Cold email automation that stays out of spam
Cold email still works — it remains the cheapest way for a B2B business to start conversations with people who've never heard of it. But the deliverability environment in 2026 is the harshest it's ever been: Google and Yahoo enforce authentication and complaint thresholds mechanically, and one careless month can put your domain in a hole that takes a quarter to climb out of. Automating outreach multiplies whatever you're doing — including the mistakes. Here's how to automate it so the thing you scale is deliverability, not damage.
The three-second model of spam filtering
Mailbox providers score every message on essentially three questions:
- Is the sender authenticated? SPF, DKIM and DMARC — DNS records proving the mail really comes from your domain. Since 2024, bulk senders without them don't get degraded, they get rejected.
- Does this sender have a good history? Domain and IP reputation, built from bounce rates, complaint rates, and engagement. New domains have no history, which is why volume must ramp.
- Do recipients want it? Spam-button presses are the nuclear metric. Google's enforced threshold is a 0.3% complaint rate — three angry recipients per thousand — and disciplined senders stay under 0.1%.
Every practice below is just a way of scoring well on these three.
Rule 1: never send cold email from your main domain
Your primary domain carries your transactional email — receipts, password resets, replies to customers. Cold outreach will generate bounces and complaints; that's the nature of unsolicited mail even done well. Put it on a separate sending domain (a variant of your name, clearly yours) so outreach reputation and business-critical reputation never share a fate. This is the one mistake you can't fully undo, and it's also the tell of a serious outreach platform: Airocrew, for instance, provisions every client a dedicated, authenticated sending domain rather than touching their real one — whatever stack you use, insist on the same separation.
Rule 2: warm up, then respect daily caps
A fresh domain sending 500 emails on day one is indistinguishable from a spammer, because that's exactly what spammers do. Reputation is built by ramping: start around 10–15 emails a day and add a handful each day, watching bounces as you go. Steady state for a small business is 30–100/day per mailbox — and that's plenty: at a realistic 2–5% reply rate, 50 well-targeted emails a day is 25–60 conversations a month, which is more pipeline than most small teams can even service.
The cap must be enforced by the system, not by intention. A good pipeline refuses to send past the daily limit; a bad one lets a big list override your judgment.
Rule 3: verify before you send
Bounce rate is the fastest way to torch a new domain — above ~5% hard bounces and providers assume you bought a list. Before an address ever gets a send:
- Syntax and domain checks — free and instant; no excuse to skip.
- MX lookup — does the domain even receive mail?
- Skip role addresses (info@, contact@) unless you've consciously decided otherwise — they bounce more, convert worse, and complain more.
- When in doubt, don't send. An unverifiable address is a no, not a maybe. Missing one prospect costs nothing; a bounce spike costs the domain.
Rule 4: suppression is sacred
One list, checked before every single send, of everyone who unsubscribed, bounced, or complained — and nothing ever removes an address from it. This is simultaneously a legal requirement, a deliverability requirement, and basic decency:
- CAN-SPAM (US) requires a working unsubscribe honored promptly, plus your physical postal address in every message. GDPR and Canada's CASL are stricter about B2C; know which applies to your market.
- One-click unsubscribe headers (RFC 8058) are mandatory for bulk senders at Gmail/Yahoo — the "Unsubscribe" link the mailbox UI itself shows. A recipient who can't find unsubscribe presses "spam" instead, and that trade is catastrophic at a 0.3% threshold.
If you automate nothing else, automate suppression — it's the guardrail with legal teeth. (The general case for enforcing rules in code rather than good intentions: What are autonomous AI agents?)
Rule 5: automate the discipline, keep the judgment
The parts of outreach that fail from human inconsistency are exactly the parts to hand to software: the warm-up ramp, the daily cap, verification, suppression checks, send-time spacing, and the follow-up sequence (where half the replies live — 2–3 touches, spaced days apart, stopping instantly on any reply). The parts that fail from lazy automation are the parts to keep thinking about: who you're emailing (a tight, researched list of 50 beats a scraped 5,000) and what you're offering them. Personalization theater — "I loved your recent LinkedIn post" — is now so common it reads as spam; relevance beats flattery. One honest sentence about why this company, then a clear, small ask.
The economics, briefly
Done right, automated outreach costs a few dollars a day of sending infrastructure and produces B2B leads at a fraction of what the equivalent pipeline costs in ads or agency retainers — we put real numbers on this in Hiring vs. automating. Done wrong, it costs a domain, a quarter of deliverability, and sometimes a legal letter. The difference between the two isn't cleverness — it's whether the boring rules above are enforced every day without exception. Which is, conveniently, the one thing software never gets tired of.