Why cold email lands in spam, and what actually moves the needle

When a campaign underperforms, the first instinct is to rewrite the subject line. That is almost always the wrong place to start. Mailbox providers decide placement using signals that are set long before the copy is read: who authenticated the message, what the sending domain has done in the past, how recipients have reacted to it, and whether the addresses on the list are real.

Below are the four checks worth running before touching a single word of the message.

1. Authentication has to be complete, not partial

SPF, DKIM, and DMARC are not three ways of doing the same thing. SPF authorises the sending host, DKIM signs the message so tampering is detectable, and DMARC tells the receiver what to do when the first two disagree with the visible From address. A domain with SPF alone is a domain that fails alignment the moment mail is forwarded.

• Publish DMARC, even at p=none to begin with, because the aggregate reports are how you find out which of your senders are misaligned.
• Check alignment, not just presence. A passing DKIM signature on the wrong domain does not help you.
• Use a subdomain for outreach so the reputation of your cold sending is separable from your transactional and internal mail.

2. Reputation is earned per domain, and slowly

A domain registered last week has no history. Sending a thousand messages from it on day one is the single most reliable way to get filtered, and no amount of personalisation compensates. Warmup exists because providers weight recency and consistency: a slow, steady ramp that produces real engagement builds a profile; a spike does not.

A useful rule of thumb: a new domain should spend its first three weeks sending less mail per day than a single person could send by hand.

3. An unverified list poisons the sender, not just the campaign

Hard bounces are a direct negative signal. So are spam traps, which are addresses that exist only to catch senders who are not validating their lists. A list bought or scraped without verification will contain both, and the damage lands on the sending domain rather than on the campaign that happened to include them.

Verification is not a single check. Syntax and domain validation are cheap and catch typos. MX lookups confirm the domain can receive mail at all. Catch-all detection tells you when a positive result is not actually meaningful. Role-address detection filters the info@ and sales@ addresses that are least likely to convert and most likely to complain.

4. Volume per mailbox matters more than volume in total

Providers rate-limit and score per sending account. Ten mailboxes each sending fifty messages a day look like ten people doing their jobs. One mailbox sending five hundred looks like software. Distributing volume, randomising intervals, and respecting a per-mailbox daily cap costs nothing and changes how the traffic is classified.

What to do first

1. Verify the list before it enters a send queue, not after the bounces come back.
2. Confirm SPF, DKIM, and DMARC all pass and all align on the sending subdomain.
3. Warm every new mailbox for three weeks before it carries campaign volume.
4. Cap per-mailbox daily sends and spread the campaign across accounts.
5. Only then, test subject lines.

None of this is clever. It is the part of outreach that is infrastructure rather than creative, and it is where the majority of lost inbox placement actually comes from.