Best and Worst TLDs for Cold Email, Ranked by Abuse Reports

Why the TLD matters at all

A receiver deciding what to do with a cold email from a domain it has never seen has very little to go on. The domain has no history, so what it has is the neighbourhood: who else registers in that TLD, and what they send. A TLD where phishing kits and spam runs are registered by the thousand is one that filters, security gateways and threat feeds have every reason to treat with suspicion, and your brand-new domain arrives carrying that suspicion before it has sent anything.

None of the receivers publishes how much weight a TLD carries. What is public is where abuse concentrates, which is what this report counts, and what our own sending shows, which is the second half of this article.

How the report ranks TLDs

The report checks 52 TLDs against 8 independent sources that publish where abuse concentrates. A TLD’s flag count is how many of those sources name it, and the tier follows from the count: none, one, or two or more. A TLD that several unrelated sources keep naming is not one researcher’s opinion.

TLDs no source names (16)

The report calls these safe. Read that as “none of the 8 sources names them”, which is the best a TLD can do. The prices are where they differ, and the renewal is the number to look at.

What to know before you pick one

• •The renewal is the real price. .host is $1.19 for the first year and $50.68 to renew, 43× the price. A cold email domain you keep past its first year pays the second number.
• •.us has rules. .us does not allow WHOIS privacy (registry nexus rules; public WHOIS), and requires a US person, entity or bona fide US presence.
• •Country codes read as a country. A .de or .co.uk domain writing to American prospects looks out of place, and most country-code registries have residency or presence rules. Use one for the market it belongs to.
• •Some read as a product, not a company. A prospect sees the domain before the copy. Pick the one that looks like a business would send from it.

TLDs one source names (3)

The report files these under caution, and one of them is the reason a flag count is not the whole story. .link is named by a single source here. In our own sending it was the worst TLD we measured by a distance, which is the next section but one.

TLDs two or more sources name (33)

Don’t send cold email from these. .cfd and .top are named by 7 of the 8 sources, and every TLD in this table is named by at least two that have nothing to do with each other.

What our own sending measured

The report says where abuse concentrates. Our Google sender-reputation study says what a TLD cost in cold email: how often Google refused mail with its permanent “very low reputation of the sending domain” verdict (550 5.7.1), as a share of every send, over 30 days to 8 October 2026.

• •.com is the baseline for a reason. It drew the refusal least often of every TLD we sent from, and it is why every prewarmed order we sell comes with one: Every prewarmed order includes a free prewarmed .COM/.CO domain, already warmed and DNS-configured.
• •.link is the warning about flag counts. One source in the report, and 16× the .com refusal rate in our sending. Inside a single client, where the copy and the list are the same, .link refused 4,160 times as often as .com. We stopped buying it, and 68 .link domains still placed with clients are being retired on a schedule.
• •.org and .co are not free passes. Neither is in the report’s rated list, and both refused more than .com in our sending: .co 1.8×, .org 2.1×.
• •.info has history. Three sources in the report name it, and in June 2026 SURBL listed .info domains on Microsoft and Azure infrastructure in large numbers. What happened. We stopped buying new .info too.

How we choose TLDs for cold email

• •.com first. The lowest refusal rate we have measured, and the TLD a prospect reads as a company. Variations on the brand name in .com are worth more than a clean name in anything else.
• •Then zero-flag only. If you need more domains than .com variations give you, pick from the 16 TLDs no source names, and prefer one that reads like a business.
• •Never two or more flags, however cheap. The domain saves a few dollars and costs the campaign.
• •Plan the renewal or the retirement. Decide when you buy whether the domain lives past year one. If it does, budget the renewal; if it does not, the first-year price is the whole cost.
• •Spread the risk. More than one TLD and more than one registrar, so a pricing change or a suspension takes out part of the fleet, not all of it: buying across registrars and clients.
• •Check every domain, not just its TLD. A clean TLD can hold a domain with a past. Run each one through the domain reputation checker, the blacklist checker and the SURBL checker before it sends. Our tools do not query the Spamhaus DBL, which needs a paid key, so check that at check.spamhaus.org.

What a flag does not tell you

• •It is not a reputation score. Google and Microsoft keep their own reputation data and do not publish it. A flag says abuse researchers see abuse concentrated in a TLD; what any receiver does with that is private.
• •It is not about your domain. A burned .com is still burned, and a well-run domain on a flagged TLD can send. The flag is the odds you start with, not the result you get.
• •It moves. TLDs change hands, registries change prices and abusers move to wherever is cheapest this year. This is the November 2026 picture, dated as such.
• •Prices are list prices. Namecheap first-year prices are standard (non-promotional) prices. Registrars change them often, and promotions come and go.

For a domain problem the TLD does not explain, describe it to the WarmInboxes Free MCP, which runs the checks in order and says when a new domain is, and is not, the answer.