Replies slow down first. Then open rates sag, a prospect mentions finding you in the junk folder, and someone finally asks: why are my cold emails going to spam? The cause can usually be found in a day, and the fixes fit into two weeks.
It is rarely one bad subject line. It is usually broken authentication, too many spam complaints, or sending habits that went unpunished before Gmail and Outlook started enforcing their sender rules. Below: what the rules require, the usual mistakes, how to check where your mail lands, and a 14-day recovery plan.
Why cold emails go to spam: the short answer
Cold email usually ends up in spam for one of five reasons:
- Authentication. SPF, DKIM or DMARC is missing, broken or not aligned with your From domain.
- Complaints. Too many recipients click Report spam, pushing your spam rate over Google's limits.
- Sending behaviour. No warm-up, sudden volume jumps, or cold email sent from your main domain.
- List quality. Unverified addresses that bounce, and people with no reason to hear from you.
- Content and tracking. Open and click tracking, too many links and identical text sent to thousands.
The stakes are high. Instantly's Cold Email Benchmark Report 2026 puts the average reply rate at 3.43% and finds that 58% of replies come from the first email in a sequence, with follow-ups adding the other 42%. If that first email lands in spam, you lose the step that produces most of your replies.
What Gmail and Outlook require from senders in 2026
Both now demand authenticated mail from high-volume senders and enforce it with rejections, not only the spam folder. Google's email sender guidelines FAQ calls you a bulk sender if you send close to 5,000 or more messages to personal Gmail accounts within 24 hours, counting all mail from one primary domain together, and the status is permanent. The rules took effect in February 2024, every sender needs SPF or DKIM, and since November 2025 Gmail has been ramping up enforcement, including temporary and permanent rejections.
Microsoft's Outlook requirements for high-volume senders cover domains sending more than 5,000 emails a day to Outlook.com consumer addresses. Since 5 May 2025, non-compliant mail can be rejected with 550; 5.7.515 Access denied. If you see that code, fix your setup, not your copy.
| Rule | Gmail, personal accounts | Outlook.com, consumer addresses |
|---|---|---|
| Authentication | SPF and DKIM, DMARC at p=none or stricter, From aligned | SPF, DKIM and DMARC at p=none or stricter, aligned |
| Complaints | Spam rate below 0.1%, never 0.3% or higher | Regular list cleaning recommended |
| Unsubscribe | One-click for marketing mail, honored within 48 hours | Functional unsubscribe link recommended |
| Enforcement | Ramping up since November 2025, including rejections | Since 5 May 2025, rejection with 550; 5.7.515 |
One detail matters for B2B. Google says its requirements apply only to mail sent to personal Gmail accounts, not Google Workspace accounts, and Microsoft's cover consumer addresses. Treat them as your floor anyway: most lists include some personal addresses, and Microsoft's own advice is that all senders benefit from these practices.
How to set up SPF, DKIM and DMARC for cold email
Every sending domain needs all three records, and your From domain must match a domain that passed SPF or DKIM. That match is called alignment, and many setups quietly fail it.
- SPF lists the servers allowed to send for your domain. Include your mail provider and sending tool, nothing else; Microsoft warns that too many include statements can make the check fail.
- DKIM adds a signature that receivers verify with a public key in your DNS. Many tools sign with their own default domain until you set up DKIM for yours, which breaks alignment.
- DMARC tells receivers how to treat failing mail and checks alignment. p=none is the minimum both providers accept; add a reporting address before you tighten it.
To check, send a test to a Gmail address you control, click More, then Show original. The full header shows the SPF, DKIM and DMARC results, and all three should pass. Repeat for every tool that sends as you, including your CRM.
Gmail spam rate limits and one-click unsubscribe
Google asks senders to keep their user-reported spam rate below 0.1% and never let it reach 0.3%. The rate is calculated daily, and above 0.1% it already hurts inbox delivery for bulk senders. It counts Report spam clicks, and nobody on a cold list asked to hear from you, so there is little room for error.
