Cold Email Deliverability: Raise Inbox Placement in 2026

Fix these five infrastructure and behavior items first, and inbox placement will usually recover within weeks. The core actions are: (1) publish SPF and DKIM records, then add a DMARC record at p=none with aggregate reporting enabled; (2) stop sending from your primary domain and switch to warmed sending domains or subdomains; (3) pause any sends to unverified lists and run contacts through a validation tool before resuming; (4) warm new mailboxes on a staged ramp and cap per-mailbox sends at a conservative daily ceiling; (5) run a seed inbox placement test and track complaint and bounce rates against known thresholds.

Cold email deliverability, the technical and behavioral discipline of getting outbound messages into primary inboxes rather than spam folders, sits at the intersection of DNS configuration, sending behavior, list quality, and content. Get all three wrong and even a well-written message never reaches a prospect. Get all three right and a well-run outbound program can reach inbox placement rates of 85–95%.

Quick action checklist for SDRs and campaign managers:

• Pause sends from any domain without published SPF, DKIM, and DMARC
• Validate every contact list with ZeroBounce or NeverBounce before the next send
• Switch to a dedicated sending domain or subdomain, never your primary
• Warm new mailboxes before loading them into a sequence
• Run a seed test to confirm inbox placement before scaling

Legal callout: Under the Australian Spam Act 2003, every commercial electronic message must include clear sender identification, a physical or electronic contact address, and a functional unsubscribe mechanism. Consent, or a recognized exception, is required. Non-compliance carries significant financial penalties.

Pro Tip: Set up a DMARC reporting address before you do anything else. Even at p=none, the aggregate reports will show you every service sending mail on your domain — including ones you forgot about.

Key Takeaways

Correct authentication, disciplined warmup, and clean lists are the three levers that determine cold email deliverability, and all three must be in place before scaling any outbound program.

Table of Contents

• How do you warm new mailboxes and domains for cold outreach?
• Does your SPF, DKIM, and DMARC setup actually protect you?
• What bounce rates actually damage your sender reputation?
• What sending limits and pacing rules keep you out of spam filters?
• What content and formatting choices reduce spam risk?
• Which tools help you test inbox placement and monitor reputation?
• How do you recover from a deliverability problem or blacklisting?
• What does the Australian Spam Act 2003 require for cold outreach?
• What KPIs should you track for cold email success?
• When should you outsource to an SDR-as-a-Service?
• What most teams get wrong about cold email deliverability
• Raki Solutions helps B2B teams reach inboxes and book meetings in APAC and ANZ
• Sources

How do you warm new mailboxes and domains for cold outreach?

Mailbox reputation is not assigned at account creation. Receiving servers build a behavioral profile over time, tracking whether recipients open messages, reply, move mail out of spam, or mark it as junk. A brand-new mailbox with zero history that suddenly sends 200 cold emails on day one looks exactly like a spam account, because that is exactly what spam accounts do.

The fix is a staged warmup: start with low volumes of human-like engagement, then ramp gradually while layering in live sends.

Sample 30-day warmup schedule

A single warmed mailbox should cap at a moderate number of live sends per day once ramped. To hit higher volumes, add mailboxes and domains rather than pushing one address past its ceiling. A practical formula: divide your target daily send volume by 50 to get the minimum number of mailboxes you need. Targeting 500 sends per day means at least 10 warmed mailboxes across two or three sending domains.

Warmup action checklist:

1. Confirm SPF and DKIM pass on the sending domain before starting warmup
2. Use a warmup network (MailReach is purpose-built for this) to generate initial engagement signals
3. Stagger send times across the day rather than batching at 9 AM
4. Vary message content across warmup threads to avoid pattern detection
5. Keep warmup sends running continuously alongside live sends, not just during the ramp phase
6. Run a seed test at day 15 and again at day 30 to confirm inbox placement

Pro Tip: Warmup networks are an on-ramp, not a permanent solution. The real engagement signals that protect long-term reputation come from live prospects opening, replying, and not marking your mail as spam. Treat warmup as the foundation, not the building.

