Cold Outreach That Still Works: Deliverability, Lists and the 0.3% Rule
Three people out of a thousand mark you as spam and the mailbox providers stop delivering your mail. That is the entire constraint.
The spray-and-pray era ended on a specific date. In February 2024, Google and Yahoo began enforcing requirements on bulk senders: authenticate with SPF and DKIM, publish a DMARC record, offer one-click unsubscribe, and keep your reported spam complaint rate below 0.3 percent, with a recommended target under 0.1 percent.
Read that threshold as an operating limit. At 0.1 percent, one complaint per thousand delivered messages is your budget. Send 5,000 generic emails, annoy six people enough that they hit the spam button, and you have exceeded the recommendation. Do it repeatedly and your domain stops reaching inboxes at all, including the mail your existing customers are waiting for.
Volume used to be the strategy. Volume is now the risk, and research is the only lever left.
This is good news for a small company and terrible news for whoever sold you a list. The economics have inverted: sending less mail to better-researched people now outperforms sending more, and the founders who were never going to win a volume war have stopped needing to fight one.
Get the plumbing right before you write anything
None of the writing advice matters if your mail lands in a spam folder. This part is a checklist, it takes a morning, and skipping it is the reason most outbound programmes fail while everyone blames the copy.
Use a separate sending domain. If your company is example.com, send outbound from a variant like getexample.com. Any deliverability damage stays away from the domain your invoices, contracts and support replies travel on. This single decision has saved more companies from self-inflicted outages than any tool.
Authenticate properly. SPF, DKIM and DMARC on the sending domain, with the from-address on a domain that aligns. These are DNS records, they are free, and providers now treat their absence as a signal in itself.
Warm the domain. A brand new domain sending 300 messages on day one looks exactly like an attack. Ramp over several weeks, starting small, with real conversations mixed in.
Make unsubscribing trivial. A visible one-line opt-out at the bottom of every message. Every person who clicks it is a person who did not report you as spam, and the opt-out is the cheaper of the two outcomes by a wide margin.
Verify addresses before sending. Hard bounces above a couple of percent damage your reputation on their own. Run the list through verification and delete anything uncertain.
Under 0.1 percent. Healthy. You can raise volume gradually while watching this number weekly. 0.1 to 0.3 percent. Above the recommended target and inside the hard ceiling. Tighten targeting now, before providers do it for you. Over 0.3 percent. You are past the enforced threshold. Stop sending, fix the list and the message, and expect reduced delivery for weeks.
Complaint rate is complaints divided by messages sent. At 300 sends a week, a 0.1 percent target allows roughly one complaint every three weeks. The meetings figure shows what the same volume produces at your reply rate: at 12 percent reply and 40 percent conversion to a meeting, 300 sends a week is about 58 meetings a month, which is more than most small teams can service.
Move the reply rate slider from 1 percent to 12 and watch the meetings number. Getting from 1 to 12 percent is a research problem, and it produces the same result as a twelvefold increase in volume without any of the deliverability risk. That comparison is the whole argument for doing outbound the slow way.
The list is the message
Reply rate is decided before you write a word. It is set by whether the person receiving the email is currently experiencing the problem you solve, and whether your first line proves you know that.
Build the list around a trigger, meaning an observable event that indicates the problem is live right now.
Hiring signals. A company advertising for the role your product makes unnecessary, or for a role that will immediately need your category of tool.
Technology signals. They run a tool you integrate with, or one you replace. Often detectable from public job ads, help pages and career listings.
Regulatory or deadline signals. A rule taking effect in their sector, a filing date, a certification renewal.
Growth signals. New funding, a new office, a new market, a new executive in the function you serve. New executives change tooling within their first two quarters more often than at any other time.
Public complaints. Someone in your target role describing this exact problem in a forum, a review or a conference question.
A list built on triggers is smaller by an order of magnitude and converts by more than that. It also makes the first line write itself, which solves the hardest part of the message.
Day 0: the trigger note
Under 90 words. Name the observed fact, the problem it implies, one number, one question.
Day 4: the proof
One customer like them, one measured result. No re-pitch, no "just following up."
Day 9: the different angle
A second problem the same buyer has. Sometimes you targeted the right person with the wrong pain.
Day 16: the close
"I will assume this is not a priority and stop here." Say it and mean it. It gets replies and it protects your rate.
Four messages over sixteen days, then stop. Sequences of nine or eleven messages produce marginally more replies and considerably more complaints, and complaints are the constraint that decides whether you can send at all next quarter.
Write the ninety-word version
Four components, in this order, and nothing else.
The observed fact. "You have had a claims assessor role open since March." Specific, verifiable, and impossible to send to anyone else. This line alone separates researched outreach from everything in the recipient's spam folder.
The implication. One sentence connecting that fact to a cost they feel. "Which usually means the backlog is sitting with two people doing overtime."
The evidence. One comparable customer and one number. "A broker your size cut assessment time from six days to under two." Not a feature list.
