Cold Email Deliverability: Inbox Placement, Spam Rates, and Provider Rules

By Laurel · Updated Oct 8, 2026

Cold email deliverability is the share of your messages that reach a recipient's inbox, not just their mail server. Mailbox providers decide placement from authentication, sender reputation, spam complaints, bounces and engagement. Cold email is unusually exposed because recipients never asked for it, so a handful of complaints can push a sender past published limits.

Copy and targeting get most of the attention in outbound, but neither matters if the message lands in spam. This article covers how placement works, what Google, Yahoo and Microsoft publish, and how to monitor and repair a domain. DNS records and mailbox setup are in cold email infrastructure, the message itself is in how to write a cold email, and the wider framework is in cold email strategy.

Key Facts

• Google tells senders to keep their user-reported spam rate below 0.10% and avoid ever reaching 0.30% in Postmaster Tools. Yahoo sets 0.3% as its ceiling, calculated on mail delivered to the inbox.
• Since May 5, 2025, Microsoft has required domains sending more than 5,000 emails a day to Outlook.com to comply with SPF, DKIM and DMARC. Failing mail goes to junk, then may be rejected with error 550 5.7.515.
• Validity, a deliverability vendor, reports that 83.5% of legitimate marketing email reached the inbox globally in 2024, while 6.7% went to spam and 9.8% went missing. That's the vendor's own seed-test data on marketing email, not cold outreach.

Delivered Is Not the Same as Inbox Placement

Most sending tools report a "delivered" number, and that word hides three outcomes. A receiving server can accept a message and file it in the inbox, accept it and file it in spam, or refuse it. Only the last shows up as a bounce.

Validity's report explains the gap: most platforms calculate delivery as sent minus bounced, so a bounce rate near 1.5% is reported as about 98.5% delivered. That counts messages accepted by the receiving server, not messages that reached the inbox.

What the Gap Looks Like

Validity measures placement with seed addresses its customers use to test campaigns. For 2024 it reported global rates of 83.5% inbox, 6.7% spam and 9.8% missing, meaning deferred or blocked. By provider, Microsoft placed 75.6% in the inbox and 14.6% in spam, against 86.0% and 4.8% at Yahoo and AOL. That's vendor data on legitimate marketing email, not cold outreach, and your numbers will differ by list, provider mix and history.

Refusals are visible: Gmail returns temporary 4.7.x codes when it rate-limits mail and permanent 5.7.x codes when it blocks it, with examples in Google's FAQ. Spam-folder placement produces no error at all, which is why replies and placement tests say more than the delivered column.

How Sender Reputation Works

Reputation is the record mailbox providers keep of how a sender behaves. Google describes it as a rating of the domains and IP addresses used to send, and says high-reputation senders are more likely to reach the inbox.

Domain Reputation and IP Reputation

A sender has two identities: the IP address mail leaves from, and the domain in the From address and DKIM signature. Yahoo lists IP, URL, domain, sender, network and authentication results among its reputation factors, and Google tracks volume, feedback and limits per domain and per IP.

On a shared IP, Google says every sender's activity affects all of them. Teams that send through a shared platform may share IPs with other customers, so the domain is the reputation they control. Yahoo says SPF, DKIM and DMARC should give a domain a consistent reputation whichever IP sent the mail.

What Moves Reputation

• Spam reports. Google says user spam reports lower a domain's reputation over time.
• Mail nobody asked for. Google and Yahoo both tell senders not to buy address lists or mail people who didn't sign up.
• Bounces. Amazon SES, a bulk-email service, notes that high bounce rates can send email to the spam folder.
• Sudden volume changes. Google warns that suddenly doubling previously sent volume could cause rate limiting or reputation drops. Yahoo says a spike can get a sender flagged as compromised.
• Mixed streams. Yahoo advises against sending marketing mail from the same IPs and domains as transactional mail, because each has its own reputation. Cold outreach shouldn't share a domain with invoices or customer replies.

SPF, DKIM and DMARC Without the Setup

Authentication answers one question for the receiving server: is this message really from the domain it claims?

• SPF is a DNS record listing the servers allowed to send for your domain.
• DKIM adds a signature that lets receivers confirm the domain owner sent the message and that it wasn't altered. Google and Yahoo require a key of at least 1024 bits, and Google recommends 2048.
• DMARC is a published policy telling receivers what to do when a message fails. A message passes when SPF or DKIM passes and that domain matches the visible From address, which is called alignment.

