Why Cold Emails Go to Spam: Diagnosis and Fixes

Cold emails going to spam usually means one of 7 checks is failing: authentication, domain age, volume, complaints, bounces, content, or mailbox reputation. If you keep sending before diagnosis, providers get more negative signals and recovery takes longer. This guide gives you the checks, records, fixes, and recovery tests to run.

Start with authentication because it is the fastest fault to prove. If you need the full DNS setup, keep the SPF, DKIM and DMARC guide open while you run the checks below. You can also test records with the free SPF checker, DKIM checker, and DMARC checker.

What failed first?

Do not change five things at once. Run a small test from the same mailbox to inboxes you control. Use the same copy, links, tracking, and sending route as your campaign. Then compare the result with this table.

Use provider-specific checks when the problem is isolated. For Gmail and Workspace, see the Gmail spam fix guide or Google Workspace spam guide. For consumer providers, use the Yahoo spam fix guide and Outlook spam fix guide.

Which numbers matter?

Cold email recovery is easier when you know the thresholds. Some are published by providers. Others are safe operating ranges used by deliverability teams. Treat the ranges as guardrails, not guarantees.

Primary references: Google publishes sender requirements in its Email sender guidelines, Yahoo lists sender practices at Yahoo Sender Hub, Microsoft documents high-volume requirements for Outlook.com in its sender requirements announcement, and SPF limits are defined in RFC 7208.

Are SPF, DKIM and DMARC passing?

Authentication tells receiving providers that your mail is allowed to use the sending domain. It does not guarantee inbox placement. It removes one major reason for spam placement and rejection.

Fix SPF

SPF is a TXT record on the sending domain. It lists the systems allowed to send mail for that domain.

A simple Google Workspace SPF record is:

Use one SPF record only. Do not create multiple TXT records starting with v=spf1. Merge all approved senders into one record.

If you send through another platform, add that platform's include or sending IP. Amazon SES, SendGrid and Mailgun each give provider-specific SPF or return-path instructions. Follow the provider's current documentation instead of copying an old record.

Then check the 10-lookup limit. Each include, a, mx, exists, and redirect can count. If you exceed 10, receivers can return permerror and treat the message as unauthenticated. Use the SPF 10-lookup fix if your record has too many vendors.

Fix DKIM

DKIM signs the message with a private key. The public key lives in DNS. Receivers use it to prove the message was not changed and that the signing domain is authorised.

The DNS record usually looks like this:

The selector depends on your provider. Common selectors include google, zmail, default, selector1, selector2, k1, s1, mail, dkim, lark, feishu, and zoho.

For Google Workspace, the usual path is Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate the key, publish the TXT record, then return and start authentication.

For Zoho, Lark, SES, SendGrid and Mailgun, use the provider's domain authentication page. If you are warming Zoho, the Zoho Mail warm-up guide covers the free API route and the DNS checks.

Fix DMARC

DMARC tells receivers what to do when SPF or DKIM does not align with the visible From domain. For cold email diagnosis, start with monitoring unless your domain is already mature.

A safe starting record is:

This record asks receivers to report results without rejecting mail. It also allows relaxed alignment. Relaxed alignment means mail.example.com can align with example.com.

For bulk sending to Gmail and Yahoo, DMARC must exist. Yahoo also requires the From domain to align with SPF or DKIM. Microsoft requires SPF pass, DKIM pass and DMARC at least p=none with alignment for domains sending over 5,000 emails per day to Outlook.com consumer mailboxes.

Check headers

After DNS is published, send a test to Gmail. Open the message, choose Show original, and read Authentication-Results. You want spf=pass, dkim=pass, and dmarc=pass.

If one fails, do not guess. The header usually names the domain that failed. Fix that domain, not a different one.

Is your sending pattern risky?

A technically authenticated domain can still look risky. Mailbox providers judge behaviour. Sudden volume, no replies, repeated templates, and poor engagement can push mail into spam.

Reduce volume first

If spam placement appears during a campaign, cut volume before rewriting everything. Pause the worst mailbox for a few days and reduce the rest to a low daily send count.

For cold outreach, stay around 30 to 50 real cold emails per day per warmed mailbox. New mailboxes should start lower. If you need more volume, add more mailboxes across several domains instead of forcing one mailbox to send hundreds of first-touch emails.

If you use BobWork Email Warm-up, the free pool does this step automatically for warm-up mail: it starts at 3 emails per day, adds 2 per day, and caps at 30 per day unless you edit the cap. Weekends run at 30%, and sends spread across 09:00 to 18:00 in the mailbox's own time zone.