One question. Small, answerable in a sentence, with no calendar attached. "Is the backlog still the bottleneck, or did you solve it another way?" Asking for a 30 minute meeting in a first email asks a stranger to give you something before you have given them anything.
No attachments, no images, no tracking pixels, no links in the first message, no formatting that looks like a newsletter. Plain text from a person, because that is what it is supposed to be.
Next week, contact twenty-five people. Not two thousand. Twenty-five, each researched for five minutes, each with a first line only they could receive. Track four numbers in a spreadsheet: sent, delivered, replied, complained. At twenty-five a week you will have 100 data points in a month, which is enough to see your real reply rate and to fix the message twice. If you cannot find twenty-five people a week with an observable trigger, your problem is not outreach volume, it is that your target segment is undefined, and Day 12 is the work you actually need to do. Scale only after the reply rate is above 10 percent, because scaling a 1 percent message just multiplies the complaints.
Channels beyond email
Email is not the only cold channel and the constraint above makes the others more attractive than they were.
The phone. Unfashionable, unblocked, and almost empty of competitors in most B2B segments. Connect rates are low and the conversation quality when you do connect is far higher than any email thread. Combined with an email the same day, it substantially outperforms either alone.
Professional networks. Message limits keep volume low, which enforces the discipline you should be applying anyway. Engaging genuinely with what someone posted before you contact them is not a growth hack, it is the reason they reply.
Referrals from customers. The highest-converting outbound available, and the least systematically requested. Ask every satisfied customer for one introduction to a peer, name the specific person if you can see them, and make it easy by writing the forwardable paragraph yourself.
Communities and events. Slower, warmer, and they compound. A comment that helps someone in a trade forum is read by two hundred people in the same role, and it never lands in a spam folder.
Relative impact, in the order founders should work on them. Most outbound advice concentrates on the bottom two because they are easy to test and easy to sell. Authentication is a gatekeeper rather than a lever: it cannot raise your reply rate, but its absence sets it to zero.
Stay on the right side of the law
Rules differ by jurisdiction and you should take advice for yours. In the United States, CAN-SPAM allows commercial email provided headers are accurate, a physical postal address is included and opt-out works promptly. In the European Union and the United Kingdom, the bar is higher: business contact generally relies on a legitimate interest basis under data protection law, requires clear identification and an easy objection route, and consumer contact usually requires consent.
The commercially useful observation is that the compliant version of outreach and the effective version are nearly the same message. Accurate identity, a real reason for contacting this person, and an easy exit are what regulators require and what keeps your complaint rate under the threshold that decides whether you can send mail at all.
The takeaway
- Keep spam complaints under 0.1 percent. The enforced ceiling is 0.3, and crossing it damages every email your domain sends.
- Send from a separate domain, authenticate with SPF, DKIM and DMARC, warm it slowly, verify addresses.
- Build lists on observable triggers. The trigger writes your first line and decides your reply rate.
- Four messages over sixteen days, then stop. Longer sequences buy replies with complaints.
- Ninety words: observed fact, implication, one number, one small question.
- Twenty-five researched contacts a week beats two thousand generic ones, and it does not cost you your domain.
Frequently asked questions
What are the bulk sender requirements for cold email?
Since February 2024, Google and Yahoo require bulk senders to authenticate with SPF and DKIM, publish DMARC, align the from-domain, offer one-click unsubscribe on promotional mail, and keep spam complaints below 0.3 percent with a recommended target under 0.1. Exceeding it throttles or blocks mail from the domain generally.
What is a good cold email reply rate?
Generic outreach to a bought list often sits below 1 percent. Researched outreach to a narrow, correctly qualified list can reach 15 to 30 percent. The gap is list quality and specificity, not subject lines or send times.
How many cold emails can I send per day safely?
Your complaint rate sets the limit, not a fixed number. Modest volume per mailbox with genuinely targeted messages keeps complaints low. Use a separate outbound domain, and increase volume only while complaints stay well under 0.1 percent.
Is cold email still legal?
Cold email legality varies by jurisdiction, so confirm your local rules. CAN-SPAM permits commercial email in the US with accurate headers, a postal address and working opt-out. EU and UK rules are stricter, generally requiring a legitimate interest basis for business contact and an easy objection route. The compliant version and the effective version are close to identical.
Sending more was never the plan. It was the absence of one.
Kill My Startup takes apart the growth tactics founders scale before they work.
Buy on Amazon →Sources
- Google Workspace and Yahoo bulk sender requirements, effective February 2024, including the 0.3 percent spam rate threshold and 0.1 percent recommendation.
- Google Postmaster Tools documentation on spam complaint rate measurement and domain reputation.
- US CAN-SPAM Act requirements; UK and EU data protection guidance on business-to-business electronic marketing.
- Oldroyd, McElheran and Elkington, Harvard Business Review, on response speed in outbound sales.