---
title: "Email Deliverability Guide: 42 Things I Bet You Didn't Know"
description: "Master email deliverability in 2026. Technical authentication, spam traps, blacklists, warm-up strategies—everything you need for 87%+ inbox placement."
date: 2026-02-01
tags: [email deliverability, cold email, SPF, DKIM, DMARC, email authentication]
readTime: 28 min
slug: email-deliverability
---
**TL;DR:** Email deliverability in 2026 is harder than ever. Gmail and Outlook enforce strict authentication (SPF, DKIM, DMARC). Hitting spam traps destroys your domain. Warm-up takes 21 days minimum. Most cold emails fail because senders ignore technical setup. This guide covers 42 deliverability secrets—including BIMI, ARC, SPF alignment, and blacklist avoidance—that separate 87% inbox placement from 60% failure rates.
---
## Why Your Emails Land in Spam (And Your Competitors' Don't)
You send 100 cold emails.
15 people open them.
Maybe 2 reply.
The other 83 never saw your message.
They're in spam. Or blocked entirely. Your carefully crafted copy wasted. Your lead list burned. Your domain reputation tanking.
Meanwhile, your competitor sends the same volume and books 20 meetings this week.
What's the difference?
Deliverability.
In 2026, inbox providers don't care about your pitch. Gmail, Outlook, and Yahoo use AI-powered filters that analyze hundreds of signals before your email reaches anyone. Authentication protocols. Sender reputation. Engagement patterns. Domain history. List quality.
One misconfigured DNS record destroys months of outreach.
One spam trap blacklists your domain forever.
One week without proper warm-up sends 90% of your emails straight to spam.
The cold email playbook from 2023 is dead. What worked then gets you blacklisted now. Google and Yahoo updated sender requirements in 2024. Microsoft followed. By 2026, these rules aren't recommendations—they're prerequisites.
Here's what nobody tells you: deliverability isn't about being perfect. It's about avoiding catastrophic mistakes that destroy your domain before you realize what happened.
This guide covers 42 things that determine whether your emails land in inboxes or disappear forever.
## The Technical Foundation: Authentication Protocols You Can't Skip
### SPF: Your Domain's Boarding Pass
SPF (Sender Policy Framework) tells receiving servers which IP addresses can send email on behalf of your domain.
Think of it as airport security for email.
You publish an SPF record in your DNS. When someone receives your email, their server checks: "Is this IP authorized?"
Match = pass. Your email proceeds.
No match = fail. Straight to spam.
**The 10-Lookup Limit That Breaks Everything**
Here's the problem nobody mentions: SPF has a 10-DNS-lookup limit.
Each third-party service you use (Salesforce, HubSpot, Mailchimp, support desk, CRM) adds lookups to your SPF record.
Hit 11 lookups? Your SPF auto-fails.
Every. Single. Email.
This happens to 40% of companies using multiple SaaS tools. They don't realize their authentication is broken until deliverability craters.
**Solution: SPF Flattening**
SPF flattening converts your record to stay under 10 lookups. Tools like AutoSPF and PowerDMARC automate this. Manual management breaks as soon as you add another service.
Check your SPF record now: `nslookup -type=txt yourdomain.com`
Count the "include:" statements. Over 8? You're in danger.
### DKIM: The Tamper-Proof Seal
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your email headers.
Receiving servers verify this signature using your public key in DNS. If the signature matches, the email is authentic and unaltered.
If it doesn't match, the email was modified in transit or forged.
**Why DKIM Matters More in 2026**
Spammers can't replicate your private DKIM key. This makes DKIM your strongest defense against domain spoofing.
But here's what most guides skip: DKIM key rotation.
**DKIM Key Rotation Prevents Replay Attacks**
Your DKIM private key should rotate every 6-12 months. Why?
If your key is compromised, attackers can sign emails as you indefinitely. Rotating keys limits exposure windows.
Most companies set DKIM once and forget it. That's like using the same password for 5 years.
Use 2048-bit keys (not 1024-bit). Stronger encryption. Better security.
### DMARC: The Policy That Matters
DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together.
It answers: "If authentication fails, what should the receiving server do?"
Three policy options:
- **p=none**: Monitor only. No enforcement. Useless in 2026.
- **p=quarantine**: Send failed emails to spam
- **p=reject**: Block failed emails entirely
**In 2026, p=none is Meaningless**
Gmail and Yahoo require p=quarantine or p=reject for bulk senders (5,000+ emails/day).
Starting with p=none made sense in 2020 when DMARC was new. Now? It's a red flag that you're not serious about security.
Move to p=quarantine immediately. Then p=reject within 90 days.
**DMARC Requires Alignment**
Here's where it gets technical.
DMARC checks two things:
1. Does SPF or DKIM pass?
2. Do the domains align?
**Two Types of Alignment: Strict vs Relaxed**
Your email has two "From" addresses:
- **RFC5322.From**: What recipients see ("sender@example.com")
- **RFC5321.MailFrom**: Return-Path header (behind the scenes)
**Strict alignment**: Domains must match exactly
- RFC5322.From: sender@example.com
- RFC5321.MailFrom: sender@example.com
- Result: PASS
**Relaxed alignment**: Subdomains allowed
- RFC5322.From: sender@example.com
- RFC5321.MailFrom: mail.example.com
- Result: PASS (same organizational domain)
If you use a third-party email service (Mailchimp, SendGrid), their Return-Path won't match your From address. Without relaxed alignment, your emails fail DMARC.
Default setting: relaxed. But some companies set "aspf=s" (strict SPF) or "adkim=s" (strict DKIM) in their DMARC record.
Check before sending.
### BIMI: Your Logo in the Inbox
BIMI (Brand Indicators for Message Identification) displays your verified logo next to emails in Gmail, Yahoo, and Apple Mail.
Sounds cosmetic? It's not.
