Cold email deliverability in 2026 rests on three things. Authenticate every sending domain, warm every mailbox slowly, and keep complaints and bounces under published thresholds.
Key takeaways
- Google and Microsoft apply their bulk sender rules from about 5,000 messages a day to their consumer inboxes, Yahoo applies its bulk rules without publishing a number, and non-compliant mail can now be rejected rather than filtered.
- For mail to personal Gmail accounts, Google asks senders to keep reported spam below 0.10 percent and never to reach 0.30 percent.
- Google and Yahoo require one-click unsubscribe on marketing mail from bulk senders, Apple requires an unsubscribe link for bulk mail to iCloud, and Microsoft recommends a functional unsubscribe link.
- Practical sending guidance in 2026 caps a warmed mailbox at 20 to 50 messages a day, after a warmup of about three to six weeks.
- The IETF published DMARC as a Proposed Standard, RFC 9989, in May 2026, and Google has required DMARC from bulk senders since February 2024.
Deliverability is not a growth tactic. It is a set of published thresholds, and the whole job is staying under them.
The checklist in one table
Everything below is either a configuration you set once or a number you watch weekly. Run the table top to bottom before a campaign, then re-run rows four to nine every month. Nothing here requires a specialist, and skipping any single row is enough to lose a domain.
Rows one to four are configuration. Rows five to ten are discipline. Teams lose domains on the second group far more often than on the first, because configuration is done once and discipline has to survive a quarter that is behind on pipeline.
- Secondary sending domain
- SPF, DKIM and DMARC
- Warmup of 3 to 6 weeks
- List verified under 30 days ago
- 20 to 50 sends a day per mailbox
What counts as a bulk sender in 2026?
Google counts a domain as a bulk sender once it sends close to 5,000 messages or more in a day to personal Gmail accounts, counted on the primary domain, and Microsoft applies its rules to domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses. Yahoo applies its bulk sender rules without publishing a number. A cold email programme running six mailboxes at fifty a day sits below these thresholds, which is one reason the volume caps below exist.
Microsoft's announcement gives the rejection code 550 5.7.515 for non-compliant high-volume senders since May 5, 2025, and Google's sender guidelines FAQ says that since November 2025 non-compliant messages face temporary and permanent rejections. A permanent rejection leaves no spam folder to recover from, and no engagement signal that will dig you out.
Being under the threshold does not exempt you. The requirements are enforced hardest above it, and applied as reputation inputs below it.
These rules cover consumer inboxes. Google states that its sender guidelines do not apply to messages sent to Google Workspace accounts, and Microsoft's rules cover Outlook.com, Hotmail and Live addresses. Many B2B prospects sit on company domains, where the receiving organisation's own filtering reads similar signals without a published threshold, so treat the numbers above as the safest reference rather than as the rule for every recipient.
How do you set up SPF, DKIM and DMARC correctly?
Publish all three on every sending domain, and make sure the DMARC record aligns with the domain in the From header. SPF lists which servers may send for you. DKIM signs each message so the receiver can prove it was not altered. DMARC tells the receiver what to do when either check fails, and reports back.
Start DMARC at p=none, read the aggregate reports for two weeks, then move to p=quarantine once you can see every legitimate sender passing. Moving straight to p=reject on a domain with unmapped senders is how internal mail disappears.
The IETF published DMARC as a Proposed Standard, RFC 9989, in May 2026, and Google has required DMARC from bulk senders since February 2024. One-click unsubscribe under RFC 8058 belongs in the same setup pass. Google and Yahoo require it on marketing mail from bulk senders, Apple requires an unsubscribe link, and Microsoft recommends one.
How many emails can one mailbox send per day?
Twenty to fifty, after warmup, is the range 2026 guidance converges on. That is not a technical limit. It is the volume that keeps a mailbox looking like a person rather than a broadcaster, which is what the filters are measuring.
Scale comes from more mailboxes, not from more messages per mailbox. Six warmed mailboxes at forty a day is 240 messages, 1,200 a week, which is more cold outreach than most teams can follow up properly. Cold email guidance compiled in 2026 and Unify's domain setup guide both land on the same shape, with inbox rotation as the scaling mechanism.
