Why your cold email lands in spam, and the three records that fix it

You wrote a tight cold email, sent it, and it never landed. The copy is usually not the problem. The receiving server decided it did not trust your domain before it read the subject line.

What changed in 2024

In February 2024 Gmail and Yahoo turned long-standing best practice into a requirement, and through 2025 they tightened enforcement from soft filtering to outright rejection. A sender who pushes more than 5,000 messages a day to Gmail addresses is a bulk sender, and that status sticks once you cross it. But the three records below are now the baseline every sender is judged against, not just the high-volume ones.

Microsoft joined in 2025, and it bounces the mail

Gmail and Yahoo were first; Microsoft followed. Since 5 May 2025, anyone sending more than 5,000 messages a day to Microsoft consumer inboxes, meaning Outlook.com, Hotmail.com and Live.com, has to pass SPF and DKIM and publish a DMARC record of at least p=none that aligns with one of them. Microsoft made one choice the others did not: rather than quietly filing failing mail in the junk folder, it rejects it at the door with a 550 5.7.515 bounce, so a misconfigured domain gets no delivery at all instead of a spam-folder demotion you might never notice. The same three records below satisfy all three providers at once, which is why setting them up properly is the single fix that covers most of the inbox market.

The three records that build trust

• SPF lists which servers may send for your domain. There is one SPF record per domain, so if one exists you merge into it rather than publishing a second.
• DKIM signs each message with a private key your provider holds, against a public key you publish in DNS. The receiver verifies the signature, so it knows the mail was not forged. The key comes from your sending provider, which is why no honest tool can generate it for you.
• DMARC ties the two together: it tells receivers what to do when SPF or DKIM fail and where to send reports. It is the record that turns the other two from advisory into enforced, and it must align with the domain in your From address.

Start DMARC at p=none, then tighten

The common mistake is jumping straight to an enforcing policy. Start at p=none: it blocks nothing but collects reports, so you can see every source sending as you, including ones you forgot. Once SPF and DKIM pass cleanly for a week or two, move to p=quarantine, then to p=reject. The tool builds all of this from your inputs.

The number that actually filters cold senders

Authentication gets you to the door; your complaint rate decides whether you stay. Google asks senders to keep spam complaints below 0.1 percent and says they should never pass 0.3 percent, which is 3 complaints per 1,000 delivered messages. Yahoo points to the same 0.3 percent ceiling. A cold list complains more than an opted-in one, so this is the line most cold campaigns trip, not the authentication.

Separate domain, slow warmup

• Never send cold outreach from your main brand domain. Use a lookalike domain bought for the purpose, authenticate it, and redirect it to your real site, so a burned reputation never reaches your invoices and customer replies.
• Warm it before you send for real. A new domain that suddenly sends hundreds of cold emails looks exactly like a spammer. Start with a trickle, ramp over several weeks, and stop to clean your list the moment bounces climb past a few percent.
• Add a one-click unsubscribe. Gmail, Yahoo and Apple now expect RFC 8058 one-click unsubscribe on bulk mail, and an easy exit is also the cheapest way to keep complaints under the 0.3 percent ceiling.

The tracking that quietly works against you

Most cold-email tools switch on open and click tracking by default, and both can cost you more than they show. Open tracking embeds an invisible image pixel, and the recipient mail server loading that pixel is what registers an open. Click tracking rewrites every link to run through a redirect before it reaches your real URL. Both the pixel and the redirect are served from a tracking domain, and on most tools that domain is shared across many senders.

That sharing is the deliverability risk. If the shared tracking domain picks up a poor reputation from other senders on the same infrastructure, filters that already distrust a redirect can hold your mail even when SPF, DKIM and DMARC all pass. Two fixes remove it: set up a custom tracking domain so its reputation is yours alone, or turn open tracking off and send a plain, near-text email, which several deliverability teams report lands better for cold outreach than a tracked HTML one.

The metric is the other problem. Since 2021 Apple Mail Privacy Protection pre-loads that tracking pixel for Apple Mail users whether or not they open the message, so every one of them counts as an open. Apple Mail is roughly half the email-client market, so a cold campaign open rate is inflated and cannot be read as proof anyone saw your email, and Apple also strips tracking parameters from links opened in its apps, which degrades click attribution too. Treat a sudden fall in opens as a deliverability warning, but judge a campaign by replies, not by an open rate the mailbox providers now pad for you.

One honest caveat

This is a deliverability setup, not legal advice. Landing in the inbox and being allowed to email someone are different questions: under GDPR and similar rules you still need a lawful basis to contact a cold prospect. Get that right first, then use the records above so the mail you are allowed to send actually arrives.

Build your records

The tool generates ready-to-paste SPF, DKIM, DMARC and BIMI records from your inputs, scans a draft for the words filters punish, and lays out a conservative 30-day warmup ramp. Everything is generated in your browser.