Why Your Cold Emails Go to Spam, and the Order to Fix It In
Almost nobody loses cold email to one dramatic mistake. They lose it to a stack of small ones fixed in the wrong order: rewriting the subject line while the domain has no DMARC record, buying a new sending domain while the old one still bounces. This page is the order.
1. Authentication first, because everything else sits on it
Gmail's own guidelines: since February 2024, all senders to personal Gmail accounts must set up SPF or DKIM, have valid forward and reverse DNS records on the sending domain, use TLS, and keep their reported spam rate below 0.3%. Senders pushing 5,000 or more messages a day must also publish DMARC, aligned with SPF or DKIM. Source: support.google.com/a/answer/81126 — read it in full, not a blog summary of it.
What the three records do, plainly:
- SPF lists the servers allowed to send as your domain. It protects the envelope, survives forwarding badly, and breaks silently when you switch sending tools.
- DKIM signs the message with a key published in DNS. It survives forwarding, and it is the record that keeps working when you change tools.
- DMARC is the policy tying the two together, telling the receiver what to do when neither passes.
p=nonemeets Gmail's stated minimum and still gives you reporting.
The check that catches real mistakes: send one message from your actual sending tool to a Gmail address you control, open the original, read the Authentication-Results header. You want spf=pass and dkim=pass for your domain, not your provider's. DKIM passing under the provider's domain is authenticated but not aligned, and that quietly caps volume.
2. Measure the spam rate before arguing about copy
You cannot fix a reputation problem you do not measure. Google Postmaster Tools is free and reports spam rate and domain reputation for mail sent to Gmail. Register the domain, verify it with a DNS record, wait for data. If the spam rate sits near Gmail's line, copy is not your problem: recipients are voting, and they are voting spam.
Gmail's FAQ also states that a sender who hits the 5,000-per-day threshold even once is classified as a bulk sender permanently. Plan volume around that line rather than discovering it.
3. Warm up the domain like it is new, because it is
A freshly registered domain has no sending history, and receivers treat no history as risk. Stated practice, not a measured claim: start with a handful of messages a day to people likely to open and reply, and increase over a couple of weeks while watching bounce and complaint signals. Warmup is not about fooling a filter; it is about building a real record of engaged recipients, and finding broken DNS records while volume is cheap.
4. Cut the list before you write to it
Bounces and complaints decide your fate, and both are list problems before they are copy problems. Verify addresses before the first send. Avoid role addresses like info@ and sales@. Keep one suppression list across every tool, and never re-add an address that complained. A smaller list that lands beats a bigger one that does not.
5. Now the copy, and the part people skip
With authentication, measurement and list hygiene in place, the remaining losses are structural: emails asking for a meeting in line one; tracking pixels and link shorteners on a first touch, adding redirects a suspicious receiver must trust; unrequested attachments; subject lines promising a number you cannot evidence. Each is a reason to say no.
The structure that survives is dull and it works: one specific observation about the recipient's business, the gap it implies, one line of proof, and an ask small enough to answer in a sentence. The pack page shows the first email in full, free, if you want the skeleton written out rather than described.
What this page is not
Not a guarantee of the inbox. Receivers do not publish their full logic and reputation is per-recipient and changes. What the five steps do is remove the causes you control, in an order where each fix makes the next one measurable.
Questions
Why do my emails land in spam when my SPF record is fine?
Because SPF is one requirement out of several. Gmail also expects DKIM, valid forward and reverse DNS, TLS, RFC 5322 formatting, and a spam rate under threshold. SPF also breaks on forwarding, since the forwarding server is not in your record. Read the Authentication-Results header on a delivered message: it names the method that failed.
Do I need a separate domain for cold email?
Many agencies do, so a reputation problem in outbound cannot reach the domain their invoices and client mail come from. That is risk isolation, not a trick: the new domain starts with no history, needs its own SPF, DKIM and DMARC, and still has to earn engagement. If you split, keep the display name recognisable.
How long does warmup take?
No number I can honestly give, because it depends on volume, list quality and how recipients respond. Practice is to ramp over weeks rather than days, and to stop the moment bounce or complaint signals move the wrong way. Treat exact daily ramp schedules as invented.
Is tracking opens hurting my deliverability?
Tracking pixels and wrapped links add requests and redirects, one more thing a receiver weighs on first contact. Practice among outbound teams is to leave both out of the first email and judge on replies. Add tracking after the relationship exists.
If you would rather not rebuild the sequence yourself
The Outreach Pack is thirty prompts across three jobs: ten for the writing, ten for the plumbing above, ten for keeping the client once replies arrive. $27 one time. Everything on this page works without it — the pack shortens the writing half, it does not fix a domain with no DMARC record.
If you want the plumbing checks and the first email in one file instead of five browser tabs: the $27 pack.