Why are my cold emails going to spam? 11 fixes that actually work

Why are my cold emails going to spam?

Short answer: because the receiving mailbox does not trust the sending mailbox yet. Spam is not a content problem first — it is a reputation problem. You earn inbox placement with authentication, warmup, list hygiene, and send pacing. Then the words start to matter.

If you have ever sent a "perfectly written" sequence to 500 prospects on a Monday morning, watched the open rate flatline at 4%, and quietly assumed the copy was wrong — this post is for you. The copy is probably fine. The plumbing is broken.

TL;DR — what fixes deliverability vs. what doesn't

Notice the bottom of that table. Most founders spend their time there. The leverage is at the top.

How spam filters actually decide

Gmail, Outlook, and the corporate filters that sit on top of them (Proofpoint, Mimecast, Barracuda) do not read your email the way a human does. They score it against three things, roughly in this order:

1. Sender reputation. Does this domain and IP have a history of sending mail people actually want?
2. Authentication. Do SPF, DKIM, and DMARC line up? Does the From address match the signing domain?
3. Engagement signals. Are recipients opening, replying, marking as not-spam — or ignoring and deleting?

Content is a tiebreaker, not the headline. A perfectly authenticated, well-warmed mailbox with a 30% reply rate can send an email containing the word "free" and land in the inbox. A brand-new domain with no DKIM and a cold list can send Shakespeare and land in spam.

So when you ask why are my cold emails going to spam, the honest answer is almost always: your sending infrastructure has not earned the right to be in the inbox yet.

The 11 fixes, ranked by leverage

1. Set up SPF, DKIM, and DMARC on the sending domain

This is non-negotiable. Without it, every modern filter treats you as suspicious by default.

• SPF (Sender Policy Framework) tells receivers which servers are allowed to send mail "from" your domain.
• DKIM (DomainKeys Identified Mail) cryptographically signs each message so receivers can verify it came from your domain and was not tampered with.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when SPF or DKIM fail — and lets you receive reports.

A minimum-viable DMARC record:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1

p=none is monitor-only. Start there, watch reports for a few weeks via a tool like Postmark DMARC, EasyDMARC, or dmarcian. Move to p=quarantine, then p=reject once you are confident no legitimate mail will be blocked.

If you are using Google Workspace, the Google Admin help docs walk you through DKIM key generation. If you are on Microsoft 365, the equivalent lives in the Exchange admin center under "DKIM."

2. Send from a secondary domain (not your main one)

Never send cold email from yourcompany.com. If a deliverability incident burns the reputation of your sending domain, you do not want it to be the domain you receive invoices on.

The pattern that works:

• Primary domain: yourcompany.com — internal, billing, support, marketing.
• Sending domain(s): yourcompany.io, getyourcompany.com, yourcompany-team.com — outbound only.

Buy 2–4 lookalikes. Configure SPF/DKIM/DMARC on each. Set up forwarding so replies route to your main inbox. Each domain hosts 2–3 mailboxes, each mailbox sends ~30–40 emails/day. That is the modern outbound stack.

3. Set up a custom tracking domain

Your sending tool (Apollo, Instantly, Smartlead, Lemlist) defaults to a shared tracking domain. That domain is also used by thousands of other senders, many of them sketchy. When a receiving filter sees a known-spammy tracking domain in your email, you inherit the reputation.

Fix: in your tool's settings, configure a custom tracking domain like link.yourcompany.io with a CNAME pointing to the tool's provided host. Five-minute job. Material impact.

4. Warm the mailbox for 4–6 weeks before sending cold

A brand-new mailbox with no sending history looks identical to a spam farm. You have to teach the receiving filters that this mailbox is a real person who sends and receives normal mail.

Warmup tools (Mailreach, Warmbox, Warmup Inbox, Instantly's built-in warmup) do this by joining a network of inboxes that send and reply to each other automatically. Aim for:

• Week 1–2: 10–20 warmup emails/day
• Week 3–4: 30–40/day, still warmup-only
• Week 5+: Start cold sending at 10/day, ramp by 5 per week to a max of 30–40/day

Never start cold at scale. The single biggest "why am I in spam" mistake is buying a domain on Monday and blasting 200 emails on Tuesday.

5. Cap volume per mailbox at 30–40/day

There is no hard Gmail limit that triggers spam at email #41. But there is a behavioural signal: real humans do not send 200 cold emails a day from one mailbox. The further you stray from human-looking volume, the more aggressively filters will scrutinise you.

If you need more volume, add more mailboxes — not more sends per mailbox.