**BIMI increases:**
- Open rates: +4-6%
- Click-through rates: +80%
- Brand recall: +44%
- Consumer confidence: +90%
**Requirements:**
1. DMARC at p=quarantine or p=reject (p=none doesn't work)
2. SPF or DKIM passing
3. BIMI DNS record pointing to compliant SVG logo
4. Mark Certificate (VMC or CMC)
**VMC vs CMC: The 2026 Difference**
Two options for certificates:
**VMC (Verified Mark Certificate):**
- Requires registered trademark
- Supported everywhere (Gmail, Yahoo, Apple)
- Gmail shows blue checkmark
- Costs $1,500-$2,500/year
**CMC (Common Mark Certificate):**
- No trademark required
- Just proof your logo was public for 12 months
- Gmail introduced this in early 2025
- Cheaper alternative
If you don't have a trademark, CMC makes BIMI accessible.
Implementation timeline: 6-8 weeks for DMARC enforcement, 7-10 days for certificate provisioning.
### ARC: Authentication Through Forwarding
ARC (Authenticated Received Chain) solves a problem nobody talks about: forwarding breaks authentication.
When someone forwards your email, SPF fails. Why?
SPF checks the sending IP. Forwarded emails come from the forwarder's server, not yours.
ARC preserves the original authentication results through the forwarding chain.
**Mailbox providers increasingly weight ARC in 2026.** If you send to mailing lists or expect forwards, ARC prevents authentication failures.
Most ESPs don't support ARC yet. But if you're on Google Workspace or Microsoft 365, you're covered.
## The Warm-Up Process: Why 21 Days Matters
New email accounts start with zero reputation.
Send 1,000 cold emails on day one? Instant spam.
Mailbox providers see: new domain + high volume + no engagement history = spammer.
Your emails get blocked. Your domain gets flagged. Recovery takes months.
**Smart Warm-Up Builds Trust Gradually**
Warm-up mimics natural human behavior:
- Small volumes initially
- Positive engagement signals
- Gradual capacity increase
- Multi-provider reputation building
**The 21-Day Timeline**
Week 1: 5-10 emails/day
Week 2: 10-25 emails/day
Week 3: 25-50 emails/day
Week 4: 50-100 emails/day
Increase volume by 15-20% weekly. Not faster.
**Why 21 Days (Not 14)**
Most guides say 14 days. That's outdated.
Gmail and Outlook use a 21-day rolling window to evaluate sender behavior. Rushing warm-up before 21 days means you're still building reputation when you launch campaigns.
Bad timing = bad results.
**What Warm-Up Actually Does**
Real warm-up services (not fake ones) send emails to real accounts. Those accounts open, click, and reply. Positive signals.
Mailbox providers learn: "This sender gets engagement. Trusted."
After 21 days, your domain transitions: Cold → Warm → Trusted.
**Warning: Warmup Services Aren't All Equal**
Some services use fake accounts or spam traps. That destroys your reputation instead of building it.
Firstsales.io uses real human-behavior patterns across Gmail, Outlook, and Yahoo. Average result: 62% inbox placement → 89% in 30 days.
Without proper warm-up? 90% of cold emails hit spam immediately.
## List Quality: The Hidden Destroyer
Your list quality determines deliverability more than your copy.
Send to invalid addresses? High bounce rate. Spam filters notice.
Send to spam traps? Instant blacklist. Domain reputation destroyed.
Send to inactive subscribers? Low engagement. Inbox providers deprioritize your future emails.
**Double Verification Is Non-Negotiable**
Single verification checks: "Does this email exist?"
Double verification checks: "Does this email exist and accept mail?"
Difference: catch-all addresses.
A catch-all email (sales@, info@, contact@) passes single verification but may not reach anyone.
Double verification flags these. Keeps your bounce rate under 1%.
**For cold outreach: 1% bounce rate is the threshold.**
Above 1%? Risk of burning email accounts.
Marketing emails: Keep bounce under 2%.
**The Three Types of Spam Traps**
Spam traps are email addresses designed to catch bad senders.
Hit one = your domain gets blacklisted.
**1. Pristine Spam Traps**
Never owned by anyone. Created specifically to catch spammers.
Only way to get these: scraping websites, buying lists, or using invalid data sources.
Impact: Instant blacklist. Severe reputation damage. Hard to recover.
**2. Recycled Spam Traps**
Real email addresses that were abandoned. Inactive for 6+ months. ISPs reactivate them as traps.
Only way to hit these: Poor list hygiene. Sending to old, unengaged contacts.
Impact: Indicates you're not cleaning your list. Gradual reputation decline.
**3. Typo Spam Traps**
Common misspellings: gmial.com, gnail.com, yahooo.com
If your list has these, you're not validating properly.
Impact: Less severe, but still damages reputation.
**How to Avoid All Three**
- Never buy email lists (pristine traps)
- Clean your list every 60-90 days (recycled traps)
- Use email verification tools (typo traps)
Services like Bouncer, NeverBounce, or ZeroBounce catch these before you send.
## Blacklists: The Permanent Ban
Blacklists (or blocklists) are databases of IP addresses and domains flagged for spam.
When you're blacklisted, receiving servers reject your emails automatically.
No inbox. No spam folder. Just blocked.
**The Big Three Blacklists**
**1. Spamhaus**
The most influential blacklist. Used by 90% of ISPs.
Their SBL (Spamhaus Block List) includes known spam sources.
Getting listed on Spamhaus is catastrophic. Your emails stop reaching anyone.
**2. SpamCop**
Builds their list from spam traps, spam reports, and complaints.
Assigns reputation scores to IPs. Drop below their threshold, you're listed.
**3. Barracuda**
Started by tracking spam sent to their own infrastructure. Now widely used.
Less impactful than Spamhaus but still serious.
**How You Get Blacklisted**
- Hitting spam traps
- High spam complaint rate (>0.1%)
- Sudden volume spikes
- Poor authentication setup
- Sending from compromised accounts
- High bounce rates (>5%)
**Checking Your Status**
Use MXToolbox's blacklist checker: scans 100+ blacklists in seconds.
Check weekly. Early detection prevents compounding damage.
**Getting Delisted**
Each blacklist has different removal processes.
**Spamhaus**: Requires using their removal portal with detailed explanations. Show you fixed the root cause.
**SpamCop**: Mostly automatic removal after clean sending for 24-48 hours.
**Barracuda**: Online delisting tool with specific requirements.
Never request removal without fixing the underlying issue. Getting relisted is worse.
**Prevention Is Everything**
Once blacklisted, recovery takes weeks. During that time, your marketing stops working.
