Cold email deliverability: warm-up, SPF, DKIM and DMARC

Deliverability is whether your email reaches the inbox, the spam folder, or nowhere at all. For outreach it matters more than the wording: the best email ever written does nothing in spam. The good news is that most of it comes down to a few settings and a little patience.

What mailbox providers are looking for

Gmail, Outlook and Yahoo are trying to answer one question about every message: did the person who appears to have sent this really send it, and do the people receiving it want it? They judge the first with authentication records on your domain, and the second with your history: how many people open, reply, delete unread or press report spam. Gmail and Yahoo now expect senders to authenticate their mail, to offer one-click unsubscribe and to keep spam complaints low, and Google publishes 0.3% as the rate to stay under.

SPF, DKIM and DMARC, briefly

• SPF is a DNS record listing the servers allowed to send mail for your domain. If you send through Google Workspace, Google's servers need to be on it.
• DKIM signs each message with a key published in your DNS, so the receiver can check the message was not altered and really came from your domain.
• DMARC tells receivers what to do when a message fails those checks, and asks them to send you reports. Start with a policy of none, which only reports, and tighten it once your legitimate mail all passes.

If you use an address at gmail.com or outlook.com, the provider runs these for you. If you use your own domain, check them before you send anything. Speek checks all three when you connect a mailbox and shows the exact record to add if one is missing.

Why a new mailbox needs to warm up

A mailbox that sent five emails last week and three hundred today looks like it has been taken over. Providers trust a sender gradually, as they watch people engage with its mail. So start small and grow steadily. Speek does this for you: a newly connected mailbox sends 10 emails on its first day and 5 more each day after that, up to 300 a day on Gmail or 250 on Microsoft 365. With several mailboxes connected, each send goes from the one with the most room left that day.

Habits that keep you out of spam

• Send from a real person's mailbox, not a no-reply address and not a shared sending service.
• Write plain, short messages. No images, no attachments and few links in a first email.
• Make leaving easy. Every email should carry an unsubscribe link and the one-click unsubscribe header, and an opt-out should be honoured everywhere, at once.
• Watch your bounces. A high bounce rate tells providers your list is poor. Speek takes a bounced address off every list and pauses a mailbox if more than 5% of its last week's sends bounced.
• Contact fewer, better-matched people. Relevance is the best deliverability tool there is: people who want your email open it and reply. Here is how to find leads that fit.

Signs you have a deliverability problem

• Replies stop while nothing else has changed.
• Bounces climb, which usually means the list is old or guessed.
• Test messages land in spam when you send to a friend's Gmail or Outlook address.
• Google Postmaster Tools shows your domain's spam rate rising, once you send enough mail to Gmail for it to report.

If you see these, slow down rather than push on. Send fewer, better-matched emails for a couple of weeks, check your records again, and remove anyone who has not engaged.

The law, briefly

Rules on business email differ by country. Many require you to say who you are, give a way to opt out and honour it promptly, and some, like the US CAN-SPAM Act, require a postal address in commercial email. In the UK and EU, writing to a business about something relevant to its work is treated differently from writing to a private person. If you are unsure, ask someone who knows your market's rules before you start.

This guide is general information, not legal advice.