The number that matters more than the cap is consistency. A mailbox that sends forty every weekday reads as a working person. A mailbox that sends four hundred on Tuesday and nothing else reads as a campaign.
How long does domain warmup take?
Three to six weeks on a new domain, longer if you intend to sit near the top of the volume range. Unify's schedule runs about five messages a day in week one, 5 to 10 in week two, 10 to 20 in week three and 25 from week four, and Instantly's 2026 benchmark report recommends starting at 5 to 10 a day and increasing over 4 to 6 weeks.
Most warmup tools keep running after you go live, and Unify's schedule keeps warmup going in the background once a mailbox reaches full volume. Some practitioners, Emailchaser among them, advise against engagement-faking warmup networks, so judge a mailbox on seed placement tests rather than on a warmup score.
Unify plans on roughly three weeks before a new mailbox carries full volume. Plan the domain purchase a month or more before the campaign, not the week of.
Do you need secondary sending domains?
Yes, if the primary domain carries anything you cannot afford to lose. Cold outreach generates complaints even when it is done well, and a complaint rate that hurts a sending domain also hurts invoices, password resets and customer replies if they share it.
Buy lookalike domains, authenticate each one with SPF, DKIM and DMARC, warm each mailbox, then rotate sending across them. That is the standard 2026 setup and the reason inbox rotation exists as a product feature. The cost is a few dollars a domain a year against the cost of a primary domain in a blocklist.
One caution. More domains is not more volume in the eyes of a receiver that can see they are related. Rotation spreads risk. It does not multiply the amount of cold mail a network will accept from you.
What numbers should you watch after launch?
Four, weekly. Spam complaint rate in Google Postmaster Tools, held below 0.10 percent. Bounce rate, held below 2 percent total and 0.5 percent hard. Reply rate, as the health signal that everything above is working. And inbox placement, sampled with seed accounts rather than assumed from opens.
Set the alarm on complaints rather than on opens. Open tracking became unreliable after privacy protections started pre-fetching images, while the complaint rate is measured by the provider that decides your fate. For context, Instantly's Cold Email Benchmark Report 2026 puts the average reply rate at 3.43 percent, and Prospeo reads a rate consistently below 3 percent as a sign of a deliverability or targeting problem. A campaign under 2 percent therefore calls for a seed test of inbox placement first, and a look at targeting and message once placement is confirmed. If every mailbox on the team is already landing in spam, our guide to fixing team-wide cold email spam placement sets out the repair order.
What changed in 2025 and 2026?
Enforcement hardened in 2025, and the standard caught up in 2026. Microsoft began rejecting non-compliant mail from domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses on May 5, 2025, with the error 550 5.7.515. Gmail began ramping up enforcement in November 2025, with temporary and permanent rejections of non-compliant traffic to personal Gmail accounts. In May 2026 the IETF published DMARC as a Proposed Standard, RFC 9989, which replaces RFC 7489.
The practical effect is that the tolerance band narrowed. Google has required DMARC from bulk senders since February 2024, and below 5,000 messages a day it still asks every sender for SPF or DKIM. The upside is that every requirement is published, measurable and free to implement, which was not true of the reputation heuristics they replaced.
Who can skip most of this?
Nobody sending cold email, but the weight differs. If you send from a domain that is a decade old, with an established reputation, to recipients who have heard of you, rows one to four plus complaint monitoring will carry you. If you are launching a new domain this month to contact people who have never heard of your company, every row applies and warmup is the one that decides whether the rest matters.
The teams that get hurt are in the middle. An eighteen-month-old domain feels established and is not, and a sudden move from twenty messages a day to two hundred looks identical to a compromised account from the receiving side.
Where Freelvy sits in this conversation
Freelvy is our product, an AI sales platform. It works the way ChatGPT or Claude does. You describe the customer you want in one prompt, and Freelvy searches 40+ live sources at query time, maps, official company registries, job boards, storefronts and ad libraries, rather than filtering a stored database. It then enriches every row with verified contact data, 18 providers in cascade for emails and 12 for phone numbers, and writes and sequences the outreach from the same brief. The waterfalls find and verify more than 92% of emails and find more than 90% of phone numbers.
