Cold Email Best Practices for B2B Outbound in 2026

Cold email still works in B2B in 2026 if you treat deliverability as infrastructure. That means you authenticate every sending domain with SPF, DKIM and DMARC, keep spam complaints below 0.1%, send modest volumes from warmed secondary domains and email only verified contacts who fit your ideal customer profile. Then write short, researched emails with one ask, and judge them on replies and meetings, not opens.

Why outbound email got harder

For a CRO, the sending domain is a revenue asset. When its reputation drops, outbound sequences, follow-ups and even proposals start landing in spam, and outbound pipeline dries up before anyone has worked out why.

The mailbox providers have tightened the rules in steps. Google and Yahoo introduced sender requirements from February 2024. Microsoft added requirements for high-volume senders to Outlook.com consumer addresses from 5 May 2025. Since November 2025, Gmail has been ramping up enforcement on non-compliant traffic, which can mean temporary and permanent rejections, not only the spam folder (Google).

When the first rules arrived, we spoke with two companies whose email had been temporarily blocked. Both ran aggressive outbound and skipped the basics in this guide. Google Workspace also has a hard ceiling of its own. Each user can send up to 2,000 messages a day, and a user who hits a sending limit cannot send new messages for up to 24 hours (Google Workspace).

What Gmail, Yahoo and Outlook require

The table shows what the three largest consumer mailbox providers publish, as we checked it on 15 October 2026.

Requirement	Gmail (personal Gmail accounts)	Yahoo	Outlook.com (hotmail.com, live.com, outlook.com)
Who it covers	All senders, with extra rules above about 5,000 messages a day to personal Gmail accounts	All senders, with extra rules for bulk senders (no number published)	Domains sending more than 5,000 emails a day
Authentication	SPF or DKIM for all senders, SPF and DKIM for bulk senders	SPF or DKIM for all senders, SPF and DKIM for bulk senders	SPF and DKIM must pass
DMARC	Bulk senders publish DMARC (policy can be none), with the From domain aligned with SPF or DKIM	Bulk senders need at least p=none and passing; relaxed alignment accepted	At least p=none, aligned with SPF or DKIM (preferably both)
Spam rate	Below 0.3% for all senders; Google advises staying below 0.1%	Below 0.3%	No published threshold; list hygiene and bounce management recommended
Unsubscribe	One-click unsubscribe for marketing and subscribed messages from bulk senders	Bulk senders need a one-click list-unsubscribe header (RFC 8058 recommended) and a visible link, honoured within 2 days	Clear, working unsubscribe link recommended
Infrastructure	Valid forward and reverse DNS, TLS, RFC 5322 formatting	Valid forward and reverse DNS, RFC 5321 and 5322 compliance	From or Reply-To address that can receive replies (recommended)
Enforcement	Since February 2024; ramp-up since November 2025 with temporary and permanent rejections	Since February 2024	Since 5 May 2025; failing mail is junked or rejected with error 550 5.7.515

The details are in Google's email sender guidelines, Yahoo's sender best practices and Microsoft's announcement for high-volume senders.

Two details matter for planning. Google counts a bulk sender as roughly 5,000 or more messages to personal Gmail accounts in 24 hours, counting all mail from the same primary domain, and once you reach that you are permanently treated as a bulk sender. Google also calculates spam rate daily, and a bulk sender above 0.3% becomes eligible for mitigation only after staying below 0.3% for seven consecutive days.

Does this apply to B2B email?

Partly. Google's FAQ says its email sender guidelines do not apply to messages sent to Google Workspace accounts, and Microsoft's requirements apply to its consumer service, Outlook.com. The first version of this post said B2B was not affected, and for the letter of the bulk-sender rules that is broadly right.

In practice, B2B outbound is not exempt, and there are three reasons why.

• Your domain's volume adds up. Google counts all mail from the same primary domain towards the 5,000-message threshold, so newsletters and product email can push a domain into bulk-sender status.
• Corporate filters check the same signals. Microsoft documents that Microsoft 365 evaluates SPF, DKIM and DMARC on inbound mail, combined with signals such as sender reputation and history, in what it calls composite authentication (Microsoft Learn).
• Some prospects use personal addresses. Founders, freelancers and small-business owners often do.

We advise meeting the bulk-sender requirements on every domain that sends outbound, whether or not you cross the threshold.

