Disclosure: I am the CEO of Overloop, an outbound platform with built-in email verification and deliverability controls. I recommend Overloop where it fits, but the 12 fixes below work with any sending setup, and I cite the free tools (Mail-tester, Google Postmaster Tools, Microsoft SNDS) you should be running regardless.
The 2-Minute Self-Check
Before you touch SPF or start warming anything, figure out which bucket your problem is in. Send a few tests and answer these. If two or more look wrong, start there.
- Where are you landing? Send a test to Gmail and to Outlook (or Microsoft 365). If one inboxes and the other spams, you have provider-specific filtering or a reputation signal.
- Are hard bounces rising? If so, pause volume increases. Bad addresses and typos damage reputation fast. Our breakdown of the 7 reasons emails bounce covers how to read the codes.
- Are spam complaints showing up? In Google Postmaster Tools and Microsoft SNDS, complaints often move first when inboxing drops. If you cannot access these, ask whoever controls your domain.
- Did you change volume or cadence? A jump from 50 to 500 emails a day triggers filtering, especially on new domains or new inboxes.
- Are you sending from a free domain? Outreach from @gmail.com or @outlook.com gives you less control over authentication and reputation. Use a domain you own.
- Are you using link shorteners or heavy HTML? Bitly-style links, large images, and copy-pasted formatting from Google Docs trip filters.
What Email Deliverability Is (and What It Is Not)
Email deliverability is the ability to place an email in the recipient's inbox at Gmail, Outlook, Yahoo, or a corporate mailbox, instead of the spam folder or being blocked outright. A message can show as "sent" in your platform and still fail, because the receiving provider filtered it after accepting the SMTP transaction.
This matters because the first fixes here (SPF, DKIM, DMARC, and alignment) decide whether mailbox providers trust your identity. If they do not, they throttle, spam-folder, or reject your mail before content ever gets a fair read.
The terms worth measuring
- Delivery rate is the share of emails accepted by the receiving server. It excludes hard bounces but tells you nothing about inbox vs spam placement.
- Inbox placement rate is the share that actually lands in the inbox. This is what most teams mean by "deliverability," and it is harder to measure without seed tests. Validity's deliverability research puts average inbox placement around 85%, meaning roughly one in six legitimate emails never reaches the inbox.
- Bounce rate splits into hard bounces (invalid address) and soft bounces (mailbox full, rate limiting). Consistent hard bounces damage reputation fast.
- Spam complaint rate is the share who hit "Report spam." Google and Yahoo both ask bulk senders to keep this under 0.3%, with 0.1% as the target.
- Sender reputation is how providers score your domain (and sometimes IP) on engagement, complaints, bounces, and spam-trap hits. It drives filtering more than any subject-line trick.
Deliverability is not open rate: Apple Mail Privacy Protection inflates opens, so treat them as directional only. It is not "avoiding spam words" either. Content matters, but if your domain fails DMARC alignment or your complaint rate spikes, clean copy will not save inbox placement. For the deeper picture across the whole topic, see our email verification guide, which covers catch-alls, greylisting, and bounce typology in detail.
Fixes 1-4: Authenticate Your Domain the Right Way
Mailbox providers trust what they can verify. If your domain fails SPF, DKIM, or DMARC checks, Gmail and Outlook have a simple option: treat your mail as suspicious. Authentication will not fix bad targeting, but it removes a common reason good emails get filtered.
| Record | What it proves | Where it lives | Common failure |
|---|---|---|---|
| SPF | Which servers may send for your domain | TXT record on the sending domain | More than one SPF record, or over 10 DNS lookups |
| DKIM | The message was not altered and is signed by your domain | TXT record on a selector subdomain | Key not rotated, or ESP not configured to sign |
| DMARC | What to do when SPF or DKIM fail, plus reporting | TXT record at _dmarc.yourdomain | No record, or stuck at p=none with no monitoring |
Fix 1: Publish a correct SPF record
SPF (Sender Policy Framework) lists which servers can send mail for your domain. Publish one SPF TXT record on the exact domain you use in the From address.
- Include every sender you use: Google Workspace, Microsoft 365, SendGrid, Amazon SES, Mailgun. Each gives an include statement or IP range.
- Avoid multiple SPF records: two TXT records starting with
v=spf1cause a permerror. - Stay under 10 DNS lookups: too many includes break SPF evaluation.