Does your SPF, DKIM, and DMARC setup actually protect you?

Publishing DNS records takes about 20 minutes. Getting them aligned, inventoried, and escalated safely to p=reject takes 60–90 days in practice when you have multiple sending services. The short answer: publish SPF and DKIM first, add DMARC at p=none with reporting, then move cautiously through the escalation sequence once reports confirm alignment.

SPF, DKIM, and DMARC together form the authentication foundation that major mailbox providers expect from any bulk sender. Microsoft has also tightened Outlook's requirements for high-volume senders, making correct authentication non-optional for B2B outbound reaching Exchange and Office 365 inboxes.

SPF: what to check

• List every service that sends mail on your domain (your ESP, CRM, marketing automation, SDR tool)
• Stay under the 10 DNS lookup limit; flatten includes if you are close to the ceiling
• End with -all (hard fail) once you have confirmed all senders are listed
• Recommended shape: v=spf1 include:_spf.youresp.com include:sendgrid.net ~all (then tighten to -all)

DKIM: what to check

• Use your own domain as the d= signing domain, not the ESP's default
• Rotate keys periodically (annually at minimum)
• Validate signatures by sending a test message and inspecting the Authentication-Results header
• Confirm the d= value in the DKIM signature matches the From: domain for alignment

DMARC: the escalation sequence

Start at p=none with rua= (aggregate reports) and ruf= (forensic reports) pointing to a monitored inbox or a DMARC report parser. Read the reports for two to four weeks to inventory every service sending on your domain. Then:

1. p=none with reporting (weeks 1–4): identify all senders, fix misaligned ones
2. p=quarantine; pct=10 (weeks 5–8): quarantine 10% of failing mail; watch for legitimate senders breaking
3. p=quarantine; pct=100 (weeks 9–12): full quarantine; confirm no legitimate mail is failing
4. p=reject (week 13+): full enforcement; unauthorized mail is rejected at the gateway

Authentication checklist:

• SPF published and under 10 lookups
• DKIM signed with custom d= matching the From: domain
• DMARC at p=none with rua= reporting address active
• Return-path (envelope-from) aligned with the From: domain
• List-Unsubscribe header present and functional
• Verified with MXToolbox or a DNS checker after every change

Pro Tip: If you use an outsourced ESP, ask them explicitly to confirm custom DKIM signing on your domain, not their shared domain. "We handle DKIM" often means their domain, not yours — and that breaks DMARC alignment.

Stat callout: Moving from no DMARC to p=reject with full alignment is an operational process, not a one-time DNS edit. Operators with multiple sending services should budget 60–90 days for the full rollout.

What bounce rates actually damage your sender reputation?

That threshold comes from Microsoft's own guidance on sender reputation: bounce-rate spikes harm deliverability, and monitoring list hygiene is a baseline expectation for any sender.

Hard bounces (invalid addresses, non-existent domains) are the most damaging. Soft bounces (mailbox full, temporary server issues) are less severe but repeated soft bounces to the same address signal a dead or abandoned contact.

Bounce rate thresholds:

• Under 2%: healthy; proceed with normal sends
• 2–5%: warning zone; pause, re-validate the list, inspect DMARC reports for authentication failures
• Above 5%: danger; stop sends immediately, run a full list audit, check blacklists

Mailtrap's bounce rate guidance recommends list validation before every major send, double opt-in for inbound leads, and immediate suppression of any address that hard-bounces. For cold outbound, where you cannot use double opt-in, pre-send validation with ZeroBounce or NeverBounce is the equivalent control.

List hygiene workflow:

• Validate every new list with ZeroBounce or NeverBounce before the first send
• Remove hard bounces from all lists immediately after a send; never retry them
• Suppress addresses that soft-bounce three or more times consecutively
• Run a re-engagement sequence for contacts inactive for 90+ days before including them in cold sequences
• Prune lists quarterly; a contact that has never engaged after three touches is a liability, not an asset
• Check B2B list building practices to ensure your sourcing methodology produces verifiable contacts from the start

A misconfigured DMARC record can also generate bounces. If DMARC is set to p=reject before all legitimate senders are aligned, receiving servers will reject mail from those senders and return bounce messages. Always check DMARC reports alongside bounce logs when diagnosing a sudden spike.

