Cold email deliverability checklist for 2026

Send cold email from a separate registered domain, with SPF, DKIM and DMARC aligned to the From address, a spam rate under the lines Google and Yahoo publish, a one-click way out, and a list that does not bounce. That is the cold email deliverability checklist for 2026.

Do the steps in order. Every figure below is from the provider’s own page, linked where it appears. Where they do not publish a number, this page does not invent one. The wider plan for the weeks after a round is outbound after you raise.

1. Use a separate sending domain

Never send cold email from the domain your customers and investors already write to. Yahoo’s sender requirements say not to send bulk or marketing mail from the same IPs you use for ordinary user mail, transactional mail and alerts. Each IP and each DKIM domain has its own reputation, and Yahoo says unsolicited commercial email can hurt it.

A subdomain is not a separate domain. Google’s sender FAQ counts every message from a primary domain together. Their example is 2,500 messages from solarmora.com plus 2,500 from promotions.solarmora.com. That is 5,000 from one primary domain, and it is enough for Google to treat you as a bulk sender.

Buy a different registered domain for outbound. Authenticate that one. Also authenticate the domain your site is on. Google’s sender guidelines recommend SPF, DKIM and DMARC on the domain that hosts your public website, so someone else cannot send as you.

• Cold mail goes out from its own registered domain, not a subdomain of the main one
• The website domain has SPF, DKIM and DMARC of its own
• Customer and investor mail stays on the main domain

2. Publish SPF, DKIM and DMARC, and align them

Three DNS records. One job: prove the domain in the From address actually sent the message.

SPF is a TXT record listing who may send for that domain. Google says that if a third-party sender is missing from the record, mail from that sender is more likely to be marked as spam. Put the tool you actually send through on the sending domain’s SPF record. The record on your website domain does not cover a different domain.

DKIM signs the message. For mail to personal Gmail accounts, Google requires a key of 1024 bits or longer, and recommends 2048 bits if your DNS host allows it. Yahoo’s FAQ requires 1024 bits or greater and also recommends 2048.

DMARC is a TXT record at _dmarc. It tells receivers what to do when SPF or DKIM fails, and it is how alignment is checked. For bulk senders, Google and Yahoo both accept a policy of p=none as the minimum. Microsoft’s help page for Outlook.com uses the same example: hostname _dmarc, value v=DMARC1; p=none.

Alignment is the step that gets skipped. The domain in the From header has to match the domain that passed SPF or the domain that signed with DKIM.

• Google, for mail sent directly to personal Gmail accounts: the organisational domain in the From header must align with the SPF organisational domain or the DKIM organisational domain. You set up both, and only one has to align. Google recommends aligning both, and says requiring both may come later. Mail that fails this can be rate-limited with error 4.7.32. That is in the sender FAQ.
• Yahoo accepts relaxed alignment. DMARC has to pass, and the From domain has to align with SPF or DKIM. That is in the sender requirements.
• Outlook.com, once you are over their high-volume line: both SPF and DKIM have to pass, and at least one has to align with the From address. That is on Microsoft’s bounce page.

A usual miss looks like a pass if you only glance at it. SPF passes for the sending tool’s own domain, DKIM is signed by the tool, and the From address is yours. That is not alignment. Sign DKIM as the domain in the From header.

Two more requirements sit on the server, not in your copy. Mail to Gmail has to go over TLS. The sending IP needs matching forward and reverse DNS: a PTR record that points at a hostname, and that hostname pointing back at the same IP. Google and Yahoo both require it. If you send through a normal provider, the IP records are theirs. The domain records are yours.

• SPF on the sending domain includes the tool that actually sends
• DKIM is on, 1024 bits or longer, and signs as the From domain
• _dmarc exists, at least p=none
• A test message shows SPF or DKIM aligned with the From domain. For Outlook.com volume, both pass
• The test went out over TLS

3. Meet Google’s and Yahoo’s bulk-sender rules

Google’s guidelines for personal Gmail accounts, the ones ending in @gmail.com or @googlemail.com, have applied since 1 February 2024. The FAQ says enforcement on mail that misses the rules has been ramping up since November 2025, including temporary and permanent rejections. The rules cover mail you send to personal Gmail accounts, including mail you send from Google Workspace. They do not cover mail that only goes to other Workspace accounts.

The stricter set applies once you send more than 5,000 messages a day to personal Gmail accounts. The FAQ’s definition of a bulk sender is close to 5,000 or more in 24 hours, counted across the primary domain and its subdomains. Cross that line once and Google says the label does not expire.

On top of the authentication in the previous section, Google asks bulk senders to:

• Keep the spam rate reported in Postmaster Tools below 0.30%. The monitoring section is firmer about the target: keep it below 0.10%, and avoid ever reaching 0.30% or higher.
• Support one-click unsubscribe on marketing and subscribed messages, and put a visible unsubscribe link in the body.