Set up domains and inboxes

• Use a separate domain for outbound. Protect the domain that carries invoices, support and customer email. If your main domain is company.com, send cold email from a similar domain such as company.so, with its own SPF, DKIM and DMARC records.
• Make replies work. The From and Reply-To addresses must be real inboxes that someone reads. Microsoft lists this among its hygiene recommendations for large senders.
• Warm up gradually. New inboxes and domains need a sending history before they carry real volume. Start small, with people likely to reply, and increase slowly.
• Keep volume low per inbox. Our rule of thumb from the first version of this guide still holds, which is fewer than 50 cold emails per inbox per day. Add inboxes before you add volume, and never send large batches at once.
• Skip the tricks. Do not use CSS to hide content. Think twice about open tracking, because the tracking pixel adds a remote image to every email, and opens are an unreliable signal anyway (see below).
• Own the infrastructure. Someone needs to own domain renewals, DNS records and monitoring. Inactive or poorly managed domains are a recurring risk in the setups we review.
• Monitor. Add your domains to Google Postmaster Tools, which reports spam rate, reputation, authentication and delivery errors for mail sent to personal Gmail accounts. Data can be missing when daily volume is low (Google).

Build a list you can trust

In the outbound setups we review, the problems usually start with the list, not the copy. We keep seeing the same things, such as stale contacts, bounced addresses, people who have left the company, wrong names or domains, and companies that never fitted the target market. Enrichment spread across several data providers still misses the right contacts and creates inconsistent company records.

These five steps are what works for us.

1. Define who you are writing to. Write down the ideal customer profile and the roles you target before you buy data. Our ideal customer profile and persona template is a starting point.
2. Verify every address before the first send, and verify again before you reuse a list that has sat unused for months.
3. Suppress centrally. Hard bounces, unsubscribes and "not interested" replies go on one suppression list that every sending tool reads.
4. Stage enriched data before it reaches the CRM. Validate and deduplicate first. Our guide to updating a CRM without creating duplicates shows one way to do it.
5. Prioritise by signal. A website visit, a job change, a hiring push or a new initiative gives you a reason to write now. Without a reason, you are sending a cold email in the worst sense.

How to write cold emails that get replies

Before drafting, read the prospect's LinkedIn profile, the company website and any relevant report or announcement. Then write the email along these lines.

• Tailor each email to the recipient, using what you found.
• Keep it short. 75 to 125 words is our working range.
• One core message and one ask per email.
• Plain text and a simple signature, with no attachments and no image-heavy HTML.
• No promotional language. All-caps, "free" offers and countdowns read as marketing and get treated that way.
• Honest subject lines. Microsoft explicitly asks large senders to use accurate subject lines and avoid deceptive headers.

Most cold emails we receive skip at least two of these. Doing all of them already puts you ahead of most of the outbound your prospects see.

Use AI without losing relevance

AI helps most before the email is written, for example by summarising an account's news, scoring fit, choosing the right contact and preparing context for the SDR. In the outbound work we see, those uses pay off. What does not work is using AI to send more email. With poor source data and loose qualification, automated personalisation still produces irrelevant outreach, only faster.

The data problem is common. In our RevOps in 2026 survey of 123 practitioners, 73% have an AI mandate and 38% have the data to support it. In our CRO AI Adoption Survey, data quality tied with budget as the top barrier to AI, at 27% each (26 CROs, so treat it as directional).

We stick to three rules.

• Feed AI verified, current data, not a raw list export.
• Let AI draft research notes and first lines; a person approves anything sent under their name.
• Keep targeting tight. Better AI is not a reason to widen the list.

For the wider picture of where AI fits in sales and RevOps, see our AI playbook for sales and RevOps.

If you would rather have this built than build it yourself, our forward deployed GTM engineers set up sending domains, enrichment, validation and AI research workflows inside your team. Book a call with our GTM engineers to talk it through.

Measure replies, not opens

Open rates stopped being a reliable signal when Apple introduced Mail Privacy Protection. With it switched on, Apple Mail hides the recipient's IP address and downloads remote content privately in the background when a message is received, rather than when it is read (Apple). An "open" can fire without a person opening anything.

Measure what people do instead.

• For deliverability, track bounce rate and the spam rate in Postmaster Tools.
• Engagement shows up in reply rate and positive reply rate.
• The outcome is meetings booked and pipeline created, per segment.