Yes, this is operationally heavier than "blast 1,000 from one mailbox." That is the point. The teams winning at outbound treat mailbox infrastructure like a fleet, not a single vehicle.

6. Verify every list before you send

Cold lists rot. People leave jobs, domains get parked, catch-all mailboxes accept anything and then bounce silently. A bounce rate above 5% will tank your reputation in days.

Before any sequence:

• Run the list through a verifier — Zerobounce, NeverBounce, Million Verifier, Apollo's built-in verifier.
• Remove "invalid", "unknown", and accept-all addresses unless your tool can detect-and-skip mid-sequence.
• Target bounce rate: under 2%.

A 5,000-row list with no verification will burn three mailboxes in a week. The same list, verified, runs clean.

7. Drop tracking pixels from cold emails

Open tracking is a 1-pixel image embedded in the email. Filters know exactly what these look like, and many of them treat their presence as a mild spam signal. Worse, Apple Mail's privacy protection pre-fetches them, which inflates open rates and makes the data useless anyway.

Two-step fix:

1. Turn off open tracking on cold-outbound campaigns. You lose noisy data; you gain inbox placement.
2. Keep link tracking only if you need it for attribution — but use your own custom tracking domain (fix #3).

8. Strip links from the first email

Filters score outbound links heavily. A first cold email with a calendar link, a website link, and an unsubscribe footer looks more like marketing than a personal note. Marketing belongs in the marketing folder.

Email 1: zero links. Plain text. The CTA is a question they can answer in one line.

Save the calendar link for email 3 or 4, after the recipient has shown interest. Add an unsubscribe line as plain text, not as a button. Example:

Reply STOP and I will remove you.

That single line satisfies most reasonable filter heuristics without adding a clickable link.

9. Plain text, not HTML

HTML emails are designed to look like marketing. That is the entire point of HTML email. Cold outbound should look like a colleague writing to a colleague.

• No images.
• No signature with logos and social icons. A two-line text signature is enough.
• No "View in browser" link.
• No coloured fonts.

If your tool sends in HTML by default, switch to plain text. If you cannot, strip every styling element until the email renders identically in a plain-text reader and an HTML reader.

10. Watch your spam complaint rate like the metric it is

Gmail's Postmaster Tools (free) will tell you your domain reputation, IP reputation, and spam complaint rate. If you are sending cold and not monitoring Postmaster Tools, you are flying blind.

Targets:

• Spam complaint rate: under 0.1% (Google's published threshold for bulk senders).
• Domain reputation: High or Medium. Avoid "Low" or "Bad."
• IP reputation: the same.

When complaint rate climbs, stop sending immediately. Pause the campaign, review the list, review the copy, then resume at half the previous volume.

11. Write like a human (this is the last fix, not the first)

Now we get to copy. After the ten technical fixes above, the words start to matter.

• Subject lines: lower-case, 2–4 words, no spammy words. "quick question" beats "Unlock 10× growth with our revolutionary platform!"
• First line: never start with "I hope this email finds you well." Filters have seen this phrase a billion times and the engagement signal is terrible.
• Body: under 90 words. One ask. One reason it is relevant to them, not you.
• Sign-off: first name only. No company tagline.

A note on "spam trigger words": the obsession with avoiding words like "free", "guarantee", and "click here" is mostly outdated. Modern filters are statistical and contextual, not keyword-based. A well-authenticated mailbox with good engagement can use any of these words without penalty. A bad mailbox cannot redeem itself by avoiding them.

A 30-day deliverability turnaround plan

If you are already in trouble — open rates under 10%, bounces above 5%, replies near zero — here is the sequence to dig out:

By day 30, a mailbox that was landing in spam should be landing in the primary inbox at 50–70% — assuming the list is good and the copy is not actively hostile.

Tools that are worth the money

• Apollo.io — list building, verification, sending. The MAVEN team uses this as the spine.
• Instantly / Smartlead — purpose-built cold email infrastructure with warmup baked in.
• Mailreach / Warmbox — standalone warmup if your sending tool's warmup is weak.
• Zerobounce / NeverBounce — list verification before every send.
• Postmark DMARC / EasyDMARC — DMARC report aggregation in human-readable form.
• MXToolbox — quick checks on SPF/DKIM/DMARC/blacklist status.

Skip the "AI deliverability optimizer" tools. They rewrite your copy to avoid words that do not matter and add to your spend. The fundamentals above do 95% of the work.

For UAE & KSA teams

Sending cold from a Gulf-based domain into Gulf inboxes has a few wrinkles foreign founders rarely see coming.