Spam rate is calculated daily. Google says a rate above 0.10% already hurts inbox delivery. At 0.30% or higher, a bulk sender is not eligible for mitigation, and stays ineligible until the rate has been below 0.30% for 7 consecutive days.

One-click unsubscribe is a header, not a sentence in the footer. Google wants both of these:

• List-Unsubscribe-Post: List-Unsubscribe=One-Click
• List-Unsubscribe with one HTTPS URL in it

A mailto link does not meet Google’s one-click rule. Transactional mail, such as a password reset, is excluded. Google says the recipient, not Google, decides whether a message feels promotional, and that mail with no easy way out gets reported as spam more often. Take the person off within 48 hours. The FAQ’s enforcement table lists unsubscribe requests that are not handled within 48 hours as a reason mitigation is unavailable.

Google also says it does not track open rates, and that a low open rate is not, by itself, proof of a deliverability problem. Watch the spam rate.

Yahoo’s requirements started in February 2024 as well. For every sender: SPF or DKIM, a spam rate below 0.3%, valid forward and reverse DNS, and mail that follows RFC 5321 and RFC 5322. For bulk senders, Yahoo adds both SPF and DKIM, a DMARC policy of at least p=none that passes, alignment, and an easy unsubscribe. Yahoo’s FAQ says they will not publish the volume that makes you bulk.

Yahoo’s spam rate is measured on mail that reached the inbox, and the line is below 0.3%. Their complaint feedback loop needs DKIM, and it is how a “report spam” comes back to you. For the unsubscribe, Yahoo wants a working list-unsubscribe header. The one-click POST method in RFC 8058 is what they prefer. A mailto header is acceptable to Yahoo, which is looser than Google. Also put a visible unsubscribe in the body. It may go to a preferences page. Honour it within two days. Yahoo says that if you miss those two days, you have not met the requirement.

Cold outbound is commercial mail. Treat it as marketing for these rules. Use the HTTPS one-click headers, so you cover Google and Yahoo’s preferred method, and put a visible opt-out in the body.

• Postmaster Tools spam rate stays below 0.10%, and clear of 0.30%
• Yahoo complaints stay below 0.3% of mail that reached the inbox
• Marketing mail sends List-Unsubscribe-Post: List-Unsubscribe=One-Click and an HTTPS URL in List-Unsubscribe
• The body has a visible way to stop
• Opt-outs are processed within 48 hours

4. Meet Outlook.com’s rules

Outlook.com’s postmaster page says that from 5 May 2025, domains sending over 5,000 emails a day have to authenticate with SPF, DKIM and DMARC. Mail that does not comply goes to junk, and Microsoft says rejection follows until the DNS is corrected.

The support page for bounce 550 5.7.515 defines that line as 5,000 or more messages to Microsoft consumer services (Outlook.com, Hotmail, Live.com, MSN) that share a domain in the From address. After that, every message from the domain has to:

1. Pass SPF and pass DKIM. Both, not one or the other.
2. Publish DMARC. Their example is v=DMARC1; p=none. p=quarantine and p=reject are also a valid policy.
3. Pass DMARC, meaning at least one of SPF or DKIM aligns with the From domain.

The error text is 550 5.7.515 Access denied, sending domain <domain> does not meet the required authentication level. If a tool sends for you, Microsoft says the mail should be DKIM-signed with your domain, your SPF record should include the service, and DMARC should validate as your domain. The page is Fix NDR error 550 5.7.515.

• A message to an Outlook.com account you control shows SPF pass, DKIM pass and DMARC pass
• The From domain is the domain in the DMARC record
• A 550 5.7.515 stops the send until the DNS is fixed

5. Warm the domain, then respect the inbox ceiling

Neither Google nor Yahoo publishes a day-by-day warmup schedule. This page will not invent one.

What Google’s guidelines do say: increase volume slowly, start low, and send at a steady rate rather than in bursts. Do not suddenly double what you were sending. If messages start bouncing or being deferred, cut the volume until the SMTP error rate falls, then raise it slowly, and watch Postmaster Tools while you do. The FAQ defines a new domain as one that has not sent more than 5,000 emails a day to personal Gmail accounts since 1 January 2024, and says those domains are enforced on a faster timetable.

Yahoo’s FAQ says a sudden spike can get a sender flagged as compromised, and tells you to spread the mail out instead.

The ceiling depends on who hosts the inbox. These are ceilings, not targets. Google’s sender guidelines still say to start low.

