Why Are All My Cold Emails Going to Spam?

Six AI engines cited 36 resolvable domains on this question. Two of them were mailbox providers. This answer comes from those two, plus the RFCs, plus the bounce code your server has already sent you.

Last updated: 31 August 2026

The question as it was actually asked, on X: "All my cold emails are going to Spam folder. How can I solve this permanently?"

That last word is the problem. Most people asking this have already tried something: a new subject line, a warmup tool, a lower send volume. It held for a fortnight, then stopped, because they fixed a symptom belonging to a different failure than the one they had.

Here is why that keeps happening. On 24 August 2026 I logged every source six AI engines cited on this exact question. Thirty-six domains came back. Two were mailbox providers, google.com and yahooinc.com, both cited by ChatGPT and by no other engine. The other thirty-four are tool vendors, agencies and forum posts restating what Google and Yahoo publish. No engine cited an RFC. Three of the cited domains sell email warmup, which matters later.

So most of what you have read is a second-hand account of four documents you could read yourself: the sender guidelines from Google, Yahoo, Microsoft and Apple. This page works from those four and from the RFCs underneath them. One caveat on my own measurement: Google's AI Overview returned three sources as obfuscated redirects I could not resolve, so they are excluded from the 36.

Why are all my cold emails going to spam?

Five checks tell the four apart. Run them cheapest and most conclusive first.

1. Read the bounce code. If mail is rejected rather than foldered, the server has already told you the answer. Codes below.
2. Check authentication. Send a test to Gmail, open it, and use Show original to read SPF, DKIM and DMARC pass or fail. There is no alignment field. DMARC pass is the alignment test, since DMARC cannot pass unless SPF or DKIM passed on a domain aligned to your From:.
3. Check Google Postmaster Tools and Microsoft SNDS. Free provider tools showing spam rate, authentication, delivery errors and compliance status.
4. Check blocklists. Spamhaus first, because it is the only blocklist any mailbox provider names in its own sender documentation: Yahoo's SMTP error codes page lists a Spamhaus listing as a cause of permanent rejection, and names no other operator. Google names none at all, and at Microsoft 365 the list that binds is Microsoft's own.
5. Run a seed-list placement test. Paid, and last rather than first.

Then read the pattern. Authentication problems appear as hard 5.7.x rejections or DMARC failures in Show original. Reputation damage appears as mail accepted and then foldered, with Postmaster reputation at Low or Bad and an elevated spam rate. Content filtering appears when authentication passes, reputation is fine, and only specific messages folder. List quality appears as bounces, complaint spikes and trap hits.

Google publishes the reputation bands and the mitigation gate. What follows is my rule of thumb, not Google's. Authentication and content problems are fully recoverable. Reputation damage is recoverable but slow. A fresh domain is warranted only when reputation is entrenched at Bad.

How do I check SPF, DKIM and DMARC for my domain?

Two things break silently here, and both are common in B2B stacks.

The SPF ten-lookup limit. RFC 7208 caps DNS-lookup mechanisms at ten per check and returns PermError if exceeded. DMARC treats a PermError as an SPF failure. Every vendor you add contributes an include: Workspace, then your CRM, then a marketing tool, then a helpdesk. Four or five is enough to break it. ip4 and ip6 entries do not count, so flattening includes into IPs is one fix. A separate limit in the same section applies to void lookups, queries that return no records. RFC 7208 says implementations SHOULD limit these to two, a recommendation rather than the hard requirement that governs the ten-lookup limit, and exceeding it also produces PermError.

Why mail passes SPF and still fails DMARC. SPF authenticates the envelope sender, the Return-Path, which for most sending platforms is the platform's domain rather than yours. DMARC checks the visible From: address instead and requires it to be aligned with an authenticated domain. So SPF can pass cleanly while producing no alignment, and unless DKIM aligns, DMARC fails. Google requires only one of the two to align.

One currency note, because most content on this topic is out of date. DMARC's original specification, RFC 7489, was obsoleted in May 2026 by RFC 9989 and its companions, promoting DMARC from Informational to Proposed Standard. Existing v=DMARC1 records stay valid. The pct, rf and ri tags are deprecated, np, psd and t are new, and the Public Suffix List is replaced by a DNS tree walk. Any guide calling RFC 7489 current was written before May 2026.

