Cold email lands in the inbox when four things hold: SPF, DKIM and DMARC pass for the domain in your From address, complaints stay under 0.3%, cold sending runs on secondary domains, and each new mailbox ramps slowly. Google, Yahoo and Microsoft publish the first two rules. The last two are practice.
Key takeaways
- Publish SPF, DKIM and DMARC on every sending domain before the first send, and make the From domain align with SPF or DKIM.
- Keep spam complaints under 0.3%. Google says to aim for under 0.10%.
- Send cold email from secondary domains so a bad week cannot damage the domain your customers email.
- No provider publishes a ramp schedule. Start low, rise slowly and cut volume when mail bounces or is deferred.
- Size capacity from the target: 600 sends a day at 25 per mailbox needs 24 mailboxes on 8 domains.
Blesso runs outbound for B2B teams as a done-for-you service, and deliverability is one of the jobs inside it. This guide is the setup we would check before any sequence goes out. It uses published provider rules where they exist and says so where they do not.
What Gmail, Yahoo and Outlook require
Three providers set the rules for most B2B inboxes. Their published requirements are short. The table shows who must do what.
| Requirement | Gmail | Yahoo | Outlook.com |
|---|---|---|---|
| Any sender | SPF or DKIM, TLS, valid forward and reverse DNS | SPF or DKIM, valid forward and reverse DNS | Valid reverse DNS, no dynamic IP space |
| Bulk threshold | More than 5,000 messages a day to Gmail | Bulk sender, no number published on the page we read | 5,000 or more a day, same From domain |
| Bulk authentication | SPF, DKIM and DMARC (p=none is enough), aligned | SPF, DKIM and DMARC (p=none at least), aligned | SPF, DKIM and DMARC (p=none at least), aligned |
| Unsubscribe | One-click for marketing mail from bulk senders | One-click, honored within 2 days | Easy to find and use |
| Spam rate | Under 0.30%; aim for under 0.10% | Under 0.3% | Not stated as a number |
Sources: Google's email sender guidelines, Yahoo's sender best practices and Microsoft's Outlook.com policies. Rules change, so check the pages before you build.
Two details matter for cold senders. First, most cold programs send far fewer than 5,000 a day from one domain, so the "any sender" row applies to you by the letter. Do the bulk-sender work anyway. Google recommends SPF, DKIM and DMARC for every domain, and DMARC reports show you who sends mail as your domain. Second, Gmail says messages that fail authentication may be marked as spam or rejected with a 5.7.26 error. Outlook.com says non-compliant bulk mail goes to junk and then may be rejected with 550 5.7.515.
Set up SPF, DKIM and DMARC on each sending domain
Do the three records in this order, on every domain, before any mailbox sends. The example domain is getnorthfield.com and is made up. The values to change are the domain, the DKIM selector and the report address.
- SPF. Publish one TXT record at the domain that lists every service allowed to send for it. Publish one record only. A second SPF record breaks the first. The standard, RFC 7208, limits an SPF check to 10 DNS lookups, so do not stack include entries from tools you no longer use.
- DKIM. Turn on signing in your mailbox provider and publish the public key it gives you. Google says Gmail needs a key of 1024 bits or longer and recommends 2048 bits where your provider supports it.
- DMARC. Publish a TXT record at
_dmarc.on the domain. Start atp=nonewith a report address, read the reports, then tighten the policy once every legitimate sender passes.
Alignment is the step people miss. DMARC passes only when SPF or DKIM passes in the same domain that shows in the From address. Microsoft's guidance says to check that the return-path domain and the signing domain match the From domain, especially when a third party sends for you. Send a test to a mailbox you own, open the message headers and read the SPF, DKIM and DMARC results. All three should say pass.
Why cold sending belongs on secondary domains
Google says Gmail tracks volume, feedback and limits per domain and IP address. A domain carries its own record. If a cold campaign draws complaints on your main domain, the same record follows the invoices and contracts your team sends from it.
A secondary domain is a separate domain you own that looks like your brand, such as getnorthfield.com next to northfield.com. It takes the risk so the main domain does not. Practitioner guides from Mailflo and OutboundPros give the same rules of thumb. No mailbox provider publishes them, so treat them as convention.
- Use a name close to the brand, on a common ending such as .com.
- Avoid hyphens and extra words that look like spam.
- Put two or three mailboxes on each domain, each with a real name.
- Publish SPF, DKIM and DMARC on the secondary domain, as in the last section.
- Point the domain's web address at your main site, so a recipient who checks it finds a real company.
Secondary domains do not hide poor targeting. A list that draws complaints burns the secondary domain as fast as the main one. Keep the complaint number visible, as the next sections show.