Action checklist for rising soft bounces:

• Pause the affected campaign
• Pull DMARC aggregate reports and check for alignment failures
• Run a Spamhaus DNSBL lookup on the sending IP and domain
• Re-validate the list segment that generated the bounces
• Inspect SPF for recently added sending services that may have pushed you over the 10-lookup limit

What sending limits and pacing rules keep you out of spam filters?

Cap each mailbox at 50–70 live sends per day once fully warmed, ramp gradually from the first send, and rotate across multiple mailboxes and domains rather than concentrating volume on one address. A sudden spike from 20 sends to 300 sends in a single day is one of the fastest ways to trigger spam-folder routing, regardless of how clean your list is.

The 30/30/50 rule

The intent is to keep the ratio of engagement signals (opens, replies) high relative to total sends during the period when reputation is most fragile.

For new domains, apply a stricter cap: 20–25 sends per day for the first two weeks, regardless of warmup status. A domain's age and sending history are independent reputation signals.

Daily volume formula:

Target daily sends ÷ 50 = minimum mailboxes needed. For 300 sends per day, you need at least 6 fully warmed mailboxes. Spread those across two or three sending domains for additional redundancy.

Pacing checklist:

• Never send more than 50–70 live emails per mailbox per day (post-warmup ceiling)
• Ramp from 10 sends on day one, adding 10 per day until you reach the ceiling
• Stagger send times across a 6–8 hour window; avoid batching at a single hour
• Route replies to a monitored inbox and respond promptly; reply signals are a positive reputation input
• Review the outbound sales cadence guide for sequencing logic that balances email, LinkedIn, and call touches

Pro Tip: Mix live personal replies into the same mailbox you use for automated sequences. A mailbox that only sends and never receives looks mechanical to spam filters. Routing real conversations through it keeps the behavioral profile human.

What content and formatting choices reduce spam risk?

Plain-text, short, personalized messages with one or zero links are the safest format for first-touch cold email. Every additional link, image, tracking pixel, and HTML element adds spam-score risk. The goal for a first send is to look like a message a real person wrote to a specific recipient rather than a broadcast.

Content dos and don'ts:

• Do keep subject lines under 50 characters and avoid all-caps, excessive punctuation, and words like "free," "guaranteed," or "urgent"
• Do personalize beyond first name: reference the company's recent activity, a specific role detail, or a relevant industry signal
• Don't use redirect chains or URL shorteners; link directly to the destination or omit links entirely on first touch
• Do include a plain-text version alongside any HTML version
• Don't embed tracking pixels in first-touch cold emails; they add spam-score risk and are blocked by Apple Mail Privacy Protection anyway
• Do include a List-Unsubscribe header with a one-click unsubscribe URL and a List-Unsubscribe-Post header for RFC 8058 compliance
• Don't use a From: address that differs from the domain you authenticated; mismatched From/Reply-To combinations raise spam scores
• Do test subject lines against a spam-score tool before sending at scale

Safe subject-line patterns:

• Question format: "Quick question about [Company]'s [specific process]"
• Referral-style: "[Mutual connection] suggested I reach out"
• Specific observation: "Noticed [Company] is hiring [role] — relevant to this"

Risky patterns to avoid: "Exclusive offer for you," "Don't miss this," "Act before [date]," anything with multiple exclamation marks, or subject lines that make claims the body cannot immediately substantiate.

Pro Tip: AI-generated personalization is only valuable when it goes deeper than name and company. A message that references a prospect's recent LinkedIn post, a funding round, or a specific product launch reads as genuine. A message that swaps in a name and job title from a template reads as exactly what it is. For personalization at scale, invest in the research layer, not just the merge-field layer.

Which tools help you test inbox placement and monitor reputation?

