How to Send Cold Email Safely: The Complete Infrastructure Guide

First: why valid emails still bounce

A bounce message has a code, and the code tells you whose problem it is. Two very different situations both produce a "550":

• 550 5.1.1 (user unknown / mailbox not found): the address does not exist. This is a list-quality problem; remove the address.
• 550 5.7.x (policy, authentication, reputation, spam): the address exists, but the receiving server does not trust the sender. This is an infrastructure problem.

If most of a campaign bounces at once, it is almost never the list. Real-world invalid rates on a verified list are low single digits. When nine in ten messages are rejected, the receiving servers are blocking the sending domain or server: it is new, unauthenticated, already on a blocklist, or sending far too much too fast. Read the full bounce text before changing anything; the troubleshooting table at the end maps the common codes to fixes.

The setup at a glance

Step 1: Never cold email from your main domain

Your main domain (yourcompany.com) carries your invoices, customer support and every employee's email. If cold outreach damages its reputation, all of that starts landing in spam. Send cold email from secondary domains instead:

• Register close variants: getyourcompany.com, yourcompany-mail.com, tryyourcompany.com. Prefer .com (or your country TLD); avoid cheap novelty TLDs, which many filters distrust.
• Redirect each secondary domain's website to your main site so recipients who check it land somewhere real.
• Buy them now: a domain registered yesterday is treated with suspicion. Give new domains at least 2 weeks (ideally longer) before any cold sending, and use that time for warm-up.
• Plan for 2–3 mailboxes per domain. More mailboxes per domain concentrates risk on one domain.

Step 2: Set up real mailboxes

• Use paid Google Workspace or Microsoft 365 mailboxes on each secondary domain. They come with good shared infrastructure and proper authentication support.
• Name them after real people ([email protected]), not sales@ or info@. Add a profile photo and a normal signature with your company name and address.
• Do not send cold email through newsletter or marketing platforms. Their terms forbid cold lists, and one campaign can get the account suspended.
• Keep reply handling in the same mailbox. Conversations (replies, back-and-forth) are one of the strongest positive reputation signals.

Step 3: Authenticate every sending domain

Since 2024, Google and Yahoo require authentication for bulk senders, and Microsoft followed in 2025. Unauthenticated mail is rejected or sent to spam. Set up all of these on every sending domain (full walkthrough in our SPF, DKIM & DMARC guide):

Test before sending: send a message to a Gmail address, open it, choose Show original and confirm SPF: PASS, DKIM: PASS, DMARC: PASS. Do the same for every domain.

Step 4: Warm up new domains and mailboxes

A brand-new mailbox that suddenly sends hundreds of emails looks exactly like a spammer. Warm-up builds a sending history first. A typical schedule per mailbox (more detail in the warm-up guide):

Keep warm-up running even after you start cold sending; it keeps a steady flow of positive engagement on the mailbox.

Step 5: Stay inside safe daily volumes

The single most common reason a good setup gets blocked is volume. Spread sending across mailboxes instead of pushing one hard:

• 30–50 cold emails per mailbox per day (new emails plus follow-ups combined).
• Random gaps of several minutes between sends; never fire a whole batch at once.
• Send during the recipient's business hours, in their time zone.
• Increase volume gradually; a sudden jump from 20 to 200 a day undoes weeks of warm-up.

Volume math: how many mailboxes do you need?

Divide your target daily volume by ~40 per mailbox. For example, to reach 1,000 contacts a day you need about 25 mailboxes, which is 9–12 domains at 2–3 mailboxes each. A database of tens of thousands of contacts should be worked as a campaign over weeks, segment by segment. Not only is that safer, it also gives you time to learn which messages and segments respond best before you use up the list.

Step 6: Keep the list clean while you send

• Verify before you send, and re-verify any list older than about 30 days; people change jobs every day. Our free email verifier checks single addresses.
• Remove hard bounces immediately, and never retry a 5.1.1 address.
• Keep the hard bounce rate under 2% per campaign (see how to reduce bounce rate). If a single day goes above 3%, pause and investigate.
• Keep spam complaints below 0.1%. Google's hard limit is 0.3%, and you should never get near it.
• Catch-all and enterprise-gateway domains (common at large companies, including pharma and healthcare) accept every address at first and bounce later. Send to them in smaller batches and watch their bounce rate separately.
• Keep a suppression list of everyone who unsubscribed, objected or bounced, and apply it to every future campaign and every new list.

