Why Are My Cold Emails Going to Spam? How to Find the Cause

Your cold emails (the outbound prospecting emails your SDRs or founders send to people who haven’t opted in) used to get replies. Now the sequences run, the send count climbs, and the replies have all but stopped. Someone sends a test to their own inbox, it lands fine, and the team concludes the copy must be the problem. So the templates get rewritten for the third time this quarter.

Often the copy isn’t the problem at all. Nobody is reading the emails because they’re sitting in spam or junk. That happens more than most teams think. Validity’s 2025 Email Deliverability Benchmark, built on seed-test data from 2024, found that one in six legitimate marketing emails never reached the inbox, and that Microsoft inboxes placed only 75.6% of mail in the inbox. Cold email starts from a weaker position than that: no consent, colder lists, fewer replies. And the rules got stricter. Microsoft began rejecting non-compliant bulk mail to Outlook.com in May 2025, and Gmail started “ramping up its enforcement” in November 2025.

This guide shows you the four layers mailbox filters actually judge, how to tell which one broke with tools you already have, what the Gmail, Yahoo and Outlook rules really say about B2B inboxes, and a 30-day plan back to the inbox. It ends with a worked sample recovery you can copy.

What are the signs your cold emails are landing in spam?

Replies collapse while sends hold steady, and the pattern of where and when it happened tells you which layer broke. A sudden cliff points to setup. A slow slide points to volume, list or relevance.

Spam placement is invisible from the sender’s side. Your sending tool reports the email as “delivered” whether it landed in the inbox, the spam folder or a quarantine queue run by the prospect’s IT team. So you have to read the problem from its side effects: replies, bounces, the gap between providers, and a couple of direct tests.

Find the first row in the table that matches what you see. Then work on that layer before anything above it.

The red-flag lines are practitioner rules of thumb, not limits published by Google or Microsoft (except the 0.1% and 0.3% spam rates, which come from Google’s own guidelines). Use them to decide where to look first, not as pass-or-fail scores.

Setup signs: the cliff

Authentication problems show up as a cliff. Replies are normal on Monday and near zero on Tuesday. The cause is usually a change: someone edited the DNS, connected a new sending tool that signs mail with its own domain, moved the website to a new host, or added a marketing platform that now shares the domain. Open the full headers of an email you sent to a Gmail address (“Show original” in Gmail) and look for three words next to SPF, DKIM and DMARC. Anything other than “pass” is your first job.

A Gmail-versus-Outlook gap belongs here too. When Gmail prospects still reply and Outlook prospects have gone silent, the most common reason is that Microsoft has stopped accepting your mail, or is filing it as junk. Microsoft’s rejection message for non-compliant bulk senders reads “550 5.7.515 Access denied”, and it shows up as a bounce in your sending tool, if anyone is looking at bounces.

Volume and list signs: the slow slide

Volume and list problems build slowly. A new inbox sending 100+ cold emails a day from its first week, a list bought last quarter and never verified, a sequence that adds a fifth and sixth follow-up: each one chips at your reputation until placement tips over. The only direct measure is an inbox placement (seed) test: you send to a set of test inboxes across providers and see where each one lands. It’s the only number that shows spam directly rather than by inference.

Relevance signs: when it isn’t deliverability at all

Sometimes the email arrives and nobody wants it. If seed tests show 85%+ in the inbox and replies are still under 1%, the problem is the message and the list, not the filter. Watch the spam rate in Google Postmaster Tools, which counts recipients who marked your mail as spam. And stop reading open rates as a signal: privacy features in Apple Mail and many security gateways load tracking pixels automatically, so opens can look healthy while the email sits unread in junk.

Do Gmail’s sender rules apply to B2B inboxes?

The written rules cover mail sent to personal Gmail and Outlook.com addresses, not your prospects’ company inboxes. But business inboxes filter on the same signals, so treat the rules as the floor for every cold email you send.

This is the question most cold email guides skip, and it matters, because almost every B2B prospect has a work address on Google Workspace or Microsoft 365, not an @gmail.com address.

What Google requires

Google’s Email sender guidelines set requirements for everyone who sends to personal Gmail accounts (addresses ending in @gmail.com or @googlemail.com). All senders need SPF or DKIM, valid forward and reverse DNS, a TLS connection, and a spam rate in Postmaster Tools below 0.3%. Senders of about 5,000 or more messages a day must also set up SPF and DKIM and DMARC, align the From domain with SPF or DKIM, and offer one-click unsubscribe on marketing mail. Google’s advice is to keep the spam rate below 0.10% and “avoid ever reaching a spam rate of 0.30% or higher”.

