Cold Email: The Complete Operator's Guide

Cold email is a one-to-one message sent to someone you have no prior relationship with, written to start a business conversation. It stops being cold email and becomes spam when it is sent to people with no reason to care, hides who it is from, or gives no way to opt out.

The line is both legal and practical. Legally, it is CAN-SPAM, GDPR, PECR and CASL, which we cover below. Practically, it is the complaint rate: if enough recipients mark you as spam, inbox providers stop delivering your mail regardless of the law. That second line is the one that ends most cold email programs, and it leads to the thesis of this guide: infrastructure decides the outcome more than copy does. A good message from a bad domain is never read. An average message from a well-built one gets a fair hearing. So the order here follows the order you should work in: infrastructure first, then the list, then the message, then the follow-up, then measurement.

The infrastructure layer: domains, mailboxes and why it comes first

Cold email infrastructure is three things: the domains you send from, the mailboxes on those domains, and the DNS records that prove the mail is yours.

Use dedicated sending domains, never your primary one. Your primary domain carries your invoices, your client replies and your reputation. A spam complaint wave on a cold campaign should cost you a disposable domain, not the address your clients write to. A common pattern is a lookalike of your brand name, such as a variation of your company name, that redirects to your real site.

Do not pay a premium for an aged domain. A lot of advice treats domain age as a deliverability asset. Warmup Inbox tested it directly across 4,406 inboxes with validated registration dates over a 30-day placement window.

The correlation between age and placement was -0.096, close to zero. Age is not a substitute for warming: a new domain that is properly warmed performs like an old one, and an old domain that is not warmed gets no protection from its age. We cover the full setup in the sections below.

Keep each mailbox's volume low. Google Workspace allows up to 2,000 messages per user per day, with a lower 1,500 limit for mail merge, and exceeding its limits suspends sending for up to 24 hours. That is a platform ceiling, not a target. Cold senders spread volume across many mailboxes so no single address or domain carries a suspicious load. AiSDR's published plans, for what it is worth, scale as multiples of three mailboxes per domain: 1 domain with 3 mailboxes on its Solo plan, 2 domains with 6 on Explore, and 6 domains with 18 on Scale.

How many domains do you need?

Work backward from the volume you want to send.

That is a lot of infrastructure for 1,000 emails a day, which is the point. The sheer number is why most small senders either run far lower volumes on well-targeted lists or use a managed platform. It is also a reminder that volume is a cost you pay in domains, mailboxes and monitoring, not a free dial.

SPF, DKIM, DMARC and one-click unsubscribe

Three DNS records tell inbox providers your mail is authorized. SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature proving the message was not altered. DMARC tells receivers what to do when SPF or DKIM fails and gives you reports. None of this is new, but the major providers have turned it from advice into enforcement.

Two honest notes. First, most cold senders sit below 5,000 emails a day to any one provider, so the formal bulk-sender rules may not strictly bind you. Authentication is still the baseline reputation signal every provider checks, so configure it on every sending domain regardless. Second, one-click unsubscribe is a bulk-marketing requirement, but a visible, honored opt-out in every cold email is both good practice and the cleanest way to keep complaints down. People who cannot find an unsubscribe link click "report spam" instead, and that is the signal that does the damage.

The volume ramp: week one versus week eight

A new domain that sends hundreds of emails on day one looks exactly like spam. Warming is the process of building a sending history gradually, and the evidence on how long it takes is consistent: Microsoft's own guidance puts it at four to eight weeks, and four to six weeks is what we use in practice. In Saleshandy's analysis of 53.1 million cold emails, a warmed, authenticated domain reached 87% inbox placement against 12% for an unwarmed domain.

A sudden spike in sending velocity is one of the clearest signals providers watch for, so ramp slowly even on a domain that has already been warmed. The 2% bounce and 0.1% complaint thresholds are tighter than Google's 0.3% ceiling on purpose: by the time you are near Google's limit, you are already in trouble.

List building: sourcing, verification and the cost of a bad list

Infrastructure gets you into the inbox. The list decides who is there.

Sourcing. Lists come from data providers, professional networks, public registries and your own research. Whichever you use, the discipline is the same: define the buyer in two sentences first, then build the list to match, not the other way around. The tighter the targeting, the lower the complaint rate and the higher the reply rate.

