Deliverability

Cold Email Deliverability for Agencies: The SPF, DKIM & DMARC Setup That Lands in the Primary Inbox

By Saad Ahmad · 8 min read

You can have a perfect ICP, hyper-personalized copy, and a great offer - and still get zero replies. Why? Because nobody saw your emails. They went to spam.

Deliverability is the silent killer of cold outbound, and it's the part most agencies get wrong when they try to run outreach in-house. The good news: it's an engineering problem with a known solution. Here's the setup we use to keep cold email in the primary inbox.

First, understand where your email actually lands

Every email you send gets sorted into one of three buckets:

• Primary inbox - where you want to be. Highest open and reply rates.
• Promotions / Updates (Gmail tabs) - seen far less; reply rates crater.
• Spam - effectively invisible. And worse: it damages your sender reputation for future sends.

Mailbox providers (Google, Microsoft) decide this in milliseconds based on authentication, reputation, and engagement. Get those three right and you live in the primary inbox.

1. Never send cold email from your main domain

This is the most common - and most expensive - mistake. If you send cold outreach from yourname@youragency.com and it gets flagged, you can poison the deliverability of your real business email: invoices, client comms, everything.

Instead:

• Buy separate sending domains (e.g., tryyouragency.com, youragencyhq.com) dedicated to outreach.
• Set up a redirect from each sending domain to your main site so they look legitimate.
• Run 2-3 inboxes per domain, and spread volume across many domains/inboxes rather than blasting from one.

This isolates risk and lets you scale volume without betting your company's email on it.

2. Authenticate every domain: SPF, DKIM, DMARC

These three DNS records tell mailbox providers "this sender is who they say they are." Missing or broken, you're going straight to spam. In plain English:

SPF (Sender Policy Framework)

A DNS TXT record listing which servers are allowed to send email for your domain. It stops spammers from spoofing your domain. Your sending tool (Google Workspace, etc.) gives you the exact value.

DKIM (DomainKeys Identified Mail)

A cryptographic signature added to every email, verified against a public key in your DNS. It proves the message wasn't tampered with in transit. Enable it in your email provider and add the provided TXT/CNAME record.

DMARC (Domain-based Message Authentication)

A policy record that tells providers what to do if SPF/DKIM fail (e.g., p=none to monitor, then tighten). It ties SPF and DKIM together and dramatically improves trust. Start with v=DMARC1; p=none; and a reporting address, then move to quarantine as you confirm everything passes.

3. Warm up before you scale

A brand-new domain has zero reputation. Send 200 cold emails on day one and you'll torch it instantly. Warming builds trust gradually:

• Run automated warm-up (tools send and reply to seed inboxes) for ~2-3 weeks before real sends.
• Ramp slowly - start at a handful of emails per inbox per day and increase over weeks.
• Keep a low daily limit per inbox (think 20-40, not hundreds). Scale with more inboxes, not more volume per inbox.

4. Content and engagement still matter

Even with perfect technical setup, the message affects placement - and your cold email copy is what turns inbox placement into replies:

• Write like a human. Short, plain-text-style emails outperform heavy HTML and images.
• Minimize links (one is fine; several looks spammy). Avoid spam-trigger words and ALL CAPS.
• Replies are the strongest signal. Personalized, relevant outreach that earns replies trains the provider to trust you. Spray-and-pray does the opposite.

5. Monitor like an engineer

Deliverability isn't "set and forget." Watch:

• Bounce rate - keep it under ~2-3%. High bounces wreck reputation, which is why verified data (sub-1% bounce) matters so much.
• Spam complaint rate - keep it under 0.1%.
• Seed/placement tests - periodically check where you're landing across Gmail/Outlook.
• Google Postmaster Tools - monitor domain/IP reputation directly from Google.

The honest takeaway

Deliverability is very solvable - but it's a standing operational job: multiple domains, dozens of authenticated inboxes, weeks of warming, and constant monitoring. That's exactly why so many agencies start cold outbound, watch reply rates flatline, and assume "outbound doesn't work for us." Usually it wasn't the strategy - it was the inbox.

← Back to all posts