Cold Email Deliverability in 2026: The Complete Guide (DMARC, Warm-Up, Sending Limits)

If you've sent cold email for more than a week, you already know the secret: the content barely matters until your infrastructure is right. A perfectly personalized email with a broken DKIM signature lands in spam. A boilerplate template from a warmed-up domain with clean SPF lands in the primary inbox.

This guide is the infrastructure half — what every B2B team running cold outbound in 2026 needs to nail before the copy debate even starts.

The 2026 deliverability stack

Before anything else, three records need to be perfect on your sending domain's DNS:

1. SPF (Sender Policy Framework)

A TXT record listing every server allowed to send on behalf of your domain. The trap: SPF has a hard limit of 10 DNS lookups per resolution. Most teams blow past this without realizing.

Bad SPF (8 includes, 14 lookups when resolved):

v=spf1 include:_spf.google.com include:sendgrid.net include:spf.mandrillapp.com include:_spf.salesforce.com include:mail.zendesk.com include:_spf.hubspot.com include:_spf.intercom.io ~all

Good SPF (flat record, 4 lookups):

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Tool to audit: dmarcian.com SPF Survey. Anything above 8 lookups = fix now.

2. DKIM (DomainKeys Identified Mail)

A cryptographic signature on every outbound email. Google Workspace and Microsoft 365 generate this automatically; cold-email platforms (Smartlead, Lemlist, Link Mailer) generate their own DKIM selector that you publish as a TXT record at selector._domainkey.your-domain.com.

Common mistake: setting up DKIM in Workspace but never enabling it. You'll see Status: not signing yet in the Workspace admin panel and have no idea it's silently sending unsigned email for weeks.

3. DMARC (Domain-based Message Authentication)

The policy that ties SPF + DKIM together. Without DMARC at p=quarantine or p=reject, Gmail and Yahoo will silently bulk your messages to spam as of February 2024 (and they're enforcing more aggressively in 2026).

Recommended starting policy for a new cold-outreach domain:

v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@your-domain.com; ruf=mailto:dmarc-failures@your-domain.com; fo=1

After 30 days of clean reports, tighten to p=reject.

The warm-up problem

A new mailbox has zero reputation. ESPs (email service providers, i.e. Gmail/Microsoft/Yahoo) decide your placement based on engagement signals: opens, replies, mark-as-not-spam, and the absence of complaints.

A cold mailbox sending 50 emails on day one will get 80% of them buried in spam — and the engagement signals from spam-buried emails are useless to the ESP. You've burned the mailbox without sending a single useful email.

The 28-day ramp (industry-standard, used by Smartlead and Link Mailer's built-in warm-up):

| Day | Daily volume | Reply rate to seed | Mailbox engagement | |---|---|---|---| | 1-3 | 5 | 100% | mark-as-important, reply, open | | 4-7 | 10-25 | 95% | reply, open, fwd | | 8-14 | 25-60 | 90% | reply, open | | 15-21 | 60-100 | 85% | reply, open | | 22-28 | 100-150 | 80% | reply, open | | 28+ | 150 | maintain via warm-up | — |

"Reply to seed" = the warm-up tool exchanges emails with a pool of friendly seed inboxes (other warm-up users' mailboxes) so engagement signals flow back to the ESPs. Built-in warm-up beats third-party warm-up because the platform can throttle outgoing real cold-email based on warm-up health in real time.

Per-mailbox send limits in 2026

What the ESPs officially allow vs. what's safe:

| Provider | Official daily limit | Safe cold-outreach limit | |---|---|---| | Google Workspace | 2,000 / day | 100-150 | | Microsoft 365 | 10,000 / day | 80-120 | | SendGrid (dedicated IP) | unlimited | 50-100 until IP warmed | | Amazon SES | varies | 50-80 on cold IP |

The gap exists because the official limit measures delivery attempts, not inbox placement. Hit 200/day on Gmail and ~140 will go to spam — you've technically sent 200, but you've damaged your domain reputation.

Math for scale: a 1,000-lead campaign at 100/day/mailbox needs 10 mailboxes running for one day, or 5 mailboxes for two days. Plan domain + mailbox count BEFORE building lead lists.

Content traps that flag spam filters

Even with perfect infrastructure, content can sink you:

1. Excessive HTML: cold email should be plain text. HTML emails with logos, buttons, and tracking pixels look like marketing — and ESPs apply marketing-grade filters. Strip HTML; let cold email look like a human typed it.

2. Link density: 1 link per email max. 2 links doubles your spam score. Use the link only when you have a clear, specific reason ("Check the case study here" beats "More info here").

3. Tracking pixels: open tracking adds a 1×1 transparent image with a URL parameter that's a giant red flag for filters. Turn off open tracking on cold outbound. Reply rate is your only honest metric anyway.

4. Subject line traps: "free", "guarantee", "no obligation", excessive punctuation, ALL CAPS, emoji at the start. A subject like "🔥 FREE consultation!" earns spam in 2026.

5. Unsubscribe footer: required by CAN-SPAM and GDPR, but the format matters. Use List-Unsubscribe: <mailto:unsubscribe@yourdomain.com>, <https://yourdomain.com/unsub/{token}> in the header (RFC 8058) + a one-line "Reply STOP" footer in the body. Long legal-language unsubscribe footers look like marketing.

What the top-performing teams run

Based on Link Mailer customer data across ~300 teams in 2025-2026:

1. 3-5 sending domains per team: cycle volume across them. If one gets flagged, the others carry the campaign.
2. 2-4 mailboxes per domain: Gmail Workspace mostly; Microsoft 365 for B2B replies to enterprise prospects.
3. Daily volume per mailbox after warm-up: 80-120 cold sends + 30-50 follow-ups = ~150 total touches/day/mailbox.
4. Reply rate target: 8-12% on first email, 4-6% on follow-ups.
5. Bounce rate target: under 3%. Above 5% gets the mailbox throttled within 48 hours.
6. Complaint rate target: under 0.1%. Above 0.3% gets the mailbox killed by Gmail's enforcement.

The link between research quality and deliverability

The cold-email community has spent a decade arguing about copy. The reality in 2026: the more personalized your email, the more it looks like a 1:1 human conversation to the ESP filter. A personalized first line that references a real recent event or post on the prospect's profile beats every other variable for inbox placement.

This is why Link Mailer runs a research pass (Apollo + Exa + Gemini) on every lead before generating the email. Research-driven personalization isn't marketing fluff — it's the modern equivalent of a clean SPF record.

Quick start checklist

If you're setting up a new cold-outbound stack:

• [ ] Buy a separate sending domain (forwarding to your brand)
• [ ] Set up Google Workspace ($6/user/month — cheapest reliable provider)
• [ ] Publish SPF (audit lookups), DKIM (verify "active" in Workspace), DMARC at p=quarantine
• [ ] Add 2-3 mailboxes per domain, give each a real first/last name
• [ ] Start a 28-day warm-up via Smartlead, Instantly, or Link Mailer
• [ ] Skip open tracking; use reply tracking only
• [ ] Cap daily volume per mailbox at 100 until you have 30 days of clean DMARC reports

Get this right and your copy can be average. Get it wrong and the best copy in the world won't matter.

Want to skip the setup and have it done for you? Link Mailer ships with infrastructure pre-configured for every customer — DMARC/SPF/DKIM checked at signup, warm-up on day one, sending limits enforced per-mailbox.