Step 7: Write emails that filters (and people) accept

• Plain text, short (50–125 words), written like one person to another.
• At most one link, and no link at all in the first email if you can. No attachments, images or URL shorteners in cold emails.
• Personalize the first line with something genuinely relevant to their role or company; avoid identical messages to thousands of people.
• Avoid spam-trigger phrasing ("100% free", "act now", "guaranteed", ALL CAPS, lots of exclamation marks).
• One clear, low-effort ask ("worth a short call next week?").
• 2–3 follow-ups at most, a few business days apart, in the same thread.
• Always include a simple way to opt out ("If this isn't relevant, just let me know and I won't contact you again"), and honour it at once.

More on structure and follow-up timing in cold email best practices.

Step 8: Compliance (EU, Germany, UK, US)

• EU (GDPR): B2B cold outreach typically relies on legitimate interest (Art. 6(1)(f)). Document a short legitimate-interest assessment, contact only people whose role makes your offer relevant, tell them who you are and where you got their data (Art. 14, at the latest with the first message), and stop immediately when someone objects. See our GDPR-compliant B2B data guide.
• Germany (UWG §7): stricter than GDPR alone. Advertising by email generally requires prior consent, including B2B. Many German teams therefore use phone, LinkedIn or events for German prospects, or send only where they have a clear legal basis. Get legal advice before emailing German recipients cold.
• Other EU countries implement the ePrivacy rules differently (several, such as France, are more permissive for B2B than Germany). Check per country before including it in a campaign.
• UK (PECR): emailing corporate subscribers (e.g. [email protected]) is allowed with a clear opt-out; sole traders and some partnerships count as individuals and need consent.
• US (CAN-SPAM): accurate sender details and subject lines, your physical postal address in the email, a working opt-out honoured within 10 business days.
• Canada (CASL): stricter than CAN-SPAM; B2B messages are allowed under implied consent in limited cases (e.g. a published business address with no "no solicitation" note, and a message relevant to the person's role). Include identification and an unsubscribe mechanism.

Step 9: Monitor reputation every day

• Google Postmaster Tools: domain reputation and spam rate for mail delivered to Gmail. Add every sending domain.
• Microsoft SNDS and the Outlook sender support portal: delivery data for Outlook / Microsoft 365 recipients.
• Blocklist checks (Spamhaus, Barracuda and similar) for each domain and sending IP, weekly or after any bounce spike.
• DMARC aggregate reports: confirm all of your mail passes and nobody is spoofing your domains.
• Your own numbers per mailbox: hard bounce rate, reply rate and the exact bounce codes. A falling reply rate on a mailbox is often the first sign of spam-folder placement.

Pause rule: if a mailbox or domain shows a sudden bounce spike, 5.7.x rejections or a blocklist hit, stop sending from it, find the cause, and only resume slowly once it is fixed.

Troubleshooting: what common bounce codes mean

If the majority of a campaign fails with 5.7.x codes, stop the campaign. The list is not the problem: the sending domain, server or volume is. Rebuild on fresh, authenticated, warmed-up secondary domains before you continue.

Pre-launch checklist

• ☐ Secondary sending domains registered and redirected to the main site
• ☐ 2–3 named mailboxes per domain on Google Workspace or Microsoft 365, with photo and signature
• ☐ MX, SPF, DKIM and DMARC published on every domain; "Show original" shows PASS for all three
• ☐ Own tracking domain, or tracking switched off
• ☐ At least 2–3 weeks of warm-up completed
• ☐ Daily limit set to 30–50 per mailbox, with random sending gaps
• ☐ List verified recently; suppression list applied
• ☐ Plain-text copy, at most one link, clear opt-out line
• ☐ Legal basis checked for every target country (especially Germany)
• ☐ Postmaster Tools and blocklist monitoring set up; pause rule agreed
• ☐ First campaign sent as a small test batch before scaling

FAQ

Can I just use my normal company mailbox for cold email?

For a handful of personal, one-to-one emails, yes. For anything at volume, no. If cold outreach damages your main domain's reputation, customer and internal email suffers too. Use secondary domains.

How long until I can send at full volume?

Plan on 3–4 weeks from registering domains to sending 30–50 cold emails per mailbox per day: about two weeks of pure warm-up, then a gradual ramp.

Our list is verified, so why are emails still rejected?

Check the bounce codes. If they are 5.7.x, the receiving servers are rejecting the sender, not the address: authentication, reputation, blocklisting or volume. Fix the sending setup first; re-sending the same list from the same setup will only make it worse.

What bounce rate is acceptable?

Under 2% hard bounces per campaign. Above 3% on any day is a signal to pause and investigate.

Should I track opens?

Open data has become unreliable (privacy features pre-load images), and tracking pixels and rewritten links are spam signals. Many teams turn tracking off and measure replies and meetings instead. If you do track, use your own tracking domain.