How do I get my emails to stop going to spam?

One scope fact almost nobody reports, and it changes what binds you: Google's bulk sender rules cover mail sent to personal @gmail.com addresses, not to Google Workspace mailboxes. Since most B2B cold email lands in Workspace-hosted corporate inboxes, the bulk rules often do not formally apply. The authentication expectations still decide where your mail sits, so this is a reason to understand the rules rather than ignore them.

Apple is the outlier worth planning around. It requires the full list for any bulk mail without defining bulk, bars purchased, rented and appended lists, and offers no dashboard, feedback loop or allow list. Google and Yahoo tell senders not to buy lists too, but as best practice: neither puts it in its enumerated sender requirements, where Apple does.

Enforcement is not theoretical. Gmail's rules took effect on 1 February 2024 and escalated to temporary and permanent rejections from November 2025. Microsoft skipped the warning shot. It had planned to junk-folder non-compliant high-volume senders from 5 May 2025, then reversed course on 29 April and rejected them outright from that same date instead, with "550; 5.7.515 Access denied, sending domain does not meet the required authentication level." That applies to Outlook.com consumer mailboxes above 5,000 messages a day from one From domain, and it has run continuously since.

On recovery: crossing 0.3% does not stop Gmail taking your mail, it stops Gmail helping you. You become ineligible for what Google calls mitigation, its escalation path for senders being filtered wrongly, and you stay ineligible until your spam rate has sat below 0.3% for seven consecutive days, recalculated daily in Postmaster Tools. Only then, and only if you also meet every other requirement, does the sender contact form get you anywhere. Postmaster compliance status can take seven days to reflect a fix. No provider publishes a guaranteed recovery period, and the "four to eight weeks" figure in circulation has no provider source.

How many cold emails should I send per day to avoid spam?

The distinction matters because the failures look nothing alike. A filtering threshold routes mail to spam. An account cap returns an SMTP error and stops the send.

The published caps: free Gmail allows 500 messages a day, and Google publishes no separate daily recipient cap for personal accounts, only a 500-recipient limit on any single message. Google Workspace allows 2,000 messages a day and 3,000 external recipients a day, of which at most 2,000 may be unique external recipients. Microsoft 365 allows 10,000 recipients per mailbox per 24 hours at roughly 30 a minute. For cold outreach, where every address is distinct, the Workspace limit that actually binds is the 2,000 unique external recipients, not the headline 3,000. Microsoft also applies a tenant-wide external recipient limit that scales with paid licences, returning 550 5.7.233 when exceeded, and caps onmicrosoft.com domains at 100 external recipients a day. Microsoft states plainly that Exchange Online "isn't designed for bulk mailing scenarios."

Google's wording on ramp is worth quoting because it is the only guidance that exists: start low to engaged users, increase slowly, avoid spikes, since "immediately doubling previously sent volumes suddenly could result in rate limiting or reputation drops."

How do I warm up a new email account for cold outreach?

I have to be blunt here, because three of the domains AI cited on this question sell warmup.

There is no independent measured study showing reciprocal warmup improves inbox placement. Every data point in circulation comes from a company selling warmup or cold-email tooling. More tellingly, the seller of a warmup pool says so on the record. Emailchaser, which runs one, posted a correction conceding that its pool simulates engagement, since mail exchanged inside it is marked read, marked important and replied to, and states that fake-engagement warmup tools are not safe to use, that Gmail does not allow them, and that they will get your address blacklisted. Two companies selling alternatives to warmup say much the same thing, and both profit from your believing it: Litemail, which sells pre-warmed inboxes, states that by 2024 Google and Microsoft had both identified the major warmup service IP ranges and network patterns and reduced the signal weight accordingly, and Mailpool, which sells sending infrastructure, says providers have become exceptionally sophisticated at spotting artificial engagement.

