Why Your Cold Emails Land in Spam (a Deliverability Checklist for Agencies)

Quick answer: Cold emails land in spam for three reasons, in this order: your domain isn't authenticated (SPF, DKIM and DMARC), you sent too much too fast from a brand-new address, or nobody replies to you. Authenticate the domain, send from a separate domain you don't mind burning, warm it up over two to three weeks, keep volume under about 30 a day per mailbox, and write mail that earns replies — reply rate is itself a deliverability signal.

You can write the best audit-first pitch in your city and still get nothing back, because the message never reached a human. Deliverability is the invisible half of cold outreach, and it's the half most agencies never diagnose — a silent inbox looks exactly the same whether your copy is weak or your mail is being filed into spam.

Here's what actually decides where your cold email lands, in the order it matters.

First: is it definitely a deliverability problem?

Before rebuilding anything, get evidence. Three cheap checks:

• Send yourself the real thing. Use test inboxes on Gmail, Outlook and a common local provider — not a preview tool. Send the actual message, from the actual address, with the actual links.
• Check the open pattern. Opens are unreliable in absolute terms, but a collapse from a normal rate to almost nothing overnight is a strong spam signal rather than a copy problem.
• Ask one prospect. If you have any relationship at all, ask them to check their spam folder. One confirmed answer beats an afternoon of guessing.

Authenticate the domain — this is non-negotiable

Gmail and Microsoft now require bulk senders to authenticate, and unauthenticated mail from an unknown domain is filtered aggressively. Three DNS records do the work:

• SPF lists which servers are allowed to send as your domain. Without it, anyone can forge you and receivers know it.
• DKIM cryptographically signs each message so the receiver can verify it wasn't altered and really came from you.
• DMARC tells receivers what to do when SPF or DKIM fails, and sends you reports. Start at p=none to observe, then tighten.

All three are DNS entries at your domain registrar, they take minutes, and they cost nothing. If you skip this step, nothing else on this page will save you.

Never cold-email from your main domain

Domain reputation is hard to build and easy to destroy, and it's shared by every message from that domain — including your invoices, your client threads and your password resets. If a cold campaign gets flagged badly enough, you can damage the mail your business actually depends on.

The standard fix: buy a close variant of your domain — a .co or a hyphenated version, or getyouragency.com alongside youragency.com — point it at your main site, and send cold outreach only from there. If the reputation goes bad, you retire the domain instead of your business.

Warm up before you scale

A brand-new domain sending fifty emails on its first morning looks exactly like a spam operation, because that's what spam operations do. Reputation is earned through gradual, normal-looking behaviour.

• Wait a couple of weeks after registering before sending anything cold. Domain age is a signal in itself.
• Start small — five to ten a day in the first week, then increase gradually over two to three weeks.
• Cap the steady state at roughly 30 to 50 a day per mailbox. If you need more volume, add mailboxes, not throughput.
• Send like a person. Spread messages across working hours instead of firing them in one burst at 9:00.

What's inside the message matters too

Content signals won't rescue an unauthenticated domain, but they will sink an otherwise healthy one:

• Keep it short and plain. Heavy HTML templates, big images and multi-column layouts read as marketing. A cold email should look like a normal message from a person.
• One link, at most. Several links — especially shortened ones — is a classic pattern filters look for. A bare tracking domain with no reputation hurts too.
• Drop the sales vocabulary. Free, guarantee, act now, limited time, rows of exclamation marks. You don't need any of it in an audit-first pitch anyway.
• No attachments. Send the audit as a link, or offer to send it after they reply.
• Make unsubscribing easy. One plain line at the bottom. Someone opting out costs you nothing; someone hitting "report spam" because there was no alternative costs you the domain.

Replies are the strongest signal you control

Mailbox providers watch what recipients do. Replies, moving a message out of spam and adding you to contacts all push you toward the inbox; deletions without reading and spam reports push the other way. This is why relevance and deliverability aren't separate problems — a targeted message to a business with a real, named issue gets replies, and those replies keep the next hundred messages landing.

It's also the argument against blasting a scraped list. Two hundred generic emails with zero replies actively teaches the filters to distrust you. Our audit-first cold email framework exists as much for this reason as for the conversion rate.

Clean the list before you send

Bounces are one of the fastest ways to wreck a new domain. Remove obvious role addresses (info@, admin@, sales@ tend to convert poorly and bounce more), verify addresses before a campaign, and drop anything that hard-bounces immediately rather than retrying it. Keep the bounce rate under a couple of percent.

Keep an eye on it over time

Deliverability decays quietly. Check the DMARC reports arriving at the address you configured, watch your reply rate for sudden drops, and re-test with seed inboxes every few weeks — especially after you change sending volume, domain or provider. The failure mode is always the same: everything looks normal, and the replies just stop.

Where this fits with the rest of the work

Tellsign is built around this order of operations: find local businesses with real, provable problems, then reach out from your own connected mailbox — your domain, your reputation, your sending limits — with the specific finding in the message and an opt-out line included automatically. It also refuses to email the same business twice, which protects the thing this whole page is about.

Fix authentication first, warm up patiently, and give people something worth replying to. If you're still building the list, start with our guide to finding clients on Google Maps — and if you're at the very beginning, getting your first clients with no portfolio.