Keep these metrics clean:
- Spam complaints: <0.1% (3 per 1,000 emails maximum)
- Bounce rate: <2% for marketing, <10% for cold
- Engagement: Opens, clicks, replies
## Sender Reputation: Your Credit Score for Email
Mailbox providers assign every sender a reputation score.
High score = inbox placement.
Low score = spam folder or blocked.
**Two Reputation Types**
**1. IP Reputation**
Your sending server's IP address has a reputation.
Shared IP = you share reputation with others on that server.
Dedicated IP = your reputation alone.
For most companies: shared IP works fine. Dedicated IPs require high volume (100,000+ emails/month) to build reputation.
**2. Domain Reputation**
Your sending domain has its own reputation.
This matters more in 2026 than IP reputation.
Why?
Spammers can switch IPs easily. Switching domains is harder.
Gmail, Outlook, and Yahoo weight domain reputation heavily.
**What Damages Reputation**
- Spam complaints (biggest factor)
- Spam trap hits
- High bounce rates
- Low engagement (unopened emails)
- Authentication failures
- Inconsistent sending volume
- Blacklist presence
**What Improves Reputation**
- High open rates (>20%)
- Click-through rates (>2%)
- Reply rates (2-4%+)
- Low spam complaints (<0.1%)
- Consistent sending patterns
- Clean authentication (SPF, DKIM, DMARC passing)
- Aged domains (older = more trusted)
**Google Postmaster Tools & Microsoft SNDS**
Free tools showing how Gmail and Microsoft view your sending.
**Google Postmaster Tools** shows:
- Domain reputation (high, medium, low, bad)
- IP reputation
- Spam rate
- Authentication results
- Encryption status
**Microsoft SNDS** (Smart Network Data Services) shows:
- Spam trap hits
- Complaint rates
- Message volume
- IP reputation color codes
Check both weekly. They'll alert you to problems before users notice.
**Domain Fatigue: The Rotation Strategy**
Domains get tired with heavy use.
Send 10,000 emails/day from one domain for 90 days straight? Reputation declines even with good engagement.
Solution: Domain rotation.
Use multiple secondary domains. Rotate sending between them. Let overused domains rest and recover.
Think of it like crop rotation. You can't farm the same field continuously without depleting it.
For high-volume cold outreach:
- 3-5 secondary domains minimum
- Rotate every 7-14 days
- Monitor each domain's reputation separately
## Cold Email Deliverability: Different Rules Apply
Cold email operates under stricter scrutiny than marketing email.
Why?
Recipients didn't opt in. They don't recognize your name. First impression is everything.
**The Cold Email Reality in 2026**
Average cold email performance:
- Inbox placement: 60-70%
- Open rate: 15-25%
- Reply rate: 1-3%
- Positive reply rate: 0.5-1.5%
Elite performers:
- Inbox placement: 87%+
- Open rate: 35-45%
- Reply rate: 8-12%
- Positive reply rate: 3-5%
Difference? Technical setup + sending behavior.
**Open Tracking Destroys Cold Email Deliverability**
Most cold email tools track opens using a 1x1 pixel image.
Gmail sees this pixel. Displays a warning banner: "Images have been blocked for your safety. This email may be tracking you."
Below that warning? A giant button: "Report spam."
You just made it one-click easy for prospects to destroy your sender reputation.
**Elite cold emailers turned off open tracking in 2024.**
They measure reply rates instead. The only metric that matters.
Instantly, Lemlist, and Smartlead all support disabling open tracking. Use it.
**Inbox Rotation: The Scaling Secret**
Send 100 emails/day from one account? Safe.
Send 1,000 emails/day from one account? Blacklisted.
Solution: Inbox rotation.
Connect multiple email accounts. Rotate sending between them.
Each account sends low volume (30-50/day). Your total volume is high.
Firstsales.io handles this automatically. Unlimited email accounts included.
Without rotation: You can't scale past 100 emails/day without spam issues.
**Links, Images, Attachments: The Triple Threat**
Cold emails with links, images, or attachments trigger spam filters.
ESPs see these as security risks.
**Best practice for cold outreach:**
- No links in first email
- No images
- No attachments
- Plain text only
Save links for follow-ups after engagement.
**Email Length: Under 50 Words Wins**
Shorter emails = higher reply rates.
Data from 500+ million cold emails shows:
- <50 words: 5.1% reply rate
- 50-100 words: 3.4% reply rate
- 100+ words: 1.9% reply rate
Long emails look like marketing. Short emails feel personal.
**The 58% First-Touch Advantage**
58% of all replies come from your first email in a sequence.
Not the second. Not the third. The first.
This means:
1. Your first email must be perfect
2. If it fails, the sequence fails
3. Testing your first email matters most
Most teams obsess over follow-up #3. They should obsess over email #1.
**Benchmark Comparison: What "Good" Looks Like**
| Metric | Poor | Average | Good | Excellent |
|--------|------|---------|------|-----------|
| Inbox Placement | <60% | 60-70% | 70-85% | 85%+ |
| Open Rate | <15% | 15-25% | 25-40% | 40%+ |
| Reply Rate | <1% | 1-3% | 3-8% | 8%+ |
| Positive Reply | <0.5% | 0.5-1.5% | 1.5-4% | 4%+ |
| Bounce Rate | >10% | 5-10% | 2-5% | <2% |
| Spam Complaints | >0.3% | 0.1-0.3% | 0.05-0.1% | <0.05% |
If your metrics fall in the "Poor" column, stop sending. Fix your setup first.
## Secondary Domains: Protecting Your Primary
Never send cold emails from your primary domain.
Why?
Cold email has higher risk of spam complaints, blacklisting, and reputation damage.
If you burn your primary domain, you burn:
- Customer emails
- Transactional emails (password resets, receipts)
- Support communications
- Employee email
Recovery is nearly impossible.
**The Secondary Domain Strategy**
Buy 2-3 domains similar to your primary:
- Primary: yourcompany.com
- Secondary: getyourcompany.com, try-yourcompany.com, yourcompany.co
Set up authentication (SPF, DKIM, DMARC) on each.
Warm them up properly (21 days).
Use secondary domains exclusively for cold outreach.
