What Is Email Deliverability? The 2026 Guide for Cold Email Senders

Delivered Is Not the Same as Inboxed

Your sequencer reports "sent" and "bounced". The gap between them is the delivery rate, and for a healthy fleet it sits above 97%. That number says the receiving server accepted the message. It says nothing about what the server did next. Gmail, Outlook and the corporate gateways in front of them accept most mail and then file it: primary inbox, promotions, junk, or quarantine. A cold email campaign can run at 99% delivered and have most of it in spam, and nothing in the sending tool will tell you.

Deliverability is that second step. It is decided per message, per receiver, from signals you only partly control, and it is the reason two senders with identical copy and identical lists get different reply rates. Everything else in this guide is about those signals.

The Four Inputs Receivers Weigh

• •Authentication. SPF says which servers may send for your domain, DKIM signs the message so it cannot be altered, and DMARC tells the receiver what to do when neither aligns. In 2026 these are pass/fail prerequisites, not advantages: Google and Yahoo's bulk sender rules require all three, with alignment, and mail without them is filtered before reputation is even consulted. Run the authentication checker on every sending domain before its first send.
• •Reputation. Each receiver keeps a private history of your domain and of the platform it sends from: how much you send, how fast that grew, how many people complained, bounced, deleted without reading, or replied. A domain registered last week has no history, which receivers treat with suspicion rather than neutrality. This is the input you cannot read directly; the closest you get is Google Postmaster Tools for mail to Gmail.
• •Content. Links, images, HTML weight, tracking pixels, attachments and the words themselves. Cold email that reads like a person wrote it, plain text, one ask, no link in the first touch, gives filters the least to object to. The spam checker and the link and pixel scanner show what a filter sees in a draft.
• •Engagement. Replies, opens that are not bots, moves out of spam, and the absence of complaints. Gmail leans on this harder than anyone. It is the input you influence through list quality and relevance, and it is why a verified, well-targeted list at a modest pace outperforms a bigger list pushed harder.

What You Can Measure, and What You Cannot

Half of the frustration with deliverability comes from treating it as a number someone else is hiding. It is better to be exact about the boundary.

• •You can verify authentication records, blacklist listings on the public lists, DNS correctness, domain age and expiry, your bounce rate and its error codes, and your complaint rate on Gmail through Postmaster Tools. Every one of those has a free check on this site.
• •You can estimate inbox placement by sending to a set of seed accounts you control across Gmail, Outlook and a corporate tenant, and by watching positive reply rate per domain. Both are noisy. Our own placement test log shows how much two tests a day apart can disagree.
• •You cannot see the reputation score a receiver assigns you, whether Microsoft has you at SCL 5 or 6 before you look at a delivered header, or whether a corporate gateway has your domain on an internal list. The Spamhaus DBL, the one commercial list that matters most, needs a paid query key, and no free tool, including ours, queries it.

The 2026 Floor: Bulk Sender Rules

Since February 2024, Google and Yahoo enforce a set of requirements on anyone sending around 5,000 messages a day to their users: SPF and DKIM both passing, DMARC published with at least p=none and one of the two aligned, a spam complaint rate held under 0.3% with 0.1% as the target, valid forward and reverse DNS on the sending IPs, and one-click unsubscribe headers on marketing mail. Microsoft followed with the same shape in 2025. A cold email fleet spreads volume across domains and rarely trips the daily threshold from any one of them, but the receivers evaluate the same signals below it. The bulk sender requirements checker splits the rules into what DNS can settle and what only your sending history shows.

Where Cold Email Loses Placement, in Order

When a campaign that was landing stops landing, the cause is almost always one of these, and they are worth checking in this order because the early ones are cheap and the late ones are expensive.

• •A record broke. A registrar change, a new sequencer, an SPF include that pushed the domain over the 10-lookup limit, a DKIM key that was delegated but never published. Check authentication first, every time.
• •A listing. Run the blacklist checker. Most public listings matter less than they look; the ones worth acting on are a small set, and the checker says which.
• •Pace crept up. The fleet was at 15 sends per inbox per day and someone approved 30 for a push. Sustainable cold pace is about 15 a day on Google, 8 on Microsoft 365, and 2 on Azure tenants that make it up in inbox count. Volume comes from more inboxes, not harder ones.
• •The list degraded. Bounces above 2% say the list is old or unverified. Bounce codes say which; the bounce analyzer reads them.
• •The content changed. A link in the first touch, a new tracking domain shared with other senders, an image, a longer template. One change at a time, and compare reply rate before and after.
• •The domain is spent. If authentication, listings, pace, list and content all check out and placement is still gone, the domain has used up its reputation. Rest it or retire it; the decision tree says which.

The Operating Checklist

• •Separate sending domains from the company domain, forwarded to the main site, two to three inboxes each.
• •SPF, DKIM and DMARC on every domain before the first send; DMARC at p=none to start, moved to quarantine once reports are clean.
• •New domains warmed for 14 to 21 days before cold volume, or prewarmed domains that have already done it.
• •About 15 cold sends per inbox per day on Google, 8 on Microsoft, spread through business hours.
• •Every list verified before the first send and re-verified after 60 days; a global suppression list across every tool.
• •Plain-text first touch, no link, one question. Links from the second message on, on your own tracking domain or none.
• •Bounce rate watched daily with pause rules at 2% and 3%; Postmaster Tools connected for every domain with Gmail volume.
• •A seed test before each new campaign and after any infrastructure change, read for direction rather than for a percentage.

If the infrastructure half of that list is the part you would rather not run yourself, that is what we sell: Google, Microsoft 365 and Azure inboxes on free prewarmed domains with the DNS done and verified before you log in, delivered within 48 to 72 hours, built by a team that sends more than a million cold emails a month on the same stack. The how it works page has the exact sequence, and the infrastructure calculator sizes a fleet for your daily volume.