Targeting matters more than most people expect. In Belkins' analysis of 7.5 million cold emails, reply rate varied sharply by who was on the other end.

By seniority, founders and owners replied at 0.57%, C-level executives at 0.42% and VPs at 0.32%. Smaller companies and the people who own them reply more.

Verification. Every address should be verified before sending, because bounces damage the reputation you just spent weeks building. Keep the bounce rate under 2%. List decay is real but poorly measured: estimates for how fast business email data goes stale start around 22.5% a year (a figure attributed to HubSpot Benchmarks in ZoomInfo's analysis) and run much higher in other vendors' analyses, but none of them traces to a study we could verify, so do not rely on a single number. Verify before every send, not once per list.

The cost of a bad list shows up downstream. In Belkins' cold calling data, 26.9% of non-meeting outcomes were the wrong person or a gatekeeper, which is a list problem, not a script problem. We covered that dataset in our cold calling analysis. The same logic applies to email: a message to the wrong person is wasted no matter how well it is written.

The message: a four-part structure that does not read as AI

Most cold emails fail in the first sentence. They open with a compliment, an introduction of the sender, or a hope that the recipient is well, and the reader has already stopped. A structure that holds up is four short parts.

1. The reason. Why you, to them, now. A real trigger: a hire, a funding round, a post, a launch, a job opening.
2. The relevance. One sentence connecting that trigger to a problem they likely have.
3. The proof or offer. One sentence on how you solve it, specific enough that it could not apply to any company in any industry.
4. The ask. A small, easy next step, phrased as a question.

Subject: your new head of sales hire

Hi [First Name],

Saw [Company] just hired a head of sales. [The reason.]

When outbound scales after a hire like that, sending infrastructure is usually the first thing to strain. [The relevance.]

We set up the domains, authentication and warm-up so your new hire's first campaign lands in inboxes instead of spam. [The proof or offer.]

Worth a 15-minute call to see if it's relevant? [The ask.]

[Your name]

Keep it short. Instantly's 2026 benchmark, drawn from billions of cold email interactions across thousands of workspaces, found elite performers average fewer than 80 words in the first email. That is a correlation from one platform's data, not a controlled test. It matches the job a cold email has: earn a reply, not close a deal.

Subject lines matter, with a caveat about the data. Belkins analyzed 5.5 million emails sent across 2024 and found personalized subject lines drew a 46% open rate against 35% for generic ones, and a 7% reply rate against 3%. Opens are unreliable now (see the measurement section), and that study predates Belkins' stricter reply-per-email-sent method, so the open figures should be read cautiously. The reply gap is the part worth keeping. The annotated templates guide has full three-touch sequences built around this data.

What reads as AI, and why it hurts. Generic flattery, stacks of adjectives, an over-polished first line, and a "personalized" sentence that could have been written about anyone. The best-sampled evidence we found is on LinkedIn, where Expandi's analysis of 13.2 million connection requests found AI hyperpersonalization lowered acceptance rate by 12% and left reply rate flat. It is a different channel, but the lesson transfers: personalization that sounds specific without being specific does not work.

Personalization that is worth the compute, and the kind that is not

Not all personalization is equal, and the cost of doing it varies enormously. Think in three tiers.

• Segment-level, cheap and always worth it. The message is written for a specific type of company or role, not for everyone. This is mostly a targeting decision and costs almost nothing per email.
• Account-level, worth it for a real trigger. A fact about the company that justifies reaching out now. This is where signal-based outreach earns its place.
• Person-level, worth it only for your top accounts. A reference to something the individual wrote or said. It is expensive to do well and obvious when done badly.

The same Expandi data found requests that referenced something specific and real, a shared group, a recent post or a mutual connection, ran 1.8 to 2.7 times the 30.2% baseline acceptance rate. Real specificity pays. Decorative specificity does not. A rule that holds across channels: personalize the reason you are writing, not the flattery.

Follow-up: how many, how far apart, and when to stop

Follow-ups are where a meaningful share of the replies are. Instantly's 2026 benchmark found 58% of all replies come from the first email and 42% from follow-ups, which means stopping after one email leaves nearly half the available replies uncollected. It puts the sweet spot at four to seven touchpoints and warns that returns diminish beyond seven unless each touch adds genuine new value.