The best protection is an easy way out. Google requires one-click unsubscribe for marketing and promotional mail, built as RFC 8058 describes: List-Unsubscribe and List-Unsubscribe-Post headers covered by a valid DKIM signature. A mailto link in the body does not count, and opt-outs should be honored within 48 hours.
Does that cover cold email? Google says recipients, not Google, determine the nature of the messages they receive, and a cold pitch is not transactional. Add the headers if your tool supports them, add a plain opt-out line, and stop writing to anyone who asks.
Sending mistakes that put cold email in spam
Most of these are self-inflicted and cost nothing to fix:
- Using your main domain. One bad campaign can hurt the domain your invoices and support mail rely on. Use separate domains that clearly belong to your brand; Gmail adds subdomain mail to the primary domain's bulk sender count.
- No warm-up. A new domain has no history. Start with small daily volumes and raise them gradually.
- Sudden volume jumps. Google's guidelines include increasing volume gradually. Doubling sends overnight, or starting new inboxes at full volume, does the opposite.
- Unverified lists and bounces. Old or bought lists often contain dead addresses. Verify before sending; Microsoft recommends removing invalid addresses regularly to cut complaints and bounces.
- Links and tracking. Open tracking adds a hidden image and click tracking reroutes links, often through a domain shared with other senders. A plain first email with one link or none reads like a note from a person.
- Identical copy at scale. When the same words reach thousands, the readers who feel spammed press Report spam. Write per segment.
- No opt-out line. People who see no easy way out use the spam button instead.
- Poor targeting. Writing to people with no reason to hear from you collects complaints fastest; signal-based selling helps you find buyers with a reason to talk now.
Tools that promise more volume can make several of these mistakes at once; we compare the options in AI SDR or outsourced sales team.
How to check if your emails are going to spam
Judge placement by replies, bounces and test mailboxes, not opens. Apple's Mail Privacy Protection prevents senders from seeing whether a message was opened, so open rates move for reasons unrelated to the inbox.
- Replies per domain. A sudden drop on one domain while the copy stays the same points to placement.
- Bounces. Gmail sends a rejection code and a reason when it rejects mail; an Outlook.com 550; 5.7.515 means authentication failed.
- Test mailboxes. Put a few Gmail and Outlook addresses, personal and company, into live sequences and see where each step lands.
- Postmaster Tools. Google Postmaster Tools shows spam rate, reputation, authentication and delivery errors for verified domains.
Know its limits. Google's Postmaster Tools help says the data covers only mail to personal Gmail accounts and may be missing when daily volume is too low. A small B2B program can see an empty dashboard while it has a real problem, so replies and test mailboxes stay your main signal.
Cold email going to spam? Symptoms, causes and fixes
Match the symptom to the likely cause before you change anything.
| Symptom | Likely cause | Fix |
|---|---|---|
| Outlook.com bounces with 550; 5.7.515 | SPF, DKIM or DMARC missing or failing | Fix the DNS records, then retest |
| Gmail rejects or delays mail with an error code | A sender requirement is not met | Read the code and fix that requirement |
| Replies fall on one domain, others hold | That domain's reputation took a hit | Pause it, clean the list, restart small |
| Replies fall on every domain at once | A shared list, copy or tracking problem | Verify the list, cut tracking, rewrite the first email |
| Opens fall but replies hold | Tracking noise, not placement | Stop judging campaigns on opens |
| Prospects say they found you in spam | Complaints or poor targeting | Tighten targeting and add an opt-out line |
A 14-day plan to get your cold emails out of spam
Practical guidance, not a promise: fixing causes is quick, while rebuilding reputation depends on the damage done.
- Day 1: stop and collect. Pause affected domains, keep answering replies, export every bounce with its error code.
- Days 2 and 3: authentication. Fix SPF, DKIM, DMARC and alignment on every sending domain; confirm with Show original.
