Cold Email Deliverability: How to Test It, What Breaks It and the Bounce Numbers That Matter
Publish date: Oct 26, 2026
Cold email deliverability is the share of the emails you send that reach the inbox: not the spam folder, and not a bounce. "Delivered" is a weaker claim. A server can accept a message and file it under spam, and your sending tool still counts it as delivered. Campaign Monitor reports an overall delivery rate of 99% and admits it cannot see how much of that mail reaches the inbox.
This guide covers three tests to run before a campaign. It shows the bounce rates Spona sees on verified B2B sends in the US and the UK, then the fix order for a sudden drop. Spona's sender rules sit in one table you can copy.
Get thousands of leads in 4 minutes.
Stop stitching tools together.
Start with verified sales data, delivered in minutes.
No contracts · No setup · No onboarding
What cold email deliverability means, and why "delivered" is not enough
Validity measures inbox placement for marketing senders. It defines deliverability as a sender's ability to reach the inbox, "not the spam folder." Three rates hide under that word:
- Delivery rate: sent minus bounced. It counts a message in the spam folder as delivered.
- Inbox placement rate: messages in the inbox divided by messages sent. This is the deliverability number.
- Open rate: a proxy at best. Apple's Mail Privacy Protection hides opens from senders, so a flat open rate proves nothing about placement.
Across the marketing senders on Validity's panel, 87.2% of mail reached the inbox last year. Another 6.1% went to spam, and 6.6% went missing, blocked or deferred on the way. Those senders mail people who opted in, so treat their figures as context, not a target.
For a B2B sender, deliverability is what your domain's reputation lets you do. It sets how many messages a day each inbox can send before Gmail, Outlook or a corporate filter starts deferring them. Reputation moves with three inputs you control: authentication, volume and the quality of the list.
What breaks cold email deliverability: six causes
Most email deliverability problems start on the sender's side.
Volume bursts. Google's sender guidelines warn that doubling your volume suddenly "could result in rate limiting or reputation drops", and tell senders to avoid bursts. A new inbox that sends 200 messages on day one looks like a spam run.
Provider caps. A Google Workspace user may send 2,000 messages a day, or 500 on a trial account. Cross the cap and sending stops for up to 24 hours. Exchange Online allows 10,000 recipients a day per mailbox and 30 messages a minute.
Broken SPF. An SPF record may trigger at most 10 DNS lookups. Every "include" for a CRM, a helpdesk or a sending tool adds at least one. Lookup eleven turns the result into "permerror", which receivers read as a failed check.
Weak or missing DKIM. Gmail requires DKIM keys of 1,024 bits or longer and recommends 2,048. The DKIM standard sets the same minimum and recommendation. When Gmail rate-limits a sender over DKIM, the bounce carries code 4.7.30.
Stale lists. Yahoo closes a mailbox after 12 months without activity, Gmail after 24. Some closed addresses return as recycled spam traps, which catch senders who never clean their lists. ZeroBounce estimates that at least 23% of a list decays within a year.
Complaints. Gmail and Yahoo both want a spam rate below 0.3%, and Gmail asks senders to stay under 0.1%. Once a domain crosses the line, Gmail applies no mitigation until the rate has stayed below it for seven days.
Can bad lead data ruin cold email deliverability?
Yes, twice over. Every hard bounce tells the receiving server that you mail addresses nobody confirmed. Every spam trap tells it the list was bought or scraped. Both lower the sending domain's reputation, and reputation decides where the next message lands.
One Spona customer shows the effect. A US SaaS outbound team with under 50 staff bought 10,000 verified contacts and sent them through Instantly. Before the switch, 245 of 10,000 sends over four weeks came back as hard bounces. That is 2.45%.
After the switch, 85 of 10,000 sends bounced over four weeks. The rate fell to 0.85%, which is 160 fewer hard bounces.
It is one customer and a before-and-after count. The figures do not prove cause, and they are not a typical result.
Do the Gmail, Yahoo and Outlook rules apply to B2B email deliverability?