Google Workspace. Gmail sending limits says the numbers can change without notice, and that they apply over a rolling 24 hours. A paid user can send up to 2,000 messages a day. Mail merge is 1,500. A trial account is 500. External recipients are capped at 3,000 a day. Unique recipients, where each address counts once, are capped at 3,000 a day, of which 2,000 may be outside your domain on a paid account and 500 on a trial. Mail sent by SMTP (POP or IMAP) is limited to 100 recipients in one message. Cross a limit and that user cannot send for up to 24 hours. Mail from an alias counts toward the same user.

Microsoft 365. On the plans in Microsoft’s sending-limits table (Business Basic and Standard, Business Premium, Enterprise E3/E5, Office 365 E1, E3/E5 and F3), the recipient rate limit is 10,000 recipients per day. The per-message recipient limit is customisable up to 1,000. The message rate limit is 30 messages per minute. After the daily limit, the mailbox cannot send until the number of recipients from the past 24 hours drops back under it. Microsoft’s own note on that page: customers who need to send legitimate bulk commercial email should use a provider that specialises in it. A trial tenant is capped at 5,000 external recipients a day under the tenant external recipient rate limit. Mail from the default onmicrosoft.com domain is tighter still: 100 external recipients per organisation in a rolling 24 hours, and further attempts come back as 550 5.7.236. The page is Exchange Online limits.

• The new domain sends a small, steady volume before anyone talks about scale
• Volume does not jump overnight, and it comes down the same day bounces or deferrals appear
• No Workspace inbox is aimed at the 2,000-message ceiling, and no Microsoft 365 inbox is aimed at 10,000 recipients
• Cold mail is not going out from an onmicrosoft.com address

6. Keep the message honest, and the links readable

Google’s formatting rules are the hygiene list. One address in the From header. Do not start a subject with Re: or Fwd: unless it really is a reply or a forward. Do not hide text with HTML or CSS. The display name should say who is writing, not the offer. It should not pretend to be a thread, and it should not include the recipient’s name. Links in the body should be visible, and the reader should be able to tell where they go.

Yahoo’s FAQ lists obfuscated URLs in the body as one reason mail is sent to spam, next to a missing reverse DNS name and mail that is not RFC-compliant.

A short note, with the link written so a person can read it, is the easiest way to stay inside those rules. There is no official number for “plain text gets more replies”, so this page does not claim one. Our free cold email checker flags links, a fake Re: or Fwd: and spam words in a draft. It checks the words, not your sending setup.

Google also says not to buy email addresses, and not to be surprised when people who never asked for the mail report it. Yahoo says not to buy lists, and that unsolicited commercial email can hurt the reputation of the IP you send from. That is the trade cold outbound makes. It is why the sending domain is not your main one.

• One From address, and the display name is a person or the company
• No fake Re: or Fwd:, and no hidden text
• Links are visible and say where they go
• The list was not bought

7. Verify the list, and treat bounces as a stop sign

Yahoo tells senders to watch hard and soft bounces, remove invalid recipients promptly, and stop mailing people who report spam. Google says that if messages start bouncing or being deferred, reduce volume until the error rate drops, then read the individual failures.

Neither of them publishes a safe bounce-rate percentage. If another blog tells you 2%, that number is not from Google or Yahoo. Check addresses before the first send, so a guessed pattern never becomes a bounce, and pause the inbox when bounces show up.

• Every address was checked before it was mailed
• Hard bounces are removed and not retried
• A rise in bounces pauses that inbox the same day
• Spam complaints and opt-outs are suppressed, not left for the next sequence

8. Seed-test placement, then monitor

Before you raise volume, send the real message to inboxes you control: a personal Gmail account, a Yahoo Mail account, and an Outlook.com account. Read where it landed, then read the headers. You want SPF, DKIM and DMARC passing, and the From domain aligned.

On Yahoo, test the unsubscribe in Yahoo webmail. The FAQ says that is where the unsubscribe control shows, once the header is right and the address has enough reputation.

Then leave the monitoring on.

• Postmaster Tools on the domain you authenticate with, the DKIM domain or the SPF return-path domain. Verify it with the DNS record Google gives you. The dashboards cover spam rate, reputation, authentication and delivery errors. Google says a day can be blank when volume is too low, to protect privacy, so an empty chart on day one is not a clean result. The FAQ also points at a compliance dashboard for the sender requirements.
• Yahoo’s complaint feedback loop, so a spam report comes back and that person is removed.
• The bounce text. 550 5.7.515 from Outlook.com means the sending domain missed the high-volume authentication bar.

Google’s troubleshooting section also says to check the domain in Safe Browsing.

• A seed to Gmail, Yahoo and Outlook.com was opened, headers included
• Postmaster Tools is verified on the sending domain
• Yahoo’s complaint feedback loop is on for the DKIM domain
• Someone reads spam rate and bounces on the days you send

9. UK and EU: who you can email, and the opt-out

This is the public guidance, not a legal opinion on your list.