All three providers accept a DMARC policy of "none", which is monitor-only, as the bulk minimum. But passing isn't the same as being trusted. Authentication proves who you are, not that anyone wants the mail, and Google says only that authenticated mail is less likely to be rejected or marked as spam. Setup is in the infrastructure guide.

What Google, Yahoo and Microsoft Require

The three consumer mailbox providers publish different rules, and the differences affect how you plan volume.

Reading the Table as a Cold Sender

The baseline applies to everyone. Below the bulk threshold Google still requires SPF or DKIM, valid forward and reverse DNS, TLS, RFC 5322 formatting and a spam rate under 0.3%.

Volume counts per primary domain, not per mailbox. Google's example adds 2,500 messages from a domain and 2,500 from its subdomain into 5,000 for the primary domain. Its FAQ puts new domains on an accelerated enforcement timetable and says enforcement has ramped up since November 2025.

The rules describe consumer inboxes. Google says its requirements apply only to mail sent to personal Gmail accounts, and Microsoft's rule names its consumer services. Many B2B recipients sit on company domains, where the filter belongs to someone else. Treat the published numbers as a floor, not a promise.

"Marketing" is the recipient's call. Google says recipients, not Google, decide what counts as promotional, and Yahoo points senders to local regulations and judgment. Neither defines a one-to-one sales email. Google does say unwanted mail without one-click unsubscribe is more likely to be reported as spam, so adding the header, where your platform supports it, is the lower-risk reading.

Why Cold Email Sits Close to the Line

None of the provider documents cited here mention cold email. What they do say is to mail only people who want the messages. Google tells senders not to send to people who didn't sign up, and warns they may mark the mail as spam. Yahoo tells senders to verify they're mailing only users who specifically requested it. A cold recipient, by definition, didn't. That doesn't make cold email impossible, but the rules carry no cold-email carve-out, so the margin is thin and complaint control does most of the work.

The Complaint Math

A 0.10% rate is one spam report per 1,000 messages that reach inboxes, and 0.30% is three. Here's an illustration, not a measurement: if 400 of a domain's messages reach Gmail inboxes in a day and two recipients mark them as spam, the rate is 0.50%, already past the 0.30% line.

Postmaster Tools reports spam rate by domain, so every mailbox signing with that domain feeds one figure, and a bad campaign on one mailbox counts against all of them.

What Tends to Draw Complaints in Outbound

• Wrong person or wrong company. An irrelevant message gets reported. A tight ideal customer profile and a clean prospect list cut this off at the source.
• Hard-to-find or ignored opt-outs. Google's compliance table lists unsubscribes not honored within 48 hours, and Yahoo's limit is 2 days.
• Long follow-up chains. Each extra step is another chance for a report, so read the cold email cadences guide before lengthening a sequence.

Bounces and List Hygiene

Hard Bounces, Soft Bounces and Thresholds

A hard bounce is a permanent failure, usually "address does not exist". A soft bounce is temporary, such as a full mailbox. Microsoft's policy says that after a 5xx permanent failure the sender must not retransmit to that recipient, and must stop after repeated non-delivery responses.

Mailbox providers publish no bounce threshold, but sending platforms do. Amazon SES advises keeping bounces below 2%, reviews accounts at 5% and may pause sending at 10%, counting hard bounces only. Instantly, a cold email platform, gives the same 2% as its own guidance. Both are platform rules of thumb, not mailbox-provider limits.

Verification Has Limits

Addresses go stale. ZeroBounce, a verification vendor, reports that at least 23% of email lists decayed in 2025, from more than 11 billion addresses it verified (vendor data). How B2B contact data works covers decay and catch-all domains, and lead data enrichment covers keeping records current.

One policy point is easy to miss. Microsoft bars "namespace mining" against Outlook.com servers, defined as verifying addresses without sending or attempting to send mail to them. If your verification tool probes mailboxes, ask how it handles Outlook.com addresses. A workable routine: verify before the first send, suppress every hard bounce permanently, and re-verify any list older than your last send wave.