Your primary domain stays pristine.
**Warning: Cross-Contamination**
Don't host all secondary domains on the same Google Workspace or Microsoft 365 account.
Why?
Mailbox providers look at account-level patterns. If one domain gets flagged, others in the same workspace might get tainted.
Use different email providers for some domains. Mix SMTP providers.
Spread sending across multiple IPs.
This prevents one bad domain from destroying all your infrastructure.
## The Technical Details Nobody Teaches
### DNS Configuration Matters
Your DNS setup affects deliverability even if you're not aware of it.
Misconfigured or unstable DNS creates intermittent delivery failures.
Mailbox providers notice. They mark your domain as unreliable.
**Required DNS checks:**
- DNS resolves correctly (no timeouts)
- No duplicate SPF records (only one v=spf1)
- DKIM keys properly published
- DMARC record formatted correctly
- MX records point to valid mail servers
Use tools like MXToolbox DNS Lookup to verify.
### SSL Certificates on All Links
Every URL in your email must use HTTPS (not HTTP).
Unsecured HTTP links damage trust. Suppress engagement.
Mailbox providers see HTTP links as potential security risks.
Result: Lower inbox placement.
Check every link before sending. Especially:
- Website links
- Case study links
- Calendar booking links
- Unsubscribe links
All need valid SSL certificates.
### Received-SPF Header: What It Tells You
When an email is delivered, the receiving server adds a "Received-SPF" header.
This header shows whether SPF passed or failed.
**Possible values:**
**Pass**: Sending IP matched SPF record. Email is authentic. Trust it.
**Fail**: Sending IP not in SPF record. Email likely spoofed. Block it.
**SoftFail**: IP is transitioning or policy is changing. Suspicious but not rejected.
**Neutral**: No SPF record found. Can't confirm or deny authenticity.
**None**: No SPF policy exists for this domain.
If you're seeing Fail or SoftFail results, your SPF record is misconfigured.
Check your Authentication-Results header to see what went wrong.
### SPF SoftFail vs HardFail
Your SPF record ends with a qualifier:
**~all (SoftFail)**: "These IPs are authorized, but others might be legitimate too."
**-all (HardFail)**: "Only these IPs are authorized. Reject everything else."
**+all (Pass)**: "Accept mail from any IP." Never use this.
**?all (Neutral)**: "No policy." Also useless.
**Recommended**: Start with ~all while testing. Move to -all once you're confident.
HardFail (-all) provides stronger protection but requires perfect setup.
### Apple Mail Privacy Protection Inflates Opens
Apple's Mail Privacy Protection (MPP) pre-loads email content even if recipients don't open it.
This inflates open rates artificially.
Impact: 30-40% of "opens" aren't real opens.
Solution: Don't optimize for open rates. Optimize for replies.
Real engagement (clicks, replies) still works.
## Volume Management: How Much Is Too Much
Different email providers have different sending limits.
Exceed them and your emails bounce or get throttled.
**Gmail (Free Accounts):**
- 500 emails/day maximum
- Across all folders and recipients
**Google Workspace:**
- 2,000 emails/day maximum
- Per user account
**Microsoft 365:**
- 5,000-10,000 emails/day depending on plan
- Higher limits for enterprise
**Other SMTP Providers:**
- SendGrid, Mailgun, Amazon SES: varies by plan
- Can handle 100,000+ with proper setup
**Cold Email Limits Are Lower**
Even if your ESP allows 2,000 emails/day, don't send that many for cold outreach.
Why?
Cold emails are unsolicited. High volume + low engagement = spam.
**Safe cold email limits per account:**
- Week 1 (warm-up): 5-10/day
- Week 2: 10-25/day
- Week 3: 25-50/day
- Week 4+: 50-100/day maximum
Want to send more? Use inbox rotation (multiple accounts).
**Erratic Volume Kills Deliverability**
Consistency matters more than total volume.
Bad: Send 1,000 Monday. 0 Tuesday-Friday. 1,000 next Monday.
Good: Send 200/day Monday-Friday. Every week.
Sudden spikes = spam behavior. Mailbox providers notice.
**The 15-20% Weekly Increase Rule**
When scaling volume, increase gradually.
If you're sending 100/day in week 4, go to 115-120/day in week 5.
Not 200/day.
Slow ramps build trust. Fast ramps trigger filters.
## Engagement Signals: What AI Filters Actually Track
2026 spam filters use AI to analyze engagement quality.
Not just: "Did they open it?"
But: "How long did they spend reading? Did they reply? What kind of reply?"
**Time in Inbox**
AI tracks how long recipients keep your email open.
Skim for 2 seconds? Low engagement.
Read for 30+ seconds? High engagement.
This affects future inbox placement.
**Reply Depth**
One-word replies ("Thanks") = low signal.
Multi-sentence replies = high signal.
AI analyzes reply length and complexity.
**Conversation Length**
Back-and-forth threads signal strong engagement.
Single reply = good.
5+ reply thread = excellent.
These conversations boost your sender reputation significantly.
**Negative Signals**
- Immediate delete (0-5 seconds)
- Mark as spam
- Move to spam folder
- No interaction after 7 days
- Unsubscribe
All damage reputation.
**The Engagement Feedback Loop**
High engagement → Better placement → More engagement → Even better placement
Low engagement → Worse placement → Less engagement → Even worse placement
This is why your first 100 cold emails determine the next 10,000.
Start with your most engaged prospects. Build positive signals. Then scale.
## List Cleaning: The 60-90 Day Rule
Even engaged subscribers go cold.
People change jobs. Abandon email addresses. Stop caring about your product.
Sending to inactive subscribers damages deliverability.
**Click-Based Suppression**
Track who clicked in your last 60-90 days.
No clicks in 60 days? Suppress them from future sends.
No clicks in 90 days? Remove them entirely.
**Re-Engagement Flows First**
Before suppressing, try re-engagement:
Email 1: "Still interested in [topic]?"
Email 2 (7 days later): "Last chance—should we keep sending?"
Email 3 (7 days later): "We'll unsubscribe you unless you click."
Anyone who doesn't click? Gone.
This cleans your list while giving people a chance to re-engage.
**For B2B Cold Outreach**
If someone doesn't reply after your sequence (5-7 touches), don't email them again for 6-12 months.
