Cold email deliverability in 2026: how to get B2B outbound into the inbox

Your outbound is not underperforming because the copy is weak. In most of the accounts I audit, a large share of the sequence never reaches a human inbox at all, and the founder is rewriting subject lines to fix a problem that lives in a DNS record. In 2026 the mailbox providers publish their rules openly and reject mail that fails them. Deliverability is the first sales metric, not an IT footnote.

The rules stopped being guidelines

Three changes matter and all are public. Google treats any domain sending close to 5,000 messages or more to personal Gmail accounts in 24 hours as a bulk sender, and that status is permanent once you cross it. Bulk senders must authenticate with SPF and DKIM, publish a DMARC record with a policy of at least p=none, hold valid forward and reverse DNS, connect over TLS, offer one-click unsubscribe on promotional mail and process opt-outs within 48 hours. Google asks senders to keep user-reported spam below 0.1% and says rates at or above 0.3% put you outside the help you would otherwise get. Those figures are in Google's own sender guidelines FAQ, and Gmail began ramping enforcement against non-compliant traffic through late 2025.

Microsoft went further. Since 5 May 2025, Outlook.com applies the same authentication floor to senders of 5,000 or more messages a day to its consumer addresses, and non-compliant mail is not quietly filtered, it is rejected outright with 550 5.7.15 Access denied. Microsoft published the change on its Defender for Office 365 blog. A bounce is at least honest. The dangerous state is the one in between, where your mail is accepted, filed in spam, and reported to you as delivered.

Nobody rejects your offer from the spam folder. They never see it. Fix the plumbing before you touch the pitch.

Set the technical floor before you send anything

This is an afternoon of work, not a project. Do it in this order on every domain you send from.

1. Publish SPF and include only the services that actually send for you. More than ten DNS lookups breaks it silently.
2. Sign with DKIM at 2048-bit where your provider supports it, and confirm the signature aligns with the domain in your From header.
3. Publish DMARC, starting at p=none with an rua address so you receive aggregate reports. Read them for two weeks, then move to p=quarantine.
4. Check reverse DNS on the sending IP and confirm the hostname resolves back. On shared infrastructure your provider handles this, but verify rather than assume.
5. Add MX and a basic A record to every alternate sending domain. A domain that cannot receive mail looks disposable, because usually it is.
6. Use a branded tracking domain or turn tracking off entirely. A shared redirect domain inherits every other sender's reputation.

Then send to a seed address on Gmail, Outlook and a Microsoft 365 tenant, open the raw headers, and confirm SPF, DKIM and DMARC all read pass. If any line says none, the configuration is not live, whatever the dashboard claims.

Separate your domains so one bad month cannot cost you the company

Never run outbound from the domain that carries your invoices, contracts and investor updates. Buy two or three close variants of your brand domain, point them at the sending platform, and keep the primary clean. If a campaign goes wrong you retire a variant instead of losing the address your clients reply to.

Then keep volume per mailbox low. New mailboxes need roughly three to four weeks of gradual ramp, and a mature one should stay around 30 to 40 cold sends a day. Scale comes from more mailboxes, not more sends each. A thousand first-touch emails a month is eight or nine mailboxes running gently, not one running hot: a jump from 20 to 300 sends looks exactly like a compromised account.

The four numbers to watch every Monday

Most teams track sends and meetings and nothing in between, which is why problems surface a month late. Put these four in your weekly review.

• Spam complaint rate. Target below 0.1%. Read it in Google Postmaster Tools, which needs the domain verified first, so verify it today.
• Hard bounce rate. Above 3% means your list build is careless. Verify every address before import and remove catch-all domains from the first send.
• Reply rate, including negatives. A "not interested" is a deliverability signal as much as a sales signal. If replies of any kind fall towards zero while sends hold steady, you are in the spam folder.
• Domain reputation in Postmaster Tools. Anything below High needs an explanation. A slide from High to Medium usually precedes a collapse in replies by about a week, which is your window to act.

