Cold Email Deliverability: How to Land in the Inbox (2026 Playbook)

Cold email deliverability is the probability that an unsolicited outbound email reaches the recipient's inbox rather than spam, quarantine, or a silent block. Three things you control decide most of it: authenticated, properly aged sending infrastructure (SPF, DKIM, DMARC aligned on a separate sending domain), conservative per-mailbox volume, and recipient engagement. Positive replies lift you; spam complaints and bounces sink you. Content matters far less than most senders assume. Reputation and list quality matter far more.

This guide is written for people who send cold email at scale and need it to actually arrive. It covers the DNS setup line by line, the volume math, how to measure placement when open rates lie, and how to recover a domain you have already burned.

What actually decides whether a cold email lands in the inbox?

Mailbox providers score every message on a handful of axes. In rough order of weight for cold email:

Fix the first four and ignore the last, and you will do well. Obsess over spam-word lists and ignore the first four, and you will fail.

What DNS records do I need for cold email, exactly?

Three records per sending domain, plus two optional ones that are worth adding. Set these on the sending domain, not your main company domain.

SPF

One TXT record at the root of the domain. For Google Workspace:

For Microsoft 365:

Two rules break SPF in practice. You may publish only one SPF record per domain (two records = permanent failure), and the record must resolve in 10 or fewer DNS lookups. Each include: can nest further lookups, so stacking five tools silently blows the limit and SPF starts returning permerror. If you are sending only through one mailbox provider, you need exactly one include.

DKIM

Generate the key inside your mailbox provider's admin console (Google Admin → Apps → Google Workspace → Gmail → Authenticate email; Microsoft 365 Defender → Email authentication settings) and publish the TXT/CNAME records it gives you. Use a 2048-bit key where offered. Then, and this is the step most people skip, turn authentication on after publishing. A generated-but-not-enabled DKIM key signs nothing.

DMARC

One TXT record at _dmarc.yourdomain.com:

p=none is sufficient, and it is what Google and Yahoo require of bulk senders as a minimum. You do not need p=reject to reach the inbox. You need a published policy and alignment. Raise the policy later, once rua aggregate reports confirm nothing legitimate is failing.

The alignment check nobody runs

Send a test to a Gmail address, open it, and choose "Show original." You want to see SPF: PASS, DKIM: PASS, DMARC: PASS, and the d= value on the DKIM signature matching the domain in your From address. If DKIM signs as the provider's domain instead of yours, DMARC alignment fails even though both SPF and DKIM "pass."

Two worth adding

If you would rather not hand-manage this across dozens of domains, infrastructure providers automate it. Inboxlogy configures SPF, DKIM, and DMARC automatically on every domain it provisions, and you keep admin access to the tenant to verify or change any of it yourself.

How many cold emails can I send per mailbox per day?

Plan on 20–40 emails per mailbox per day as a steady-state ceiling, and scale horizontally with more mailboxes rather than pushing any single mailbox harder. This is an operational convention, not a published provider limit, and it exists for a reason: a single mailbox sending 200 unsolicited messages a day looks nothing like a human, and recovery from a flagged mailbox costs more than the extra mailboxes would have.

Practical sizing math. If you need 3,000 sends per week and run 30/day across a five-day week, that is 150 per mailbox per week, so 20 mailboxes. At typical cold email infrastructure pricing (Inboxlogy starts at $2.80 per mailbox per month), that capacity costs less than the tooling that sends it, which is why horizontal scaling is the standard answer.

Other volume rules worth following:

Does email warmup actually work, and how long does it take?

Warmup is an automated network of mailboxes that exchange, open, and reply to each other's messages. It does two useful things: it establishes a baseline of sending activity on a brand-new mailbox, and it generates positive engagement signals before real prospects ever see you. Run it for 2–4 weeks before the first campaign, and keep it running at low volume afterward.

Be clear-eyed about what it is not. Warmup traffic is artificial engagement between cooperating accounts. It does not simulate how real recipients treat your actual pitch, and no amount of warmup rescues a bad list or an offer that earns complaints. Treat it as a floor, not a strategy. The signal that compounds over months is real replies from real prospects.

One operational note: warmup runs inside your sending tool, not your mailbox provider. Inboxlogy does not run warmup itself. You connect the mailboxes to Instantly, Smartlead, or ReachInbox and enable warmup there, which is also where your campaigns and reply handling live. Any infrastructure vendor claiming to warm mailboxes for you is either reselling a sending tool or describing something else.

Should I send from my main domain or a separate one?

Always use separate sending domains. Cold email reputation is volatile and domain-level. If it degrades on yourcompany.com, your invoices, support replies, and sales follow-ups degrade with it, and that damage is slow to undo.

