Cold Emails Going to Spam? How to Find the Real Cause
How-to — — by Mahmoud Zalt
Spam placement is a reputation and consent problem, not a copy problem. What Google actually requires, what to fix first, and where the legal duty sits.
The first sign is usually a silence that does not match the numbers. Opens look fine, replies dry up. Or you send yourself a test and find it sitting in spam, and you start swapping words in the subject line, hoping one of them is the culprit.
Here is the uncomfortable framing that makes the rest of this make sense. A spam filter is not marking your email. It is marking you, and the domain you send from, based on how thousands of previous messages were received.
That means the fixes are boring and structural. Authenticate the domain properly, send at a volume the domain has earned, send to addresses that exist, and send to people who have some plausible reason to hear from you. In that order.
What Google actually requires from senders
Google publishes its email sender guidelines, and they are the clearest baseline available. Every sender must set up SPF or DKIM authentication for their sending domain, use a TLS connection, and keep valid forward and reverse DNS records. Those are not optional extras, they are the floor.
Senders who send roughly 5,000 or more messages a day to Gmail accounts carry extra requirements on top.
- Both SPF and DKIM. Not one or the other. Google requires both to be set up for the sending domain.
- DMARC. A DMARC record on the sending domain, with the From header domain aligned to the SPF or DKIM domain.
- One-click unsubscribe. For marketing and subscribed messages, using the List-Unsubscribe-Post and List-Unsubscribe headers, plus a clearly visible unsubscribe link in the message.
- A spam rate below 0.3 percent. Measured in Google's Postmaster Tools. Google recommends staying below 0.10 percent to leave yourself room.
Google also states the point most cold senders would rather skip: do not send messages to people who did not sign up to get messages from you. That single line explains more spam placement than any subject line ever will, because the complaint rate it produces is the number the filters are watching.
The fix order that actually works
Do these in sequence and stop guessing. Each step either fixes the problem or rules out a whole category, and none of them involves rewriting your email until the very end.
From worst offender to smallest detail
- Authenticate the domain — Confirm SPF, DKIM, DMARC and MX records exist and are correct. Instantly documents a Test domain setup action on its Email Accounts dashboard that checks these, and names missing or incorrect DNS records as a cause of bounces and disconnected accounts.
- Verify the list before you send — Instantly's guidance is to verify all emails before uploading and clean lists regularly, because high bounce rates damage sender reputation. Bounces are the fastest way to convince a provider you are guessing at addresses.
- Cut the daily volume — Instantly recommends a maximum of 30 campaign emails per day per account. Volume is the variable people raise first and should raise last.
- Warm up new accounts — Instantly recommends warming up new accounts gradually for at least two weeks before sending at full volume. A brand new domain with no history is treated with suspicion, and that is reasonable.
- Make leaving easy — Include a clear, easy to find unsubscribe option, and honour it immediately. Complaints fall when the alternative to complaining is one click.
- Then look at the message — Instantly's documented content guidance is to avoid all-caps words, excessive punctuation, spammy words, too many links or images, and heavy HTML. Useful, but last, because it moves the smallest number.
If you only do one thing from that list, do the first. Authentication is binary and checkable, it takes an afternoon with your domain provider, and it is the one thing that both Google and the sending tools agree is mandatory rather than advisable.
If you bought a list, that is probably your answer
This part is worth saying plainly. If deliverability collapsed shortly after you loaded a purchased list, the list is the cause. Bought lists carry dead addresses, role accounts and abandoned mailboxes, and sending to them produces exactly the bounce and complaint pattern that providers use to identify a sender worth filtering.
No setting inside a sending tool repairs that. Instantly's own campaign error guide documents an automatic pause when recent emails bounce at a rate typically above 5 percent, and asks you to verify the list, review the copy, investigate the bounce reasons and clean the list before resuming. Resuming without cleaning simply reproduces the damage.
The recovery is unglamorous. Cut back to addresses you have verified, accept a much smaller list, slow the sending right down, and rebuild the domain's record over weeks. Instantly notes that reputation problems tied to sending limits or spam flags can need 24 to 48 hours just to settle, and a genuinely burned domain takes far longer.
Symptoms point at different causes, and treating them all with the same remedy wastes weeks. The table below maps what you are seeing to the thing most worth checking first, using only requirements and behaviours the sources above document.
| What you are seeing | Most likely cause | Start here |
|---|---|---|
| Everything lands in spam from day one | Missing or misaligned authentication | Check SPF, DKIM, DMARC and MX on the sending domain |
| Placement got worse after a new list | List quality, bounces and complaints | Verify the list, cut it back, slow the sending |
| Bounces spiked and sending paused | Invalid addresses in the list | Clean the list before resuming anything |
| Fine on one domain, bad on another | That domain's own reputation and history | Warm it up separately, do not raise volume |
| Slow decline over several weeks | Rising complaint rate | Make unsubscribing easy, tighten targeting |
| Gmail worse than everyone else | Bulk sender requirements not met | Check spam rate in Postmaster Tools and DMARC |
Notice what all of this has in common. Deliverability rewards restraint, relevance and record keeping, which are exactly the things a busy founder runs out of first. At Sistava an AI Employee holds that discipline for you, researching who is genuinely worth contacting and keeping the volume honest instead of chasing a bigger number this week.
