What is cold email deliverability?
Cold email deliverability is whether a message you send to someone who has not heard from you before actually reaches their inbox, rather than being rejected at the door or filed into spam. It is distinct from delivery, which only means the receiving server accepted the message — mail can be delivered and still never be seen.
The important thing to understand first is that deliverability is not a setting. There is no toggle, no header, and no vendor that can put your mail in the inbox. It is the cumulative result of three things: whether you are provably who you say you are, whether your sending volume matches your history, and whether the people receiving your mail want it. Everything below is one of those three.
What actually decides whether your email lands?
Four inputs, roughly in the order a receiving server evaluates them:
- Authentication. Can the receiver verify the message really came from your domain and was not altered? This is SPF, DKIM and DMARC, and it is binary — it either passes or it does not.
- Domain and IP reputation. What has this domain sent before, and how did recipients react? A domain with no history is not trusted; a domain with a bad history is trusted less.
- Recipient engagement. Replies, opens and moves out of spam are positive. Deletions without reading, and especially spam complaints, are negative. This is why list quality is a deliverability input and not only a conversion one.
- List hygiene. Bounces and repeated sends to dead addresses mark a sender as working from a bought or stale list.
Content matters far less than most people expect. Spam-word checkers are largely folklore; a well-authenticated domain with good engagement can use the word "free" without consequence, and a new unauthenticated domain will struggle no matter how carefully the copy is written.
What are SPF, DKIM and DMARC?
They are three DNS records that together let a receiving server prove a message genuinely came from your domain. Each proves a different thing, and DMARC only works if at least one of the other two is in place and aligned. All three are published internet standards, so unlike most of what gets written about deliverability, these can be stated exactly.
| Record | What it proves | What breaks without it | How to check it |
|---|---|---|---|
| SPF TXT at the domain | That the server sending the message is one your domain authorised to send on its behalf (RFC 7208). | Anyone can send mail claiming to be from your domain, and receivers have no way to tell. Bulk mail from your domain is likely to be rejected or filtered. | dig TXT yourdomain.com — look for one record starting v=spf1. Two SPF records invalidate both. |
| DKIM TXT at a selector | That the message was signed by your domain's private key and its contents were not altered in transit (RFC 6376). | Forwarded mail loses its provenance, and DMARC has nothing durable to align against — SPF alone breaks whenever a message is forwarded. | dig TXT selector._domainkey.yourdomain.com, using the selector your provider names. |
| DMARC TXT at _dmarc | What a receiver should do when SPF and DKIM both fail, and where to send reports about it (RFC 7489). | No policy and no visibility: you cannot see who is failing authentication on your domain, including attackers spoofing it. | dig TXT _dmarc.yourdomain.com — look for v=DMARC1 and a p= policy. |
Since 2024, Google and Yahoo have both required bulk senders to publish all three, to support one-click unsubscribe, and to keep spam complaint rates low. That shifted authentication from good practice to a precondition: mail that fails it is not filtered more aggressively, it is frequently refused.
How do you set up email authentication?
In this order. The sequence matters because tightening a DMARC policy before the reports are clean will block your own legitimate mail.
- Publish an SPF record. One TXT record at the sending domain, listing every service allowed to send as you. Exactly one — a second SPF record invalidates both.
- Enable DKIM signing in your mail provider, and publish the public key it gives you as a TXT record at the selector it names.
- Publish a DMARC record at p=none with a reporting address. This asks receivers to tell you what is failing without rejecting anything yet.
- Read the reports, then tighten. Once your legitimate mail is passing with alignment, move to p=quarantine, then p=reject.
- Ramp volume gradually from the new mailbox, holding steady whenever bounces or complaints rise.
- Suppress bounces and unsubscribes automatically, permanently, on every campaign.
Nova checks SPF, DKIM and DMARC when you connect a mailbox and tells you which of the three is missing, rather than letting a campaign start from a domain that cannot authenticate. The records themselves live in your DNS and have to be published by whoever controls it.
Why can't a new domain or mailbox send volume on day one?
Because it has no sending history, and reputation is the main thing a receiver has to judge it on. A domain that sent nothing yesterday and four hundred messages today is the exact shape spam filtering exists to catch — the volume is not the problem so much as the discontinuity.
The fix is a ramp: start small, increase gradually, and hold volume steady any time bounces or complaints tick up. An honest caveat applies to every number you will read about this, including anything we publish — mailbox providers do not document their thresholds, so ramp schedules are working shapes drawn from practice, not specifications. Several weeks is a reasonable expectation, and the shape matters more than the figures: small, steady, responsive to what the bounces are telling you.
This is the same logic as LinkedIn account warm-up, for the same reason: both platforms judge behaviour against history, and both punish discontinuity. Nova gives a newly connected mailbox its own warm-up ramp and daily cap, paced by the same governor and ledger that paces LinkedIn invites.
What is a hard bounce, and why must it be suppressed forever?
A hard bounce is a permanent failure: the address does not exist, and no amount of retrying will change that. A soft bounce is temporary — a full mailbox, a server briefly refusing — and can reasonably be retried a few times before being treated as permanent.
