Email deliverability is the discipline of getting your messages into the recipient's primary inbox rather than spam, promotions, or the void of silently dropped mail. For cold email specifically, deliverability is the entire game: a campaign that lands at 95% inbox placement converts 6–9x better than the same copy at 40% placement, because humans never see what the spam folder catches. This guide is the long-form reference we wish existed when we started building StackMail's mailbox infrastructure—a full walkthrough of how inbox placement actually gets decided in 2026, what to do about it, and how to recover when it breaks.
What "deliverability" actually measures
Most people conflate three different metrics. Delivery rate is the percentage of messages the receiving server accepted (returned a 250 OK to the SMTP transaction). Inbox placement rate is the percentage that landed in the recipient's primary inbox specifically, as opposed to spam, promotions, updates, or quietly filtered into a hidden folder. Read rate is the percentage actually opened by a human. The three numbers can diverge wildly: a campaign with 99% delivery can have 35% inbox placement and 8% read rate, and the campaign owner will celebrate the 99% number while the campaign quietly fails.
Inbox placement is the only number that matters for cold outreach, and it cannot be measured from your sender side because the receiving server does not tell you which folder it routed your mail to. The standard way to estimate placement is a seed-list test: you send one email from your mailbox to a panel of monitored test inboxes distributed across Gmail consumer, Gmail Workspace, Outlook.com, Microsoft 365, Yahoo, and a few corporate hosts, then a collector script logs which folder each test address received the message in. The aggregate gives you a percent placement estimate accurate to within a few points. Run our free inbox placement test once per cohort per week, plus before any volume increase.
The deliverability stack — 7 layers
Deliverability is not a single setting. It is a stack of seven independent layers, each of which can fail independently and each of which the spam filter scores separately. A missing layer at the bottom of the stack invalidates everything above it.
| Layer | What it controls | Where it breaks |
|---|---|---|
| 1. IP reputation | Trust score for the sending IP address | Shared pool neighbours, blocklists |
| 2. Domain reputation | Trust score for the sending domain (and its parent) | Spam complaints, sudden volume changes |
| 3. DNS authentication | SPF, DKIM, DMARC, MX, PTR records | Misaligned, missing, or syntactically broken records |
| 4. Content quality | Body, subject, links, images, headers | Spammy phrasing, shorteners, image-only mail |
| 5. Engagement | How recipients interact (reply, archive, mark spam) | Bad lists, irrelevant targeting |
| 6. List quality | Bounce rate, role addresses, spam traps | Scraped or unverified lists |
| 7. Sender history | Cumulative behaviour over weeks/months | Inconsistent volume, gaps, sudden ramps |
Layers 1–3 are infrastructure: get them right once and they keep working. Layers 4–7 are operational: they need attention every campaign. Most deliverability failures we see at StackMail are layer-2 (domain reputation) or layer-5 (engagement), not layer-3 (auth)—auth is usually correct because tools like our SPF checker, DKIM checker, and DMARC checker make it trivial to verify.
Why your emails go to spam — top 12 reasons
- No DMARC policy or p=none with no monitoring. Gmail bulk-sender rules treat unauthenticated 5K+/day senders as suspicious by default.
- Sending cold email from your primary brand domain. One spam complaint cohort poisons the domain that receives your invoices.
- Misaligned SPF or DKIM. The Header-From domain does not match the SPF return-path or DKIM d= tag, so DMARC alignment fails silently.
- Cold mailbox with no warmup. Brand-new mailboxes have zero domain reputation; ramping volume on day one triggers immediate filtering.
- List hygiene failure. Bounce rate over 5% in a single send tells receiving servers you bought or scraped the list.
- Spam-trap hits. Old recycled addresses on a list silently flag you as a list-buyer.
- Subject-line keywords. "Free," "guaranteed," excessive punctuation, ALL CAPS, currency symbols in subject.
- Link shorteners. bit.ly, t.co, and bare TinyURL links fingerprint as spam in 2026.
- HTML-only with no plain-text part. Multipart MIME is expected; HTML-only triggers content scoring.
- Image-heavy content. Cold email should be plain-text styled—no logos, no banners, no tracking pixels.
- High send velocity from one mailbox. Sending 200+ messages from one Workspace mailbox in an hour is a red flag.
- Recipient inactivity. Mailboxes that have not been opened in 12+ months are increasingly classified as dormant and flagged.
How Gmail and Outlook decide
Gmail and Microsoft use different filter architectures, and the differences matter. Gmail's spam classifier is a transformer-based model trained on billions of user-actions per day, with Google Postmaster Tools exposing the four signals it weights most heavily: domain reputation, IP reputation, authentication, and spam rate. As of February 2024 Gmail also enforces hard requirements for senders pushing 5,000+ messages per day to gmail.com addresses: SPF, DKIM, DMARC alignment, one-click List-Unsubscribe headers, and a spam complaint rate below 0.3% (with 0.1% as the soft target for non-degraded delivery).