Run seed inbox placement tests and continuous reputation monitoring before scaling any cold sequence. A spam-score check alone is not enough; you need to know whether your message lands in the primary inbox, the promotions tab, or the spam folder across Gmail, Outlook, and Yahoo before you send to real prospects.

Pre-send checklist:

• Run a seed test using MailReach or a comparable seed-test platform across Gmail, Outlook, and Yahoo inboxes
• Check spam score with a header-inspection tool; look for SPF pass, DKIM pass, DMARC pass, and a spam score below the provider's threshold
• Verify DNS records with MXToolbox after every change to SPF, DKIM, or DMARC
• Confirm the sending IP is not listed on Spamhaus DNSBLs before the first send from a new domain
• Inspect the Authentication-Results header in a test message to confirm all three records pass

Reputation monitoring tools:

1. Google Postmaster Tools — tracks domain reputation, IP reputation, spam rate, and delivery errors for Gmail recipients; free and essential for any program sending to Gmail addresses
2. Microsoft SNDS (Smart Network Data Services) — provides IP-level complaint and trap-hit data for Outlook/Hotmail/Exchange recipients
3. Spamhaus DNSBL lookup — check sending IPs and domains against the Spamhaus Block List, Exploits Block List, and Domain Block List
4. DMARC report parsers (dmarcian, Postmark's DMARC tool) — parse aggregate XML reports into readable dashboards showing pass/fail rates by sending source
5. MailReach — combines warmup network with inbox placement testing and reputation scoring; useful for ongoing monitoring alongside warmup
6. Email trust metrics tools — check authentication and reputation signals in one place

Thresholds that should trigger a campaign pause:

• Bounce rate exceeds 2%
• Spam complaint rate exceeds 0.1% (Google's published threshold for Gmail)
• Inbox placement drops below 80% on seed tests
• Sending IP or domain appears on any Spamhaus list
• DMARC reports show a sudden increase in alignment failures

Pro Tip: Build a Slack or email alert that fires when any of these thresholds are breached. A campaign that runs unchecked for 48 hours after a complaint spike can do weeks of reputation damage. Automate the alert; make the pause decision human.

How do you recover from a deliverability problem or blacklisting?

Diagnose volume, authentication, list quality, and content in that order, then act on the findings before resuming sends. The sequence matters: fixing content while authentication is broken wastes time, and fixing authentication while the list is still dirty will trigger another bounce spike within days.

Step-by-step recovery flow:

1. Stop all sends immediately from the affected domain and mailbox
2. Pull recent DMARC aggregate reports and identify whether failures are authentication-related or volume-related
3. Run Spamhaus DNSBL lookups on the sending IP and domain; note which lists you appear on
4. Fix authentication first: confirm SPF, DKIM, and DMARC are correctly published and aligned
5. Re-validate the list that was active during the incident; remove all hard bounces and flag soft-bounce addresses
6. Inspect content for spam-trigger patterns; simplify HTML, remove redirect links, reduce image-to-text ratio
7. Request delisting from blocklist operators once authentication is confirmed clean; Spamhaus provides a self-service delisting portal with specific criteria for each list
8. Re-warm the mailbox from a low baseline (10–15 sends per day) before resuming live sends
9. Run a seed test to confirm inbox placement before scaling

When to recover vs. retire the domain:

• Recover if the domain is on one blocklist, authentication was the root cause, and inbox placement was above 60% before the incident
• Retire if the domain appears on multiple Spamhaus lists simultaneously, inbox placement has been below 50% for more than two weeks, or the domain has a history of repeated incidents

Recovery timelines are not instant. Practitioner playbooks show moderate incidents take two to four weeks to resolve; severe cases involving multiple blocklists and sustained low placement can take two to three months.

Blacklist-specific notes:

• Spamhaus SBL (Spam Block List): typically requires demonstrating that the spam source has been removed and policies are in place
• Spamhaus DBL (Domain Block List): domain-level listing; requires fixing the underlying sending behavior, not just the IP
• PBL (Policy Block List): usually an ISP-assigned listing for dynamic IPs; use a dedicated sending IP to avoid this

Pro Tip: Document every step of a remediation in writing: what you found, what you changed, and when. Blocklist operators respond faster to delisting requests that include a clear incident summary. It also protects you if a client or employer asks what happened.

