The Ultimate Cold Email Deliverability Guide for Enterprise Outbound

Why Deliverability Is the #1 Outbound Killer

We've audited over 100 outbound programs. The pattern is always the same: companies invest thousands in lead lists, copywriting tools, and revenue infrastructure, then send everything from a single unwarmed domain with no authentication.

The result? 70% of their emails land in spam. They blame the copy. They blame the list. They never think to check their infrastructure.

Cold email deliverability is the foundation every outbound campaign is built on. Get it right, and a mediocre email still gets read. Get it wrong, and the best copy in the world sits unread in a spam folder.

Here's exactly how we set up deliverability infrastructure for every FlowStrata client.

What Email Authentication Records Do You Need?

Three records are non-negotiable. Think of them as your email passport. Without them, inbox providers treat your messages as suspicious.

SPF (Sender Policy Framework)

SPF tells receiving servers which IP addresses are authorized to send email on behalf of your domain.

How to set it up:

1. Identify every service that sends email from your domain (your ESP, CRM, outbound tool)
2. Add a single SPF record to your domain's DNS:

v=spf1 include:_spf.google.com include:sendgrid.net -all

1. Use -all (hard fail), not ~all (soft fail). This tells servers to reject anything not on your list

Common mistake: Multiple SPF records on the same domain. You can only have one. Merge them.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email you send, proving it wasn't tampered with in transit.

How to set it up:

1. Generate a DKIM key pair in your email sending platform
2. Add the public key as a TXT record in your DNS
3. Your platform automatically signs outgoing emails with the private key

Common mistake: Using the default DKIM key from your ESP instead of a custom one for your domain.

DMARC (Domain-based Message Authentication)

DMARC tells inbox providers what to do when an email fails SPF or DKIM checks. It also sends you reports about who's sending email from your domain.

How to set it up:

1. Start with a monitoring-only policy:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

1. Monitor reports for 2-4 weeks to ensure legitimate emails pass
2. Tighten to p=quarantine then p=reject once everything is clean

How Should You Structure Your Sending Domains?

Never send signal-based outbound from your primary domain. One spam complaint, one blacklisting, and your entire company loses the ability to send email, including to existing customers.

The Domain Architecture

For every client, we set up this structure:

• Primary domain (company.com) - never used for cold outbound. Protected.
• Sending domains (trycompany.com, getcompany.com, meetcompany.com) - dedicated to outbound.
• 3-5 sending domains per campaign for volume distribution
• 2-3 mailboxes per domain (e.g., martin@trycompany.com, hello@trycompany.com)

Domain Selection Rules

• Use variations of your brand name (not random words)
• Register .com domains, since other TLDs have lower trust scores
• Purchase from a reputable registrar (Google Domains, Namecheap, Cloudflare)
• Set up a basic landing page on each domain that redirects to your main site (this adds legitimacy)

Volume Distribution

Our recommendation: Keep it to 2 mailboxes per domain and cap volume at 25 emails per inbox per day. More domains spreads your risk, but cramming more mailboxes onto a single domain or pushing volume above 25 is where things break.

What Does the Warmup Process Look Like?

Domain warmup is the process of gradually building a sending reputation with inbox providers. A brand-new domain that suddenly sends 500 emails on day one will be flagged as spam immediately.

The Warmup Schedule

Warmup Rules

1. Start with real conversations. Send to people who will reply. Inbox providers track engagement, and replies signal legitimacy.
2. Use a warmup tool. Services like Instantly, Warmbox, or Lemwarm simulate realistic email exchanges during the warmup period.
3. Monitor daily. If open rates drop below 40% at any stage, pause and investigate before continuing.
4. Don't rush. We've seen companies try to compress warmup into 5 days. Every single one ended up blacklisted within a month.

How Do You Monitor Deliverability Day-to-Day?

Deliverability isn't a one-time setup. It's an ongoing process. Reputations degrade silently. Here's what we track for every client, every day:

The Daily Dashboard

• Open rate by domain - sudden drops indicate deliverability issues
• Bounce rate - must stay below 3%. Above 5% is an emergency.
• Spam complaint rate - must stay below 0.1% (Google's published threshold)
• Blacklist status - check against major blacklists (Spamhaus, Barracuda, SORBS)
• Reply rate - healthy replies improve sender reputation

Red Flags That Demand Immediate Action

❌ Open rate drops below 30% on a previously healthy domain

❌ Bounce rate spikes above 5% in a single day

❌ You appear on any major email blacklist

❌ Google Postmaster Tools shows domain reputation as "Bad"

❌ Multiple recipients report your emails as spam

Tools We Use

What Kills Deliverability After Setup?

Even with perfect infrastructure, these mistakes will tank your reputation:

Content Issues

• Spam trigger words in subject lines ("Free", "Act now", "Limited time")
• Too many links in the email body (stick to 1-2 max)
• Image-heavy emails with little text (use plain text or minimal formatting)
• Identical copy sent to thousands, so personalize every email

List Quality Issues

• Sending to invalid emails - verify every address before sending
• Ignoring unsubscribe requests - this generates spam complaints
• Purchasing lists from unverified vendors. These are full of spam traps.
• Not cleaning bounces - remove hard bounces immediately

Volume Issues

• Sending too much, too fast - respect your warmup ramp
• Inconsistent sending patterns - don't send 500 on Monday and 0 for the rest of the week
• Sudden volume spikes - gradually increase by 10-15% per week

The Complete Deliverability Checklist

Before launching any cold outbound campaign:

The Bottom Line

Deliverability is boring. It's DNS records, warmup schedules, and blacklist checks. Nobody wants to do it.

But in our experience, deliverability accounts for 60% of outbound success. The best copy in the world is worthless if it never reaches the inbox. Companies that treat deliverability as infrastructure, not an afterthought, consistently book 3-5x more meetings from the same volume.

Want us to audit your email deliverability? Audit your pipeline architecture and we'll run a full infrastructure check on your sending domains, authentication, and inbox placement, completely free.