Mostly not, and yet they set the standard. Google's bulk-sender rules cover mail to @gmail.com and @googlemail.com addresses and "don't apply to messages sent to Google Workspace accounts". Microsoft's rule names outlook.com, hotmail.com and live.com. A B2B list of work addresses meets those filters only through the people who run a free mailbox for work.
Business mailboxes still check SPF, DKIM and DMARC. Microsoft 365 writes its own authentication verdict, labelled "compauth", into the Authentication-Results header of incoming mail. So the three providers' rules are the cheapest guide to the checks your B2B recipients run anyway.
| Rule | Gmail, personal accounts | Yahoo | Outlook.com |
| Who counts as bulk | around 5,000 messages a day or more, counted per primary domain; the status is permanent | not defined by volume | more than 5,000 messages a day |
| Authentication | all senders: SPF or DKIM; bulk: SPF and DKIM plus DMARC (p=none allowed) with an aligned From domain | all senders: SPF or DKIM; bulk: SPF and DKIM plus DMARC at least p=none, passing and aligned | SPF pass, DKIM pass, DMARC at least p=none, aligned |
| Spam rate | below 0.3%; aim under 0.1% | below 0.3%, measured on mail that reached the inbox | not stated as a number |
| Unsubscribe | one-click header plus a visible link, for marketing and subscribed mail | one-click header plus a visible link; honor requests within 2 days | not among the three enforced checks |
| DKIM key minimum | 1,024 bits, 2,048 recommended | 1,024 bits | not stated |
| Enforcement | temporary and permanent rejections, ramping since November 2025 | enforced since February 2024 | rejection with "550; 5.7.515 Access denied" since May 5, 2025 |
Gmail's baseline has applied to every sender since February 1, 2024, not only to bulk senders: SPF or DKIM, valid forward and reverse DNS, and TLS. Microsoft is the harder room. On Validity's marketing panel, inbox placement was 89.8% at Gmail and 77.4% at Microsoft, which Validity calls "the toughest".
The B2B email list guide explains which Gmail rules apply to B2B email.
How to test email deliverability before a campaign: three checks
An email deliverability test needs no paid tool. Run the three checks in this order, because each one depends on the last.
Check SPF, DKIM and DMARC in the message headers
Send one message from the campaign inbox to a Gmail address you control. Open it, click More next to Reply and choose Show original. Google's DKIM guide says to look for Authentication-Results, with a result like "DKIM=pass". Check SPF and DMARC there too.
For a Microsoft 365 recipient, find the Authentication-Results line in the header, which records the outcome of each check. If DMARC fails while SPF and DKIM pass, the From domain matches neither the SPF domain nor the DKIM domain. That is an alignment problem; Spona's table below has the fix.
A free email deliverability checker reads the header for you. Send a message to ping@tools.mxtoolbox.com and MxToolbox returns the header analysis, the blocklist status of your outbound IP and your SPF record.
Run an inbox placement test on seed addresses
A seed test sends your real campaign email to mailboxes at Gmail, Outlook, Yahoo and business hosts, then reports which folder each copy landed in. The free plan at GlockApps gives two test credits, and paid plans start at $59 a month billed annually. The free tier at mail-tester scores one message out of 10 against a default SpamAssassin install, three tests in 24 hours.
A deliverability score is not a placement rate. The score grades the message; the mailbox grades the sender. Only a seed test measures inbox placement rate, the count in the inbox divided by the count sent. Check the email deliverability score first, for the cheap mistakes.
Google's Postmaster Tools shows domain reputation and spam rate for mail to personal Gmail, and its dashboards may show no data on low-volume days.
Send a small verified batch and count hard bounces
Verify the list, then send the first week at 10 messages a day per inbox, the opening step of Spona's ramp. The SMTP standard splits bounce codes in two. Codes starting 5.x.x mark a permanent failure, "not likely to be resolved by resending". Codes starting 4.x.x mark a transient one.
Hard bounce rate is permanent failures divided by attempted sends. Above 2%, stop and re-verify before week two. The next section shows the numbers behind that threshold.