The standard pattern:

Use a custom tracking domain, or no tracking at all

Shared tracking domains are a common and avoidable cause of spam placement. Hundreds of senders redirect links through the same hostname, and one of them gets that hostname blocklisted. If you track clicks, set up a custom tracking subdomain on your sending domain. Better still for cold email: turn off open tracking entirely. It injects a pixel from an external host for no reliable gain, and Apple's Mail Privacy Protection pre-fetches images and inflates opens into noise. Measure replies instead.

What does a "dedicated IP" actually mean for cold email?

This deserves plain language, because it is widely misrepresented.

When you send through Google Workspace or Microsoft 365, the IP that delivers your mail to the recipient belongs to Google or Microsoft. Nobody sells you a dedicated Gmail outbound IP. That is not a product that exists. Your reputation at the receiving end is carried by your domain, which is why the DNS work above matters so much.

What a dedicated IP does mean in cold email infrastructure is the IP your sending tool connects from when it authenticates to the mailbox and sends. That matters for a different reason: mailbox providers watch where accounts are accessed from. If your automation connects from a datacenter IP shared with hundreds of other senders, some of them abusive, you get security interrupts, suspicious-login challenges, and lockouts that have nothing to do with spam filtering. A clean, dedicated, geographically consistent IP (Inboxlogy offers US and EU options) keeps the account-access side quiet so the deliverability side is the only thing you have to manage.

Anyone selling you "dedicated IPs for better Gmail inbox placement" is describing the wrong mechanism. Ask them which IP they mean.

Why do mailboxes bought from resellers get suspended?

Cheap Google Workspace and Microsoft 365 mailboxes often come from panel operations: one vendor's tenant, sliced up and sublet, with you as a user rather than an owner. Two things go wrong. First, you have no admin access, so you cannot generate DKIM keys, inspect logs, change DNS, or export anything. Second, when the provider acts against the parent tenant for abuse, every mailbox inside it dies at once, mid-campaign, with your domains and sequences attached.

The defensible setup is mailboxes provisioned through authorized channels where you own the tenant outright and hold admin access. That is what Inboxlogy provides with authorized Google Workspace and Microsoft 365 accounts, 100% ownership, full admin, and an API for provisioning at scale. The test is simple: ask whether you can log into the admin console yourself, and whether the accounts survive if you stop paying the vendor. If the answer to either is no, you are renting someone else's risk.

How do I measure cold email deliverability properly?

Open rates are not a deliverability metric. Watch these instead, in order of usefulness:

Microsoft gives you far less visibility than Google. There is no Postmaster Tools equivalent for Outlook.com placement, and SNDS only covers IPs you control. For Microsoft recipients, reply rate per domain is effectively your only live signal, which is a good argument for splitting Google-heavy and Microsoft-heavy segments across different domains so you can see them separately.

How do I fix a domain that is already landing in spam?

Work through this in order. Resist the urge to skip to rewriting copy.

Judgment call: a badly burned domain is often cheaper to replace than to rehabilitate. Domains are inexpensive, your pipeline is not. If reply rates do not recover after a rest-and-ramp cycle, retire it and move the mailboxes to fresh domains. Rotating domains out of service before they fail is an operating practice, not an admission of defeat.

What are the compliance rules I actually have to follow?

Not legal advice, but the practical baseline:

The rails are also moving. Since 2024, Google and Yahoo have required SPF, DKIM, DMARC, one-click unsubscribe (RFC 8058), and sub-0.3% complaint rates for bulk senders. In 2025, Microsoft began requiring SPF, DKIM, and DMARC for domains sending high volumes to Outlook.com consumer addresses. Unauthenticated mail is becoming undeliverable mail.

The cold email deliverability checklist

Before your next campaign:

Frequently asked questions

How long does it take to warm up a new cold email domain?

Two to four weeks before the first campaign, ramping from roughly 5 sends per mailbox per day to 20–40. Warmup should keep running at low volume indefinitely afterward. Domains that were pushed to full volume in the first week rarely recover a good reputation later.

Is Google Workspace or Microsoft 365 better for cold email?

Google Workspace gives you far better feedback, since Postmaster Tools shows domain reputation and complaint rates you can act on. Microsoft 365 often reaches Microsoft-hosted recipients more reliably, which matters because a large share of B2B inboxes are on Microsoft. Many teams run both and route by the prospect's MX record. Inboxlogy provisions both, so you can split your list without splitting vendors.

Do I need a dedicated IP for cold email?

Not for inbox placement. When you send via Google Workspace or Microsoft 365, the outbound delivery IP is theirs, and your reputation rides on your domain. A dedicated IP is worth having for the connection your sending tool makes to the mailbox: it prevents suspicious-login flags and lockouts caused by sharing a datacenter IP with abusive senders.

Will changing my subject line fix my spam problem?

Almost never, on its own. If messages are going to spam, the cause is usually authentication, domain reputation, list quality, or a blocklisted link domain. Fix those first. "Spam trigger words" are a far smaller factor in 2026 than folklore suggests. One exception worth acting on: links through shared tracking domains and URL shorteners do get messages filtered, and removing them is a genuine fix.