Engagement Signals

Providers want evidence that people read what you send. Yahoo warns that mailing recipients who don't read, or who report spam, harms your delivery metrics, and suggests reconfirming inactive subscribers. Google says it doesn't track open rates and can't verify third-party open figures, so low opens aren't necessarily a deliverability signal.

Opens are a weak measure anyway, because Apple's Mail Privacy Protection stops senders from knowing when mail is opened. The subject lines article goes deeper. Replies are the cleanest signal you can measure, and a reply also shows the message was wanted. Stop a sequence the moment someone replies, and retire contacts who never respond.

Content Factors in Brief

Content matters less than reputation, but provider guidance names some patterns. Google says not to hide content with HTML or CSS, to keep links visible, and not to start subjects with "Re:" or "Fwd:" unless the message is a real reply or forward. Yahoo ties spam-folder placement to poor reputation plus traits such as obfuscated URLs. The cold email writing guide covers the copy side.

Monitoring Deliverability

Google Postmaster Tools

Postmaster Tools reports on mail sent to personal Gmail accounts. Add the domain you sign with DKIM (or the SPF domain) and verify it through a DNS record. The dashboards cover compliance status, spam rate, IP and domain reputation, feedback loop, authentication, encryption and delivery errors.

Three limits are worth knowing:

• Low volume hides data. Google notes that dashboards may be empty on low-volume days to protect user privacy.
• Data lags. Dashboards typically update within 24 hours, and compliance changes can take up to 7 days to show.
• Spam rate counts only inbox reports. Google defines it as the share of messages delivered to the inbox and then marked as spam. If Gmail already files your mail in spam, recipients never see it to report it, so the dashboard can look clean while placement is poor.

Microsoft SNDS and Yahoo's Feedback Loop

Smart Network Data Services gives senders data on individual IP addresses, and Microsoft's Junk Email Reporting Program reports back when recipients junk your messages. Access is requested for the IPs you're responsible for. That usually means SNDS helps teams running dedicated sending IPs, while mailbox-based senders often have none to register.

Yahoo's complaint feedback loop sends a copy of each spam complaint to senders who enroll their DKIM domain. Its FAQ says bulk senders should enroll, and that email service providers generally enroll domains for you, so confirm yours has.

Blocklists and Placement Tests

Spamhaus publishes a Domain Blocklist of domains with poor reputation, and its checker at check.spamhaus.org handles removals from that list.

Seed-based placement tests estimate where mail lands. Treat them as a second opinion: Google notes that spam figures from third-party tools typically differ from Postmaster Tools data, and recommends using both.

Recovering a Damaged Domain

No provider publishes a recovery timetable. Google says to avoid the behaviors that lowered reputation and wait for the domain to recover. The steps below come from Google's, Yahoo's and Microsoft's own guidance.

1. Cut volume. Google advises reducing volume when messages bounce or defer, until the error rate falls. Pause sequences on the affected domain.
2. Find the cause. Check spam rate, delivery errors, authentication and the bounce log. Each points to a different fix.
3. Fix the source. Suppress hard bounces and non-responders, correct authentication, add an unsubscribe header, and tighten targeting.
4. Ramp slowly. Google says to send at a consistent rate, start low with engaged recipients, and raise volume gradually while watching server responses and spam rate.
5. Give it time. Google says spam-rate improvements take time to show in spam classification. Bulk senders regain mitigation eligibility after spam rate stays below 0.3% for 7 consecutive days.
6. Ask for help once compliant. Microsoft says its support team may be unable to help senders who aren't following its policies. Yahoo reviews Sender Support Requests but doesn't guarantee inbox delivery.

Retiring a domain is a business call, and the guidance above doesn't recommend it. A new domain carries none of the old history, but it carries the same list and copy that caused the damage if those haven't changed.

Before the Next Send

• Authentication passes for the sending domain, and the From domain aligns with SPF or DKIM.
• The list is verified, hard bounces are suppressed, and no addresses were bought.
• Every message has a working opt-out, and replies stop the sequence.
• Postmaster Tools shows the domain, and the spam rate sits under 0.10% wherever data appears.
• Volume rises in steps, never in a jump.

Your platform decides how much of this you can control. The BDR/SDR tech stack guide, the Instantly vs Lemlist vs Smartlead comparison and the best Smartlead alternatives are worth a look before you commit volume.