No mailbox provider's own sender documentation forbids or permits reciprocal warmup by name, not Google's, Microsoft's, Yahoo's or Apple's. But the practice is not unaddressed. M3AAWG, the anti-abuse working group whose members include Google, Microsoft and Yahoo as sponsors and Apple as a full member, published its Position on Cold Email in November 2025, and it is unambiguous about the mechanism: attempts to "bypass mail volume limits, avoid spam filters, mask sending domains, artificially simulate subscriber engagement, or use other tools or services that exploit loopholes in mailbox providers or cloud platforms are particularly egregious and are not acceptable in any manner." So it is a norms question as well as an efficacy one, and on efficacy the honest answer is that the practice is unproven and by its sellers' own accounts may be counterproductive.

Manual warmup differs in kind, not degree: the engagement is real, which is the whole point. Google's guidance says to start with a low sending volume to engaged users and increase it slowly, and, under a separate "Phishing exercises" heading, warns that sending test phishing messages or test campaigns from your domain might hurt the domain's reputation. Google is talking about simulated-phishing exercises there, not about deliverability checks.

What tools actually test inbox placement?

Prices retrieved 30 August 2026 from vendor pricing pages. The low end of the MailReach and Warmforge row is a warmup slot that includes one placement test a month; Warmforge's standalone placement-test plan starts at $39. Check the live page before buying.

Two limits. Seed lists have no engagement history, so results are directional, and they generalise poorly to Google Workspace and Microsoft 365 recipients, which is where your B2B mail goes: each tenant's admin sets its own anti-spam policies, bulk complaint threshold and allow and block lists, so a seed mailbox in one tenant tells you less about another than a consumer seed tells you about consumer Gmail. And Postmaster Tools suppresses data on low-volume days for privacy, so small senders may see nothing; Google publishes no minimum volume and the figure you have seen quoted is third-party. Google is also retiring the Domain and IP Reputation dashboards, which Postmaster v2 does not carry. Google's stated reason is that "The current dashboard can be misleading as reputation is only one of many factors affecting deliverability." A replacement has been promised but not shipped, and the v1 phase-out is rolling out sender by sender.

Is cold email still effective in 2026?

Read the provenance before the number. Belkins' 2026 study, published on 26 June 2026 and covering 7,530,489 emails sent across client campaigns from January to December 2025, reports 0.45%, which Belkins describes as strict cold outreach to net-new contacts with no open-rate inflation. Backlinko and Pitchbox, in a 2019 study of 12 million SEO and content outreach emails sent through Pitchbox, report 8.5%, and found in that same 2019 dataset that a single follow-up lifted replies by 65.8% while contacting several people at one company raised responses by 93%. Instantly, from billions of cold email interactions across thousands of workspaces between 1 January and 18 December 2025, puts the overall average at 3.43%. Woodpecker republishes that figure, calls 5% to 10% good and above 10% excellent, and blames inbox saturation, tighter Gmail and Outlook spam enforcement and a flood of low-effort AI-generated outreach, a causal claim it does not source and Instantly does not make.

Those are not contradictory. A strict net-new methodology produces a low number, and a different population, cold SEO and content outreach to publishers seven years earlier, produces a high one. Every figure here is published by a company selling cold email tooling.

Ignore open rates. Litmus put Apple clients at 62% of tracked opens in July 2026, calculated from over a billion opens, and counts privacy-impacted opens inside that Apple total. Apple's documentation says why that breaks the metric: with Protect Mail Activity on, "your IP address is hidden from senders and remote content is privately downloaded in the background when you receive a message (instead of when you view it)." The pixel fires on delivery, so your open rate is substantially Apple's servers, not your prospects.

One last conflation worth ending on. Legal compliance and deliverability are separate systems. A perfectly CAN-SPAM-compliant email, valid postal address and working opt-out included, will still be filtered if your reputation is poor. And the deliverability best practice of sending only to people who opted in is stricter than US law requires.

Frequently asked questions

How do I check SPF, DKIM and DMARC for my domain?

Run dig TXT yourdomain.com for SPF, dig TXT selector._domainkey.yourdomain.com for DKIM, and dig TXT _dmarc.yourdomain.com for DMARC, or use Google's Admin Toolbox. Then send a test to Gmail and open Show original to confirm each passes and the From: address aligns.