What does the Australian Spam Act 2003 require for cold outreach?

Commercial electronic messages sent to Australian recipients must meet three non-negotiable requirements under the Spam Act 2003: the sender must have consent (express or inferred), the message must clearly identify the sender, and it must include a functional unsubscribe mechanism that the sender honors within five business days.

For cold B2B outreach, the most commonly used consent basis is inferred consent, which applies when the recipient's address is published in a business context and the message is relevant to their business role. This is not a blanket permission to email anyone with a LinkedIn profile; the relevance test is real and the ACMA (Australian Communications and Media Authority) enforces it.

Compliance checklist for cold campaign templates:

• Sender name and business name clearly stated in the From: field and message body
• Physical or electronic contact address included in every message
• Functional unsubscribe link present in every message (not just the footer of a sequence's last step)
• Unsubscribe requests honored within five business days; add to suppression list immediately
• Consent basis documented for each contact segment (express or inferred, with source)
• Do-not-contact list maintained and checked before every send
• One-click unsubscribe via List-Unsubscribe header implemented at the technical level

One-click unsubscribe and List-Unsubscribe: Gmail and Outlook now surface one-click unsubscribe options for messages that include the List-Unsubscribe and List-Unsubscribe-Post headers. Implementing these headers is both a legal best practice under the Spam Act and a deliverability signal: providers treat senders who make unsubscribing easy as more trustworthy than those who bury the option.

Enforcement and record-keeping: The ACMA can issue infringement notices and pursue civil penalties for Spam Act breaches. Penalties for serious or repeated contraventions can be substantial. Maintain records of consent, source, and date for every contact segment, and keep suppression lists current.

Pro Tip: Treat your suppression list as a permanent asset, not a campaign-level setting. A contact who unsubscribed from one campaign must never receive another commercial message from your domain, regardless of which tool or sequence sends it.

Stat callout: The Spam Act 2003 applies to messages with an Australian link — meaning the sender is in Australia, the recipient is in Australia, or the message originates from Australian infrastructure. It covers email, SMS, and instant messaging, not just traditional email.

What KPIs should you track for cold email success?

Monitor inbox placement rate, bounce rate, spam complaint rate, reply rate, and unsubscribe rate as your core five. Open rate is worth tracking but treat it as directional rather than definitive; Apple Mail Privacy Protection and Outlook's link-prefetching inflate open rates in ways that make them unreliable as a primary signal.

Benchmark thresholds:

• Inbox placement rate: healthy above 85%; warning at 70–85%; danger below 70%
• Bounce rate: healthy below 2%; warning at 2–5%; danger above 5%
• Spam complaint rate: healthy below 0.08%; warning at 0.08–0.1%; Google's published threshold for Gmail is 0.1%, above which deliverability degrades
• Reply rate: healthy above 3% for cold outbound; warning at 1–3%; below 1% suggests content or targeting issues
• Unsubscribe rate: healthy below 0.5%; rising unsubscribes signal list-audience mismatch

Each metric should drive a specific operational response. A bounce spike triggers list re-validation and authentication review.

Prefer reply rate and seed placement over raw open rates when reporting to leadership. Reply rate is the only metric that cannot be inflated by tracking artifacts, and seed placement is the only direct measure of where your mail actually lands.

Weekly deliverability dashboard checklist for SDR managers:

• Inbox placement rate from most recent seed test
• Bounce rate for the past 7 days (hard and soft, separated)
• Spam complaint rate from Google Postmaster Tools and Microsoft SNDS
• Reply rate by sequence and by sending domain
• Blacklist status check (Spamhaus lookup on all active sending IPs and domains)
• DMARC aggregate report review for alignment failures

When should you outsource to an SDR-as-a-Service?

