Cold Email Deliverability Is an Infrastructure Problem

The Status Quo Nobody Wants to Audit

Open rate has been a vanity number since Apple's Mail Privacy Protection started pre-fetching every image years ago, and Gmail's own image caching does something similar. A 45% open rate on a cold campaign today tells you almost nothing about whether a human looked at the email. It tells you a server pinged a pixel.

So teams keep optimizing the one thing they can still measure (subject lines, opens) while ignoring the two things that actually determine whether a message gets read: authentication and sender reputation. Google, Yahoo, and Microsoft have spent the last two years tightening bulk sender enforcement, and most outbound stacks are still running on setup work someone did once, eighteen months ago, and never revisited.

Here is the fix order we run on every outbound engineering engagement, and it is a strict order. Skipping ahead doesn't save time, it just means you rebuild the earlier steps later once the reputation damage is already done.

Step 1: Authentication, Or Nothing Downstream Matters

SPF, DKIM, and DMARC need to be passing, not "configured." Configured and passing are different states, and a lot of stacks have one without the other because a DNS record got added once and nobody validated propagation or alignment.

Add RFC 8058 one-click unsubscribe headers on every domain you send cold from. This stopped being optional in 2024 once Google and Yahoo made it a bulk sender requirement, and Microsoft has followed the same direction since. Treat it as table stakes, not a nice-to-have: a missing unsubscribe header is one of the fastest ways to get a domain throttled regardless of how clean your list is.

The bulk sender bar itself is specific and unforgiving: spam complaint rate under 0.3%, bounce rate under 2%. Those numbers are not aspirational targets, they are the line where mailbox providers start deciding your domain is the problem, not your prospect's spam folder.

Step 2: Isolate Sending From Your Real Domain

Never send cold outbound from the domain your company actually operates on. One bad sending window, one aggressive list, one provider algorithm update, and you have put your primary domain's reputation, the one your invoices, your support emails, and your actual customer relationships depend on, at risk for the sake of a prospecting campaign.

Use dedicated lookalike sending domains that redirect to the real site. This is not a trick to dodge filters, it is a blast radius decision: if a sending domain gets burned, you retire it and stand up a new one. If your primary domain gets burned, you are rebuilding trust with Google and Microsoft for months while your actual customer emails start landing in spam too.

We built this exact separation inside a full GTM rebuild for Device Solutions, an HVAC field service outbound program: dedicated sending infrastructure sat alongside list building, segmented Clay enrichment, dedupe, and lead scoring, as one piece of a system, not a bolt-on. Infrastructure that is designed in from the start survives scale better than infrastructure patched in after the first reputation hit.

Step 3: Warm Every Inbox Like the Reputation Is Real, Because It Is

A brand new sending inbox has zero history with mailbox providers. Sending real cold volume from it on day one is the single fastest way to get flagged. Warm every new inbox for a minimum of three weeks: start at five to ten emails a day, ramp slowly, and let the provider build a picture of an inbox that behaves like a real person's.

Once inboxes are warmed, the lever is rotation, not volume. Spread sends across more warmed inboxes and domains rather than pushing more messages through fewer of them. HeyReach for the LinkedIn side and Instantly or Smartlead for email exist precisely so this rotation can be managed at the account level instead of by hand in a spreadsheet. The tools are not the strategy. The rotation discipline is the strategy; the tools just make it enforceable.

Step 4: List Hygiene Is the Silent Killer

Bad data destroys sender reputation faster than bad copy ever will, and it does it quietly. A list with a 4% hard bounce rate looks fine in a spreadsheet and looks like a reputation event to Google.

This is where the enrichment layer and the sending layer have to agree on the same rule: nothing sends to an email that has not cleared a verified-email gate. Dedupe before you enrich, not after, so you are not paying to verify the same contact twice under two different spellings of the same company. And run providers in a stop-on-first-hit waterfall ordered by cost per successful hit for your specific ICP, rather than stacking every enrichment source on every contact regardless of whether the first one already found a valid email. The cost discipline and the deliverability discipline are the same discipline here: a cheaper, cleaner list is also a safer list to send from.

Step 5: Monitor Placement, Not Opens

Since open rate cannot be trusted, measure what can be. Run a seed list across Gmail, Outlook, and Yahoo accounts you control, and check weekly, not quarterly, where your sends are actually landing: inbox, promotions, or spam. Track reply rate, bounce rate, and spam complaint rate as your real health signals. If complaint rate creeps toward that 0.3% ceiling before you have noticed anything in your CRM, the seed list is what caught it.

This is the same operating principle behind every system we build: instrument the clock, watch the leading indicator, and flag the problem before it shows up as a dead campaign three weeks later. A weekly deliverability check is cheap. Rebuilding a burned domain's reputation is not.

Infrastructure Is What Makes the Rest of the System Work

None of this replaces good targeting, a real ICP, or a message worth reading. But infrastructure is the floor everything else stands on. A perfectly scored, perfectly enriched, perfectly suppressed list (see our suppression architecture breakdown for the layer that keeps you from emailing customers and competitors by accident) still fails if the send itself never reaches an inbox. Fix the plumbing first. Then argue about subject lines.

If your outbound program is stuck under a 1% reply rate and nobody on the team has checked inbox placement in the last month, that is where to look before you touch the copy again. Our GTM engineering and outbound work starts exactly there: authentication, domain isolation, warm-up, list hygiene, and placement monitoring, built as one system instead of five disconnected checklist items. If that is the gap, TCA's outbound infrastructure engagement is built to close it.