The sender guidelines FAQ adds two details that matter for cold email. First, “Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic”, with temporary and permanent rejections for messages that fail. Second, the 5,000-message count covers every message sent from the same primary domain. If marketing, product notifications and three SDRs all send from yourcompany.com, they add up.

What Yahoo and Microsoft require

Yahoo’s Sender Hub asks all senders to authenticate with SPF or DKIM and keep their spam rate below 0.3%, and asks bulk senders to honour unsubscribes within 2 days.

Microsoft went furthest. In its April 2025 announcement, Outlook said domains sending more than 5,000 emails a day to its consumer service (Outlook.com, Hotmail and Live addresses) must pass SPF, DKIM and DMARC, with a DMARC policy of at least p=none, aligned with SPF or DKIM. An update later that month moved from junk-foldering to outright rejection: from 5 May 2025, non-compliant messages are rejected with “550 5.7.515 Access denied”.

And what that means for business inboxes

Google’s FAQ is explicit: the guidelines “don’t apply to messages sent to Google Workspace accounts”. Microsoft’s rules cover its consumer service. So, on paper, a cold email to a prospect at their company address isn’t bound by these written rules.

In practice, it makes little difference. Validity’s 2025 benchmark measured business hosting platforms separately and found Office 365 placing 85.2% of mail in the inbox and Google Workspace (still “Google Apps” in the report) 83.1%, close to the consumer providers. Validity’s explanation is simple: the filtering technology is similar to the consumer platforms, and business admins can add their own custom rules, “usually stricter” than the defaults. Many companies also route mail through a third-party security gateway before it reaches the inbox at all.

So the safe reading is this: the written rules decide which requirements a mailbox provider can enforce against you by name. The filters judge every sender on the same signals anyway. Authentication, alignment, low complaints and an easy way to opt out are the floor for cold email, whatever your volume.

Is it my setup, my volume or my message?

Check in order, from the bottom up: setup, then volume, then list, then relevance. Each layer only matters once the one beneath it passes, so fixing the top layer first wastes weeks.

Teams usually start at the top because it’s the most visible layer. Rewriting a subject line feels like progress. But if DMARC fails, the filter has decided before it reads a word.

Layer 1: Setup

Setup is identity. It answers one question for the receiving server: is this email really from who it says it’s from? Three DNS records do the work. SPF lists the servers allowed to send for your domain. DKIM adds a signature that proves the message wasn’t changed. DMARC tells receivers what to do when the first two fail, and requires that at least one of them matches the domain in the From line (“alignment”).

Most cold email setups break on alignment, not on missing records. Your Google Workspace or Microsoft 365 mailboxes are signed correctly, but your sequencing tool sends through its own servers with its own DKIM signature, so DMARC fails for every email it sends. Check each tool that sends as your domain, not just the mailbox provider. Also check custom tracking domains: a click-tracking link on a shared domain borrows that domain’s reputation.

Layer 2: Volume

Volume is behaviour. Filters compare how much a domain and an inbox send against what they’ve sent before. A new inbox that sends 120 cold emails on day one looks like a compromised account or a spam operation, whatever the content. The section on sending limits below covers the numbers: how fast to ramp, where to cap, and why cold email belongs on its own domain.

Layer 3: List

List quality is the next signal. Every hard bounce tells the receiving server that you’re mailing addresses you never confirmed, which is exactly what spammers do. Bought or scraped lists, contacts who changed jobs, and catch-all domains all add bounces. Verify every list before it enters a sequence, track bounce rate by data source, and drop the sources that bounce.

Layer 4: Relevance

Relevance is the recipient’s verdict. Complaints, deletes without reading, and replies all feed back into your reputation. Buyers are not shy about it. In a Gartner survey of 632 B2B buyers published in June 2025, 73% said they actively avoid suppliers who send irrelevant outreach. In an inbox, the spam button is the fastest way to avoid you, and every click on it lands on your domain’s record.

Why “spam words” come last

Most top-ranking guides still open with lists of trigger words. Modern filters weigh who you are and how recipients react far more than any single word in the body. Words matter mostly at the edges: misleading subject lines, heavy HTML, several links, images instead of text, and attachments on a first email. Fix those once your setup, volume and list are clean, and treat them as part of the message, not the main cause.