Persistent follow-up to cold leads burns your reputation.
## Inbox Placement Monitoring: Know Where You Land
You can't manage what you don't measure.
Email delivery ≠ email deliverability.
**Delivery**: Did the email reach the server? (95%+)
**Deliverability**: Did the email reach the inbox? (60-87%)
You need to know where your emails actually land.
**Seed Account Testing**
Send test emails to seed accounts across multiple providers:
- Gmail (personal and Workspace)
- Outlook (personal and Microsoft 365)
- Yahoo
- Apple Mail
- ProtonMail
Check: Inbox, Promotions tab, Spam folder, or Blocked?
Do this weekly during campaigns.
**Tools for Monitoring**
Firstsales.io includes real-time inbox placement monitoring. Updates hourly.
Alternative: GlockApps, Mail-Tester, Litmus Spam Testing.
**What to Watch For**
- Inbox placement dropping below 70%
- Increased spam folder placement
- Specific provider issues (Gmail fine, Outlook spam)
- Sudden drops after configuration changes
Catch problems in 2 hours, not 2 weeks.
## The Compliance Layer: CAN-SPAM, GDPR, CASL
Legal requirements aren't optional.
Violate them and you face fines. Plus deliverability destruction.
**CAN-SPAM (United States)**
Requirements:
- Accurate sender information (no fake names)
- Honest subject lines (no deceptive claims)
- Physical mailing address in footer
- Clear unsubscribe link
- Honor opt-outs within 10 business days
- Monitor third-party compliance
Penalty: $46,517 per violation.
**GDPR (European Union)**
Requirements:
- Legitimate interest basis for B2B (document your reasoning)
- Clear privacy policy
- Right to be forgotten (delete data on request)
- Data processing records
- No purchased lists without verified consent
- DPO required for large-scale processing
Penalty: €20 million or 4% of global revenue (whichever is higher).
**CASL (Canada)**
Requirements:
- Express or implied consent
- Implied consent expires after 2 years
- Clear sender identification
- Unsubscribe mechanism
- Record-keeping of consent
Penalty: $10 million CAD per violation.
**Best Practice**
Include unsubscribe link in every email. Make it one-click.
Don't hide it. Don't require login to unsubscribe.
Gmail and Yahoo (as of 2024) require one-click unsubscribe for bulk senders.
If users can't easily opt out, they mark you as spam instead. That's worse.
## Timing: When to Send (And When to Avoid)
Send time affects open rates and engagement.
**Best Days:**
- Tuesday: 23% higher open rate than Monday
- Wednesday: Peak engagement day
- Thursday: Second-best performance
**Worst Days:**
- Monday: Inbox overload
- Friday: People mentally checked out
- Saturday/Sunday: Personal time (B2B tanks)
**Best Times:**
- 8-10 AM recipient's timezone: Inbox check #1
- 2-4 PM recipient's timezone: Post-lunch check
**Worst Times:**
- Before 7 AM: Too early
- 12-1 PM: Lunch hour
- After 6 PM: Work day done
- Overnight: Dead zone
**Time Zone Optimization**
If you're sending to US recipients from Europe, don't send at 9 AM your time.
That's 3 AM in New York.
Use send time optimization features. Firstsales.io automatically adjusts for recipient time zones.
## The Firstsales.io Advantage: 87% Inbox Placement
Everything in this guide requires technical expertise, constant monitoring, and time.
Most sales teams don't have that.
They need to focus on closing deals, not debugging DNS records.
Firstsales.io handles deliverability infrastructure completely:
**Smart 21-Day Warm-Up**
Automated. Mimics real human behavior. Builds reputation across Gmail, Outlook, Yahoo.
Not generic warm-up. Proprietary algorithms that adapt to your specific sending patterns.
**Auto List Cleaning**
Scans every upload. Removes invalid emails, spam traps, inactive accounts before you send.
Competitors charge $47/month extra for this. Firstsales.io includes it free.
**Real-Time Monitoring**
Live dashboard shows exactly where your emails land. Updated hourly.
Catch deliverability drops immediately. Not after 2 weeks of wasted campaigns.
**Unlimited Email Accounts**
Connect as many accounts as needed. Automatic inbox rotation.
Scale from 100 to 10,000 emails/day without reputation damage.
**Auto DNS Configuration**
SPF, DKIM, DMARC setup handled automatically. No technical knowledge required.
Average setup time: 8 minutes.
**Pricing**
**Starter**: $28/month
- 1,000 contacts
- 5,000 emails/month
- Unlimited accounts
- Smart warm-up
- Auto list cleaning
**Growth**: $73/month (Most Popular)
- 25,000 contacts
- 100,000 emails/month
- Everything in Starter
- Advanced analytics
- Priority support
**Scale**: $269/month
- 100,000 contacts
- 500,000 emails/month
- Dedicated infrastructure
- White-glove onboarding
- 24/7 support
**Compare to Competitors:**
Instantly: $97/month for similar features (save $828/year)
Lemlist: $94/month (save $792/year)
Smartlead: $97/month (save $828/year)
All charge extra for list cleaning. Firstsales.io includes it.
