Z Zestmail
← All posts

Cold Emails Going to Spam? Fixes for Small Senders

If your cold emails are going to spam, the cause is almost always one of four things: your domain is not authenticated (SPF, DKIM, DMARC), you started sending too much too soon from a new address, your messages look like bulk mail, or enough recipients have marked you as spam that Gmail and Outlook no longer trust you. The fix is to work through those four in order. Authentication takes about an hour and is permanent. Warm-up takes a few weeks. Content and list quality are ongoing habits. This article walks through each one for a small sender using Gmail or Google Workspace, without needing an expensive deliverability tool.

Why cold emails go to spam in the first place

Spam filters do not read your email the way a person does. They score it. Each incoming message gets points for things that look risky and loses points for things that look trustworthy, and the total decides whether it reaches the inbox, the Promotions tab, or the spam folder.

For a small sender, the inputs that matter most are:

  • Authentication. Can the receiving server prove that your domain really sent this message? If not, the message starts out at a disadvantage no matter how good it is.
  • Sender reputation. How have recipients reacted to mail from your domain and your sending IP over the past weeks? Replies, opens, and moving a message out of spam help. Spam reports, bounces to dead addresses, and being ignored hurt.
  • Volume pattern. A domain that sent five emails a day for a year and suddenly sends four hundred looks like a compromised account or a spammer. New domains with no history get the least benefit of the doubt.
  • Content signals. Dozens of near-identical messages, tracking-heavy HTML, link shorteners, attachments from an unknown sender, and classic sales phrasing all raise the score.

Note that Google publishes specific requirements for anyone sending 5,000 or more messages a day to Gmail addresses (SPF and DKIM, a DMARC policy, one-click unsubscribe for marketing mail, and a spam complaint rate kept below 0.3%). Most small senders are nowhere near that threshold, but the same signals are used to score everyone. Treating those requirements as your baseline is the simplest way to stay out of trouble.

Fix 1: Authenticate your domain (SPF, DKIM, DMARC)

If you send cold email from your own domain through Google Workspace, this is the first thing to check. If you send from a personal @gmail.com address, Google already handles authentication for you and you can skip to the next section, though a personal address is a weak choice for outreach because recipients and filters both treat it as less legitimate for business mail.

SPF

SPF is a DNS record that lists which servers may send mail for your domain. For Google Workspace, you need a TXT record on your root domain containing:

v=spf1 include:_spf.google.com ~all

If you also send through another service (a newsletter tool, a CRM, a helpdesk), add its include mechanism to the same record. A domain should have exactly one SPF record. Two separate SPF records is a common mistake that causes SPF to fail entirely.

DKIM

DKIM adds a cryptographic signature to each message so the receiver can confirm it was not altered and really came from you. In Google Workspace:

  1. Open the Admin console and go to Apps > Google Workspace > Gmail > Authenticate email.
  2. Select your domain and click Generate new record. Keep the default 2048-bit key unless your DNS host cannot store a record that long.
  3. Copy the TXT record name (something like google._domainkey) and value into your DNS settings at your domain registrar or DNS host.
  4. Wait for DNS to propagate, then return to the same Admin console page and click Start authentication.

DMARC

DMARC tells receivers what to do when SPF or DKIM fails and where to send reports. Start with a monitoring-only policy so nothing breaks:

v=DMARC1; p=none; rua=mailto:[email protected]

Add this as a TXT record at _dmarc.yourdomain.com. Once you have watched the reports for a couple of weeks and confirmed that all your legitimate mail passes, tighten the policy to p=quarantine and eventually p=reject.

How to verify it worked

Send a message to a Gmail address you control, open it, click the three-dot menu and choose Show original. The header summary at the top shows SPF, DKIM, and DMARC with PASS or FAIL next to each. All three should say PASS. Free checkers such as mail-tester.com or Google's Admin Toolbox Check MX page will show the same information and flag common record errors.

Fix 2: Warm up the address and control daily volume

Authentication proves who you are. Reputation decides whether anyone cares. A brand-new domain or mailbox has no reputation at all, and the fastest way to get a bad one is to send a large batch on day one.

A realistic warm-up schedule for a small sender

There is no official number from Google for how many emails a new address can safely send, so treat the following as conservative practice rather than a rule:

  1. Week 1: Send normal, human email only. Write to colleagues, friends, existing customers, and suppliers. Ask them to reply. Reply to them. Aim for 10 to 20 messages a day, all of which get engagement.
  2. Week 2: Add a small number of cold emails, around 10 to 15 a day, mixed in with the normal correspondence. Keep writing real replies.
  3. Weeks 3 and 4: Increase gradually, roughly 20 to 30 percent per week, as long as you are not seeing bounces or a drop in replies.
  4. Ongoing: Many small senders find that staying under 50 cold emails a day per mailbox keeps things stable. If you need more volume, add a second mailbox and warm it up separately rather than pushing one address harder.

If at any point replies dry up or several messages bounce, stop increasing and hold the volume steady for a week.