Fix 2: Turn on DKIM signing
DKIM (DomainKeys Identified Mail) adds a cryptographic signature proving the email was not altered and the sender controls the domain. Enable it in your provider, then publish the TXT or CNAME record it gives you. Use 2048-bit keys where supported. The common mistake: you add a second tool and forget to enable DKIM there. One unsigned stream drags down the whole domain.
Fix 3: Add DMARC, reporting first
DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receivers what to do when SPF and DKIM fail, and it sends you reports.
- Publish a DMARC TXT record on
_dmarc.yourdomain.comwithp=noneand a mailbox forruareports. - Review reports for one to two weeks to find unknown senders and misaligned streams.
- Move to
p=quarantine, thenp=rejectonce legitimate sources pass consistently.
Google and Yahoo's sender requirements made DMARC a baseline for bulk senders in February 2024. Even for cold email, DMARC reduces spoofing that poisons your reputation. Use Google's guide to set up DMARC; the policy and reporting fields are defined in RFC 7489.
Fix 4: Check alignment, the hidden failure
Alignment means the domain in your visible From address matches the domain that passes SPF or DKIM. DMARC can fail even when SPF and DKIM "pass," if they pass for a different domain (common with forwarded mail, misconfigured ESPs, or inconsistent subdomains). Validate with real data: run Mail-tester for a quick header check, then confirm in Google Postmaster Tools once you have volume. Fix alignment before you scale, because reputation builds on whatever identity you present.
Authentication passes, still landing in spam?
Most spam placement after SPF/DKIM/DMARC is a reputation or list problem. Overloop verifies prospects before they enter a sequence and paces sends so you do not create the volume cliffs that trigger filtering.
Try Overloop free →Fixes 5-7: Repair Your Sender Reputation
Reputation forms from patterns: how fast you ramp volume, how predictable your cadence looks, and how often recipients complain. Once Gmail or Outlook decides your domain behaves spiky or unwanted, inbox placement drops even when SPF, DKIM, and DMARC pass.
Fix 5: Warm up like a human, not a blast
Warm-up means gradually increasing daily sends from a new domain, or one that recently hit spam. Start with your highest-intent audience (recent signups, active users, prospects who engaged on LinkedIn). Keep early emails simple: one clear ask, low link count, a real reply path.
- Increase volume slowly. Pick a number you can sustain daily, then step up every few days. Do not double overnight.
- Keep sending windows consistent. Bursts at odd hours look automated.
- Warm each mailbox separately. If you send from multiple inboxes, ramp each one on its own.
For the full ramp schedule and tooling, see our guide to email warm-up.
Fix 6: Control volume spikes and throttling
Providers rate-limit senders they do not trust. If you see soft bounces, deferrals, or "try again later" responses, treat it as a volume signal: reduce daily sends, spread them across more days, and smooth follow-ups so you do not stack a 3-step sequence on the same day. If you use an ESP like Amazon SES or SendGrid for product email, separate traffic types: send marketing, transactional, and cold outreach from different subdomains so a prospecting spike does not poison password resets.
Fix 7: Drive complaint rate toward zero
Spam complaints are one of the fastest ways to lose inbox placement, and you cannot copywrite your way out of bad targeting.
- Target tighter. Use firmographic filters and role relevance, then personalize the first line to prove intent.
- Stop emailing non-responders forever. Cap follow-ups and add a cooldown before re-contacting.
- Make replies easy. Ask a simple yes-or-no question, and send from a real person, not "no-reply."
- Prefer unsubscribes over complaints. Add an unsubscribe link even for cold outreach (more on this in Fix 12).
Operationally, monitor complaints in Google Postmaster Tools and watch IP and domain signals in Microsoft SNDS.
Fixes 8-10: Clean Your List and Target Engagement
Volume pacing and complaint monitoring help, but list quality decides whether those sends build trust or burn it. A small share of bad addresses, role inboxes, and disengaged recipients pushes bounces up and engagement down, two signals providers treat as risk.
Fix 8: Verify addresses before you send
Email verification reduces hard bounces and spam-trap risk by catching invalid domains, dead mailboxes, and typos. Verify at two points: when you import a list, and again right before a big campaign, because addresses decay. Validity estimates B2B data decays at roughly 22.5% per year as people change jobs.
- Use a verifier with clear statuses: tools like ZeroBounce, NeverBounce, and BriteVerify label emails valid, invalid, risky, or unknown.