Microsoft uses SmartScreen and Microsoft SNDS (Smart Network Data Services), which tracks IP-level metrics including complaint rate, spam-trap hits, and message-frequency patterns. Microsoft is more sensitive to volume spikes than Gmail and more aggressive about quarantining first-contact mail from unknown senders. The same campaign that hits 95% inbox at Gmail can hit 60% at Outlook; this is why diversifying across mailbox providers (mixing Workspace and Microsoft 365 mailboxes per recipient TLD) materially improves blended placement.
The dominant signal in 2026 is recipient engagement, specifically replies and archives. Opens are essentially worthless as a signal because Apple Mail Privacy Protection pre-fetches every pixel and Gmail's image proxy obscures the timing. What the algorithm actually measures is whether your recipient replies, marks as important, moves out of spam, or archives without reading. Marks-as-spam is the single worst signal you can generate; one in a thousand will cost you more than ten opens will buy. The provider-by-provider details for Google and Microsoft live in our Google Workspace and Microsoft 365 pages.
Domain isolation — separate sending domain from primary brand
The single most important architectural decision in cold email is using a sending domain that is not your primary brand domain. If your business runs at acme.com, your cold sequences send from try-acme.com, get-acme.com, or acme.io—a registered cousin that resolves DNS-independently and has its own DMARC policy. The reason is mathematical: cold email always generates some complaint volume, and even at 0.05% complaint rate over hundreds of thousands of sends, your domain will accumulate negative reputation. You do not want that reputation polluting the domain your customers, vendors, and payment processors send mail to.
The practical pattern at 30+ mailbox scale: register 3–5 cousin domains, point each at Google Workspace or Microsoft 365, set up SPF, DKIM, and DMARC on each, and distribute mailboxes 5–8 per domain. This shards your reputation surface—if one domain gets flagged, the others continue working while you investigate. Setup is mechanical but tedious, which is why we automate it; see our DNS setup guide and domain DNS setup walkthrough for the record-by-record steps. Agencies running this for clients should also read our agency setup page, which covers per-client domain segmentation patterns.
IP reputation — shared vs dedicated, when each matters
For cold email at any sane scale, shared IPs are the right answer and dedicated IPs are usually a mistake. Here is the counterintuitive logic: reputation on an IP accrues by volume, and a low-volume dedicated IP looks more suspicious to filters than a high-volume shared IP carrying millions of legitimate messages. When you send via Google Workspace, your mail leaves Google's IP pool—the same pool that carries half the world's legitimate business email. You inherit Google's IP reputation, which is unbeatable.
Dedicated IPs make sense in exactly two situations. First, transactional senders pushing 100,000+ messages per month from a single sender identity through an ESP like Postmark or SendGrid; at that volume you want isolation from neighbours and you have the volume to build IP reputation independently. Second, large lifecycle email programs running through a dedicated marketing ESP, where your sends are predictable and high-volume. Cold email at 30–300 mailboxes does neither: each individual mailbox sends 30–50 messages per day, which is far below the threshold where dedicated-IP reputation can stabilize. Stay on the shared Google or Microsoft pools.
Content traps that flag spam filters
Content scoring is the smallest input in 2026, but it is also the easiest to get wrong for free. The traps below are not about "spam words" in a meaningful sense—modern filters use statistical models, not regexes—but they are patterns that correlate strongly with spam in the training data:
- Link shorteners. bit.ly, t.co, tinyurl, lnkd.in, ow.ly. Use your own domain redirect or the bare destination URL. A shortened link in a cold email costs you 10–20 placement points immediately.
- Image-only emails. A single 600x800 image with no real text body trips spam classifiers in microseconds. Every cold email should be plain-text-style.
- Tracking pixels. The 1x1 transparent gif fingerprints as a marketing send. Disable pixel tracking in cold sequences—you will lose the open-rate metric, but it was lying to you anyway because of MPP.
- Unsubscribe placement. Cold email needs a working opt-out path. The 2024 Gmail rules require a one-click List-Unsubscribe header for bulk senders. A footer link works for sub-bulk volumes; both is best.
- Subject-line punctuation. Multiple exclamation marks, currency symbols, all-caps words, and emoji in subjects all correlate with spam classification.
- Excessive personalization tokens. Spinning the same email with 30 placeholder fields ({{first_name}}, {{company}}, etc.) and broken token rendering ("Hi {{first_name}}," appearing literally) is a signature spam pattern.
