How do I keep cold email out of spam?

Why cold email lands in spam

Gmail, Yahoo and Outlook do not filter on whether a message is "cold." They filter on who is sending it, whether that sender can be verified, and what recipients have done with that sender's previous mail. A message from a domain with no history, sent to a list nobody verified, from a mailbox that went from zero to four hundred sends overnight, has every signal of spam before anyone reads a word of it. The copy is usually the last thing that matters and the first thing founders rewrite.

The three providers that matter published their rules in 2024 and 2025, and they are unusually specific. The table below is what each one actually requires. Everything else in the deliverability industry is advice layered on top of these.

Sources: Google's sender guidelines, Yahoo's sender best practices, Microsoft's Outlook.com postmaster page and Microsoft's 550 5.7.515 support article.

The authentication floor

SPF says which servers may send for your domain. DKIM signs each message so the receiver can prove it was not altered. DMARC tells the receiver what to do when the two disagree, and requires that the domain in your From: line aligns with the domain that passed SPF or DKIM. Google requires SPF or DKIM from every sender and all three from anyone over 5,000 messages a day; it also requires a TLS connection and a valid reverse-DNS record on the sending server (sender guidelines). Microsoft began enforcing SPF, DKIM and DMARC for domains over 5,000 a day on May 5, 2025, sending non-compliant mail to junk first and rejecting it afterwards (Outlook.com postmaster).

Two details catch small senders. Google counts every message from the primary domain and its subdomains toward the 5,000, and once a domain is classified as a bulk sender it stays classified (Google's FAQ). Microsoft applies its rule the same way: once a domain has sent 5,000 messages to its consumer services, all mail from that domain is expected to meet the standard (Microsoft Support). If you have ever run a big send from your main domain, you are already held to the bulk rules even if today's volume is fifty.

Authentication is a floor, not a fix. Passing all three proves you are who you say you are. It does not make anyone want the message.

The number that decides it

The metric the providers actually act on is the spam rate: the share of your messages that reached an inbox and were then marked as spam by the person who received them. Google publishes it per domain in Postmaster Tools and defines it that way (Postmaster Tools dashboards). Its guidance is to stay under 0.10% and never reach 0.30%; a bulk sender at 0.30% or above becomes ineligible for delivery support until the rate stays under 0.30% for seven consecutive days (sender guidelines, FAQ). Yahoo's ceiling is the same 0.3% (Yahoo Sender Hub).

Put that in cold-email terms. One complaint in every thousand delivered messages is your target. Three in a thousand and Gmail stops helping you. Postmaster Tools also rates domain reputation on a four-step scale — Bad, Low, Medium, High — and describes Low as a domain whose mail "is likely to be marked as spam" (Postmaster Tools dashboards). Google adds a caveat worth reading twice: if it is already routing a lot of your mail to spam, your reported spam rate can look artificially low, because fewer recipients ever saw the message to complain about it. A quiet dashboard is not proof of a healthy domain.

Volume, list and message

Three practices keep the spam rate down, and none of them is a product feature. First, ramp volume. Google's own guidance is to start with a low volume to engaged users and increase slowly, and to avoid sudden spikes if you have no history of sending at that level (sender guidelines). A new mailbox sending hundreds on day one is the single most common way a founder burns a domain.

Second, verify the list before sending. A bounce is not a complaint, but a domain that bounces heavily and then keeps sending looks like a domain that does not know who it is mailing, and unverified lists also carry the spam traps and dead addresses that turn into complaints later. Verification before send, and a suppression list that is enforced at send time rather than remembered by a rep, are the two controls that stop a list from degrading a domain.

Third, the message. If a reader marks it as spam, no authentication record saves you. Short, specific, addressed to a real problem the recipient has, with an obvious way to say no — and never sent to someone who already said no. Google requires a visible unsubscribe and one-click unsubscribe from bulk senders on marketing mail; Yahoo requires unsubscribes to be honored within two days (Yahoo Sender Hub). Treat those as the minimum for outbound too. The honest summary is that deliverability tooling can keep a good campaign out of trouble. It cannot make a bad list or a bad message land.

Where SalesARC fits

SalesARC Prospect is the CRM and sending engine underneath the SalesARC playbook. Each sending channel is warmed gradually rather than switched on at full volume, every address is verified before it is sent to, and the suppression list is enforced at send time so a rep cannot accidentally send around it. Outbound goes out from a dedicated subdomain of your domain, never a shared pool, so another customer's behavior cannot affect your reputation. Basic ($199/mo) includes one warmed sending channel and 2,500 contacts; Standard ($499/mo) allows up to three channels; Enterprise ($1,499/mo) adds dedicated deliverability management by a person. None of that writes the message or cleans up a list you bought — the playbook and the ICP do that work first.

See SalesARC Prospect or build a plan.