- Days 4 and 5: the list. Verify addresses, remove hard bounces, keep one shared suppression list. If the list is the problem, see our guide to IT sales leads.
- Days 6 and 7: the email. Plain text, tracking off, one link at most, a clear opt-out line, a first email rewritten for one segment.
- Day 8: monitoring. Set up Postmaster Tools and test mailboxes, then check replies, bounces and complaints daily.
- Days 9 to 11: restart small. Send only to your best-fit segment, at a fraction of the old volume.
- Days 12 to 14: raise with care. Increase volume step by step while signals stay clean. If a domain keeps failing, retire it.
Meanwhile, let other channels carry more. RAIN Group found it takes an average of 8 touches to get a first meeting with a new prospect, so LinkedIn and phone steps can offset lower email volume. A sample three-week sequence across email, LinkedIn and phone is laid out in our guide to multichannel outbound for small sales teams.
Is cold email legal in the EU? GDPR, consent and Czech rules
In Europe, law and spam rate point the same way: write to people who can reasonably expect it, make saying no easy and honor it at once. Complaints drive the spam rate, and people who never expected your email are the ones who complain.
Under the GDPR, Recital 47 says processing personal data for direct marketing may be regarded as carried out for a legitimate interest, which still needs a balancing test and an easy opt-out.
National email rules come on top. In the Czech Republic, the Czech data protection office (ÚOOÚ) says commercial email requires the recipient's consent in advance, and the rule covers legal persons, so B2B too. The exception is existing customers, for the sender's own similar products or services, with an opt-out in every message. Confirm your own case with counsel. If you also email prospects outside the Czech Republic, our country-by-country guide to cold email law covers Germany, France, the UK, Turkey and five more countries.
Frequently asked questions
Is cold email still allowed under the Gmail rules?
Yes. The rules do not ban cold email; they require authentication, a low spam rate and an easy way to unsubscribe. Relevant, well-targeted email from an authenticated, warmed-up domain, with opt-outs honored within 48 hours, can still reach the inbox. Mass email to bought lists mostly cannot.
What spam rate is safe for cold email?
Google's lines: stay below 0.1% and never reach 0.3% or higher. Treat 0.1% as a ceiling, not a target. Nobody on a cold list opted in, so aim as low as tight targeting, relevant copy and an obvious opt-out allow, and check it daily, since Google calculates it daily.
Do these rules apply to B2B email sent to company addresses?
Formally, only in part. Google's requirements cover mail to personal Gmail accounts, not Google Workspace accounts, and Microsoft's cover Outlook.com consumer addresses. Company mailboxes run their own filters. But most B2B lists include personal addresses, and Microsoft says all senders benefit from these practices, so build to the rules either way.
Should I use a separate domain for cold email?
Yes. Send from separate domains that clearly belong to your brand, each with SPF, DKIM, DMARC and a proper warm-up, and keep your main domain for customers and invoices. Gmail counts subdomains together with the primary domain for its bulk sender threshold, so a subdomain is not a separate sender there.
Outbound that reaches the inbox
Deliverability decides whether the rest of your outbound gets a chance. When we run lead generation for IT and SaaS companies, warmed-up sending domains come with every plan: one on Launch, two on Traction, three or more on Scale. Plans start at 1,750 euros a month with five qualified meetings a month guaranteed; see our pricing.
Want the whole cycle handled? See IT sales outsourcing. Launching a new product? Start with our SaaS sales checklist.
Sources and further reading: Google, email sender guidelines FAQ; Google, Postmaster Tools help; Google Postmaster Tools, spam rate and authentication dashboards; Microsoft, Outlook requirements for high-volume senders; RFC 8058, one-click unsubscribe standard; Apple, Mail Privacy Protection; Instantly, Cold Email Benchmark Report 2026; RAIN Group, touches needed for a first meeting; GDPR Recital 47, legitimate interest; ÚOOÚ, Act No. 480/2004 on commercial communications.