- Misleading From-name vs From-address. Display name "John from Acme" sending from john@unrelated-domain.com triggers display-name-spoofing checks.
Engagement signals — what matters most in 2026
Spam filters used to weight three signals roughly equally: opens, clicks, replies. Two forces broke that balance. First, Apple Mail Privacy Protection (rolled out in late 2021 and now affecting roughly 60% of consumer mail) pre-fetches every tracking pixel, making opens unreliable. Second, Gmail's image proxy and link rewriting introduced similar noise. Filters responded by re-weighting toward signals that cannot be faked: replies, archives, marks-as-important, folder moves out of spam, and (negatively) marks-as-spam.
| Signal | Direction | Relative weight |
|---|---|---|
| Mark as spam | Negative | Highest (10x other signals) |
| Reply | Positive | Highest positive |
| Move out of spam | Positive | High |
| Archive (not delete) | Positive | Medium |
| Star / mark important | Positive | Medium |
| Open | Positive | Low (degraded by MPP) |
| Delete without reading | Negative | Low |
The operational implication: optimize copy to generate replies, even short ones—"not interested" replies count as positive engagement. Avoid patterns that trigger spam-marks (bait subjects, false personalization). Use sequence cadence that gives recipients time to act (3–5 days between touches, not 24 hours).
List hygiene — bounces, suppression, complaint rate
Bounces are the cheapest signal you can fix. Hard bounces (5xx SMTP responses indicating the address does not exist) directly damage domain reputation; a single campaign with 8% hard bounce rate can drop your Postmaster reputation from "High" to "Medium" in 48 hours. Verify every list with a real-time SMTP verifier (NeverBounce, ZeroBounce, Million Verifier) before sending, and reject any list returning over 3% invalid. Soft bounces (4xx temporary failures) are less critical but a sustained 5%+ soft-bounce rate to the same domain indicates the receiving server is gray-listing or rate-limiting you.
Maintain a suppression list at the platform level: any address that ever bounced, replied with an opt-out, or marked spam should be permanently blocked from receiving any future mail across all your sequences. Do not rely on the sequencer to track this per-campaign; it has to be cross-campaign and cross-domain. The complaint rate target is below 0.1% (one complaint per thousand sends). Above 0.3% Gmail will start rate-limiting you; above 0.5% you will be classified as bulk-spam-source and ramping back is a months-long project.
Spam traps are addresses that should never receive mail—they are unmonitored mailboxes recycled from old accounts, planted by ISPs and blocklist operators specifically to identify list-buyers. A single pristine spam-trap hit can blocklist your domain. The only defence is to not buy lists and to remove any address you cannot verify provenance for.
How to monitor deliverability ongoing
Deliverability is not a setup task. It is an ongoing monitoring discipline, the same way uptime is for SaaS. The minimum monitoring stack:
- Google Postmaster Tools — verify every sending domain, check weekly. Watch the four dashboards: Spam Rate, Domain Reputation, IP Reputation, and Authentication. Any drop from High/Medium to Low is a five-alarm fire.
- Microsoft SNDS — IP-level data for Outlook/Hotmail. Useful when you have dedicated IPs; less useful on shared Workspace because you cannot see a single shared IP cleanly.
- mxtoolbox — weekly blocklist scan. We also expose this via email blacklist checker, domain blacklist checker, and IP blacklist checker.
- StackMail inbox placement test — weekly seed-list run per cohort. Run a placement test.
- DMARC aggregate reports. Set
rua=mailto:in your DMARC record and parse the daily XML reports for authentication failures.
Recovery from a deliverability collapse — 3 paths
When placement collapses (typically: your team notices reply rates have dropped 60%+ and a placement test confirms inbox at sub-50%), you have three paths in increasing order of cost:
- Path A — Stabilize and rebuild (2–6 weeks). Pause all outbound, fix the root cause (usually list quality or volume ramp), drop sending volume to 5–10 per mailbox per day for two weeks, run heavy reply-warmup, and monitor Postmaster Tools daily. Resume at 50% of pre-collapse volume only after Postmaster reputation returns to Medium or higher. Works if domain reputation has not crossed into Postmaster "Bad" or "Low."
- Path B — Retire the domain, warm a fresh one (4–6 weeks). When Postmaster reports the domain reputation as Bad or Low, recovery is statistically unlikely and not worth the engineering time. Register a new cousin domain, configure DNS, warm fresh mailboxes for 3–4 weeks, and migrate the campaign to the new identity. See our email warmup guide and cold email infrastructure guide for the timeline.