- Suppress role accounts for cold email: info@, sales@, support@, admin@, and postmaster@ generate complaints and rarely reply.
- Watch accept-all domains: some accept any address at SMTP time. Treat these as risky and send to them at lower volume.
Keep hard bounces under 2%. Past 5%, Gmail and Outlook start filtering you regardless of content.
Fix 9: Add a sunset policy
A sunset policy stops sending to contacts who do not open, click, or reply over a defined window. Disengaged recipients drag down positive signals and raise the odds of spam-folder placement.
- Pick an engagement window. For outbound, use replies as the primary signal and treat opens as unreliable.
- Send one re-engagement step. A short "still relevant?" email, then stop.
- Suppress, do not delete. Keep the record in your CRM with a do-not-email flag so it does not get re-imported.
Fix 10: Segment for relevance
Segmentation improves deliverability because it concentrates sends on people most likely to respond, and providers observe that behavior.
- Separate proven from experimental. Send higher volume to ICP-matched accounts that historically reply; keep test segments small.
- Split by provider. Gmail and Microsoft 365 react differently to the same campaign. Monitor bounces and complaints per provider.
- Split by intent. A job-change or recent-funding signal usually outperforms a generic industry blast.
Fix 11: Write Emails That Do Not Trigger Filters
Segmentation gets you in front of people who might care. Content decides whether filters treat the message like a real note or like automated outreach. Providers score formatting fingerprints, link reputation, and whether your email resembles known spam templates. You do not need clever copy, you need clean structure that looks like normal person-to-person email.
Plain text wins for cold email
For cold outbound, default to plain text or very light HTML. Heavy templates, hero images, and multi-column layouts raise the odds of spam-folder placement, especially on strict Microsoft 365 tenants.
- Write a reply-able note: short paragraphs, one clear question, a real signature, a working reply-to.
- Avoid copy-paste artifacts: Google Docs and rich editors inject odd spans, fonts, and hidden characters that trip content scanners.
- Keep punctuation normal: all-caps subjects, repeated exclamation points, and "RE:" tricks look manipulative.
Links, tracking, and formatting
- Limit to 0 to 2 links in cold email. One is often enough.
- Do not use shorteners like Bitly or TinyURL. They hide destinations and get abused by spammers.
- Be careful with tracking. Pixels and wrapped links change the message fingerprint and can increase spam placement on some setups.
- Avoid attachments in first-touch outbound. Link to a PDF on your site instead.
On word choice, the patterns matter more than any single banned term, but a few categories genuinely hurt. Our list of 500+ email spam trigger words and our 10 pro tips to avoid the spam folder cover what to cut. When you troubleshoot, test the exact email you send with Mail-tester, which scores spam signals and authentication from a real message and headers.
Fix 12: Make Unsubscribing Easy
When recipients cannot find a clean exit, they hit "Report spam." That single click is a direct negative signal to Gmail and Outlook, and it is harder to recover from than an unsubscribe. Easy unsubscribing improves inboxing because it converts frustration into a low-risk action: providers see fewer complaints, and your future sends face less filtering.
"Easy unsubscribe" means a one-step, immediate opt-out with no login, no password reset, and no "pick 12 topics" gate.
- Put an unsubscribe link in every email. Footer placement, plain anchor text.
- Honor the request immediately. Update suppression on click. Do not keep sending for "up to 10 days."
- Suppress across tools. Centralize suppression in your CRM and sync it outward so an opt-out stops every campaign.
- Use List-Unsubscribe headers. Many inboxes surface a native unsubscribe button when you include
List-UnsubscribeandList-Unsubscribe-Postheaders. Google and Yahoo now require one-click unsubscribe for bulk senders. The header is defined in RFC 2369.
How to Monitor Deliverability Weekly
Deliverability rarely fails all at once. It slips first in bounces, throttling, and provider reputation dashboards. Run this weekly on every sending domain and mailbox group.
- Pull five numbers: delivery rate, hard bounce rate, soft bounce rate, spam complaint rate, reply rate. Track per provider where you can.
- Check authentication health: send one real message to Mail-tester and confirm SPF, DKIM, and DMARC pass and align.
- Review provider reputation: open Google Postmaster Tools for domain reputation, and Microsoft SNDS if you qualify on volume.
- Scan bounce reasons: "mailbox unavailable" (bad list), "policy rejection" (content or reputation), "rate limited" (too much, too fast).