Reading the signals correctly

Diagnose by pattern, not by feeling. Opens steady and replies collapsing points at content and targeting. Both collapsing on one domain points at that domain's reputation. Everything collapsing across all domains on one day points at a platform or DNS change. Each has a different fix, and guessing costs you a fortnight.

Content is a deliverability setting, not just a persuasion problem

Filters read what you send. Cold first-touch mail should be short, plain, and free of the machinery marketing email carries: no images, no attachments, no tracking pixel, and no link at all in the first message if you can avoid it. Send plain text or very light HTML, under about 120 words.

The bigger lever is relevance. A message sent to 400 people with a token first name swapped in produces complaints, and complaints are the one metric that damages you permanently. Forty people who share an observable trigger produce replies instead. Compare two openers:

• "I hope this finds you well. We help companies like yours scale revenue with our innovative platform." That is a complaint waiting to happen.
• "You posted two SDR roles in Helsinki this month and your careers page still lists a third from June. Is the bottleneck hiring, or the pipeline those hires are meant to work?" That earns a reply, including the honest no.

Volume is not the lever people think it is. I have written before about the qualification bar that decides whether your pipeline is real, and the same discipline applies upstream: fewer, better-chosen recipients protect the asset that makes all future outbound possible.

Permission and law across Europe, Africa and the US

I sell across three continents and the rules differ. In the EU and UK, B2B cold email to a named individual at a corporate subscriber is generally handled under legitimate interest rather than consent, which carries obligations: identify yourself and your company, explain how you obtained the address, and honour an objection immediately. The ICO's guide to PECR is the plainest reference I know. In the US, CAN-SPAM requires accurate headers and a working opt-out honoured within ten business days, whether or not you think of your mail as marketing. African data protection acts increasingly mirror the EU model, so building to the stricter standard travels well.

There is a conviction underneath the compliance for me. Someone's inbox is their attention, and attention is not mine to take by force. Mail a person can ignore, answer or stop in one click treats them as a person rather than a row in a list. That conviction has never cost me a deal. It has repeatedly saved me a domain.

The deliverability question and the integrity question have the same answer: would this message be welcome if the recipient knew exactly how you found them?

A 30-day repair sequence

If your numbers are already bad, stop sending and work through this. Resuming a broken programme at full volume is how a temporary problem becomes a permanent one.

1. Days 1 to 3. Pause all cold sending. Fix SPF, DKIM, DMARC, reverse DNS, MX and the tracking domain. Verify Postmaster Tools and record your starting reputation so you have a baseline.
2. Days 4 to 7. Clean the list. Remove role addresses such as info@ and sales@, verify the rest, and delete any record whose source you cannot explain. If you cannot say where an address came from, you cannot defend it to a regulator or to yourself.
3. Days 8 to 21. Restart at 10 sends per mailbox a day and add five every second day, to your tightest segment only, the one where you can name the trigger. Watch complaints daily.
4. Days 22 to 30. Return to normal volume only if complaints stay under 0.1% and reputation reads High. If either fails, hold volume and change the targeting, not the subject line.

The trap is week three. You see early replies, decide the problem is solved, and triple volume on the Friday. That one decision undoes the month.

What this is worth

Deliverability compounds in both directions. A clean, well-authenticated sending estate makes every future campaign cheaper, because the same copy reaches more people. A damaged one taxes everything afterwards, and the cost is invisible, which is what makes it dangerous. Founders will spend a month rewriting a value proposition before they spend an afternoon on DNS, and the DNS is where the revenue is hiding.

Here is the next action. Open the last message you sent to a prospect, view the original, and check the three authentication lines. If any of them says anything other than pass, that is your Monday. If all three pass, log into Postmaster Tools and read your complaint rate: it will tell you more about next quarter's pipeline than your CRM will. More on building outbound that holds up is in the Sales Growth library.