**Results**
Average customer results in 30 days:
- Inbox placement: 62% → 89%
- Reply rates: 2-4% → 5-7%
- Bounce rates: 5-8% → under 2%
- Meetings booked: 2-3x increase
[Start Free 7-Day Trial](https://firstsales.app/) (No credit card required)
## Email Deliverability Checklist
Before sending any campaign:
**Authentication:**
- ✓ SPF record published and under 10 lookups
- ✓ DKIM configured with 2048-bit keys
- ✓ DMARC set to p=quarantine or p=reject
- ✓ BIMI setup (if applicable)
- ✓ All domains aligned (strict or relaxed)
**Warm-Up:**
- ✓ New domains warmed for 21+ days
- ✓ Started at 5-10 emails/day
- ✓ Increased volume 15-20% weekly
- ✓ Engagement signals positive
- ✓ Google Postmaster/Microsoft SNDS monitored
**List Quality:**
- ✓ Double verification completed
- ✓ Bounce rate below 1% (cold) or 2% (marketing)
- ✓ No purchased lists
- ✓ Inactive subscribers removed (60-90 days)
- ✓ Re-engagement flows sent
**Sending Behavior:**
- ✓ Volume consistent (no sudden spikes)
- ✓ Open tracking disabled (for cold email)
- ✓ Plain text emails (no images/links in first touch)
- ✓ Email length under 50 words
- ✓ Inbox rotation enabled (if scaling)
**Reputation:**
- ✓ No blacklist presence (check MXToolbox)
- ✓ Spam complaints under 0.1%
- ✓ Sender reputation "High" in Postmaster Tools
- ✓ Domain not fatigued (rotate if needed)
- ✓ Secondary domains protect primary
**Technical:**
- ✓ DNS configured correctly (no duplicates)
- ✓ All links use HTTPS (SSL valid)
- ✓ Received-SPF headers show "Pass"
- ✓ Within ESP sending limits
- ✓ Compliance with CAN-SPAM/GDPR/CASL
**Monitoring:**
- ✓ Inbox placement tested weekly
- ✓ Engagement metrics tracked
- ✓ Alerts set for deliverability drops
- ✓ Alternative providers ready (if blacklisted)
Miss any of these? Fix it before sending.
## Common Deliverability Mistakes (And How to Fix Them)
**Mistake #1: Skipping Warm-Up**
"I have a big list. I need results now."
Reality: Send 1,000 cold emails on day one from a new domain. 90% go to spam. Domain reputation destroyed.
**Fix:** Always warm up. 21 days minimum. No shortcuts.
**Mistake #2: Using One Email Account for Everything**
Primary domain handles:
- Customer communications
- Cold outreach
- Marketing campaigns
- Support tickets
One spam complaint on cold email burns everything.
**Fix:** Secondary domains for cold outreach. Protect your primary.
**Mistake #3: Buying Email Lists**
"500,000 verified B2B emails for $99!"
These lists are packed with:
- Spam traps (pristine and recycled)
- Invalid addresses
- People who never opted in
**Fix:** Build your own list. Use LinkedIn Sales Navigator, Apollo, or other legitimate sources. Verify with double verification.
**Mistake #4: Ignoring Bounce Rates**
"2% bounce rate isn't that bad, right?"
For marketing: 2% is acceptable.
For cold outreach: 2% is too high. Aim for under 1%.
**Fix:** Double verification. Clean your list before every send.
**Mistake #5: Blasting the Same Copy to Everyone**
Generic emails = low engagement = poor sender reputation.
**Fix:** Micro-segmentation. Personalize based on industry, role, trigger events.
**Mistake #6: Leaving DMARC at p=none**
"We set up DMARC in 2020. We're good."
p=none provides zero protection. It's monitoring only.
**Fix:** Move to p=quarantine. Then p=reject within 90 days.
**Mistake #7: Not Monitoring Inbox Placement**
"Our emails are delivered. That's all that matters."
Delivered ≠ in inbox. Could be spam folder.
**Fix:** Use seed account testing. Check inbox placement weekly.
**Mistake #8: Inconsistent Sending**
Monday: 1,000 emails.
Tuesday-Friday: 0 emails.
Next Monday: 1,000 emails.
This looks like spam behavior.
**Fix:** Consistent daily volume. Spread across week.
**Mistake #9: Using Open Tracking for Cold Email**
Gmail warns recipients. Encourages spam reports.
**Fix:** Disable open tracking. Measure reply rates instead.
**Mistake #10: Forgetting About Engagement**
You optimized authentication. Your technical setup is perfect. But nobody opens your emails.
Low engagement still kills deliverability.
**Fix:** Write better copy. Test subject lines. Personalize. Make emails valuable.
Technical setup gets you to the inbox. Good copy gets results.
## Advanced Strategies: What Elite Senders Do Differently
**Strategy #1: Intent-Based Sending**
Don't send to everyone at once.
Send to prospects showing buying signals:
- Funding announcements
- Hiring signals
- Technology changes
- Competitor mentions
- Website visits
Tools: Bombora, 6sense, Clearbit Reveal.
**Strategy #2: Multi-Channel Sequences**
Don't rely on email alone.
Combine:
- Day 1: LinkedIn connection request
- Day 2: Email #1
- Day 4: LinkedIn engagement (like/comment)
- Day 5: Email #2
- Day 7: Phone call
- Day 8: LinkedIn InMail
- Day 10: Email #3
Email is one touchpoint in a broader strategy.
**Strategy #3: Reply Categorization**
Not all replies are equal.
Automate categorization:
- Interested (hot lead)
- Not interested (remove from sequence)
- Out of office (pause and retry)
- Wrong person (remove)
- Requesting more info (nurture)
AI tools (Firstsales.io includes this) handle categorization automatically.
**Strategy #4: Hyper-Personalization at Scale**
Generic: "Hi {{first_name}}, I saw you work at {{company}}."
Hyper-personalized: "Hi Sarah, saw Acme raised Series B last week. Congrats. Usually means aggressive pipeline pressure. Ramp had same situation..."
Use:
- LinkedIn recent activity
- Company news (Crunchbase, PR)
- Podcast appearances
- Blog posts
Tools: Clay.com automates this.
**Strategy #5: The Breakup Email**
After 4-6 touches with no reply, send a breakup email:
"Hi [Name], I'll stop reaching out. If things change, here's my calendar: [link]."
This often gets the highest reply rate in your sequence.
Why?
Pattern interrupt. Removes pressure. Shows respect for their time.
## Tools That Actually Matter
**Email Verification:**
- Bouncer (recommended)
- NeverBounce
- ZeroBounce
**Blacklist Checking:**
- MXToolbox
- MultiRBL
**Authentication Setup:**
- PowerDMARC
- Red Sift OnDMARC
- Valimail
**Warm-Up:**
- Firstsales.io (built-in)
- Instantly (standalone)
- Mailreach
**Cold Email Platforms:**
- Firstsales.io (best deliverability + price)
- Instantly
- Smartlead
- Lemlist
**List Building:**
- Apollo.io
- LinkedIn Sales Navigator
- ZoomInfo
**Monitoring:**
- Google Postmaster Tools (free)
- Microsoft SNDS (free)
- Firstsales.io real-time monitoring
**Alternative: If Budget Is Tight**
Minimum viable stack:
- Bouncer for verification ($20/month)
- MXToolbox for blacklist checks (free)
- Google Postmaster Tools (free)
- Firstsales.io Starter ($28/month)
Total: $48/month for complete deliverability infrastructure.
