Deliverability is now a compliance problem, not a copy problem
For years the cold-email conversation was about subject lines and personalization. That still matters, but it is no longer where most campaigns die. Since the Google and Yahoo bulk-sender requirements took effect in February 2024, and Microsoft's equivalent rules for Outlook, Hotmail, and Live began rolling out in 2025, the mailbox providers decide whether your message is even eligible for the inbox before a human ever reads the first line.
The good news is that the rules are now explicit. If you authenticate correctly, keep complaints low, and ramp volume sensibly, you land. If you skip steps, you get filtered to spam or rejected outright. This guide walks the full setup in the order you should actually do it.
Step 1: Use a separate sending domain
Never run cold outreach from your primary company domain. A deliverability incident on a cold campaign can poison the domain you use for contracts, invoices, and support. Instead, register one or more dedicated sending domains — often a close variant of your brand, such as a .co or a get-, try-, or -hq version of your main name — and point your outreach only at those.
This separation is the single most important structural decision you will make. It contains reputation damage, lets you retire a burned domain without touching your business, and makes it possible to scale volume across several domains rather than overloading one. We register and configure these dedicated domains for you, but the principle holds however you buy them.
Step 2: Authenticate with SPF, DKIM, and DMARC
Every sending domain needs all three authentication records published before you send a single message. SPF lists the servers allowed to send for your domain. DKIM cryptographically signs each message so the receiver can verify it was not altered and genuinely came from you. DMARC ties the two together, tells receivers what to do with mail that fails, and — critically — is now mandatory for bulk senders.
Start DMARC at p=none so you can monitor without risk, then tighten to p=quarantine and eventually p=reject once your legitimate mail is passing cleanly. If this sounds like a lot of DNS work, it is exactly the part we automate: records are published and verified for you before any inbox goes live. For the full mechanics, see our companion piece on SPF, DKIM, and DMARC explained for cold outreach.
Step 3: Warm every inbox before you send at volume
A brand-new inbox with no sending history looks exactly like a spam operation to a mailbox provider: sudden volume, no established engagement, no reputation. Warmup fixes this by simulating organic activity — a slowly increasing trickle of sends that are opened, replied to, and moved out of spam — so the domain and mailbox build a positive reputation before real campaigns start.
Thirty days is the practical floor for a cold inbox, which is why our pre-orders warm for a full 30 days before handover and our marketplace bundles arrive already warmed. We cover the mechanics in depth in how email warmup actually works and why 30 days.
Step 4: Meet the 2024-2025 sender requirements
The bulk-sender rules from Google and Yahoo, and the matching Microsoft requirements, share a common core. Authenticate with SPF, DKIM, and DMARC, with the domains aligned. Keep your spam-complaint rate below 0.3% — and realistically under 0.1% — as measured in Google Postmaster Tools. Include a working one-click unsubscribe (the List-Unsubscribe header per RFC 8058) and honor opt-outs within two days. Send over TLS, from a domain with valid forward and reverse DNS, using standards-compliant message formatting.
These thresholds were written for senders pushing 5,000+ messages a day to consumer inboxes, but treating them as your baseline from message one is the safest posture. A single spike in complaints can undo weeks of warmup.
Step 5: Ramp volume slowly and watch the signals
Even a warmed inbox should not jump straight to hundreds of sends a day. Ramp gradually — many teams stay around 30 to 50 cold sends per inbox per day and never exceed it — and spread total volume across multiple inboxes and domains rather than maxing out a single mailbox. This is the deliverability-safe reason we keep inbox counts per domain small.
Watch the signals as you scale: complaint rate and domain reputation in Postmaster Tools, reply and bounce rates in your sequencer, and any sudden dip in open rates. Deliverability is not a set-and-forget switch; it is a system you keep in balance. If you would rather not assemble every piece by hand, that is precisely what GoodInboxes exists to do — authenticated, warmed Google Workspace inboxes on dedicated domains, ready to hand to your sequencer.