Cold email deliverability: Gmail, Yahoo and Outlook rules

You write a careful first email to a company that has just opened, hired or raised money. The offer is relevant, the timing is right, and nobody answers. Often the email was fine. It simply never reached the inbox, because the domain it came from could not prove who sent it.

Gmail, Yahoo and Microsoft's Outlook.com have each published rules for people who send email to their users. Some apply to every sender, some only to large ones, but all of them shape where your cold email lands. This post sets out what each provider actually asks for, links to their own pages so you can check, and walks through how to pass each rule from an ordinary mailbox on your own domain.

Why good cold emails land in spam

Mailbox providers cannot read your intentions. They see a message, the domain in its From line, and the records that domain has published. If those records do not confirm that your mail server is allowed to send for your domain, the message looks the same as a forged one. Add a few people marking it as spam and the provider learns to file your next email there too.

The good news is that the rules are public, short and checkable. Most of them come down to three DNS records, a header in each email, and how many people complain about what you send.

What Gmail asks of every sender

Google's email sender guidelines split senders into two groups. Everyone sending to personal Gmail accounts must meet the first list. Anyone sending close to 5,000 messages or more to personal Gmail accounts in 24 hours is a bulk sender, and Google's sender guidelines FAQ says that once you reach that level, you are treated as a bulk sender permanently.

Rules for all senders

• Set up SPF or DKIM for your sending domain.
• Have valid forward and reverse DNS (PTR) records for the sending IP or domain.
• Send over a TLS connection.
• Keep the spam rate reported in Google Postmaster Tools below 0.3%. Google recommends staying below 0.1%.
• Format messages to the internet message standard, and do not impersonate Gmail in your From header.

Extra rules for bulk senders

• Set up both SPF and DKIM, plus a DMARC record (a policy of none is accepted).
• Align your From domain with the domain SPF or DKIM checks.
• Support one-click unsubscribe for marketing and subscribed messages, with a clearly visible unsubscribe link in the body as well.

A freelancer sending twenty careful emails a day is nowhere near the bulk line. That is not a reason to skip the bulk rules. They describe what a trustworthy sender looks like, and meeting them costs you an afternoon at most.

Yahoo and Outlook: the same ideas, a few differences

Yahoo

Yahoo's Sender Hub best practices match Google's closely. All senders need SPF or DKIM, valid forward and reverse DNS, and a spam rate below 0.3%. Bulk senders need SPF and DKIM, a DMARC policy of at least p=none that passes, a From domain aligned with SPF or DKIM, a working one-click List-Unsubscribe header, and must honour unsubscribes within 2 days. Yahoo notes that it measures spam rate on mail delivered to the inbox.

Outlook.com

Microsoft announced its requirements for high-volume senders to hotmail.com, live.com and outlook.com addresses. Domains sending more than 5,000 emails a day must pass SPF and DKIM and publish DMARC with at least p=none, aligned with SPF or DKIM. Mail that fails is sent to Junk, and Microsoft says rejection will follow. It also recommends a From or Reply-To address that can receive replies, a clear unsubscribe link, removing invalid addresses, honest subject lines and sending only to people who would expect your mail.

The rules side by side

Each cell comes from the provider's own page linked above. Providers update these pages, so check them again before you rely on a detail.

Set up SPF, DKIM and DMARC for cold email

All three live in your domain's DNS, wherever you bought the domain or host its records. Your email host (the company that runs your mailbox) gives you the exact values.

1. SPF: publish one TXT record that lists the servers allowed to send for your domain, using the include value your email host gives you. Keep it to a single SPF record; two records break it.
2. DKIM: turn on DKIM signing in your email host's admin panel and publish the public key it shows you as a DNS record. Google says sending to personal Gmail accounts needs a key of at least 1024 bits, so choose 2048 if offered.
3. DMARC: publish a TXT record at _dmarc on your domain. Start with p=none and an address for reports, read them for a few weeks, then move to quarantine once all your real mail passes.
4. Alignment: send from an address on the same domain your records cover. Sending as you@yourcompany.com through a server that signs for a different domain is the most common reason DMARC fails.
5. Test: send a message to a Gmail address you own, open it, choose Show original, and look for SPF, DKIM and DMARC all marked PASS.

Keep spam complaints low

Records prove who you are. Complaints decide whether people want to hear from you. A 0.3% limit is small: on a few hundred emails, a handful of spam clicks can matter. The way to stay under it is to write to fewer, better people.

• Write only to businesses with a real, recent reason to hear from you, such as a new opening, a hire or a raise. Our post on hiring signals shows how to spot them.
• Build your list from public records and published work addresses, never bought lists. See building a B2B lead list from public data.
• Narrow who you write to before you write. An ideal customer profile keeps poor fits off the list.
• Start with a small number of emails a day and grow slowly, so providers see a steady pattern.
• Remove addresses that bounce straight away, as Microsoft also recommends.
• Stop following up the moment someone replies. The follow-ups guide covers how many to send and what each one should add.

One-click unsubscribe, done properly

RFC 8058 is the standard behind the unsubscribe button Gmail and Yahoo show next to the sender's name. An email carries two headers: List-Unsubscribe with an HTTPS address, and List-Unsubscribe-Post set to List-Unsubscribe=One-Click. When someone presses the button, their provider sends a POST request to that address and the person is removed, with no page to visit and no login. The standard also says the message needs a valid DKIM signature covering both headers, which is one more reason to get DKIM right.

For cold email this is a gift, not a burden. Someone who is not interested can leave in one click instead of reaching for the spam button, and an unsubscribe does not count against you the way a complaint does. Honour it quickly; Yahoo asks bulk senders to do so within 2 days, and Google's FAQ recommends 48 hours.

A quick check before every campaign

1. SPF, DKIM and DMARC all pass on a test email to an address you own.
2. The From address is on the domain those records cover, and it receives replies.
3. Every email has one-click unsubscribe and a visible unsubscribe line.
4. Every person on the list has a clear reason to hear from you, and their address was published.
5. Your daily volume is modest, and follow-ups stop on reply, unsubscribe or bounce.