Compare to hiring a deliverability consultant: $5,000-$10,000/month.
## What To Do If You're Already Blacklisted
Don't panic. Recovery is possible.
**Step 1: Stop Sending**
Immediately halt all campaigns. Continuing to send makes it worse.
**Step 2: Identify the Cause**
Check:
- Which blacklist (Spamhaus, SpamCop, Barracuda)?
- What triggered it (spam trap, complaints, volume spike)?
- When did it happen?
Use the blacklist's lookup tool to see details.
**Step 3: Fix the Root Cause**
Common fixes:
- Clean your list (remove invalid addresses)
- Verify authentication (SPF, DKIM, DMARC)
- Lower sending volume
- Improve engagement
- Remove spam traps
- Secure compromised accounts
Don't request removal until you've fixed the underlying issue.
**Step 4: Request Delisting**
Each blacklist has specific removal processes:
**Spamhaus:**
- Use their removal portal
- Provide detailed explanation of what you fixed
- Show evidence of corrective action
- May require 24-48 hours of clean sending first
**SpamCop:**
- Often auto-delists after 24-48 hours of no spam reports
- If not automatic, submit delisting request with proof
**Barracuda:**
- Use online delisting tool
- Follow their specific requirements
- Provide server information and corrective actions
**Step 5: Monitor Daily**
Check status daily. Some delistings happen automatically. Others require manual review.
If relisted quickly, you didn't fix the root cause. Go back to Step 3.
**Step 6: Prevent Future Listings**
After recovery:
- Implement proper warm-up for new domains
- Use double verification on all lists
- Monitor bounce and complaint rates daily
- Keep spam complaints under 0.1%
- Regular blacklist checks (weekly)
**When to Give Up on a Domain**
If you're repeatedly blacklisted despite fixes, the domain may be permanently damaged.
Start fresh with a new domain. Implement proper practices from day one.
## The Future of Email Deliverability (2026 and Beyond)
**AI Filters Get Smarter**
Gmail's AI already analyzes:
- Engagement patterns
- Reply sentiment
- Conversation quality
- Time spent reading
Expect filters to weight "conversation value" more heavily.
Generic blasts will perform worse. Personalized, relevant emails will win.
**BIMI Becomes Standard**
By end of 2026, expect:
- 60%+ of major brands using BIMI
- Verified logos as trust signal
- Emails without BIMI looking less legitimate
- CMC making BIMI accessible to smaller companies
**Stricter Authentication Requirements**
DMARC at p=reject will become the norm, not the exception.
Mailbox providers may start requiring:
- ARC for forwarding support
- Regular DKIM key rotation
- SPF flattening for complex setups
**Zero Tolerance for Spam Traps**
Hitting a pristine spam trap in 2026 may result in permanent blacklisting with no appeal.
List hygiene becomes non-negotiable.
**Engagement Metrics Dominate**
Authentication gets you to the table.
Engagement determines if you stay there.
Future focus:
- Conversation depth
- Reply quality
- Time-in-inbox
- User behavior signals
**The Deliverability Gap Widens**
Companies with proper infrastructure (authentication, warm-up, monitoring) will see 85%+ inbox placement.
Companies without it will see 30-40%.
The middle ground disappears.
Either invest in deliverability or stop using email.
## Key Takeaways: What Actually Matters
You just read 42 deliverability insights. Here's what to prioritize:
**Technical Must-Haves:**
1. SPF, DKIM, DMARC configured correctly (p=quarantine minimum)
2. BIMI setup (if you have a trademark or 12-month logo history)
3. 21-day warm-up for new domains
4. Double verification on all lists
**Behavioral Must-Haves:**
1. Consistent sending volume (no spikes)
2. Keep spam complaints under 0.1%
3. Keep bounce rate under 2% (1% for cold)
4. Monitor inbox placement weekly
**Strategic Must-Haves:**
1. Secondary domains for cold outreach
2. Inbox rotation for scaling
3. List cleaning every 60-90 days
4. Engagement-first approach
**The Bottom Line**
Deliverability isn't about perfection.
It's about avoiding catastrophic mistakes that destroy your domain.
Set up authentication. Warm up properly. Clean your lists. Monitor your metrics.
Or use a platform that handles this automatically.
Firstsales.io manages every technical aspect of deliverability. You focus on closing deals.
87% average inbox placement. $28-$269/month. Free list cleaning.
[Start Free 7-Day Trial](https://firstsales.app/)
No credit card required.
## Related Resources
Want to go deeper on cold email strategy?
**[72 Cold Email Templates That Just Work in 2026](https://firstsales.io/blog/cold-email-templates)**
Battle-tested templates by industry and role. Includes deliverability science and personalization frameworks.
**[Best Cold Email Tool: 15 Platforms Tested in 2026](https://firstsales.io/blog/best-cold-email-outreaching-tool)**
Comprehensive comparison of Firstsales.io vs Instantly vs Smartlead vs 12 other platforms. Real data on deliverability and ROI.
**[How to Write Cold Emails: 2026 Framework That Gets 40% Reply Rates](https://firstsales.io/blog/how-to-write-cold-emails)**
Industry-specific tactics, psychology frameworks, and deliverability secrets for high-performing cold emails.
## Frequently Asked Questions
### What is email deliverability and why does it matter?
Email deliverability is whether your emails reach recipients' inboxes (not spam folders or get blocked entirely). It matters because deliverability determines if your outreach actually works. 87% inbox placement means 87 out of 100 emails reach the inbox. 60% means 40 emails are wasted before anyone sees them.
### How long does it take to warm up a new email domain?
Minimum 21 days. Start with 5-10 emails per day. Increase volume by 15-20% weekly. Week 1: 5-10/day. Week 2: 10-25/day. Week 3: 25-50/day. Week 4+: 50-100/day. Rushing warm-up sends 90% of emails to spam immediately.
