Google and Microsoft both tightened bulk-sender enforcement, and the tolerance for unauthenticated, high-volume cold email is now effectively zero. Landing in the inbox in 2026 is a setup problem before it is a copy problem.
This is the checklist we run before any campaign leaves our infrastructure.
1. Separate your sending domains
Never send cold outbound from your primary domain. Register lookalike domains (yourcompany-hq.com, getyourcompany.com), point them at your main site, and use those for outbound. If reputation is damaged, your invoices and support email keep flowing.
2. Authenticate all three records
- SPF — one record listing every service that sends on your behalf; keep it under ten DNS lookups.
- DKIM — enabled and signing on every sending platform.
- DMARC — start at p=none with reporting, review two weeks of aggregate reports, then move to quarantine.
- Optional but useful: BIMI once DMARC is enforced, and MTA-STS for transport security.
3. Warm up before you send anything real
Scale with more mailboxes, never with higher volume per mailbox. Two mailboxes at 40 beat one at 80 every time.
| Week | Emails per mailbox per day | Notes |
|---|---|---|
| 1 | 5–10 | Warm-up network traffic only |
| 2 | 15–25 | Introduce a small real segment |
| 3 | 30–40 | Watch bounce and complaint rates daily |
| 4 | 40–50 | Steady state — do not exceed per mailbox |
4. Clean the list before every campaign
- Verify within seven days of sending — older verification is not reliable.
- Remove role addresses (info@, sales@, support@) unless deliberately targeting them.
- Apply your global suppression list across every tool.
- Segment by domain provider; Microsoft-hosted domains typically need lower volume than Google-hosted ones.
5. Copy choices that affect placement
- One link maximum in the first email, none if you can avoid it.
- No tracking pixels on the first touch — open tracking hurts placement more than the data is worth.
- Plain text formatting; skip images, HTML templates and heavy signatures.
- A real, working unsubscribe line. It reduces complaints, which matter far more than opt-outs.
6. Watch these numbers
| Metric | Healthy | Stop and fix |
|---|---|---|
| Bounce rate | Under 3% | Over 5% |
| Spam complaint rate | Under 0.1% | Over 0.3% |
| Reply rate | Above 3% | Under 1% |
| Inbox placement (seed test) | Above 85% | Under 70% |
Recovering a damaged domain
Stop sending entirely for two to four weeks, fix authentication and list hygiene, then restart at week-one warm-up volumes. There is no shortcut — and this is precisely why the setup work above is cheaper than the recovery.
Frequently asked questions
How many mailboxes do I need?
Divide target daily volume by 40. For 400 emails a day, plan for ten warmed mailboxes across two or three sending domains.
Does email warm-up software still work?
It helps establish baseline engagement on a new mailbox, but it cannot compensate for a bad list or missing authentication. Treat it as one step, not a solution.
Should I use open tracking?
Not on cold outbound. Tracking pixels add a known spam signal and open data has become unreliable due to privacy proxies. Measure replies instead.
Do you manage this for customers?
Yes — the GTM Automation Engine includes domain setup, warm-up, ramp management and monitoring alongside list sourcing and sequencing.
Let the engine handle infrastructure
Domains, warm-up, ramp and monitoring managed alongside verified list data and AI sequencing.
See the GTM engine