Our practical range is three to five emails, spaced across roughly two weeks, with each follow-up adding something the previous one did not: a relevant stat, a short example, a different angle. A bump that only repeats the ask reads as pressure. The end of the sequence should give a clean, low-pressure way out, which is also what keeps complaints down. Our templates guide shows an opener, a bump and a breakup in full.

Stop rules matter as much as the sequence. Stop on any reply, on an unsubscribe, and on a bounce. Pause a campaign if spam complaints or bounces rise. A sequence that keeps emailing someone who has opted out is the quickest route to a complaint and a legal problem.

Measurement: reply rate, not open rate, and why

For years the default cold email dashboard led with open rate. It no longer tells you what it appears to.

Litmus reports that Apple's Mail Privacy Protection now affects roughly 55 to 60% of all email opens. MPP pre-loads tracking pixels at delivery, so an "open" can be recorded whether or not anyone read the message. Belkins moved to the same approach in its 2025 study: it no longer reports open rates and measures replies divided by total emails sent instead.

Measure instead:

1. Reply rate, as replies divided by emails sent, so it is comparable over time.
2. Positive reply rate, the share of replies that show interest, which separates real response from unsubscribes and out-of-office messages.
3. Meetings booked per 1,000 emails sent. Belkins booked over 1,200 appointments across 7.5 million emails, which is roughly 0.16 per 1,000 emails, or about one appointment per 6,250 emails or fewer (our arithmetic). At three emails per contact, that is about 2,083 contacts per appointment at the average, which is why targeting and list quality matter so much.
4. Bounce rate and spam complaints, the health indicators that protect everything else.
5. Held meetings and opportunities, which separate real pipeline from replies. Our B2B lead generation guide lays out the full chain of six numbers.

Now the confusing part: published reply-rate benchmarks disagree by almost an order of magnitude, because they measure different things.

The honest takeaway is to benchmark yourself against your own history first, and to treat any platform average as coming from its own self-selected users. A 3% reply rate in one population can be a weaker result than 0.5% in another.

Compliance: CAN-SPAM, GDPR, PECR and CASL in one view

Compliance varies by where the recipient is, not where you are. Our full compliance guide covers each regime. This is the summary.

The practical rule that covers all of them: build the opt-out once and apply it everywhere, keep a record of why each list exists, and segment Canadian contacts separately.

Where DeliMail fits

We build and sell DeliMail, $199 a month on its own or $499 a month bundled with DeliChat and DeliReach, a managed cold email platform with dedicated sending domains separate from your main email, domain warm-up, SPF, DKIM and DMARC configuration, and deliverability monitoring, so weigh this section accordingly. It exists because the steps above are laborious and unforgiving: the infrastructure has to be right before the first email goes out, and nobody enjoys maintaining twelve domains.

If you would rather hand off the whole operation, our done-for-you outbound service runs the infrastructure, the list, the sequences and the booking. If you want to run it yourself, the checklist above is everything we would do.

Sources

• Google Workspace, Email sender guidelines, bulk sender requirements effective February 2024
• Google Workspace, Gmail sending limits in Google Workspace
• Microsoft Defender for Office 365 blog, Outlook's new requirements for high-volume senders, April 2025, as summarized by dmarcian
• Belkins, B2B Cold Email Response Rates, 7.5 million emails, 2025
• Belkins, B2B Cold Email Subject Line Statistics, 5.5 million emails, 2024
• Instantly, Cold Email Benchmark Report 2026, billions of interactions, January to December 18, 2025
• Saleshandy, Email Deliverability Statistics, 53.1 million emails
• Warmup Inbox, What Actually Drives Inbox Placement, 4,406 inboxes
• Litmus, Email Client Market Share, July 2026, over one billion tracked opens
• Expandi, State of LinkedIn Outreach H2, 13.2 million connection requests
• AiSDR, Pricing, for published plan infrastructure structure
• ZoomInfo, B2B Data Decay, for the attribution of the 22.5% figure to HubSpot Benchmarks
• FTC, CAN-SPAM Act: A Compliance Guide for Business; UK ICO, Electronic mail marketing; CRTC, Compu-Finder notice of violation

FAQ

Related reading

• Cold email compliance: CAN-SPAM, GDPR, and CASL
• B2B outbound templates: cold email, cold call, and LinkedIn, annotated
• Signal-based outreach: how it actually works
• B2B lead generation: channels, costs, and what converts
• AI SDR: what it is, what it does, and where it fails