: Postmaster Tools, SNDS and your own numbers

Google Postmaster Tools shows spam rate, authentication and delivery errors for mail to personal Gmail accounts, plus a compliance status dashboard that checks you against the sender requirements. Data “might be missing” on low-volume days, so expect gaps at cold email volumes.
Microsoft SNDS reports on sending IP addresses you’re responsible for. On Google Workspace or Microsoft 365 you don’t control the IPs, so it mainly helps senders with dedicated IPs.
Your own numbers are the early warning: bounce rate, reply rate, negative replies, your tool’s warmup scores, and rejection codes such as Outlook.com’s “550; 5.7.515.”

If numbers drop, pause first. Then recheck authentication, clean the list, cut volume and resume slowly.

Where Instantly and lemlist fit

You don’t need a sequencing tool to be deliverable, but once you run several mailboxes, one saves a lot of work. Instantly and lemlist both offer warmup (lemlist’s is called lemwarm), inbox rotation (spreading one campaign across many mailboxes), bounce safeguards, custom tracking domains and unsubscribe handling, though which features come with which plan varies. We compare their pricing and plans in Instantly vs lemlist.

Pros

Automates warmup, ramp-up and per-mailbox caps
Rotation keeps each mailbox’s volume low
Lead verification (built in or through an integration), bounce auto-pause and unsubscribe handling

Cons

Warmup results are documented only by the vendors
Rotation doesn’t multiply reputation
Defaults aren’t always safe: lemlist auto-pauses only at a 50% bounce rate, and Instantly’s default tracking domain is shared
Every extra domain and mailbox adds cost and admin

Who doesn’t need one yet: if you send a handful of hand-written emails a day, a tool and extra domains may be overkill. Authentication and a clean list still matter. See our cold outreach stack guide for the full setup.

Compliance basics: CAN-SPAM, GDPR and CASL

Not legal advice. This summarizes published rules as of September 2026. What applies depends on where your recipients are, so check with a qualified lawyer.

US (CAN-SPAM). The FTC says the law “makes no exception for business-to-business email.” Don’t use misleading headers or deceptive subject lines. Identify the message as an ad, include a valid postal address and a clear opt-out, and honor opt-outs within 10 business days. You’re also responsible for anyone sending on your behalf. The FTC lists penalties of up to $53,088 per violating email.

EU and UK (GDPR, plus PECR in the UK). A named person’s work address (like firstname.lastname@company) still identifies them, and the ICO notes data protection rules may apply to it. Recital 47 says direct marketing “may be regarded as carried out for a legitimate interest,” but only if the recipient’s rights don’t override it, so document that balancing test. People can object at any time, and then you must stop (Article 21). If you didn’t collect the data from them, Article 14 requires privacy information by your first communication. In the UK, the ICO says you can email corporate bodies without consent if you don’t hide your identity and give an opt-out address. Sole traders and some partnerships are treated as individuals and need consent, unless they bought something similar from you and didn’t opt out. The ICO says this guidance is under review after the Data (Use and Access) Act. Other countries have their own e-marketing rules.

Canada (CASL). CASL requires consent. Implied consent from a published address applies only if it was conspicuously published without a “no unsolicited messages” note and your message fits the person’s business role. Identify yourself with a mailing address and a contact method, include an unsubscribe mechanism, and honor unsubscribes within 10 business days. Maximum penalties are C$1 million per violation for individuals and C$10 million for businesses.

Cold email launch checklist

Domains. Buy 1–2 secondary domains and redirect them to your main site.
Mailboxes. Create a few per domain, with real names and signatures that include your postal address.
DNS. Publish MX, one SPF record (no more than 10 DNS lookups), DKIM, and DMARC at p=none with a monitored rua.
Verify. Confirm SPF, DKIM and DMARC pass using “Show original.”
Tracking and opt-out. Set up a custom tracking domain or turn tracking off, and enable List-Unsubscribe if your tool supports it.
Warm up for at least two weeks, until scores clear your tool’s threshold.
Clean the list. Verify it and apply your suppression list.
Write lean emails. Use plain text, at most one link, and a clear opt-out.
Ramp gradually, starting below about 30 per mailbox per day.
Monitor weekly and pause if bounces or complaints rise.
Check compliance for each country you target.

Verdict

Cold email deliverability comes down to giving providers no reason to distrust you. Keep cold sending off your main domain, authenticate everything, grow slowly, and only email verified people you have a real reason to contact. The bulk-sender rules may not formally apply at small volumes, but they’re the clearest statement of what providers expect, so build to them from day one.