For SDRs and BDRs, deliverability starts upstream of the sending settings, in the list. A row that fails verification is never delivered and never billed, which removes the largest single source of hard bounces before a campaign exists. Sequences are sent from your own mailboxes by the sequencer, so the authentication and warmup work described above stays yours to own and to keep. Plans start at €49 per month for 1,500 credits with unlimited team members. There is a free 7-day trial, no credit card, at freelvy.com.
How we verified these numbers
Provider rules were read on the providers' own pages on September 23, 2026, namely Google's email sender guidelines and FAQ, Yahoo's Sender Hub best practices, Microsoft's Outlook.com announcement and Apple's iCloud Mail postmaster page. The DMARC standard was read on the IETF datatracker the same day. Warmup schedules and daily volume ranges are practitioner guidance rather than provider policy, and are attributed as such in the text.
FAQ
How many cold emails can you send per day safely?
Twenty to fifty per mailbox after a warmup of three to six weeks, according to 2026 practitioner guidance. Scale by adding warmed mailboxes and rotating between them rather than by raising the per-mailbox number. Google and Microsoft apply their bulk sender rules from about 5,000 messages a day to their consumer inboxes.
Is DMARC mandatory for cold email in 2026?
In practice yes. Google, Yahoo and Microsoft all require DMARC from bulk senders, and Google and Yahoo ask every sender for at least SPF or DKIM. The IETF published DMARC as a Proposed Standard, RFC 9989, in May 2026. Start at p=none, read the reports for two weeks, then move to p=quarantine.
What spam complaint rate is too high?
Google asks senders to stay below 0.10 percent and to avoid ever reaching 0.30 percent, and a bulk sender above 0.30 percent becomes ineligible for Gmail's delivery mitigation. Yahoo also asks senders to stay below 0.30 percent. Complaints are the metric providers weigh most heavily, and unlike opens they are measured by the provider itself rather than inferred from tracking pixels.
Should cold email come from your main domain?
No. Use secondary sending domains, authenticated and warmed individually, and keep the primary domain for invoices, support and customer replies. Cold outreach generates complaints even when done carefully, and a shared domain means a bad campaign also delays a password reset email.
How long should you warm up a new domain?
Three to six weeks before production sending. Unify plans on about three weeks for a new mailbox, ramping from about five messages a day to 25, and Instantly's 2026 report recommends a gradual climb from 5 to 10 a day over 4 to 6 weeks. Judge readiness on seed placement tests rather than on the calendar alone.
Does a verified list fix deliverability?
It fixes bounces, which is roughly half the problem. Authentication, warmup, volume discipline and complaint rate decide the rest. A perfectly clean list sent from an unauthenticated new domain at three hundred a day will still fail. Our guide on verifying a B2B email list covers the list half.
What reply rate should you expect in 2026?
Instantly's Cold Email Benchmark Report 2026 puts the average reply rate at 3.43 percent, with the top-performing campaigns above 10 percent. If deliverability checks pass and replies stay under 2 percent, the problem is targeting or message, not infrastructure.
Sources and methodology
Provider documentation and the IETF record were read on September 23, 2026. Third-party pages were read on September 13, 2026 and again on September 23, 2026. Warmup and volume ranges are practitioner guidance.
- support.google.com, answer 81126
- support.google.com, answer 14229414
- senders.yahooinc.com, best practices
- techcommunity.microsoft.com, strengthening email ecosystem outlook’s new requirements for high‐volume senders 4399730
- support.apple.com, en us 102322
- datatracker.ietf.org, doc rfc9989
- rfc-editor.org, rfc rfc8058
- unifygtm.com, explore cold email 2026 domain setup deliverability sequences
- emailchaser.com, learn how to improve your cold email deliverability
- instantly.ai, cold email benchmark report 2026
- prospeo.io, s b2b cold email reply rates
- https://freelvy.com/pricing
More in this cluster: how to verify a B2B email list, Instantly pricing in 2026 for the sending side of the stack, lemlist alternatives for choosing a sender, and the best AI prospecting tools of 2026.