Outsource when your team lacks the technical bandwidth to manage authentication, warmup, and monitoring simultaneously with running live sequences, or when you need guaranteed qualified meetings on a defined timeline without building the infrastructure from scratch. The technical overhead of cold email deliverability in B2B, particularly for APAC and ANZ expansion, is higher than most sales teams anticipate.

Vendor evaluation checklist:

• Can they demonstrate correct SPF, DKIM, and DMARC setup on their sending infrastructure?
• Do they use dedicated sending domains per client, or shared infrastructure?
• What is their warmup protocol and how long before they begin live sends?
• Do they provide weekly reporting on deliverability metrics (bounce rate, complaint rate, inbox placement)?
• Do they have regional expertise in APAC and ANZ, including familiarity with the Spam Act 2003?
• Do they have an escalation playbook for blacklisting or complaint spikes?
• Can they demonstrate multi-channel outreach across email, LinkedIn, and calls, not just email blasts?

An SDR-as-a-Service like Raki Solutions operationalizes all of this: dedicated sending infrastructure per client, staged warmup before live sends, multi-channel sequences across email and LinkedIn, weekly reporting on deliverability and pipeline metrics, and a guaranteed qualified meetings model that ties performance to outcomes rather than activity.

For teams expanding into APAC and ANZ, local expertise matters. Spam Act compliance, time-zone-aware sending windows, and understanding of regional buyer behavior are not details an offshore generic agency will handle correctly by default.

Pro Tip: Before engaging any SDR-as-a-Service, ask them to walk you through their authentication setup for a new client domain. If they cannot explain DKIM alignment and DMARC reporting in plain terms, their deliverability discipline is likely surface-level.

What most teams get wrong about cold email deliverability

Authentication is the most common failure point, and it almost never looks like a failure from the outside. A team publishes SPF and DKIM, checks the boxes, and assumes they are covered. What they miss is alignment: the DKIM d= domain does not match the From: domain, or the return-path is still on the ESP's shared domain, so DMARC fails silently while the team wonders why inbox placement is declining.

The second pattern is warmup treated as a one-time event. A mailbox gets warmed for 30 days, then the warmup tool gets cancelled to save money. Six weeks later, after a campaign pause or a holiday break, the mailbox has lost its behavioral baseline and sends start landing in spam again. Warmup is maintenance, not setup.

The third is AI used for scale rather than depth. Generating 5,000 personalized-looking emails from a template that swaps in a name and company is not personalization. Receiving servers and human recipients both recognize the pattern. The teams that see strong reply rates from cold outbound use AI to research and surface specific, relevant details for each prospect, then write shorter messages around those details. Volume follows quality, not the other way around.

Recovery from deliverability problems takes longer than most teams expect. Moderate incidents resolve in two to four weeks. Severe ones take months. The patience required during a re-warm period, when you are sending 15 emails a day from a domain that used to send 200, is real. Cutting the re-warm short is the most common reason teams end up back at square one.

Raki Solutions helps B2B teams reach inboxes and book meetings in APAC and ANZ

Getting cold email deliverability right requires dedicated infrastructure, disciplined warmup, and ongoing monitoring — work that pulls sales and marketing teams away from the conversations that actually close deals.

Raki Solutions provides SDR-as-a-Service for B2B companies expanding into APAC and ANZ, with deliverability infrastructure built in from day one. Every client engagement includes dedicated sending domains with full SPF, DKIM, and DMARC setup, a staged warmup protocol before live sends begin, multi-channel outreach across email and LinkedIn, and weekly reporting on both deliverability metrics and pipeline outcomes. The model is built around guaranteed qualified meetings, not activity reports.

For teams that need inbox placement and booked meetings without building the infrastructure themselves, Raki Solutions is the direct route. Request an outreach audit to see where your current setup stands and what a structured APAC/ANZ program would look like.

Sources

• Legislation
• Learn
• Spamhaus
• Theinboxledger

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Recommended

• Email vs LinkedIn Outreach: What Works Best in Australian B2B
• Best B2B List Building for APAC & ANZ Outbound Teams
• Cold Calling Scripts That Book More B2B Meetings
• Intent Data Providers for APAC SDR Outbound: 2026 Guide