The legal duty is yours, not your tool's
Whichever platform you send from, the obligations sit with the sender. The FTC is explicit that even if you hire another company to handle your email marketing, you cannot contract away your legal responsibility to comply, and that both the company whose product is promoted and the company that sends the message may be held responsible.
In the United States, the FTC's CAN-SPAM guidance covers all commercial messages and states that the law makes no exception for business-to-business email. Its main requirements are worth reading in full, and these are the ones cold senders trip over.
- Accurate headers and honest subject lines. Your From, To, Reply-To and routing information must be accurate and identify who sent the message, and the subject must reflect the content.
- A real postal address. The message must include your valid physical postal address.
- A clear way to opt out. Explained clearly and conspicuously, with no fee and no requirement beyond a reply email or a single web page.
- Opt-outs honoured promptly. The mechanism must work for at least 30 days after sending, and you must honour a request within 10 business days.
- Penalties are per email. The FTC states that each separate email in violation is subject to penalties of up to 53,088 US dollars.
In the UK the picture is different again. The ICO explains that the PECR rule on marketing by electronic mail does not apply to corporate subscribers, meaning bodies with separate legal status such as companies and limited liability partnerships. But it also states that sole traders and certain other partnerships are classed as individual subscribers and get the same protections as individuals.
And the ICO is clear that UK GDPR still applies whenever you process personal data for direct marketing, even in a business context. If you collect someone's contact details in their business capacity and intend to market to them, you must tell them and have a lawful basis, and they can object or withdraw consent at any time. Treat that as a reason to keep your list small and relevant, not as a loophole.
FAQ
Why do my cold emails go to spam even though the copy is good?
Because filters score the sender before they weigh the words. Google's sender guidelines require SPF or DKIM for all senders, plus SPF, DKIM and DMARC for bulk senders, and ask senders to keep spam rates in Postmaster Tools below 0.3 percent. Authentication, bounce rate and complaint rate move placement far more than a subject line rewrite.
What spam complaint rate is too high?
Google asks senders to keep the spam rate reported in Postmaster Tools below 0.3 percent, and recommends staying under 0.10 percent so you have margin. Complaint rate is driven by how relevant and expected your message is, and by how easy you make it to leave.
Do I need DMARC for cold email?
Google requires DMARC on the sending domain for senders of roughly 5,000 or more messages a day to Gmail accounts, along with SPF and DKIM and alignment between the From header domain and the SPF or DKIM domain. Below that threshold Google still requires SPF or DKIM, TLS and valid forward and reverse DNS records for every sender.
How many cold emails per day per inbox is safe?
Instantly's documented guidance is a maximum of 30 campaign emails per day per account, and warming up new accounts gradually for at least two weeks before sending at full volume. Those are the numbers a major sending platform publishes, and they are deliberately conservative because reputation is slow to build and fast to lose.
Can I fix deliverability after buying a bad list?
You can recover, but not by changing settings. Verify what remains, cut the list back to addresses you can confirm, slow the sending right down, and rebuild the domain's history over weeks. Instantly documents an automatic campaign pause when recent bounces run above roughly 5 percent, and asks you to clean the list before resuming rather than restarting and hoping.
Is cold email legal?
It depends on where your recipients are and how you handle it, and this is general information rather than legal advice. In the US the FTC states that CAN-SPAM covers all commercial messages with no exception for business-to-business email, requires accurate headers, a physical postal address and a working opt-out honoured within 10 business days, and sets penalties of up to 53,088 US dollars per violating email. In the UK the ICO states that the PECR electronic mail rule does not apply to corporate subscribers, but sole traders and some partnerships count as individual subscribers, and UK GDPR still applies whenever you process personal data.
Fix the domain, shrink the list, slow the sending, and only then touch the words. That order is the whole article. If you want a hand with the writing part once the plumbing is right, our free Sistava tools include a cold email generator you can use without an account.
Sources
- Google Workspace Admin Help, Email sender guidelines
- US Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business
- UK Information Commissioner's Office, Business-to-business marketing
- Instantly Help Center, How to Ensure Your Emails Get Delivered and Avoid Spam Filters
- Instantly Help Center, Campaign Error: Troubleshooting Guide
- Instantly Help Center, How to Fix Disconnected Email Accounts