Cold Email Deliverability Best Practices for Small Senders

Cold email deliverability comes down to four things: authenticate your sending domain, keep your spam complaint rate under the 0.3% ceiling Google and Yahoo both enforce, write and format messages like a person instead of a mail-merge tool, and stop immediately on a bounce or complaint instead of pushing through it. None of this needs a paid deliverability platform — the checks below are free, and most of the setup is one-time.

The checklist, at a glance

What does "deliverability" actually mean?

Deliverability is whether your message reaches the inbox at all, which is a separate question from whether anyone opens or reads it. A technically "delivered" email can still land in spam, in a promotions tab, or get silently dropped — Gmail and Yahoo don't send a notice when that happens. The checklist below is entirely about the first problem: getting past the spam filter. What the recipient does once it's in their inbox is a different, harder problem that no checklist fixes.

What's the minimum authentication every sender needs?

At minimum, Google requires every sender — regardless of volume — to have SPF or DKIM set up, and Yahoo's baseline is the same. If you send more than 5,000 messages a day to Gmail addresses, Google requires all three: SPF, DKIM, and a DMARC record (Google's email sender guidelines, checked October 2026). The three work together:

• SPF (Sender Policy Framework, RFC 7208) is a DNS record that lists which mail servers are allowed to send on your domain's behalf.
• DKIM (DomainKeys Identified Mail, RFC 6376) signs each message cryptographically, so the receiving server can confirm it wasn't altered in transit.
• DMARC (Domain-based Message Authentication, Reporting and Conformance, RFC 9989) tells inbox providers what to do when SPF or DKIM fails, and sends you reports when they do. (RFC 9989 replaced the older RFC 7489 as the current base DMARC spec as of 2026.)

Two specifics worth knowing even at small scale: Google requires a DKIM key of at least 1024 bits for any mail sent to personal Gmail addresses, and messages that fail both SPF and DKIM can be "marked as spam or rejected with a 5.7.26 error" (Google's guidelines, same source). Our cold email guide for SaaS founders has the Google-versus-Yahoo requirements side by side and how to add the DNS records with your registrar — this article assumes that part is already done.

How do you check your own sender reputation for free?

Google Postmaster Tools is free and is the most direct way to see how Gmail actually scores your domain. Verify your sending domain there and it shows dashboards covering "spam rate, reputation, message authentication," and delivery errors, pulled from real Gmail inboxes (Google Postmaster Tools overview, checked October 2026). Two caveats from Google's own documentation: the data only covers mail sent to personal @gmail.com and @googlemail.com addresses (not Google Workspace accounts), and a day with too little volume may show no data at all, which Google says is intentional to protect recipient privacy. For outreach at founder scale — a handful of emails a day — expect gaps in the dashboard rather than a clean daily trend, but the spam-rate and authentication numbers are still worth checking weekly.

What in the email itself can get you flagged as spam?

Filters read more than your sending reputation — they read the message. Google's sender guidelines are specific about what to avoid:

• Match your identity. "Email message subject, headers, display names, and other message elements should accurately represent the sender identity." Don't put Re: or Fwd: in a subject line unless it's an actual reply or forward.
• Keep headers valid and singular. Every message needs a valid Message-ID, and headers like From, To, Subject and Date should appear only once each, formatted to RFC 5322. A From: header should list exactly one email address.
• Don't fake formatting. Google explicitly warns against using "emojis or other non-standard characters to imitate graphic elements," and against using HTML and CSS to hide content in a message — both read as attempts to trick a filter, and Google says hiding content "might cause messages to be marked as spam."
• Don't impersonate anyone. That includes Gmail's own From: headers and any domain or sender you don't have permission to represent.

Personal cold email sent from a normal email client already does most of this by default — the risk shows up when people copy-paste from a marketing template that was built for bulk sending and carries some of that baggage (tracking pixels disguised as images, hidden preview text, a generic From: name that doesn't match the reply-to address).

How should you handle bounces and invalid addresses?

Treat a bounce as a hard stop, not something to retry. Google's guidance is direct: "automatically unsubscribe recipients who have multiple bounced messages," and if your messages "start bouncing or start being deferred, reduce the sending volume until the SMTP error rate decreases" rather than sending through it. It also flags two SMTP codes worth recognizing if you ever see them in a bounce message: 5.7.26 (an authentication failure) and 4.7.28 (a temporary rate limit, where Google's guidance is to stop sending for at least 10 minutes).

For outreach where you found the address yourself rather than someone opting in, the practical version of "don't buy lists" and "don't send to people who didn't sign up" (both explicit in Google's guidelines) is to verify the address before you send at all. Our guide to finding a website owner's email covers the free verification step most people skip, which catches a dead or mistyped address before it becomes a bounce on your record.

How fast should you ramp up a brand-new sending domain?

Gradually. Google's guidelines call out "sudden volume spikes" as something to avoid, without giving a specific daily number for small senders — the rule is about the shape of the increase, not a threshold. A domain with zero sending history has no reputation yet, good or bad, so the safest pattern is a handful of emails for the first week, a modest increase the second, and your normal volume only once replies and opens (not just sends) are coming back clean.

If you'd rather see your reputation build than guess at it, Mail Mantis — a free, open-source tool from the team behind Larvabot — sends itself an ordinary email to inboxes you already own (Gmail, Outlook, iCloud, or any IMAP account) and reports back whether each one landed in the inbox or in spam, so you can watch a new domain's standing change instead of assuming it's fine (Mail Mantis on GitHub, checked October 2026). It's a separate tool and doesn't connect to Larvabot directly. Larvabot's own outreach drafts stay under the volume thresholds above by design — personal email drafts go out in small batches (one or two per campaign per day) and nothing sends until you approve it, which keeps a new domain's ramp slow automatically rather than by willpower (see how the email drafts work).

Frequently asked questions

Is a 0.3% spam complaint rate actually strict?

It's stricter than it sounds. If 1,000 people receive your message, Google's ceiling of 0.3% means three complaints or fewer — and its stated target is even lower, under 0.10%. At founder scale (tens of emails, not thousands) that translates to: one complaint on a small batch is already a signal to stop and rethink the message, not something to shrug off.

Do I need DMARC if I only send a few emails a day?

Google only requires it for senders over 5,000 messages a day to Gmail addresses, so a founder sending outreach by hand doesn't strictly need it. It's still worth setting up once SPF and DKIM are in place, since it's the record that gets you reports when something's misconfigured, rather than finding out from a bounce.

Does a new sending domain start with bad reputation?

No — it starts with no reputation at all, which is different. Spam filters have nothing to score it against yet, which is why a slow ramp matters: a sudden burst of outreach from a day-old domain looks identical to what spam does, even if every message is genuine.

Does Gmail treat a low open rate as a spam signal?

No. Google's own position is that it doesn't track opens for this purpose, and a low open rate on its own isn't evidence of a deliverability problem. Spam rate, authentication, and sending behavior are the signals that matter — not whether people are opening what already reached them.

What should I do the moment I get a bounce?

Stop sending to that address and don't retry it. If you're seeing bounces across several addresses in the same batch, Google's guidance is to pause and reduce volume until the error rate drops, rather than sending through it — repeated bounces are one of the fastest ways to damage a domain that's still building reputation.