Why your cold email lands in spam, and what actually fixes it
Here is the uncomfortable part of outbound that few agencies mention in their pitch: a large share of cold email never gets seen by a human. Not ignored. Not deleted. Simply filtered out before it reaches the inbox.
We send outreach for a living, so we spend an unusual amount of time staring at deliverability data. The picture it paints is consistent. When a campaign fails, the copy gets the blame, but the delivery layer is usually the culprit. This guide covers the four things that decide inbox placement, in the order they matter.
1. Authentication comes first, always
SPF, DKIM and DMARC are three DNS records that prove an email actually comes from the domain it claims to. Google and Microsoft have both tightened their rules for bulk senders since 2024, and mail without proper authentication now gets treated roughly the way an unsigned cheque would.
The check takes 2 minutes: send yourself an email from your sending address, open the technical headers, and look for spf=pass, dkim=pass and dmarc=pass. Three passes and your foundation holds. Anything else and there is no point tweaking subject lines yet.
The mistake we see most: a company sets up SPF for its email platform, then adds a CRM, a support tool and a newsletter service over the years without updating the record. One misconfigured include and every campaign inherits the damage.
2. Reputation is earned slowly on SMTP, or skipped entirely with an API gateway
Mailbox providers score every sending domain and mailbox on history: how much it sends, how quickly volume grows, how often recipients open, reply, delete or complain. A brand-new SMTP mailbox that fires off 500 emails on day one looks exactly like a spammer, because that is exactly what spammers do.
The traditional fix is warm-up: start at a handful of emails a day, grow volume gradually over several weeks, and hope nothing breaks. It is slow and it is fragile — and it is a consequence of using SMTP, a protocol designed for one-to-one email, to do a job it was never built for.
We take a different route. Our outreach is delivered through a professional API-based sending gateway — the same class of infrastructure large SaaS platforms use to ship hundreds of thousands of emails a day — on a dedicated IP allocated to your account, with your authenticated sending subdomain on top. Because the gateway carries the sending reputation and is already trusted by the major inbox providers, there is no client-side mailbox to warm up. Campaigns run at full volume from day one, isolated from your corporate domain, while your everyday Gmail or Outlook account is only used to receive replies. Domain authentication (SPF, DKIM, DMARC) still has to be right, and genuine replies remain the strongest positive signal you can generate, but the multi-week SMTP ramp is not part of the timeline.
3. List quality is a delivery problem, not just a targeting problem
Every bounced address tells the receiving server you do not know who you are writing to. A bounce rate above roughly 2% starts to hurt. Above 5%, you have a problem that copy cannot repair.
Verify every address before it enters a sequence. Drop the catch-alls you cannot confirm. Resist the temptation of the 50,000-row purchased list, because 10 verified decision makers with a plausible need will outperform it while leaving your domain intact.
4. Copy matters, but not the way people think
Spam filters read your emails, and they have seen every trick. Image-heavy messages, link shorteners, attachment on first contact, WRITING IN CAPS, the word free with an exclamation mark. All of it raises the score against you.
Plain text wins. Short, specific, one link at most, written the way you would write to a colleague you respect. Conveniently, that is also the style human recipients respond to. The filter and the reader want the same thing, which makes this the rare case where you do not have to choose.
Why we send from your domain and not ours
Some agencies run campaigns from domains they own, so their infrastructure takes the reputational risk instead of yours. It sounds protective. In practice it means prospects see an unfamiliar address, replies live in mailboxes you cannot access, and the sender reputation being built each month belongs to someone else. When the contract ends, all of it evaporates.
Our model is the opposite: dedicated sending subdomains under your brand, isolated from your everyday email, authenticated and delivered through our API-based sending gateway, monitored for as long as campaigns run. If placement drops below the agreed threshold, sending pauses and lost volume is compensated. The reputation stays yours either way.
The short version
Fix authentication before anything else. Warm up new domains for weeks, not days. Verify every address. Write plainly. And be careful with anyone who wants to send your outreach from a domain you do not own, because the asset being built should be yours.