The bounce numbers that matter for cold email deliverability: Spona data
Gmail, Yahoo and Microsoft publish no bounce limit. Google tells senders to unsubscribe anyone with "multiple bounced messages". Yahoo says to remove invalid recipients "promptly", and Microsoft says "regularly".
The 2% line is vendor advice, and Spona uses it as its own operating target. Twilio tells senders to act when the bounce rate creeps above 2% and calls anything under 1% healthy. Over a recent quarter, Spona checked 10,000 unique candidate addresses in each market and sent to 5,000 of the addresses that passed.
| Market | Addresses checked | Pass | Catch-all | Other rejected | Verified sends | Hard bounce |
| US | 10,000 | 78.0% | 14.0% | 8.0% | 5,000 | 1.5% (75 bounces) |
| UK | 10,000 | 80.0% | 12.0% | 8.0% | 5,000 | 1.2% (60 bounces) |
Pass and catch-all are shares of all unique addresses checked. "Other rejected" covers invalid, unknown, disposable and suppressed addresses. Hard bounce rate is permanent failures divided by attempted sends to verified, non-catch-all addresses. Spona does not measure inbox placement, which only a seed test does.
The Germany and France rows sit in the email list cleaning post.
Hard bounces are the 5.x.x failures: the address does not exist, or the server rejects the sender outright. Each one counts against the sending domain, so suppress the address for good.
Soft bounces are the 4.x.x failures: a full mailbox, a greylisting delay, a rate limit. A retry may get through. A run of soft bounces from one provider usually means you send too fast for it.
Catch-all addresses belong to domains that accept mail for any name. ZeroBounce calls them "impossible to validate without emailing them". Spona reports them as their own line and keeps them out of the verified benchmark. The B2B data validation post explains how a verifier reaches each verdict.
For context only: marketing senders on Validity's panel averaged 1.46% unknown users, its term for hard bounces, and 0.06% complaints last year. Those are opt-in lists, not cold-email benchmarks. ZeroBounce found only 62% valid across the more than 11 billion addresses it checked last year. Its mix of consumer and business lists does not compare with a B2B pass rate either.
Spona's email deliverability checklist: 10, 20, then 30 emails a day
This is the list Spona gives customers at onboarding, as issued. It covers the sender's side only.
| Check | Rule |
| SPF | Authorize every sending service in the domain's SPF record; confirm pass |
| DKIM | Enable signing and confirm pass; 2,048-bit keys where supported |
| DMARC | Publish DMARC, at first at least p=none with reports; align From with SPF or DKIM |
| Infrastructure | TLS and matching forward and reverse DNS; the provider manages shared IP setup |
| Warm-up | Raise genuine sending gradually over two to four weeks; pause increases when deferrals or complaints rise |
| Daily volume per inbox | Week one: 10, week two: 20, week three on: 30 outbound messages a day, follow-ups included, within provider limits and observed results |
| Complaints | Aim below 0.1%; investigate any rise; never approach 0.3%; check provider dashboards daily |
| Unsubscribe | Visible opt-out, plus one-click headers for bulk marketing; process suppressions within two days |
| List verification | Verify before delivery; recheck any check older than 30 days before sending; catch-all excluded from the verified benchmark |
| Hard bounces | Target below 2% on freshly checked lists; above it, pause the batch and investigate; apply customer suppressions before sending |
Other vendors set the daily cap higher. Artisan advises 15 to 50 emails a day per inbox. Woodpecker says to try never to go over 50 to 100 a day from one address. Mailreach sets a maximum of 80 cold emails a day per sending address.
Spona's 30 sits at the low end on purpose. Follow-ups count toward it, and every follow-up sequence multiplies the first send. Spona also pauses increases when deferrals or complaints rise. When hard bounces pass 2%, the batch pauses.
How to fix email deliverability when bounces or complaints rise
A sudden drop has a short list of causes. Folderly's checklist puts blocklists first, then recent changes, then the bounce messages; Google's advice adds the first move.