How many cold emails per inbox per day is safe, and should we use a separate domain?

Start a new inbox at 5–10 a day, ramp over 4–6 weeks, cap each inbox at about 30–50 a day, and add inboxes on a separate sending domain rather than pushing one inbox harder.

There is no limit published by Google or Microsoft for cold email, and anyone who quotes one as an official rule is guessing. What exists is a ramp that sending platforms recommend from their own data, and a cap practitioners have settled on because it keeps placement stable.

The ramp

Instantly’s Cold Email Benchmark Report 2026, built on billions of cold email interactions across its platform, advises starting new sending domains at 5–10 emails a day and increasing gradually over 4–6 weeks, while keeping bounces below 2%. The logic is the same one filters use: a sender that grows steadily looks like a real person building a business; a sender that appears overnight at full volume doesn’t.

The cap

Once an inbox is warm, keep it at about 30–50 cold emails a day. That number is a rule of thumb, not a provider limit. It leaves room for normal one-to-one mail from the same inbox, and it keeps the damage contained if one list or one sequence goes wrong. To send more, add inboxes. Three inboxes at 40 a day are far safer than one inbox at 120.

The separate domain

Send cold email from a secondary domain, not the one your company runs on. A lookalike such as “getquillstack.com” or “quillstack.io” for a company at quillstack.com, with its own SPF, DKIM and DMARC records, a simple page or redirect to your main site, and its own warmed inboxes. The point is containment: if cold email collects complaints, it never touches your invoices, password resets, product notifications or marketing newsletters. Remember Google’s count, too: the 5,000-a-day threshold is measured per primary domain, so separating streams also keeps marketing and cold sending from adding up.

Two cautions. A secondary domain isn’t a disguise: the emails should still say clearly who you are and offer an easy opt-out. And don’t rotate through dozens of throwaway domains to stay ahead of filters; that’s the pattern filters are built to catch.

How do we get out of spam and stay out?

Pause, fix the lowest broken layer, restart small on clean infrastructure, and ramp only while placement and complaints stay healthy. Recovery is mostly patience applied in the right order.

Step 1: Pause and check setup

Stop cold sends while you diagnose, because every email sent into spam makes the hole deeper. Check SPF, DKIM and DMARC for every tool that sends as your domain, confirm alignment in real message headers, look up your domain and sending IPs on the major blocklists, and open Google Postmaster Tools for your spam rate and compliance status.

Step 2: Rebuild on a separate domain

Move cold sending off your main domain. Set up one or two secondary domains with full authentication and a handful of inboxes each, and start warming them. Leave the main domain to rest and recover on normal one-to-one and transactional mail.

Step 3: Verify the list

Run every contact through verification before it enters a sequence. Remove hard bounces, role addresses you can’t justify, and contacts from sources that bounced badly. Track bounce rate by source from now on.

Step 4: Restart small, with a better reason to write

Restart at 5–10 emails per inbox a day. Send plain text with one link at most, no attachments, and a clear line telling people how to opt out. Tighten the segment so every recipient has an obvious reason to care, and lead the email with that reason. Instantly’s 2026 data found its best campaigns keep emails under 80 words.

Step 5: Ramp and watch

Increase volume weekly toward the cap, but only while the weekly seed test holds and the spam rate stays under 0.1%. If either slips, hold volume for a week and look at which segment or sequence caused it.

Worked example: a sample deliverability recovery

Here’s what this looks like for a fictional Series A company, “Quillstack,” selling accounts-payable automation software, with three SDRs running sequences from a sales engagement tool connected to HubSpot. The numbers are illustrative sample data, built to show the method.

At week 0, Quillstack’s SDRs were sending 360 cold emails a day from three inboxes on the company’s main domain, and booking four meetings a month. The team’s plan was a new data provider and a fourth SDR.

The diagnosis took a week. Layer 1 failed first: the domain had no DMARC record, and the sequencing tool signed mail with its own DKIM domain, so nothing aligned. Layer 2 failed next: 120 emails per inbox a day, from inboxes that also sent invoices and onboarding mail. A seed test put only 48 of 100 emails in the inbox, with the worst results at Microsoft. The list was third: a bought list from the previous quarter was bouncing at 6.4%.

Quillstack added DMARC and aligned DKIM for the sequencing tool, moved cold email to two secondary domains with eight new inboxes, warmed them for four weeks, verified and trimmed the list, and rebuilt the first email around one finance-team problem in under 80 words. By week 6, total sends were a third lower (240 a day instead of 360), yet meetings nearly tripled. Nothing about the product or the offer changed. The emails were simply being seen, by people who had a reason to read them.