In the UK, the consent rule for unsolicited marketing email is regulation 22 of PECR, and it applies to individual subscribers. The ICO’s guide to business marketing defines a corporate subscriber as a body with its own legal status: companies, limited liability partnerships, Scottish partnerships and some government bodies. Sole traders, and other kinds of partnership, are individual subscribers. PECR treats them like individuals.

For a limited company, the ICO says you do not need PECR consent to send a marketing email. You still must not hide who you are, and you must give a valid address where they can tell you to stop. That duty is regulation 23, and it is not limited to individuals. The ICO says you should honour a corporate opt-out. Where the address belongs to a named person, you can be required to, because their name and work email are personal data.

That personal data needs a lawful basis. Legitimate interests can be it. UK GDPR article 6(1)(f) is the ground, and article 6(11)(a) lists processing necessary for direct marketing as an example of what may count. The ICO’s legitimate-interests guidance is plain that “may” is not “always”. You still do the three-part test: purpose, necessity, and balancing. The ICO says business contacts are more likely to expect a business email, and the impact is often lower, and that there is still no automatic pass. Their table marks legitimate interests as the likely basis for email to business contacts, and not for email to individuals unless you have consent or the soft opt-in.

People can object to direct marketing at any time. Article 21(2) and 21(3) say that if they object, you stop. Article 21(4) says you tell them about that right, clearly and separately from everything else, by the first message at the latest. The ICO says the way out should be easy and free of charge.

If PECR requires consent, legitimate interests cannot stand in for it. That is email to individual subscribers, including sole traders, unless the soft opt-in in regulation 22(3) applies: you got the address during a sale or negotiations for a sale, you are marketing your own similar product, and you offered a free opt-out when you collected the address and in every message since. A cold email to a sole trader is not that.

Outside the UK, do not carry the corporate exception with you. Directive 2002/58/EC, article 13(1), says electronic mail for direct marketing may be allowed only with prior consent. Article 13(5) says that consent rule applies to subscribers who are natural persons, and that each country must still protect the legitimate interests of other subscribers. The choice is national. Article 13(4) is not optional: do not disguise who the message is from, and include a valid address where the recipient can ask you to stop.

• The list is companies, or you have consent for anyone who is a sole trader
• Every email says who you are, in the From line and in the body
• Every email has a working opt-out, and the first email says they can object
• Opt-outs are honoured, including from a named person at a company
• A country outside the UK was checked against that country’s rule

FAQ

What is the cold email deliverability checklist for 2026?

Send from a separate registered domain, align SPF, DKIM and DMARC, keep the Gmail spam rate below 0.10% and clear of 0.30%, keep Yahoo complaints below 0.3%, add one-click unsubscribe, verify the list, and give every recipient an easy opt-out.

Does one-click unsubscribe apply to cold email?

Google requires it on marketing and promotional messages once you send at bulk volume to personal Gmail accounts. A mailto link does not meet Google’s rule. Yahoo requires a list-unsubscribe header for bulk marketing mail, prefers the same one-click method, and also accepts mailto. Cold outreach is commercial mail. Add the HTTPS headers, and a visible opt-out in the body. Google expects the request honoured within 48 hours. Yahoo’s window is two days.

Can we send from a subdomain of our main domain?

Not if the point is to protect the main domain. Google counts a primary domain and its subdomains together toward the 5,000-message bulk line. Use a different registered domain for cold mail, and keep authentication on both.

How many cold emails can one inbox send per day?

There is no official cold-email number. A paid Google Workspace user can send up to 2,000 messages in a rolling 24 hours, and a trial user 500. On the Microsoft 365 plans in Exchange Online’s sending-limits table, the cap is 10,000 recipients a day. Those are ceilings, and they can change. Google still says to start low, avoid bursts, and cut volume when bounces start. Neither Google nor Yahoo publishes a warmup calendar.

Is cold email to UK businesses allowed?

For corporate subscribers, companies, LLPs, Scottish partnerships and some government bodies, PECR does not require consent. You must not hide your identity, and you must offer a valid opt-out. Sole traders need consent or the soft opt-in. A named person’s details are personal data: you need a lawful basis, often legitimate interests after the three-part test, and you must stop if they object. Other European countries set their own rule under Directive 2002/58/EC.

Want buyers to find you first?

Ignura is an AI-native agency that automates your GEO and SEO. You approve what goes out. We don’t set up sending domains or run sequences. We work on the other side of it: the pages buyers find when they search you on Google and in AI answers. See AI search, technical SEO and content. Plans are on the pricing page.

Book your free Growth Check