Why your cold emails are going to spam: a 12-point check.

Authentication: prove the email is really from you

1. SPF. A DNS record listing the servers allowed to send for your domain. If you send through Google Workspace or Microsoft 365, their record must be in it, and there can only be one SPF record per domain.
2. DKIM. A signature your email provider adds to each message, checked against a key in your DNS. Turn it on in your provider's admin console; it's often off by default on new domains.
3. DMARC. A DNS record telling receivers what to do when SPF or DKIM fails, and where to send reports. Start with a monitoring policy (p=none) and read the reports before tightening it.
4. Alignment. The domain in your From address must match the domain SPF or DKIM authenticates. Sending as name@company.com through a tool that signs with its own domain fails this.

How to check: send yourself a message, open it in Gmail, choose "Show original", and look for PASS next to SPF, DKIM and DMARC.

Domain and inbox: protect your reputation

5. Never send cold email from your primary domain. Use separate secondary domains, so a reputation problem can't reach the domain your customers and invoices depend on. We run all sending this way, in the client's own accounts.
6. Warm up new domains and inboxes. A brand-new domain that starts sending in volume looks like a spammer. Start small, send to people who reply, and raise volume gradually over weeks.
7. Cap volume per inbox, and write the cap down. Spread sending across several inboxes rather than pushing one hard, and send in the recipient's business hours. We set sending volume and warm-up practice in writing for each engagement. How many per day?
8. Check the basics your provider should already handle. Valid forward and reverse DNS, and TLS for sending. Google Workspace and Microsoft 365 handle both; self-hosted or cheap sending services may not.

Your list: send to fewer, better-chosen people

9. Verify every address before sending. Bounces tell mailbox providers you don't know who you're writing to. Remove anything unverifiable rather than risking it.
10. Only write to people with a plausible reason to care. Every spam complaint counts against your domain, and the surest way to collect them is a list built for size rather than fit.

The message: look like a person writing to a person

11. Drop open and click tracking. Tracking pixels and redirected links add machinery a personal email wouldn't have. We don't use them in our own outreach. Plain text, one link at most, no attachments.
12. Make opting out easy, and keep your headers honest. Say who you are, give a real way to stop hearing from you, and act on it.