Why cold email lands in spam

Authentication is the floor. Inbox placement now follows whether people reply, and whether every email looks like the same template.

Cold email still reaches people. The mail that misses the inbox is usually not missing a DNS record. Operators on r/coldemail and r/DigitalMarketing spent 2025 and 2026 saying the same thing: SPF, DKIM, and DMARC were already correct, and placement still fell.

Google’s bulk-sender rules made authentication, a visible unsubscribe, and a spam-complaint rate under 0.3% the price of entry for anyone sending at scale. Those rules are necessary. They are not the ranking of your domain inside Gmail or Outlook. Providers now weigh whether people open, reply, delete, or mark you as spam, and whether the messages share one fingerprint.

Treat authentication as the floor

Check four things before you rewrite a word. One SPF record, and no more than the ten DNS lookups SPF allows. A DKIM signature that actually validates. A DMARC policy of at least quarantine once you are sending in earnest, with reports you read. Alignment between the domain you show and the domain you sign.

If any of those fail, fix them and stop. If they pass and mail still lands in spam, more DNS work will not move it. The rest of this guide is about the signals that remain.

What the four checks actually prove

SPF says which servers may send for the domain. A second SPF record, or a chain of includes that blows past ten lookups, fails closed. Mail can leave your platform and still fail the check at the receiver. DKIM proves the message was not altered and that you hold the signing key. DMARC tells the receiver what to do when those two do not agree with the address the person sees. Alignment is the part teams skip: the visible From domain and the authenticated domain have to be the same organisation.

Passing all four means you are allowed to send. It does not mean anyone wanted the message. Complaint rate, reply rate, and how similar each note looks to the last one are separate signals, and they are the ones that move a domain after the DNS is clean.

Sameness burns a domain faster than volume

A common report this year: teams dropped from about 50 emails a day per inbox to 15 or 20, kept the same copy, and still burned the domain. Gmail is not only counting volume. It is recognizing a campaign. The same opening, the same sentence rhythm, and the same call to action, sent to many people, reads as one blast even when the first name changes.

Volume is the easy number

Daily caps are simple to put on a slide. They are also the change that feels like work while the mail stays identical. A provider can see the same skeleton across inboxes, across domains, and across a week. Cutting the count without changing the shape just sends the same fingerprint more slowly. The domain still teaches the filter what to expect.

Spintax that swaps synonyms does little. Changing the structure does more. A note to a finance lead about month-end close should not share a skeleton with a note to a founder who just hired their first salesperson. Rotate the angle, the length, and the ask. Keep each inbox’s daily volume low enough that a bad hour does not teach the provider the wrong lesson. Warm the domain in the background. Do not treat a warmup score as proof that real buyers want the mail.

Personalization people can smell

“I noticed you posted about X” has become its own template. Readers on r/coldemail call most of it expensive spam: more effort, same reply rate, and a first line that announces the tool that wrote it. The split that does show up in those threads is between personalization and relevance. A scraped compliment is about the person. A timely reason is about their situation: a role they just opened, a public complaint in their market, a product change that creates a specific job.

A shorter list with that reason beats a long list with a custom first line. If the model invents the reason, you have a worse problem than spam. You have a false email in a buyer’s inbox. Check every concrete claim against a source you can open.

What to change this week

Do the checks in this order. Stop when a step fails, and do not buy another domain to skip it.

• Pause any inbox whose replies have gone quiet. Measure replies, complaints, and bounces per inbox, not a blended open rate.
• Confirm SPF has one record and stays inside ten lookups. Confirm DKIM and DMARC, then leave DNS alone.
• Split the list by situation, and write a different shape of email for each slice. One clear reason. One ask. No link stack in the first note.
• Cut daily volume before you buy another domain. A burned domain does not recover because the next sequence is clever.

How to read the reply rate

Community threads now describe a 2–3% positive reply rate as a solid cold-email result, down from the 5–8% people quoted a few years ago. Treat that as a field report, not a Sendblox benchmark. Your number moves with the list, the offer, and whether the mail was wanted. A blended open rate hides the inbox that has already gone quiet.

Where software helps, and where it does not

No sender fixes a list that should not have been emailed. What software can do is stop the sameness: pull the real record from the CRM, keep the offer inside a structure you approved, and vary the message from facts you already hold instead of a guessed compliment. Sendblox is built for that path. Connect the CRM, set the tone, and keep a person on the approval before anything sends.

If the domain is already injured, fix placement first. A better draft on a burned domain still lands in spam.