FAQ

Do Google’s bulk sender rules apply to cold email?

Only if you send close to 5,000 or more messages a day to personal Gmail accounts, counted per primary domain. Google says the guidelines don’t cover mail to Google Workspace accounts. Meeting them anyway is cheap insurance.

Can I send cold email from my main domain?

You can, but Instantly and lemlist both recommend a separate domain so outreach problems are less likely to spill over onto your customer email.

How long should I warm up a new mailbox?

Instantly recommends at least two weeks. lemlist’s process runs about 40 days of ramp-up plus 14 days of stabilization.

How many cold emails can one mailbox send per day?

No provider publishes a safe number. Instantly recommends 30 a day, and lemlist suggests 30–40 for a new mailbox.

Is cold email legal?

It depends on where recipients are: CAN-SPAM in the US, GDPR and national rules in the EU and UK, CASL in Canada. This isn’t legal advice.

Sources

Email sender guidelines — Google, Gmail Help, accessed September 2026
Email sender guidelines FAQ — Google, Gmail Help, accessed September 2026
Set up Postmaster Tools — Google, Gmail Help, accessed September 2026
Postmaster Tools dashboards — Google, Gmail Help, accessed September 2026
Gmail sending limits in Google Workspace — Google, accessed September 2026
Set up SPF — Google, accessed September 2026
Set up DKIM — Google, accessed September 2026
Recommended DMARC rollout — Google, accessed September 2026
Sender Best Practices (Sender Requirements & Recommendations) — Yahoo Sender Hub, accessed September 2026
FAQs — Yahoo Sender Hub, accessed September 2026
Strengthening Email Ecosystem: Outlook’s New Requirements for High-Volume Senders — Microsoft Tech Community (published April 2, 2025, updated April 30, 2025), accessed September 2026
Set up SPF to identify valid email sources for your Microsoft 365 domain — Microsoft Learn, accessed September 2026
Exchange Online limits — Microsoft Learn, accessed September 2026
Smart Network Data Services (SNDS) — Microsoft, accessed September 2026
RFC 8058: Signaling One-Click Functionality for List Email Headers — IETF, accessed September 2026
RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) — IETF (May 2026, Appendix A.6 on removal of the pct tag), accessed September 2026
Protect email privacy in Mail on Mac — Apple Support, accessed September 2026
Instantly Cold Email Strategy — Instantly Help Center, accessed September 2026
Account and Campaign Limits — Instantly Help Center, accessed September 2026
Warmup Settings — Instantly Help Center, accessed September 2026
When Your Email Account Is Ready for Campaigns — Instantly Help Center, accessed September 2026
Inbox Rotation: Assign Sending Accounts to a Campaign — Instantly Help Center, accessed September 2026
High Bounce Auto-Pause Feature — Instantly Help Center, accessed September 2026
How to Verify Leads — Instantly Help Center, accessed September 2026
Custom Tracking Domain (CTD) — Instantly Help Center, accessed September 2026
List-Unsubscribe — Instantly Help Center, accessed September 2026
Choose subdomain vs separate domain — lemlist Help Center, accessed September 2026
Set Up Domain Redirections in lemlist — lemlist Help Center, accessed September 2026
How to set up and use lemwarm — lemlist Help Center, accessed September 2026
Understand sending limits in lemlist — lemlist Help Center, accessed September 2026
Use inbox rotation for campaigns — lemlist Help Center, accessed September 2026
Reduce email bounces — lemlist Help Center, accessed September 2026
Should you track clicks and opens in cold email campaigns? — lemlist Help Center, accessed September 2026
Set up a custom tracking domain — lemlist Help Center, accessed September 2026
How to add and manage unsubscribe links — lemlist Help Center, accessed September 2026
Verify emails with Bouncer — lemlist Help Center, accessed September 2026
CAN-SPAM Act: A Compliance Guide for Business — U.S. Federal Trade Commission, accessed September 2026
GDPR Recital 47, Article 14 and Article 21 — text of Regulation (EU) 2016/679 as reproduced by gdpr-info.eu (unofficial secondary source, used because the official EUR-Lex page could not be fetched), accessed September 2026
Electronic mail marketing (Guide to PECR) — UK Information Commissioner’s Office, accessed September 2026
Canada’s Anti-Spam Legislation, S.C. 2010, c. 23 (sections 10–11) and section 20 — Justice Laws Website, Government of Canada, accessed September 2026
Getting consent to send email — Innovation, Science and Economic Development Canada, accessed September 2026