Continuing to send to hard-bounced addresses is one of the clearest signals that a sender is working from a purchased or stale list, and it damages domain reputation directly. The operative word is automatic: suppression that depends on somebody remembering to clean a CSV will eventually fail, usually at the worst moment. Nova honours bounces permanently, so an address that failed once is not re-sent to by the next campaign.
Why does one-click unsubscribe protect your domain?
Because the alternative to an easy unsubscribe is a spam complaint, and a spam complaint is far more damaging. Someone who cannot find the opt-out will reach for the "report spam" button instead, and that single action tells the mailbox provider something much worse about your domain than a quiet unsubscribe would.
One-click unsubscribe is a published standard (RFC 8058): headers that let the mail client show an unsubscribe control and action it without the recipient visiting a page. Google and Yahoo now require bulk senders to support it. Honouring it has to be automatic and immediate — an opt-out that is recorded but still receives the next campaign step is worse than no opt-out at all. Nova applies one-click unsubscribes automatically across campaigns.
Should you send from your own domain or a lookalike?
Both have real costs, and anyone presenting this as settled is skipping the trade-off. A separate lookalike domain insulates your primary domain if a campaign goes badly — but it starts with zero reputation, needs its own full warm-up, and resembles the pattern phishing uses, so filters treat new lookalike domains with suspicion. Recipients notice too.
Sending from your primary domain means every message carries whatever reputation that domain has already earned, and the address matches the company making contact. The cost is that bad sending damages the domain your invoices and support mail also come from — which is an argument for sending carefully, not for sending from somewhere disposable. Nova sends from your own domain and mailbox, connected over OAuth for Google Workspace and Gmail or over SMTP and IMAP for any other host, never from a shared pool or a lookalike, because sender reputation should stay yours.
How does LinkedIn-first outreach change deliverability?
It changes the single input you have least direct control over: whether the recipient wants the mail. An email from a stranger is judged as a stranger's email. An email that arrives after a connection request from a name the person has already seen is not quite cold — recognition lowers the chance of a spam complaint, and complaints are the most damaging signal a recipient can send.
This is why Nova runs LinkedIn first and email second by default: on a LinkedIn campaign, invites still unaccepted after seven days are picked up by email automatically, carrying the same research and tone as the invite. Email can also run as a campaign of its own from the first touch, off your own list. What does not happen is both channels aimed at the same person at once to inflate touch counts, and a reply on either channel cancels every remaining step. Where an email campaign starts from LinkedIn profile URLs rather than addresses, the work-email lookup asks Apollo, SalesQL and QuickEnrich in that order until one answers.
Frequently asked questions
Why is my cold email going to spam?
Almost always one of four things, in this order of likelihood: the domain is not authenticated (SPF, DKIM and DMARC are missing or misaligned), the mailbox is sending more volume than its history supports, the list contains addresses that bounce, or recipients are marking the mail as spam. Authentication is the one to check first because it is binary and free to fix — Google and Yahoo both require SPF, DKIM and DMARC from bulk senders, and mail that fails them can be rejected outright rather than filtered. After that it is reputation, which is earned slowly and lost quickly. There is no setting that puts mail in the inbox: deliverability is the cumulative result of who you send to, how much, and how many of them want it.
How long does it take to warm up a new email domain?
Plan for several weeks rather than days, starting with a handful of sends a day and increasing gradually while bounces and complaints stay low. Nobody publishes an official ramp — mailbox providers do not document their thresholds any more than LinkedIn documents its limits — so treat every schedule you read, including ours, as a working shape rather than a specification. The principle is firmer than any number: a brand-new domain has no sending history, so every message is evaluated on the domain's reputation alone, and a sudden burst from an unknown domain is the exact pattern spam filtering is built to catch. A domain registered specifically to send cold email also starts with no positive signal of any kind, which is why a ramp matters more there, not less.
Do I need a separate domain for cold email?
It is a real trade-off, not a best practice. Sending from a lookalike domain protects your main domain's reputation if a campaign goes badly, but the lookalike starts with no reputation at all, has to be warmed from zero, and is the same pattern phishing uses — so filters treat new lookalike domains with suspicion. Sending from your primary domain means every message is backed by whatever reputation that domain has already earned, and recipients see an address that matches the company they are being contacted by. Nova sends from your own domain and mailbox rather than a shared pool or a lookalike, because sender reputation should stay yours. If you do use a separate domain, warm it as carefully as you would a new mailbox, and never treat it as disposable — burning domains in sequence is a pattern of its own.
What happens if I keep emailing an address that bounced?
Your domain reputation falls, and continuing to send to known-bad addresses is one of the clearest signals that a sender is working from a purchased or stale list. A hard bounce means the address does not exist and will never exist — it must be suppressed permanently, not retried. A soft bounce is temporary (a full mailbox, a server briefly refusing) and can be retried a limited number of times before being treated as hard. The practical rule is that suppression must be permanent and automatic, because a list that is manually cleaned will eventually not be. Nova honours bounces permanently and applies one-click unsubscribes automatically, so a bad address is removed once rather than re-sent to by the next campaign.
Terms used above are defined in the glossary — including SPF, DKIM and DMARC, mailbox warm-up, one-click unsubscribe and the email lookup waterfall. Email is included on both plans — see pricing for what a sender covers.
Want authentication checked at connect, a warm-up ramp per mailbox, and bounces and opt-outs suppressed automatically? Start free trial — self-serve, no card required.