What reply rate is normal for cold email now?

About 3–4% on average, 5.5% or more for the top quarter of senders, and 10% or more for the best. Under 1% usually means a deliverability or relevance problem, and the seed test tells you which.

Benchmarks are only useful once you know what they measure. Instantly’s 2026 report defines reply rate as all replies, including replies to follow-ups, divided by total emails sent. On that definition, the platform average was 3.43%, the top quartile reached 5.5% or more, and the top 10% of senders passed 10.7%. Note that Instantly is a cold email platform reporting its own users’ data, so treat the numbers as a reference point, not an industry census.

Two other findings from the same report are worth acting on. First, 58% of all replies came from the first email in a sequence. If your first email is generic, the follow-ups are mostly cleaning up. Second, the best-performing campaigns kept emails under 80 words and tested new messaging weekly.

Why open rates no longer count

For years, open rate was the first number on every cold email dashboard. It no longer measures anything reliable. Privacy features in Apple Mail and many corporate security gateways load tracking pixels automatically, so emails register as “opened” whether a human saw them or not, including emails that landed in spam. Drop open rate as a success measure and use three numbers instead: seed-test placement, reply rate, and positive replies that turn into meetings.

Reading your own reply rate

Under 1% is the rule-of-thumb line where you should stop rewriting and start testing. Run a seed test first. If placement is under 80%, it’s a deliverability problem: go back to layers 1–3. If placement is 85% or better, the emails are arriving and people are choosing not to answer: that’s relevance, and the fix is the list and the reason you’re writing, not the filter.

Putting it to work: 30 days back to the inbox

You can run the whole plan in four weeks with one owner, usually the head of sales development or RevOps, plus an hour or two from whoever manages your DNS. The output is clean authentication, a separate sending setup, a verified list and a weekly habit of checking placement, the foundation for outbound plays that actually reach buyers.

Week 1: Stop and check

Pause cold sends. Check SPF, DKIM and DMARC for every tool that sends as your domain, and confirm “pass” on all three in real message headers. Look up blocklists. Set up Google Postmaster Tools if you haven’t, and note your spam rate. Run a baseline seed test so you know where you’re starting.

Week 2: Rebuild

Register one or two secondary domains, authenticate them fully, create inboxes and start warming. Verify the entire list and remove what bounces. Agree the caps: 5–10 a day to start, 30–50 at most per warm inbox.

Week 3: Restart small

Restart sends at 5–10 per inbox a day on the new domains. Plain text, one link at most, an opt-out line. Narrow the first segment to the accounts with the clearest reason to care, and rewrite the first email around that reason in under 80 words.

Week 4: Ramp and watch

Ramp weekly toward the cap. Run a seed test every week and log placement by provider. Review spam rate, bounces and replies by segment. Hold volume whenever placement or the spam rate slips.

The checklist

• SPF, DKIM and DMARC pass and align for every tool that sends as your domain
• No listings on the major blocklists; Postmaster Tools set up
• Cold email moved to a separate, fully authenticated domain
• New inboxes warmed from 5–10 a day; caps written down
• Every list verified before it enters a sequence; bounces under 2%
• Plain-text first emails under 80 words, with a clear opt-out line
• Weekly seed test running; placement logged by provider
• Spam rate under 0.1% in Postmaster Tools

Done means 85%+ inbox placement on seed tests, bounces under 2% and a spam rate under 0.1%. The first two are rules of thumb; the last is Google’s own guidance. If you’d rather have someone run this with you, that’s exactly what the free roadmap call is for.

Sources

• Google, Email sender guidelines — requirements for senders to personal Gmail accounts
• Google, Email sender guidelines FAQ — enforcement from November 2025; Google Workspace exemption
• Yahoo Sender Hub, Best practices — sender requirements
• Microsoft Defender for Office 365 blog, Outlook’s new requirements for high-volume senders (2 Apr 2025, updated 29 Apr 2025) — 5,000+ emails a day to Outlook.com
• Validity, 2025 Email Deliverability Benchmark (Mar 2025) — seed-test data, 2024
• Instantly, Cold Email Benchmark Report 2026 (updated 12 Jan 2026) — billions of cold email interactions on its platform
• Gartner, Sales survey finds 61% of B2B buyers prefer a rep-free buying experience (25 Jun 2025) — 632 B2B buyers