Spread sends across the day

Sending 40 messages at 9:00 looks different from sending 40 messages between 8:30 and 17:00. Scheduled sending helps here. Gmail's built-in Schedule send (the arrow next to the Send button) works for one message at a time. If you are sending a mail merge from a Google Sheet, Zestmail's scheduled sending lets you set a send time for the batch so it goes out when your recipients are at their desks rather than the moment you finish writing, which also means you are not sending a visible burst at an odd hour.

Keep your list clean

Every bounce to a nonexistent address counts against you. Before a campaign, remove anything that is obviously stale, role addresses like info@ or sales@ that you have no relationship with, and anyone who has previously asked not to be contacted. Google Workspace also enforces a daily cap on outgoing mail (currently 2,000 messages per user for paid accounts and 500 for personal Gmail), and hitting it repeatedly is its own red flag.

Fix 3: Write cold emails that do not look like spam

Filters have seen millions of sales emails. Yours will be compared to them. The goal is to make each message look like something one person wrote to another, because that is what it should be.

Keep it short and plain. Plain text or very light formatting. No large images, no banner headers, no three-column layouts. Under 150 words is a good target for a first message.

Personalize beyond the first name. A mail merge that only swaps {{first_name}} produces a hundred messages that are 98 percent identical, and that pattern is detectable. Add at least one merge field that genuinely varies: the company, a specific product or page you looked at, the role, a recent event. If you keep a column in your Google Sheet for a one-line custom opener, the merge stays personal even at volume.

Avoid the usual triggers. Link shorteners, more than one or two links, attachments, all-caps words, multiple exclamation marks, and phrases like "limited time offer", "act now", "risk-free", "100% guaranteed", and "dear friend". None of these alone will sink you, but they stack.

Include an easy way out. You are not sending a newsletter, so you do not need an unsubscribe button, but a plain sentence such as "If this isn't relevant, just reply 'no thanks' and I won't follow up" reduces the chance that someone clicks Report spam instead. A spam report costs you far more than a polite no.

Use a real signature. Your name, company, and one URL. Not a signature image, not five social icons.

Send from the same identity every time. Changing display names, reply-to addresses, or sending tools between messages makes the pattern look inconsistent.

How to tell whether your cold emails are landing in spam

You cannot see other people's spam folders, but you can get good evidence.

Seed tests

Create free test accounts at Gmail, Outlook.com, and if possible Yahoo, and add them to your merge list. After each send, check where the message landed in each. Do this with the actual template, not a test version, because small differences change the outcome. Tools like mail-tester.com will also give you a spam score with a breakdown of what cost you points.

Google Postmaster Tools

If you send from your own domain, register it at postmaster.google.com. Once you are sending enough mail for Google to show data, you will see your domain reputation (High, Medium, Low, Bad), your spam complaint rate, and whether authentication is passing. A reputation that drops from High to Medium is the earliest warning you will get. Keep the complaint rate as close to zero as you can; Google's published guidance is to stay under 0.1%.

Watch for a sudden drop in opens

An abrupt fall in open rate across a batch is often the first visible symptom of spam placement, because people do not open what they never see. This is where email open tracking is useful as a diagnostic rather than a vanity metric. Zestmail, a Chrome extension for Gmail, shows whether and when each tracked message was opened, filters out your own opens and common bot opens, and lets you watch results in a side panel without leaving Gmail. If a batch sent on Tuesday shows a normal spread of opens and a nearly identical batch sent on Thursday shows almost none, something changed between the two: a new template, a bigger volume, a bad list, or a reputation hit. That contrast is more informative than the absolute number.

Treat open data as a trend indicator, not a count. Image blocking and privacy proxies such as Apple Mail Privacy Protection mean some real opens are never recorded and some are recorded automatically, so individual results are unreliable even when the overall pattern is clear. The free plan covers up to 20 tracked emails a day and adds a small "Sent with Zestmail" footer to those messages; if you would rather not have a footer on outreach, the Pro plan removes it and the details are on the pricing page. You can install it from the Chrome Web Store. It does not request permission to read your Gmail inbox, which matters if you are sending from a work account.

Ask

The least technical check is often the most reliable. When someone does reply, ask whether your first message reached their inbox. If two or three people say it was in spam, you have your answer, and you know roughly when the problem began.

If you are already in spam: recovery order

Reputation can be rebuilt, but not quickly. Work in this sequence.

  1. Stop cold sending for at least a week. Continuing to send while filtered makes things worse.
  2. Fix authentication first. Confirm SPF, DKIM, and DMARC all pass using Show original in Gmail. Nothing else helps until this does.
  3. Clean the list. Remove every address that bounced and every domain that never engaged.
  4. Rewrite the template so it is shorter, plainer, and more specific, with the opt-out sentence included.
  5. Restart at warm-up volume, 10 to 15 cold emails a day, mixed with normal correspondence, and increase slowly while watching Postmaster Tools and your open trend.
  6. Consider a fresh mailbox on the same domain if the specific address has a long history of complaints. Do not switch to a brand-new domain just to escape a bad reputation; a new domain with no history and immediate cold sending is the exact pattern filters are built to catch.

Most small senders who land in spam got there by skipping authentication or by sending too much from a new address in the first week. Both are fixable, and once the records are in place and the volume curve is gradual, deliverability tends to stay stable as long as the list is clean and the writing stays human.