What subject lines make cold emails less likely to go to spam?

Honest ones. Google requires subject lines and display names that reflect the actual sender and content, and bars imitating replies with "Re:" or "Fwd:" when untrue. Deceptive subject lines also breach CAN-SPAM. No provider publishes a banned word list; the circulating ones have no primary source.

How many cold emails should I send per day to avoid spam?

No provider publishes a number. Google says start low, ramp slowly, avoid spikes. Account caps are separate from spam filtering: 500 messages a day on free Gmail, 2,000 messages a day on Google Workspace with at most 2,000 unique external recipients, about 10,000 recipients per Microsoft 365 mailbox. Specific "safe" daily figures are convention, not thresholds.

What tools can test my email deliverability and inbox placement?

Free: Google Postmaster Tools, Microsoft SNDS, and Mail-Tester for single messages. Paid: GlockApps, free tier then $59 a month on annual billing, $85 month to month, and MailReach and Warmforge, which also sell warmup. Seed-list results are directional, since seed addresses have no engagement history.

How do I warm up a new email account for cold outreach?

Send small volumes of real mail to real recipients and increase gradually, which is the only approach any provider endorses. Automated warmup networks manufacture engagement. No provider documents warmup improving placement, and several warmup vendors say providers now detect and discount it.

What does bounce code 5.7.26 mean?

Gmail is rejecting the message because it is not authenticated: SPF and DKIM are both absent or failing. Read the bounce code before changing anything else, because a rejection means the server has already told you the cause, and it is a different failure from mail that is accepted and then foldered.

Why does my mail pass SPF but still fail DMARC?

SPF authenticates the envelope sender, the Return-Path, which for most sending platforms is the platform's own domain rather than yours. DMARC checks the visible From: address instead and requires alignment with an authenticated domain. So SPF can pass cleanly while producing no alignment, and unless DKIM aligns, DMARC fails.

---

Sources

1. Google, Email sender guidelines (support.google.com/a/answer/81126) and FAQ (answer/14229414), retrieved 30 August 2026.
2. Google, Postmaster Tools dashboards (answer/14668346); Postmaster v2 changes (answer/16594218).
3. Yahoo, Sender Requirements and Recommendations (senders.yahooinc.com/best-practices) and FAQs.
4. Microsoft, high-volume sender requirements (techcommunity.microsoft.com, April 2025); Exchange Online sending limits and TERRL (learn.microsoft.com).
5. Apple, Postmaster information for iCloud Mail (support.apple.com/en-us/102322, 25 February 2025).
6. RFC 7208 (SPF, ten-lookup limit); RFC 6376 (DKIM); RFC 8058 (one-click unsubscribe).
7. RFC 9989, 9990 and 9991 (DMARCbis, May 2026), obsoleting RFC 7489 and RFC 9091.
8. FTC, CAN-SPAM Act Compliance Guide for Business.
9. Belkins, "What are B2B Cold Email Response Rates?", updated 26 June 2026, measuring 7,530,489 emails across 2025 client campaigns; Instantly, Cold Email Benchmark Report 2026 (billions of interactions across thousands of workspaces, 1 January to 18 December 2025), retrieved via Woodpecker's cold email statistics page, updated 23 June 2026; Backlinko and Pitchbox, "We Analyzed 12 Million Outreach Emails", 2019 (SEO and content outreach). All vendor-published.
10. Warmup commentary from Litemail, Mailpool and Emailchaser. Only Emailchaser sells warmup, an engagement pool included on all plans. Litemail and Mailpool sell cold-email sending infrastructure positioned as an alternative to warmup, so their scepticism is commercially interested.
11. Inbox placement tool pricing, vendor and review pages, retrieved 30 August 2026.
12. M3AAWG, Position on Cold Email, version 1.0, November 2025.
13. Litmus, Email Client Market Share, July 2026 (over a billion opens); Apple, Use Mail Privacy Protection.
14. Paraphrase Labs AI Visibility Baseline, 24 August 2026: 40 B2B buyer questions across six AI engines. On this question 36 resolvable domains were cited, two of them mailbox providers. Three AI Overview sources returned as unresolvable redirects and are excluded.