Separate domains carefully

Do not send cold email from your main company domain if losing inbox placement would hurt normal business mail. Use a secondary domain that is close to your brand but separate enough to protect your primary domain.

Set up SPF, DKIM and DMARC before the first campaign. Then warm the domain and the mailboxes. The secondary domain setup guide gives the safer order.

Watch each mailbox

One bad mailbox can pull down a campaign. Diagnose at mailbox level and domain level.

If only one mailbox has spam placement, pause that mailbox. Check whether login, SMTP, DKIM signing or recent bounce rate differs from the others.

If every mailbox on the domain fails, treat it as a domain problem. Lower all sending and re-check DNS alignment.

Are your list and copy safe?

Cold email spam placement often starts with targeting, not infrastructure. Providers see what recipients do. Deletes without reading, spam complaints, bounces, and no replies are negative signals.

Remove risky contacts

Suppress role accounts unless you have a clear reason. Examples include info@, sales@, support@, and admin@. They are often shared, monitored differently, or more likely to complain.

Remove stale contacts. If a lead source is old, unverified, scraped or purchased, bounce risk rises. A clean list beats a larger list.

Track bounces by reason. Hard bounces should be suppressed permanently. Repeated soft bounces from the same domain are also a warning.

Make the email look human

Use plain text first. Avoid heavy HTML, large signatures, images, attachments, and multiple links. Do not use link shorteners.

Keep the first email short. One clear reason for writing is better than a long pitch. If the email looks like a newsletter, but the recipient did not subscribe, it can get treated like unwanted bulk mail.

Use one call to action. Asking for a meeting, a reply, a download, and a referral in the same message makes engagement less likely.

Add unsubscribe correctly

Bulk senders should make opting out easy. Yahoo expects one-click unsubscribe for bulk mail and says unsubscribes should be honoured within 2 days. Gmail also expects easy unsubscribe for bulk senders.

For cold email, include a clear opt-out sentence at minimum. If your sending tool supports it, add a List-Unsubscribe header and link. Suppress unsubscribed contacts permanently.

If you use sequences, stop on reply. A reply is a clear engagement signal, and continuing automated follow-ups after a reply creates complaints.

Will warm-up help?

Warm-up is useful when the mailbox needs normal activity before or during outreach. It is not a cure for broken fundamentals.

Warm-up should resemble ordinary mail. Short plain-text messages, replies, realistic timing and spam-folder rescue are more useful than blasting artificial volume.

BobWork Email Warm-up uses a shared warm-up network by default, or a private pool per account if you prefer. It only touches warm-up messages carrying the engine's own hidden header, or a known warm-up subject for Zoho API senders. Found warm-up mail is moved out of Spam, marked read, labelled Warm-up, and archived after 24 hours. Real mail is never read, moved or answered.

If you are deciding whether warm-up fits the problem, read does email warm-up work and the 14-day and 28-day warm-up schedule.

What should you do now?

Work from fastest to slowest. Do not start with copywriting if DMARC is failing.

Use the provider guides for the mailbox you send from. Gmail users can start with warm up Gmail. Google Workspace users should use warm up Google Workspace. If you send through a platform, use the SendGrid warm-up guide, Mailgun warm-up guide, or Amazon SES warm-up guide.

Did the fix work?

Do not judge recovery from one email. Use a small, repeatable test.

First, confirm DNS. Your test message should show spf=pass, dkim=pass, and dmarc=pass in the receiving inbox headers. If authentication fails, recovery has not started.

Second, confirm placement across providers. Send to Gmail, Yahoo and Outlook.com test inboxes. If only one provider fails, use that provider's guide. If all providers fail, look at domain-level reputation, list quality and content.

Third, compare copy variants. Send a plain-text version with no tracking and no link. Then send the campaign version. If the plain-text email lands better, your content, links or tracking domain are part of the issue.

Fourth, monitor real campaign signals. Watch bounces, unsubscribes, replies and complaints where provider tools expose them. Google Postmaster Tools can help when you send enough volume to Gmail accounts. Microsoft and Yahoo expose fewer cold-email-friendly diagnostics, so your own test inboxes and bounce logs matter.

Fifth, restart slowly. Send to your best-fit segment first. Avoid old leads, broad titles and weak matches during recovery. If spam placement returns, stop and identify the exact change that caused it.

If you want a practical baseline, connect the mailbox to BobWork Email Warm-up. It is free for up to 10 mailboxes, no credit card and no time limit. It checks SPF, DKIM and DMARC daily, warms mailboxes on a controlled ramp, and shows readiness before outbound: 7+ days warming, 7-day spam rate at or below 3%, and at least 30 warm-up emails received.

Frequently asked questions