### What's the difference between SPF, DKIM, and DMARC?
SPF verifies the sending IP is authorized. DKIM adds a cryptographic signature proving the email wasn't altered. DMARC requires SPF or DKIM to pass and checks that domains align, then enforces a policy (none, quarantine, reject). All three are required in 2026.
### How do I check if my domain is blacklisted?
Use MXToolbox Blacklist Check. It scans 100+ blacklists in seconds. Check weekly. Focus on the big three: Spamhaus, SpamCop, and Barracuda. Getting listed on Spamhaus is catastrophic. Your emails stop reaching anyone.
### What's a spam trap and how do I avoid hitting one?
Spam traps are email addresses designed to catch bad senders. Three types: (1) Pristine (never owned by anyone, from scraped/bought lists), (2) Recycled (old abandoned addresses reactivated), (3) Typo (gmial.com, gnail.com). Avoid them by: never buying lists, cleaning your list every 60-90 days, using email verification tools.
### Why do my emails go to the Promotions tab in Gmail?
Gmail's algorithm categorizes emails based on content, sender reputation, and engagement history. Marketing-style emails (images, multiple links, sales language) typically land in Promotions. Cold emails with plain text and no links are more likely to reach Primary inbox. Focus on engagement (replies, clicks) to train Gmail's algorithm.
### What's the ideal email sending volume per day?
Depends on account age and type. Gmail free: 500/day max. Google Workspace: 2,000/day max. Microsoft 365: 5,000-10,000/day. For cold outreach specifically: 50-100/day per account maximum. Use inbox rotation (multiple accounts) to scale beyond this without reputation damage.
### How do I improve my sender reputation quickly?
You can't. Sender reputation builds over weeks/months through consistent positive signals. Focus on: low spam complaints (<0.1%), high engagement (opens, clicks, replies), low bounce rates (<2%), proper authentication (SPF, DKIM, DMARC passing), consistent sending patterns. Shortcuts don't exist. Reputation recovery after damage takes 3-6 months.
### Should I use a dedicated IP or shared IP for sending?
Most companies should use shared IPs. Dedicated IPs require high volume (100,000+ emails/month) to build reputation. Low volume on dedicated IP = poor reputation. Shared IPs benefit from collective reputation (assuming other senders behave well). Switch to dedicated only when you consistently send 100K+/month and have pristine sending practices.
### What's BIMI and do I need it?
BIMI displays your verified logo next to emails in Gmail, Yahoo, and Apple Mail. Increases open rates 4-6%, CTR 80%, brand recall 44%. Requires: (1) DMARC at p=quarantine or p=reject, (2) Mark Certificate (VMC with trademark or CMC with 12-month public logo history), (3) BIMI DNS record. Not mandatory but increasingly important for brand differentiation.
### How do I know if my emails are landing in spam?
Use inbox placement monitoring. Send test emails to seed accounts (Gmail, Outlook, Yahoo, Apple Mail). Check where they land: inbox, promotions, spam, or blocked. Do this weekly. Tools: Firstsales.io (real-time monitoring), GlockApps, Mail-Tester. Also check Google Postmaster Tools and Microsoft SNDS for reputation scores.
### What's the difference between email delivery and deliverability?
Delivery = did the email reach the receiving server? (Yes/no, usually 95%+)
Deliverability = did the email reach the inbox? (Percentage: 60-87% typical)
You can have 100% delivery but 40% deliverability if 60% land in spam.
### Can I recover from being blacklisted?
Yes, but it takes time. (1) Stop sending immediately. (2) Identify which blacklist and why. (3) Fix the root cause (clean list, fix authentication, lower volume). (4) Request delisting through each blacklist's specific process. (5) Monitor daily. Recovery can take 1-4 weeks. If repeatedly blacklisted, consider a new domain.
### How often should I clean my email list?
Every 60-90 days minimum. Remove subscribers with no clicks in 60 days. Completely remove those with no activity in 90 days. Run re-engagement flows before final removal. For cold outreach: after each campaign sequence (5-7 touches), don't contact non-responders for 6-12 months.
### What's the best time to send cold emails?
Best days: Tuesday, Wednesday, Thursday. Best times: 8-10 AM and 2-4 PM in recipient's timezone. Avoid: Monday mornings (inbox overload), Friday afternoons (mentally checked out), weekends (B2B dead). Use send time optimization to automatically adjust for recipient timezones.
### Why is my bounce rate high and how do I fix it?
High bounce rate causes: (1) Invalid email addresses, (2) Typos in emails, (3) Outdated list, (4) Spam traps, (5) Full mailboxes. Fix: Use double verification before sending. Clean list regularly. Never buy email lists. Remove hard bounces immediately. Monitor soft bounces and remove persistent failures. Keep bounce under 2% for marketing, under 1% for cold outreach.
### Do I need a secondary domain for cold email?
Yes. Always. Never send cold emails from your primary domain. Why? Cold email has higher risk of spam complaints, blacklisting, reputation damage. If you burn your primary domain, you burn customer emails, transactional emails, support communications. Buy 2-3 secondary domains. Set up authentication. Warm them properly. Use only for cold outreach.
### How do I set up SPF, DKIM, and DMARC?
**SPF:** Add TXT record to DNS: `v=spf1 include:_spf.google.com ~all` (example for Gmail). List all authorized sending services.
**DKIM:** Generate keys through your ESP. Add public key to DNS as TXT record. Use 2048-bit keys.
**DMARC:** Add TXT record: `v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com`
Start with p=none for monitoring. Move to p=quarantine then p=reject. Or use Firstsales.io which configures all three automatically in 8 minutes.
### What's inbox rotation and why do I need it?
Inbox rotation spreads your sending across multiple email accounts. Instead of sending 1,000 emails from one account (instant spam), you send 100 from 10 accounts. Each account stays under safe limits. Your total volume scales. Required for cold outreach beyond 50-100/day per account. Firstsales.io handles rotation automatically with unlimited email accounts on all plans.
### How do I disable open tracking and should I?
Most cold email tools have "Disable open tracking" in settings. Turn it off. Why? Gmail shows a warning banner when it detects open tracking pixels: "This email may be tracking you." Below that: "Report spam" button. This destroys deliverability. Elite cold emailers disabled open tracking in 2024. Measure reply rates instead. Only metric that matters.