Cold Email Deliverability Checklist: How to Land in the Primary Inbox (2026)

1. Send from a separate domain

Never send cold email from the domain your business runs on. If your outreach gets flagged, you do not want invoices, client replies and password resets flagged with it. Register a second domain that is clearly yours, for example a variant of your brand name with a different ending, and use it only for outreach.

• Set the new domain up with a proper mailbox provider, not a bare mail server on a VPS.
• Put a simple one-page site on it that says who you are and links to your main site, so anyone who looks it up sees a real business.
• Create two or three sending addresses on it (your name, a colleague's name) rather than one address that sends everything.

A new domain has no history, which is why the warm-up step below matters.

2. Set up SPF, DKIM and DMARC

These three DNS records are how receiving servers check that you are who you say you are. Google's email sender guidelines require SPF or DKIM for all senders to Gmail accounts, and both SPF and DKIM plus DMARC for senders of 5,000 or more messages a day. Even at cold-email volumes, set up all three.

SPF: which servers may send for your domain

SPF is a DNS TXT record listing the servers allowed to send mail for your domain. In Google's words, when receiving servers get messages from your domain, "they check the SPF record to verify that the messages came from authorized servers". Each domain needs its own record. Google recommends ending the record with ~all (soft fail), which tells receivers to treat mail from unlisted servers as suspicious, and notes that a record can include up to 10 include: tags. Add every service that sends for the domain, or its messages can be marked as spam.

example-outreach.com.  TXT  "v=spf1 include:_spf.google.com ~all"

DKIM: proof the message was not altered

DKIM adds a digital signature to each outgoing message. Your mail provider signs with a private key, and the matching public key is published in DNS so the receiving server can confirm the message came from your domain and was not changed in transit. Google recommends a 2048-bit key where your DNS provider supports it, because longer keys are more secure. You switch it on in your mail provider's admin console.

DMARC: what receivers should do when checks fail

DMARC tells receiving servers what to do with messages from your domain that fail SPF or DKIM, and sends you reports about what they saw. Google's DMARC guide says to set up SPF and DKIM first, wait about 48 hours, and then publish a DMARC record starting with policy p=none, which delivers mail normally while you read the reports. Once you can see that your legitimate mail passes, move to quarantine (send failures to spam) and later reject. Use a dedicated mailbox for reports rather than your personal inbox.

_dmarc.example-outreach.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example-outreach.com"

3. Warm the domain up and keep volume low

Google's guidance for all senders is to start with a low sending volume to engaged users and increase it slowly, and to send at a consistent rate rather than in bursts. For a new outreach domain that means a few weeks of real, personal messages before any cold sequence starts.

• Begin with messages to colleagues, partners and existing contacts who reply. Real conversations are the signal.
• Add cold volume gradually, a few extra messages a day per mailbox, and hold each level for a while before increasing.
• Automated warm-up services exist. Treat them as a supplement to real replies, not a substitute.

Cold email to local businesses is a low-volume activity. You are writing to one business at a time with something specific you noticed, not blasting a list. Spread outreach across the two or three addresses on your outreach domain, keep each one well under whatever daily limit your provider states, and pause a mailbox entirely if its bounce or complaint numbers jump.

4. Verify the list before you send

Bounces are the fastest way to damage a new domain. Every address should be checked before it goes into a sequence: the format, whether the domain accepts mail, whether the mailbox exists, and whether it is a role address like info@ that may be shared or unread. How to do that, including free options, is covered in how to verify email addresses in bulk for free.

Where the addresses come from matters as much as whether they exist. Google's guidelines say not to buy email addresses from other companies and not to send to people who did not sign up to hear from you. Building your own list from Google Maps and each business's own website gives you addresses that are current and specific to the business. If you use LeadOutreach, the Email Verified column shows which addresses passed its basic checks; treat a failed check as a reason not to send.

5. Write like a person and make it easy to opt out

• Plain text, or close to it. No images, no tracking-heavy templates, no buttons. A message that looks like a newsletter is filtered like one.
• Few or no links. One link at most, to a page on a domain you control. Avoid link shorteners.
• Vary the wording. Hundreds of identical messages are easy to fingerprint. Change the first line for every business, which you should be doing anyway.
• Honest subject lines and headers. Google's guidelines require messages to follow the Internet Message Format standard (RFC 5322) and not to impersonate other senders. A fake "Re:" on a first email is a bad start.
• A real signature with your name, business name, postal address and phone number.

For message structure, see the cold email templates for local businesses. Short, specific and personal is both better copy and better deliverability.

Every commercial message also needs a clear, working way to stop receiving it. Google's bulk-sender rules require a visible unsubscribe link in the message body and one-click unsubscribe headers (List-Unsubscribe and List-Unsubscribe-Post, as defined in RFC 8058), with requests honoured within two days. At cold-email volumes a plain sentence such as "Reply 'stop' and I will not write again" is the minimum, and you must actually act on it.

Keep a suppression list of everyone who opted out, bounced or replied no, and check every new list against it before sending. Legal requirements for commercial email vary by country, and a sole trader's business email can be personal data. This is not legal advice; the general principles are in is Google Maps scraping legal.

6. Monitor bounces, complaints and reputation

Google's guidelines set a spam-rate requirement in Postmaster Tools: keep it below 0.3% and, ideally, below 0.1%. That is the only published threshold worth planning around. Set up Postmaster Tools for your outreach domain before you send anything, so the history starts on day one.

The checklist

1. Separate outreach domain with a one-page site and a real mailbox provider.
2. SPF record with all sending services included and ~all at the end.
3. DKIM enabled in the provider console, 2048-bit key where supported.
4. DMARC record at p=none with a reports mailbox, published after SPF and DKIM have been live for about 48 hours.
5. Postmaster Tools set up for the domain.
6. Two to four weeks of low-volume, real conversation before any cold sequence.
7. Every address verified; role addresses and failed checks removed.
8. Plain-text messages, one link, real signature, honest subject line.
9. Working opt-out and a suppression list checked before every send.
10. Weekly review of bounces, complaints, DMARC reports and replies, with the sequence paused if any of the first three moves.

Work through the list once, then repeat the last four items every week.