- Path C — Re-architect (2–3 months). Repeated collapses indicate the underlying program has structural issues: list sourcing, copy targeting, or sequencer misuse. Pause cold outreach entirely, audit the program, and resume only after fixing the upstream cause. The instinct to "just register more domains" compounds the problem; you will burn through cousin domains faster than you can warm them.
FAQs
What is a good open rate for cold email in 2026?
For a clean, properly authenticated, well-warmed cold email program, expect 35–55% open rates measured the right way (server-side, not pixel). Programs landing primarily in the spam folder show open rates of 5–15%, which is a strong signal of inbox-placement failure rather than copy failure. Note that Apple Mail Privacy Protection inflates pixel-based open rates by roughly 30–40% across most lists, so the absolute number matters less than the trend across cohorts.
How do I test inbox placement before a campaign?
Use a seed-list inbox placement test like our /tools/inbox-placement endpoint, GlockApps, or MailReach. The tool sends a single email from your mailbox to a panel of seed addresses across Gmail, Outlook, Yahoo, and corporate hosts, then reports the percent that landed in primary inbox, promotions/categorized, spam, or missing. Run a placement test once per week per mailbox cohort, plus once before any volume increase.
What does p=reject in DMARC actually do?
DMARC has three policy levels: p=none (monitor only), p=quarantine (route failing mail to spam), and p=reject (drop failing mail at the gateway). p=reject is the strictest and is what Google requires for senders pushing 5,000+ messages per day to Gmail. It tells receiving servers to bin any mail claiming to be from your domain that fails both SPF and DKIM alignment. For a fresh sending domain, start at p=none, monitor reports for two weeks, then move to p=quarantine, then p=reject.
Is IP warmup still necessary on Google Workspace and Microsoft 365?
Domain warmup is necessary; IP warmup is not, because both providers use shared, pre-warmed IP pools. What you are warming on those platforms is the domain reputation, not the IP. Send 5–1320 emails per day per mailbox during week one, ramp 25% per week, and prioritize generating real human replies, archives, and folder moves—those are the engagement signals Google and Microsoft actually score. See our /guides/email-warmup deep dive.
What is the right image-to-text ratio?
For cold email, the safe ratio is 0% images to 100% text. Spam filters historically penalized image-heavy emails because spammers used embedded images to hide text content from filters. In 2026 the rule is simpler: cold outreach should be plain-text-style, no embedded images, no tracking pixels, no HTML signature blocks with rendered logos. If you are sending a marketing newsletter from a different domain, image-to-text up to 40/60 is fine.
How long does it take to recover from a spam-folder placement?
Domain reputation recovers slowly. If a domain has been classified as spam by Gmail, expect 2–6 weeks of disciplined sending (low volume, high engagement, zero complaints) to rebuild. If the reputation has tipped to "bad" in Postmaster Tools, the realistic move is to retire the domain, register a new one, and warm a fresh sending identity—trying to rehabilitate a domain that crossed into Postmaster red is usually slower and more expensive than starting clean.
How do I look up my domain reputation?
Three free authoritative sources: Google Postmaster Tools (postmaster.google.com) for Gmail-specific reputation, Microsoft SNDS (sendersupport.olc.protection.outlook.com/snds) for Outlook/Hotmail data on dedicated IPs, and mxtoolbox.com for blacklist scans across the major DNSBLs. Postmaster Tools requires DNS verification of your sending domain and 30 days of accumulated volume before reputation data appears.
Should I A/B test subject lines while deliverability is broken?
No. A/B testing assumes your messages are reaching the inbox in the first place. If inbox placement is below 70%, every test result is contaminated by the spam-folder bias—you are measuring which subject line escapes the spam folder more often, not which one converts. Fix placement first using a seed test and infrastructure audit, then resume copy experiments once placement is stable above 85%.
How do I get removed from a blocklist (RBL/DNSBL)?
Identify which list flagged you using mxtoolbox or our /tools/email-blacklist-checker. Each list has its own delisting process: Spamhaus and Spamcop accept self-service requests if you have removed the underlying issue (compromised account, open relay, list hygiene problem). UCEPROTECT delists automatically after 7 days of clean sending. SORBS requires manual ticket. Before requesting delisting, fix the root cause—re-listing within 30 days makes you ineligible for fast-track removal.
When does a dedicated IP make sense?
A dedicated IP only helps once you are sending more than 100,000 messages per month consistently from a single sender identity, because reputation accrues per-IP and a low-volume dedicated IP looks more suspicious than a high-volume shared one. For cold email at 30–300 mailboxes, shared pools on Google Workspace and Microsoft 365 are the right answer—you inherit Google's and Microsoft's IP reputation, which is unbeatable. Move to dedicated only when transactional volume from a single ESP justifies it.