Why cold email goes to spam, and the order to fix it

Almost every discussion of this problem starts with the copy — the spam words, the subject line, the number of links. That is the fifth most likely cause, and working on it while an earlier one is broken is the reason teams rewrite emails for a month and see nothing change.

The causes, in the order they should be checked: authentication, then list quality, then complaints, then volume and pattern, then content. Each one dominates the ones below it. A domain failing DMARC alignment will be filtered regardless of how good the writing is.

Two of these have published numbers attached, which makes them objectively checkable rather than a matter of judgement:

Spam complaint rate

Keep under 0.30%, target 0.10%. The figure the major providers publish for bulk senders.

Hard bounce rate

Sustained above roughly 5% is read as a purchased or stale list.

Authentication

SPF, DKIM and DMARC — all three, aligned with the visible From domain.

Unsubscribe

A one-click List-Unsubscribe header, not only a footer link.

Authentication is the entry ticket. Passing does not make you reputable; failing means very little else about you is considered. Three records, and they do different jobs.

SPF lists the servers permitted to send for your domain. Its two classic failures are the ten-lookup limit — every include: for a provider, a helpdesk, a marketing tool costs at least one, and exceeding ten fails the entire record rather than the eleventh entry — and leaving the record at ~all indefinitely, which keeps it advisory.

DKIM signs the message cryptographically. Unlike SPF it survives forwarding, which is why it usually carries alignment in practice. When it fails, something modified the message after signing — a mailing list footer, a security appliance rewriting links, a gateway reformatting MIME.

DMARC is the one that matters most, because it ties the other two to the From address the recipient actually sees and states what a receiver should do when neither aligns. Start at p=none, read the aggregate reports until every legitimate sender is accounted for, then move to quarantine and reject. Publishing reject early breaks your own mail; leaving none forever provides no protection.

If authentication passes and mail is still filtered, the list is the next suspect — and the symptom is your bounce rate. A sustained hard-bounce rate above roughly five percent is where receiving providers stop treating you as someone with a few bad addresses and start treating you as a list problem.

• Suppress every hard bounce immediately. Sending again to an address that does not exist has a direct cost and no upside. It is the single most common avoidable mistake in outbound.
• Retry soft bounces a few times, then stop. A mailbox that has been full for three months will not accept the fourth attempt either.
• Treat catch-all domains as a separate cohort. They accept everything, so verification tells you nothing and the failure is silent — no bounce, no reply, capacity consumed.
• Age is the hidden variable. Roughly a quarter to a third of business contact records go stale each year through job changes alone, so a verified record with an eighteen-month-old check is not verified, it is historical.

The complaint rate is the most damaging number in sending, because it is the recipient telling the provider directly that your mail is unwanted — which is exactly the judgement a filter exists to make. At a 0.3% ceiling, three complaints per thousand delivered messages is the limit, and on a fifty-a-day mailbox that is a handful of people over a month.

Note the denominator: complaints are measured against delivered mail. Fixing your bounce rate without improving relevance can therefore raise your complaint rate, because more of what you send now arrives in front of people.

The causes are structural rather than editorial — irrelevance at volume, a hidden or broken unsubscribe, excessive follow-up, and role addresses read by the people least patient with unsolicited mail. The single cheapest control is making the exit obvious: one-click unsubscribe via the List-Unsubscribe header, with the removal written to a suppression list checked before every send.

Providers score consistency as well as content. A domain that sends nothing for three weeks and then two thousand messages in an afternoon is describing itself as a campaign rather than as a business, and a new mailbox that goes from zero to hundreds in a day looks exactly like a compromised account.

Three controls handle almost all of it: a daily cap per mailbox set well below what your provider technically allows, a ramp that raises a new mailbox's ceiling gradually, and a send window that keeps mail inside working hours on working days. Business mail arriving at three in the morning looks automated regardless of how it is written.

The related question — how to run several mailboxes without any of them carrying too much — is the subject of the rotation guide.

Content-based filtering is real, and it is much smaller than its reputation. Modern filters weight sender behaviour far more heavily than keywords, which is why the phrase spam trigger words describes a 2008 problem. A message from an authenticated domain with a clean complaint history is not filtered for containing the word free.

What does still matter is structural. Mail that is one large image with no text, that carries link shorteners or a redirect chain, that links to a domain with no reputation of its own, or that is HTML-heavy with no plain-text alternative, is all harder to place. So is a message whose visible From domain differs from the one that passed authentication.

The genuinely effective content change is not a rewrite. It is sending to fewer, more relevant people — because the metric filters are actually reading is whether recipients engage, and relevance is the only lever on that.

When placement is already bad, work from evidence rather than from theory. Four steps, in order:

• Check the resolved records — SPF, DKIM, DMARC, MX and blocklist status for every domain you send from, and note when each answer was checked. A cached answer presented as current is how a fixed record appears broken for hours.
• Send to mailboxes you control. A seed list across the providers your recipients actually use is the only direct observation of placement available to a sender. Delivery statistics cannot tell you — a message filed in spam is delivered.
• Segment by cohort, not by day. A bounce spike almost always traces to one imported list, and a complaint spike to one sequence or one audience. The average across everything hides both.
• Reduce volume while you fix it. Reputation falls in days and recovers in weeks, so sending at full rate through a diagnosis extends the recovery you are trying to start.

SalesShift checks SPF, DKIM, DMARC, MX and blocklist status per sending domain with a timestamp on every answer, keeps seed-list placement tests as a history rather than a snapshot, and pauses a mailbox automatically when the complaint or bounce threshold is crossed with enough events behind it to be real.