When results drop, do not add volume. In the setups we review, low traction can come from inbox placement, audience fit or the message itself, and the three are hard to separate. Test one variable at a time on a defined subset of leads. For the team side of outbound, from ramp time to activity mix, see our BDR productivity blueprint.

Is B2B cold email allowed in the UK and Germany?

Meeting Gmail's rules makes your email deliverable. It does not make it lawful. Rules on unsolicited business email differ by country, as these two examples show.

• In the United Kingdom, the ICO's guidance under PECR says you can send marketing emails to corporate subscribers without specific consent, but sole traders and some partnerships are treated as individuals, and you must identify yourself and give a valid address for opting out. The ICO notes that this guidance is under review after the Data (Use and Access) Act (ICO).
• In Germany, section 7 of the Act against Unfair Competition (UWG) treats email advertising without the recipient's prior express consent as an unreasonable nuisance and, unlike its rule for phone calls, does not distinguish business recipients from consumers (UWG section 7).

Check the rules for each country you email, and take legal advice before you scale. This section is a starting point, not legal advice.

A complete outbound strategy goes beyond cold email

Cold email is one channel. For a complete outbound strategy, also consider the following.

• following the practices in this guide on every sending domain;
• making cold calling a standard part of outbound;
• being present in the online communities your buyers use;
• using intent data to target better;
• conferences and in-person meetings;
• LinkedIn for personal brand and social selling.

Deliverability checklist

Run through this before every new campaign or domain.

Area	Check	Where to verify
Authentication	SPF, DKIM and DMARC published and passing on every sending domain; DMARC at least p=none, From domain aligned	DNS records, DMARC reports, message headers
Authentication	Valid forward and reverse DNS for sending IPs; TLS on	Email provider admin settings
Reputation	Spam rate under 0.1% and never at 0.3%	Google Postmaster Tools
Reputation	Low bounce rate; hard bounces suppressed	Sending tool
Volume	Fewer than 50 cold emails per inbox per day; new inboxes ramped gradually	Sending tool
Volume	Well inside the Google Workspace limit of 2,000 messages per user per day	Google Admin console
List	Every address verified before the first send; one suppression list shared by all tools	Validation tool, CRM
List	Every contact fits the ICP and has a reason to hear from you now	ICP document, CRM fields
Content	Plain text, 75 to 125 words, one ask, accurate subject line	Peer review before launch
Content	Clear way to opt out, honoured within 2 days	Sending tool, test send
Replies	From and Reply-To addresses are monitored inboxes	Test reply
Measurement	Replies, positive replies and meetings tracked; opens ignored	CRM reports
Compliance	Consent rules checked for each country you email	Legal review

If you want help working through this list or fixing what it turns up, book a call with our GTM engineers.

Frequently asked questions about B2B cold email

Do Gmail's bulk sender rules apply to B2B cold email?

Google says its email sender guidelines do not apply to messages sent to Google Workspace accounts; they cover personal Gmail addresses. B2B senders should still meet them, because Microsoft 365 and other corporate filters check the same authentication signals, all mail from your domain counts towards Google's threshold, and some prospects use personal addresses.

What spam rate does Google allow?

Google requires a spam rate below 0.3% in Postmaster Tools and advises staying below 0.1%. A bulk sender above 0.3% is not eligible for mitigation until the rate has stayed below 0.3% for seven consecutive days.

How many cold emails can I send per day?

There is no official number for cold email. Google Workspace caps sending at 2,000 messages per user per day, but that is a technical limit, not a target. Our rule of thumb is fewer than 50 cold emails per inbox per day, on inboxes that have been warmed up gradually.

Do I need a separate domain for cold email?

A separate domain is the safest setup, because it protects the reputation of the domain that carries your customer, finance and support email. Authenticate it with SPF, DKIM and DMARC like your main domain, and make sure replies reach a monitored inbox.

Is cold email still effective in 2026?

Yes, when the list is accurate and the message is relevant to the recipient. What stopped working is volume-led outbound, because sender rules, spam filters and buyers all punish it.

What is the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send mail for your domain, DKIM signs each message so the receiver can check it was not altered, and DMARC checks that the visible From domain aligns with SPF or DKIM and tells receivers what to do when the checks fail. Microsoft's documentation explains how the three work together.