Size your capacity: a worked plan
This is an estimate with stated assumptions, not a measured result. The goal is 600 cold emails a day. The assumptions are 25 sends per mailbox per day, which sits inside the 20 to 30 range that several practitioner guides use, and three mailboxes per domain.
- Mailboxes: 600 sends ÷ 25 per mailbox = 24 mailboxes.
- Domains: 24 mailboxes ÷ 3 per domain = 8 secondary domains.
- Follow-ups count. If step two and step three go out from the same mailbox, new leads get fewer than 25 slots. Plan the 600 as all steps combined.
To grow, add mailboxes and domains. Do not raise the cap on the ones you have. Google's guideline says to avoid sudden volume spikes and gives the example that immediately doubling previously sent volume could cause rate limiting or reputation drops.
Ramp each mailbox over five weeks
Google's guidelines say to start with a low volume to engaged users, to increase it slowly, to send at a consistent rate and to avoid bursts. They give no day-by-day schedule, and neither does Yahoo's Sender Hub. Every schedule you find is the author's own. This one is ours, built for the 25-a-day target above.
| Week | Cold sends per mailbox per day | What you do |
|---|---|---|
| 1 | 0 | Authenticate, run warmup, send mail people expect |
| 2 | 0 | Keep warmup low and steady. Check headers and DMARC reports |
| 3 | 8 | First cold sends to your best-fit accounts only |
| 4 | 16 | Add accounts if bounces and complaints stay low |
| 5 | 25 | Hold at the cap. Add mailboxes for more volume |
A warmup tool is a pacing aid, not a fix. Warmup networks trade automated messages between mailboxes. We found no statement from Google, Yahoo or Microsoft that they count. Google says it does not track open rates. The signals that move your spam rate come from real recipients, so a clean, narrow list does more than any tool.
Back off on a signal. Google says to reduce volume when messages bounce or are deferred, then increase slowly again. Treat a deferral as the cue to drop to the last week's volume, not to push through.
Monitor three numbers every week
Authentication gets you in the door. These numbers tell you whether you can stay. Review them weekly, per domain.
| Number | Where to read it | Act when |
|---|---|---|
| Spam rate | Google Postmaster Tools, Yahoo complaint feedback loop | Near 0.10%. Never let it reach 0.30% |
| Bounce and deferral rate | Your sending tool's logs | Bounces rise or the provider defers mail |
| DMARC pass rate | DMARC reports sent to your rua address | Any sender fails alignment |
Postmaster Tools shows spam rate only when a domain sends enough volume to Gmail. Low-volume mailboxes may show nothing. In that case the bounce log and the replies are your signal. Remove anyone who asks to stop at once, and add a plain unsubscribe line to every message.
Check these before the first send
- One SPF record per domain, under 10 lookups.
- DKIM signing on, key at 2048 bits where supported.
- DMARC published at p=none with a report address.
- Header test passes SPF, DKIM and DMARC with aligned domains.
- Domain added to Google Postmaster Tools.
- Mailboxes ramped on the five-week plan, not launched at the cap.
- A suppression list and an unsubscribe line in every message.
Where Blesso fits
Blesso's Outbound Engine runs email and LinkedIn on one sequence, with deliverability included. The setup in this guide is part of that job, so you do not carry it yourself. See the three motions or how we count results. Engagements start at $2k a month, with a three-month minimum.
FAQ
Do I need DMARC if I send fewer than 5,000 emails a day?
Gmail and Yahoo require DMARC only from bulk senders, but Google recommends SPF, DKIM and DMARC for all domains. Publish p=none with a report address. It costs one DNS record and gives you reports on who sends as your domain.
Is p=none enough?
For the Google, Yahoo and Outlook.com bulk-sender rules, yes: a policy of p=none passes the requirement, provided DMARC itself passes. Microsoft's policy page recommends p=reject. Move to quarantine or reject once the reports show every legitimate sender passes.
How many emails can one mailbox send per day?
No provider publishes a limit for cold mail. Practitioner guides we read range from 20 to 50 a day per mailbox, and this guide plans on 25. Add mailboxes for more volume instead of raising the cap.
How long does a new domain take to warm up?
Plan on about five weeks to reach full volume: two weeks of warmup only, then three weeks of rising cold sends. Practitioner sources give two to four weeks. This schedule is ours, not a provider rule.
Can I use my main domain for cold email?
You can, but it puts your main domain's record at risk. Gmail tracks feedback per domain, so complaints from a cold campaign follow the mail your team sends to customers. Use a secondary domain for cold sending.
Want deliverability handled with the rest of outbound? Book a call.