Why Cold Emails Land in Spam, and What to Check First

Check in this order: authentication, then bounce rate, then volume, then content. That is the order of how much each one actually moves. Missing SPF or DKIM gets you rejected outright with a clear error message, while the copy you have rewritten three times is the smallest lever on the list.

Key takeaways

• Authentication is binary. Every sender, at any volume, needs SPF or DKIM, TLS, and valid forward and reverse DNS.
• Bounces are the loudest list signal. Every major provider tells senders to remove invalid addresses promptly.
• Complaint rate has a published ceiling: below 0.3% at Gmail and Yahoo; Gmail advises operating below 0.10%.
• Volume jumps are documented as dangerous — doubling previous volumes suddenly can cause rate limiting or reputation drops.
• Promotions is not spam. No provider describes tab placement as a reputation penalty.

Is it authentication?

Start here, because this failure mode is the one that produces an outright rejection rather than a quiet spam-folder landing.

Google requires of all senders, regardless of volume: SPF or DKIM set up for the sending domain, a TLS connection for transmission, valid forward and reverse DNS records for the sending address, and messages formatted according to RFC 5322. Above 5,000 messages a day to personal Gmail accounts, it becomes SPF and DKIM and a DMARC policy — p=none is acceptable — with the From domain aligned to either the SPF domain or the DKIM domain. DKIM keys must be 1024 bits or longer (Google).

The corresponding rejections are unambiguous. Gmail returns 550 5.7.26 when a message is blocked for failed authentication and 550 5.7.25 when the sending address has no matching reverse DNS record (Google). Microsoft rejects unauthenticated high-volume mail to Outlook.com, Hotmail, Live.com and MSN with 550 5.7.515 Access denied, sending domain does not meet the required authentication level (Microsoft). Yahoo asks all senders for SPF or DKIM at a minimum and bulk senders for both plus a DMARC policy of at least p=none (Yahoo).

If any of that is missing, fix it before touching anything else. Nothing further on this list matters while a provider is refusing your mail at the door.

Is it your list?

Bounces are the most visible statement you can make about list quality, and every provider comments on them.

Yahoo tells senders to “Monitor hard and soft bounces as well as inactive recipients,” to “Remove invalid recipients from your list promptly,” and to “Reduce the number of invalid recipients by using double/confirm opt-in” (Yahoo). Microsoft’s bulk guidance says to maintain list hygiene by removing invalid and bouncing addresses and honouring unsubscribe requests immediately (Microsoft).

None of them publish a numeric bounce threshold, and you should be suspicious of anyone who claims a provider does. What they publish is a direction: bounces should be rare and invalid addresses should be removed as soon as they are known. The practical response is to verify addresses before sending and to stop a campaign when its bounce rate climbs, rather than after the list is exhausted.

Complaints are the other half of list quality, and here there is a number. Gmail: keep spam rate below 0.3%, and aim below 0.10%. Yahoo: keep your spam rate below 0.3%, and honour unsubscribes within two days. Three complaints per thousand delivered messages is the whole allowance.

Is it your volume?

Google is explicit: “Start with a low sending volume to engaged users, and slowly increase the volume over time,” and “The more email that you send, the more slowly you should increase sending volume.” It also notes that daily sending permits a faster ramp than weekly sending, and warns that immediately doubling previously sent volumes suddenly could result in rate limiting or reputation drops (Google).

Provider mailbox limits set the outer edge of what is even possible:

Those are ceilings for all mail from that mailbox, not targets for outreach. The safe pattern is many mailboxes each sending modestly and ramping gradually.

Is it your domain’s history?

Two structural traps sit outside content and volume.

The first is a sending domain that does not look like a real domain. Microsoft documents that a sending domain with no A record and no MX record in public DNS is always routed through its high-risk delivery pool, whatever the message contains (Microsoft). A freshly-registered lookalike domain with nothing but an SPF record is exactly that shape.

The second is stream mixing. Yahoo advises not sending bulk or marketing mail from the same addresses used for user, transactional and alert mail (Yahoo), and Microsoft recommends a custom subdomain for bulk mail, “for example, m.contoso.com,” to protect the primary domain’s reputation (Microsoft). Running outreach from the same domain your invoices leave on means one bad campaign takes the invoices with it.

Is it really the copy?

Less often than the industry pretends, and the documented content rules are narrower than the folklore.

What Google actually publishes: links “should be visible and easy to understand”; avoid hiding content via HTML and CSS; do not put subject lines, recipient names or emoji in the From display name; avoid urgency language of the “LAST CHANCE” variety (Google).

What no provider publishes: a maximum number of links, a correct HTML-to-image ratio, a list of trigger words, a rule that plain text outperforms HTML, or anything about randomised send minutes. Fix the four documented rules, then spend the rest of your effort on targeting — relevance is what keeps complaints under 0.3%, and that is the number providers watch.

What does the Promotions tab actually mean?

It means your message was delivered and categorised. Tabs are a sorting of inbox mail; no provider documents tab placement as a reputation penalty or as a spam action.

If your open rate dips after a move to Promotions, that is a visibility effect worth reacting to — but it is a different problem from filtering. Spam-folder placement and outright rejection are the failures worth chasing.

How WarmySender handles this

WarmySender’s scheduler paces every send inside per-mailbox and per-domain caps and a gradual ramp, which is the sending shape provider guidance describes rather than a burst that a provider then throttles. Per-domain daily allowances are spread across the day rather than drainable in one hour.

On the list side, a campaign is put into a cooldown when its bounce rate crosses a set threshold, instead of continuing to burn a domain against a bad list — the point of the guard is to stop early, not to report the damage later. Provider rate-limit responses are classified as rate limits rather than as bounces, so a throttled send is retried rather than marking a real prospect undeliverable.

The same limits hold when an agent is driving. Claude, ChatGPT, Cursor, Codex, OpenClaw and Hermes Agent can create, launch, pause and manage campaigns in plain language, but an agent never sends a message itself and can never raise a limit. See the email verifier, why a campaign paused for bounces and how warmup protects your deliverability.

Frequently asked questions

What is the single most common cause of cold email going to spam?

Sending to a list that has not been verified, from a domain whose authentication is incomplete. Those two together produce bounces and complaints at the same time, which is the combination every provider’s published guidance is designed to catch. Both are fixable before you send a single message.

How do I know whether my emails are going to spam?

Seed a handful of real personal mailboxes across the major providers and check placement yourself. Reputation dashboards will not tell you: Gmail’s reporting “only applies to messages sent to personal Gmail accounts” and may be withheld entirely when daily volume is too low (Google), which covers very little B2B outreach.

Do spam trigger words still matter?

There is no published provider list of trigger words. Google documents avoiding urgency phrasing like “LAST CHANCE” and hiding content with HTML or CSS, which is about deceptive presentation rather than vocabulary. Word-level rewriting is the lowest-yield change on this page.

My open rate dropped suddenly — is that a spam problem?

Possibly, but check placement before assuming. A sudden drop can equally be a move to another tab, a change in your list source, or an image-blocking change at the recipient’s end. Confirm with a seed test to fresh mailboxes, then work the list from authentication downwards.

Does sending at random times help me avoid filters?

No provider documents send-timing regularity as a filtering signal. Spreading sends over time is real advice — Microsoft says to spread bulk sends rather than sending all at once — but that is about rate limits, not about looking human to a filter.