Deliverability advice is usually a pile of tips with no order to them, which is why so many people rewrite their subject lines while their domain is failing authentication.
There is an order. It is infrastructure, then reputation, then list, then behaviour, then content. Work down it and stop when things improve. Working up it, which is what most people do, means changing the least important variable first.
Layer 1: Infrastructure
1. Use a separate domain for cold outreach
Not a subdomain. A separate domain, ideally a close variant of your main one, redirected to your website.
This is the highest-leverage decision in the entire list and the only one that is expensive to change later. If a cold campaign damages sender reputation, that damage should land somewhere replaceable rather than on the domain your invoices, contracts and customer support run through.
2. Let the domain age before you send
A domain registered yesterday sending cold email today is the oldest spam pattern there is. Two to four weeks of age before serious sending, longer if you can wait.
3. Point the domain at a real website
A sending domain that resolves to nothing, or to a parked page, is a signal. Redirect it to your main site.
4. Publish SPF, correctly
List every service that sends as this domain. Then check it with a validator: SPF permits ten DNS lookups, includes nest, and exceeding the limit makes SPF fail permanently for everything.
5. Enable DKIM on every sending service
Each service that sends as you needs its own DKIM key published. Verify each one individually rather than assuming.
6. Publish DMARC, starting at p=none
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Google and Yahoo require a record. Start at none, read the reports for a fortnight, then move to quarantine. The full reasoning is in our guide to DMARC for cold email.
7. Check alignment, not just authentication
SPF can pass for a domain the recipient never sees. Send yourself a message at Gmail, open "Show original," and confirm all three of SPF, DKIM and DMARC say PASS. A DMARC failure alongside an SPF pass is an alignment problem.
8. Set up reverse DNS if you control the sending IP
Only relevant if you send from your own infrastructure. If you use a mailbox provider, they handle it.
Layer 2: Reputation
9. Warm up every new mailbox
A brand-new mailbox has no history, and no history reads as suspicious. Warm-up builds a record of mail being sent, received, opened and replied to before you send anything cold.
Two to four weeks minimum. This is not optional, and it is the step people skip when they are in a hurry, which is exactly when they most need it.
10. Keep warm-up running
Warm-up is not a phase you complete. Reputation decays, and a mailbox that only sends cold outreach has a sending profile no legitimate mailbox has. Leave it running underneath your real sending.
11. Ramp volume gradually
Day one is not 200 emails. A workable curve for a warmed mailbox is 10 a day in week one, 20 in week two, 30 to 40 by week four. If bounce or complaint rates move, stop climbing.
12. Add mailboxes, not volume
Reputation is tracked per sending identity. Four mailboxes at 40 a day is a far safer 160 than one mailbox at 160. Rotation across mailboxes also means one struggling mailbox does not take the campaign down with it.
13. Watch each mailbox separately
An aggregate deliverability number hides the mailbox that is quietly failing. Health should be visible per mailbox, with the ability to pull one out of rotation.
Layer 3: List quality
14. Verify every address before it enters a sequence
Syntax, domain records, and mailbox existence where the server will answer. This removes the large, predictable share of bounces.
15. Treat catch-all domains as risky, not verified
A catch-all accepts mail for every address, so a verification probe returns a meaningless yes. Send to them deliberately and in smaller proportions, not by mistake.
16. Re-verify anything older than a few months
Business email data decays at roughly 20 to 30% a year. A list verified in March is not a verified list in September.
17. Never buy a list
Purchased lists are stale by construction, shared with everyone else who bought them, and full of spam traps. One spam trap hit does more damage than the entire list can earn back.
18. Suppress non-engagers over time
Someone who has received six emails across two campaigns and never opened or replied is not a prospect, they are a liability. Continuing to mail them depresses your engagement metrics, which is a signal providers use.
Layer 4: Sending behaviour
19. Keep complaint rate under 0.3%
This is the number Google and Yahoo published, and it is the one they act on. Roughly three complaints per thousand delivered. Getting there is mostly about relevance and an obvious unsubscribe.
20. Make unsubscribing trivially easy
Include one-click unsubscribe headers as well as a visible link. Someone who cannot find the unsubscribe presses the spam button instead, and the spam button costs you far more.
21. Send during working hours in the recipient's timezone
Mail arriving at 3am local is a small signal of automation, and it is also worse for replies.
22. Stop the sequence the moment someone replies
Obvious, frequently broken, and one of the fastest ways to generate a complaint from someone who was about to become a customer.
Layer 5: Content
Last, deliberately.
23. Write like a person, not a campaign
Plain text or near-plain text. No image-heavy templates, no tracking pixel farms, minimal links, real signature. Cold outreach that looks like a newsletter gets filtered like a newsletter.
24. Do not obsess over spam trigger words
The word "free" has not sent an email to junk on its own in a decade. Filters weigh sender reputation, engagement and structure far more heavily than vocabulary. If you are failing on content alone, it is usually the shape of the message, not one word inside it.
How to know it is working
Not opens. Apple Mail Privacy Protection pre-fetches images for a large share of recipients, which means your open rate now includes people who never looked. It is not a measurement any more.
Watch these instead:
| Metric | Healthy | Investigate |
|---|---|---|
| Bounce rate | Under 1% | Above 2% |
| Complaint rate | Under 0.1% | Above 0.3% |
| Reply rate | 3% or more | Under 1% |
| Positive reply rate | 1% or more | Under 0.3% |
Then test placement directly: send to seed addresses across Gmail, Outlook and a couple of business domains, and look at where it lands. That is the only measurement that answers the actual question.
The order, one more time
Infrastructure. Reputation. List. Behaviour. Content.
Most people who ask why their emails go to spam are on layer five, changing adjectives, while layer one is unfinished. Leads Ranger runs the deliverability layer underneath your sending: warm-up on every mailbox, a DNS audit in plain English, verification on every address, rotation with automatic failover, and one-click unsubscribe headers on outbound. The reason it is bundled rather than sold separately is that the campaigns that fail almost never fail at the copy.