Cold outreach occupies an awkward position. It is legitimate business communication in most jurisdictions when done properly, and it is also structurally similar to the thing spam filters exist to stop: unsolicited commercial mail sent at volume to people who did not ask for it.
Understanding that similarity is what makes the technical setup make sense.
Why engagement works against you
Mailbox providers weight recipient behaviour heavily. An opt-in newsletter to an engaged list might see 30% opens, replies, and effectively no complaints. Cold outreach might see 5% opens, few replies, and a complaint rate an order of magnitude higher.
That gap is visible to providers, and they respond to it. So the goal of a cold email setup is not to disguise what you are doing — it is to remove every additional reason to filter you, so the mail is judged on its targeting rather than on avoidable technical faults.
Separate your outbound domains
This is the decision that matters most, and it is structural rather than technical.
Do not send cold outreach from the domain that sends your invoices, password resets and customer replies. Complaints accumulate on the sending domain, and if that domain is also your primary one, a bad campaign degrades delivery for correspondence your business depends on.
The standard pattern is to register separate domains for outbound — a variant of your company name — authenticate each properly, and keep the primary domain entirely out of the campaign path.
Two caveats. Those domains still need a real website; a domain that sends mail but serves nothing is a recognised spam signal. And they still need warming, which takes weeks.
Distribute volume, do not concentrate it
Sending 1,000 messages from one mailbox is the single most detectable thing you can do. Sending the same 1,000 across twenty-five mailboxes at 40 each is unremarkable.
A defensible configuration:
- Three to five outbound domains.
- Three to five mailboxes per domain.
- Thirty to fifty messages per mailbox per day, after warm-up.
- Rotation across the whole pool rather than draining one account at a time.
That yields somewhere between 270 and 1,250 messages a day from a setup where no individual account is doing anything a provider would object to.
Pacing matters as much as volume
Forty messages sent in ninety seconds and forty messages spread over a working day are the same volume and completely different signals. The first is obviously automated; the second is what a person doing outreach looks like.
A randomised interval between sends — 25 to 45 seconds, varying per message rather than fixed — produces a cadence of roughly 80 to 144 messages an hour per account and, importantly, one with no detectable rhythm. A fixed 30-second gap is itself a pattern.
Vary the content
Thousands of byte-identical messages arriving at one provider within a short window is a fingerprint. Two techniques address it:
- Mail merge — substitute real per-recipient data from your list into the subject and body.
- Spintax — write several phrasings of the same sentence and have one selected per recipient, so no two messages are identical even before personalisation.
Neither is a trick. Both produce what a person writing individually would naturally produce: similar messages, not identical ones.
Make opting out trivial
There is a persistent belief that hiding the unsubscribe preserves list size. It does the opposite of preserving your ability to reach anyone.
A recipient who wants out and cannot find the link presses the spam button. One spam complaint is worth vastly more damage than one unsubscribe — the unsubscribe is invisible to providers, the complaint is a direct negative signal on your domain.
Include a one-click unsubscribe header (RFC 8058) on every send, process opt-outs immediately, and store them in a suppression list checked against every future campaign. Hashing those entries means you can honour the opt-out permanently without retaining readable contact data for someone who asked not to be contacted.
None of this fixes bad targeting
It is worth being blunt about the limits. Perfect authentication, ideal pacing, well-warmed domains and flawless suppression will not save a campaign sent to people with no plausible interest in it. They will still not open it, some will still complain, and providers will still respond to that.
The technical setup buys you a fair hearing. What happens after that is a function of whether the message is worth receiving — which is a targeting and copywriting problem, not an infrastructure one.
Compliance is not optional
Whatever your jurisdiction, some obligations are close to universal: identify yourself accurately, do not falsify headers or the subject line, include a physical postal address, and provide a working opt-out that you honour promptly. Some regions require prior consent for any commercial email; others permit business-to-business contact with clear identification.
Purchased and scraped lists are prohibited under our terms of service, and are in any case the fastest route to the bounce and complaint rates that end a domain's usefulness.