- Cut volume. Google says that when messages start bouncing or deferring, reduce the sending volume until the SMTP error rate falls, "then, increase slowly again."
- Check the blocklists. The MxToolbox report from the header test shows the outbound IP's status.
- Read the bounce codes. A 550 5.7.1 is a policy rejection. Gmail's 4.7.30 points at DKIM. Outlook's 550 5.7.515 means a high-volume domain failed authentication.
- Find what changed. A new tool added to SPF can push the record past 10 lookups. A new domain or a new list explains most of the rest.
- Re-verify the list. Recheck any address whose last check is older than 30 days, Spona's rule, and suppress every hard bounce from the affected batch.
- Re-run the header test. Confirm SPF, DKIM and DMARC all pass and that the From domain aligns.
- Pause the inbox if complaints approach 0.3%. Gmail lifts nothing until the rate has stayed below the line for seven days.
Most email deliverability tips come down to one habit: read the bounce messages, not the open rate. The bounce names the check that failed.
Where Spona fits in cold email deliverability, and where it does not
Spona works on the list side of the problem. You describe your ideal customer in a chat. The AI mines 40+ sources, verifies every lead and delivers a scored list in about 4 minutes, and you pay per lead.
Credits cost $0.008 to $0.01 each, depending on the plan. Each new search session costs a one-time 1,000 credits, and the price per lead shows at checkout.
A Deep Search lead, scored and verified, costs $0.48 to $2.00. A Bulk Search lead costs $0.008 to $0.09. Every search starts with a free sample, so you can test the bounce rate yourself.
Spona does not send email, warm up inboxes or rotate domains; sending tools such as Instantly or Woodpecker do. It does not measure inbox placement; GlockApps or Validity does.
Its enrichment adds verified emails to a list you upload. Checking the addresses already in a list takes a bulk verifier such as ZeroBounce or NeverBounce.
The email list cleaning post compares those services and their prices.
Get thousands of leads in 4 minutes.
Stop stitching tools together.
Start with verified sales data, delivered in minutes.
No contracts · No setup · No onboarding
Cold email deliverability FAQ
What is a good email deliverability rate?
Validity's guide calls 85% or more good, as an opinion, and its panel of marketing senders averaged 87.2% inbox placement last year. Validity's panel does not cover cold email. Run your own seed test, and fix hard bounces above 2% first.
Does DKIM improve deliverability?
Yes, and at Gmail its absence costs you directly. Gmail requires SPF or DKIM from every sender and both from bulk senders. A DKIM failure can trigger rate limiting with code 4.7.30. DKIM cannot rescue a bad list; it only proves the message came from your domain unchanged.
Does the domain name affect email deliverability?
The sending domain carries the reputation, and Gmail counts bulk-sender status per primary domain. Woodpecker recommends a separate outbound domain, so you control everything sent from it. A new domain starts with no reputation, so warm it up over two to four weeks.
What is the 30/30/50 rule for cold emails?
One version gives 30% each to personalization and value. Follow-up gets 50%, so the shares add up to 110%. It is a copywriting heuristic, not a deliverability rule, and the follow-ups it calls for count toward your daily cap. The B2B cold email templates post has 15 examples.
Is cold emailing illegal?
Not in the US or the UK, with conditions. The FTC says CAN-SPAM "makes no exception for business-to-business email". Each violating email can cost up to $53,088. You must honor opt-outs within 10 business days and put a postal address in every message.
In the UK, the ICO says the PECR consent rule "doesn't apply to corporate subscribers", while sole traders and some partnerships count as individuals. You must still say who you are and give a valid opt-out address. UK GDPR applies to personal data used for marketing, even in a business context. The buy email list post covers the rules market by market.
How often should you re-verify a cold email list?
Spona rechecks any address whose last check is older than 30 days before a send. ZeroBounce puts list decay at at least 23% a year. Recheck the addresses you plan to mail this month, not the whole database once a year. The data decay post explains where the churn comes from.
Share this article
GET FREE LEADS
