B2B Cold Email Deliverability: The Complete 2026 Setup

Cold email only works when it lands in the inbox. In 2026, getting there takes meaningfully more setup than it did three years ago — Google and Microsoft have tightened bulk-sender requirements, spam filters now score prose for AI-generation patterns, and “warmed-up” domains are no longer optional. This post is the complete deliverability setup we run for every B2B cold email engagement.

This is the operational companion to Cold Email Outreach in 2026: Complete Guide for B2B Lead Generation. That post covers strategy and copy; this one covers the technical foundation that makes the strategy possible.

The domain strategy

Rule #1: never send cold email from your primary domain.

If your main business runs on yourcompany.com and you send cold email from that same domain, a single spam-flagging incident can blacklist your entire primary domain — breaking your invoices, password resets, and transactional email.

The correct setup:

1. Buy a secondary domain that redirects to your primary (yourcompany.co, tryyourcompany.com, getyourcompany.com — any variant).
2. Set the secondary domain to 301-redirect to your primary at the DNS/hosting layer.
3. Send cold email from that secondary domain only.

Scaling beyond one domain:

A single domain/mailbox should send no more than 30–40 cold emails per day after warmup. If you need to scale, buy additional secondary domains — 2–5 mailboxes per domain, never more. Tools like Instantly and Smartlead handle rotation across mailboxes automatically.

Cost: 3 secondary domains with 2 mailboxes each (6 inboxes) costs about CAD $50–$80/month in domain registration + Google Workspace fees and supports ~180–240 cold emails/day.

DNS authentication: SPF, DKIM, DMARC

Without these three records, Google and Microsoft treat your email as suspicious by default. With them, you pass the baseline.

SPF (Sender Policy Framework)

Tells receiving servers which IPs are allowed to send on behalf of your domain.

Record example (TXT):

v=spf1 include:_spf.google.com include:sendgrid.net ~all

• Start with v=spf1.
• include: each sending service (Google Workspace, SendGrid, Instantly, etc.).
• End with ~all (softfail — safer for gradual rollout) or -all (hardfail — stricter, deploy after testing).

Common mistake: having multiple SPF records on one domain. Only one SPF TXT record is allowed; merge includes into the single record.

DKIM (DomainKeys Identified Mail)

Cryptographically signs outgoing emails so receivers can verify they weren’t forged.

Setup: every sending service (Google Workspace, Microsoft 365, SendGrid, Instantly) provides a DKIM selector and public key. Add these as TXT records at <selector>._domainkey.<yourdomain>.

How to verify: use mxtoolbox.com/dkim.aspx — paste your domain and selector, confirm the record is found and valid.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

Tells receivers what to do when SPF or DKIM fails, and where to send reports.

Start-here record (monitoring only):

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com; fo=1

• p=none means “monitor but don’t block.”
• Run this for 2–4 weeks. Check the aggregate reports (rua) for any legitimate email failing authentication.

Graduate to strict policy:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com

Gradually increase pct (percentage of failed email sent to spam) from 25 → 50 → 100. Eventually move to p=reject for maximum protection.

Required by: Google and Microsoft both require DMARC for any sender exceeding 5,000 emails/day to their users. For cold email at scale, it’s not optional.

BIMI (Brand Indicators for Message Identification) — optional but valuable

Displays your logo next to emails in Gmail. Requires DMARC at p=quarantine or p=reject plus a Verified Mark Certificate (VMC). Worth it if you’re a recognizable brand; skip for pure outbound SaaS sales.

Inbox warmup

New domains and new mailboxes are distrusted by default. Warmup is the process of gradually building sender reputation by sending small volumes of “good” email before cold outreach begins.

How warmup works

Automated warmup tools (Instantly, Smartlead, Warmup Inbox) put your mailbox in a pool of thousands of other inboxes. They exchange realistic-looking emails with each other — opening, replying, marking as important. This teaches Gmail and Microsoft that your domain is trusted.

Timeline

• Week 1: 5–10 warmup emails/day.
• Week 2: 10–20 emails/day.
• Week 3: 20–30 emails/day.
• Week 4+: 30–40 emails/day (steady-state for a single mailbox).

Do not send real cold email during warmup. Warmup runs in the background while you finalize copy and lists.

After warmup

Even after warmup completes, keep 30–50% of your sending volume as warmup traffic alongside real cold email. This maintains the reputation signal long-term.

Sending cadence and volume

Per mailbox, post-warmup:

• 30–40 cold emails/day maximum.
• Send Tuesday–Thursday for highest reply rates; Monday and Friday are lower.
• Spread throughout 9am–3pm in the recipient’s timezone, not all in a burst.

Per sequence:

• 3–5 emails over 14–21 days.
• 3–5 day gaps between messages.
• First email: personalized opener + value hook. Under 80 words.
• Email 2: a different angle, same goal. Not “just following up.”
• Email 3: social proof or case study.
• Email 4 (optional): soft breakup (“last email from me”).

Copy patterns that trigger spam filters

Gmail and Microsoft’s spam filters have gotten aggressive. Avoid:

• Direct “unsubscribe” links in cold email. This triggers bulk-sender classification. Use “reply STOP” instead.
• Images in cold email. Images trigger bulk filters. Plain text only for outbound.
• More than 2 links per email. Ideally one link (to your booking page) per email.
• HTML email for cold outreach. Plain text survives filters better and reads more like a real human wrote it.
• Spammy trigger words. “Guaranteed,” “urgent,” “limited time,” “free,” “winner,” “congratulations.” Older filters; still worth avoiding.
• All-caps subject lines or excessive punctuation. Obvious.
• Large attachments. Never attach on first touch. Link to a doc hosted on your domain if you must share something.

Monitoring and maintenance

Check these weekly:

• Deliverability rate (emails delivered ÷ emails sent). Healthy: 95%+. Below 90% signals a deliverability problem.
• Open rate. 40–60% for well-targeted, well-warmed cold email. Below 25% usually means poor deliverability, not bad subject lines.
• Reply rate. 1–5% is normal. Above 5% is strong; above 8% indicates exceptional targeting and copy.
• Bounce rate. Keep under 3%. Above 5% and Gmail will throttle your sending.
• Spam complaints. Should be near zero. Any complaint is worth investigating.

Monthly checks:

• Recheck DNS records (SPF, DKIM, DMARC, MX) — they sometimes get changed inadvertently during hosting migrations.
• Review DMARC aggregate reports for forged/spoofed sends.
• Check Google Postmaster Tools and Microsoft SNDS for domain reputation scores.

Tools stack we recommend

• Instantly or Smartlead (CAD $60–$200/month) — sending platform with built-in warmup, multi-mailbox rotation, unified inbox, sequences.
• Hunter, Apollo, or Clay — for list building and enrichment.
• Google Workspace (CAD $9/user/month per mailbox) for sending infrastructure.
• Namecheap or Cloudflare for domain registration and DNS management.
• MXToolbox (free) for checking DNS records and blacklists.

When to outsource

Cold email deliverability is 20% setup and 80% ongoing monitoring. For teams doing cold outreach at significant volume (>200 emails/day), the time to maintain deliverability usually exceeds the time to write sequences.

If you want us to run this for you end-to-end — domain setup, authentication, warmup, sequence writing, and monthly optimization — that’s exactly what our cold email outreach service covers. For teams preferring to DIY, our companion complete cold email guide walks through strategy and copy; this post plus that one is the full playbook.