Government and quasi-government domains in KSA — .gov.sa, .edu.sa, and many ministry-affiliated domains sit behind aggressive filters (Mimecast or Proofpoint variants) that quarantine bulk-pattern mail by default. Your DKIM has to be perfect, your sending domain has to be reputable, and even then a first cold touch frequently lands in quarantine. The fix is not technical — it is to seed the relationship through LinkedIn or a warm intro before the cold email arrives, so the recipient is looking for it and releases it from quarantine.

Etisalat and du in the UAE — many UAE SMBs use Etisalat-hosted email (@etisalat.ae is rare in B2B, but Etisalat hosts thousands of company domains). These tend to be stricter on SPF/DKIM alignment than Google or Microsoft. If you are seeing UAE-specific bounces or spam placements, double-check that your SPF record uses -all (hard fail) and that DKIM is signing with at least a 2048-bit key.

Arabic content in subject lines — if you are localising to Arabic, do not mix scripts in the subject line. A subject like "خصم 20% on your next purchase" reads as suspicious to filters that treat script-switching as an obfuscation tactic. Either fully Arabic or fully English. Body content can mix more freely.

TLD signal — .com and .ae are both fine for sending into UAE inboxes. .io and .co are slightly weaker signals for enterprise GCC buyers (treated as "tech startup" rather than "established business"), but this is a brand-perception issue, not a deliverability one. Filters do not care.

Ramadan and weekends — sending volume that ramps up during Ramadan or weekend days (Friday and Saturday in KSA, Saturday and Sunday in UAE) looks anomalous to filters trained on local patterns. Hold your ramps to weekdays and back off volume by 50% during Ramadan. You will see better open rates anyway.

Working hours — schedule sends for 9–11am local time. KSA and UAE B2B buyers check email in the morning, then again briefly after Asr prayer. Mid-afternoon sends drop into a quiet inbox and never get opened — which hurts your engagement metrics and, downstream, your deliverability.

Frequently asked

Will switching email providers (Google to Microsoft, or vice versa) fix my spam problem?

No. The reputation that matters is on the sending domain, not the provider. Switching providers without fixing the underlying authentication and warmup issues just moves the problem.

How long does it take to recover a burned domain?

3–6 months realistically, and sometimes the answer is: it does not recover. If you have sent thousands of unverified cold emails from your main domain and the reputation is in the Low/Bad band on Postmaster Tools, retire it for outbound. Buy a new sending domain and start clean. Keep the main domain for everything else.

Can I use Gmail for cold outbound?

Yes — Google Workspace mailboxes with proper warmup and volume caps work fine. You cannot use a free @gmail.com address. You need a domain you control so you can set up SPF/DKIM/DMARC. Free Gmail addresses are a deliverability red flag and most filters treat them harshly in a B2B context.

Do I need to set up DMARC immediately?

SPF and DKIM are mandatory from day one. DMARC at p=none is mandatory once you start sending volume. DMARC at p=quarantine or p=reject is recommended within 30–60 days once you have visibility into your authentication health.

Why does my email go to spam for some recipients but not others?

Spam filters are personalised. If a recipient has previously marked similar mail as spam, or if their company filter has a stricter ruleset than Gmail consumer, you will land differently in different inboxes from the same send. This is normal. The aggregate inbox placement rate is what matters.

Is buying a list ever okay?

No. Bought lists are saturated, have high bounce rates, and frequently include addresses that have been used as spam traps. The bounce rate alone will burn your domain in a week. Build the list yourself with Apollo, ZoomInfo, or LinkedIn Sales Navigator.

Should I send from a personal-looking address or a generic one?

First name first letter dot last name (e.g., j.smith@yourcompany.io) outperforms generic addresses like sales@ or hello@. Cold outbound is one human to another human. Make it look that way.

What MAVEN does about it

Deliverability is one of the first things we audit when a client's outbound is underperforming. Our 90-day Sales Process Program includes full mailbox infrastructure setup — secondary domains, authentication, warmup, custom tracking — alongside the copy, sequencing, and CRM work. The Apollo Quick-Start is the standalone version if you only need the prospecting and sending layer dialled in.

If you would rather talk through your current setup before committing, book a virtual coffee — 30 minutes, no slides, we look at your domain reputation together and tell you the three things to fix first.

Want to go deeper on the cold email side? Our Cold Email Playbook covers the copy and sequencing decisions once the deliverability is sorted.

---

Post 3 of 10 in our outbound + sales OS series.

Related reading

• How long should a cold email be in B2B?
• Cold email vs LinkedIn outreach
• Why are my cold emails going to spam?
• Best cold email subject lines
• How many follow-up emails to send
• What is sales sequencing?