- Audit list inflow: sample 50 recently added leads, verify sources, and confirm you suppress role addresses.
Use a simple traffic-light scorecard. Green: bounces flat, complaints near zero, replies steady. Yellow: soft bounces rise or a provider reputation drops a level, so slow volume for 48 to 72 hours and tighten targeting. Red: hard bounces spike, policy rejections climb, or seed tests start spam-foldering, so pause the sequence, verify the next batch, remove risky segments, and retest templates before resuming.
How Overloop Operationalizes These Fixes
Most of the 12 fixes are settings and habits, but they fail in the details: one bad import, one inbox that spikes volume, one sequence that keeps hammering non-responders. Overloop is built to keep those failure points visible and controllable at the campaign level, so you can scale outbound without turning your domain into a test lab. Four controls map directly to the fixes above:
- Verification before sending (Fix 8). Verify prospects in bulk or as you build lists, then exclude invalid and risky addresses before they enter a sequence. That directly cuts the hard bounces providers treat as a trust signal.
- Pacing across inboxes (Fixes 5-6). Overloop helps you keep cadences consistent and avoid the "50 yesterday, 500 today" pattern that triggers throttling on Gmail and Microsoft 365.
- Personalization that reads human (Fixes 7, 11). It generates copy from prospect context in your tone of voice, so relevance lifts replies and lowers complaints, which protects reputation more than any subject-line trick.
- Global suppression (Fix 12). One opt-out stops every follow-up step across campaigns, even when several reps run outbound in parallel.
The operational win is consistency: the same verification rules, suppression behavior, and sending guardrails apply to every campaign. When a risk signal appears, you act inside the same workflow, pausing the campaign, removing a segment, or reducing daily volume on the inboxes sending that sequence. The Starter plan is $69/mo with verification and finder credits gated by the plan, so there is no overage bill at month-end.
Deliverability is not one switch. It is four buckets that compound: identity (SPF, DKIM, DMARC alignment), reputation (warm-up, steady volume, low complaints), list quality (verification, sunset, segmentation), and content (plain, few links, easy unsubscribe). Get the first three right and content stops being your problem.
If you do one thing today, send your exact email to Mail-tester, confirm authentication passes and aligns, then verify your next batch before you hit send. That order, authentication then list then content, is the difference between a 90%+ deliverable program and a bounce machine.
Frequently asked questions
How long does email warm-up take?
Plan for 2 to 4 weeks to reach stable daily volume on a new domain or new inbox. You earn trust through consistent cadence, low bounces, near-zero complaints, and real replies. If you see Microsoft 365 deferrals or a domain reputation drop in Google Postmaster Tools, extend the warm-up and reduce daily sends for 48 to 72 hours. See our full email warm-up guide for the ramp schedule.
What daily volume is safe for cold email?
There is no universal safe number, because mailbox providers score your behavior and your audience response, not a fixed quota. As a practical guardrail, keep each individual inbox at a low, steady daily number until replies look healthy and soft bounces stay low. Sudden jumps trigger throttling faster than steady growth.
Do I need DMARC for cold email?
Yes. DMARC with alignment tells Gmail and Outlook that your From identity is real. Google and Yahoo made DMARC a baseline requirement for bulk senders in February 2024. Start with a p=none monitoring policy and reporting, then move to quarantine or reject once legitimate sources pass consistently.
Should I buy a new sending domain if I hit spam?
Treat it as a last resort. If SPF, DKIM, and DMARC alignment are wrong, a new domain fails the same way. If your list quality is poor, a new domain burns quickly. Switch domains only after you have fixed authentication, tightened targeting, and cleaned the list, then warm the new domain slowly.
Does open tracking hurt deliverability?
It can. Some setups treat tracking pixels and wrapped links as higher risk, especially on stricter Microsoft 365 tenants. Apple Mail Privacy Protection also inflates open data, so opens are an unreliable signal. If you troubleshoot spam placement, test a plain version with fewer links and reduced tracking, then compare bounces, deferrals, and replies.
What is the fastest way to fix email deliverability?
Do these in order: pause the failing sequence, verify the next batch, suppress role and risky addresses (including accept-all domains), simplify the email to plain text with zero or one link, then restart at lower daily volume. Send your exact email to Mail-tester first to confirm SPF, DKIM, and DMARC pass and align before you send another batch.
