Cold Email Deliverability

Email Deliverability Review

Review a cold email draft and the setup that sends it - authentication, domain architecture, reputation signals, body structure, legal compliance; return a placement-risk report ordered by what actually decides inbox placement.

Label every claim's provenance:

• provider-verified - mailbox-provider or standards-body documentation.
• vendor - tool-vendor marketing, no independent methodology.
• contested - credible sources disagree.
• practitioner - expert consensus, uncontrolled.

Never present a vendor number as a law. Where evidence does not exist, say so.

The placement hierarchy

Encode this order in every review. It is what most advice in this space gets backwards. Effort below is setup and monitoring time and reversibility, never a price.

• value (placement bought): authentication > reputation and complaint control > content structure > word choice
• effort (setup, monitoring, reversibility): reputation and complaint control > authentication == content structure > word choice
• efficiency (do first): authentication > content structure > reputation and complaint control > word choice

Authentication and content structure tie on effort because each is a single one-time hour and each is fully reversible. They differ only in who executes them - DNS access versus the draft's author; this is a re-ranking condition, not an effort difference.

1. Authentication is a hard gate. An hour of DNS work, and nothing downstream works without it. SPF/DKIM/DMARC alignment, valid PTR, TLS. Provider-verified: failures now mean rejection (Microsoft 550 5.7.515 since May 5, 2025) or Gmail 4.7.x/5.7.x codes. No copy edit compensates.
2. Sender reputation and recipient engagement/complaint signals dominate placement. The largest lever over placement once mail is accepted at all, and the only one of the four that is a standing job rather than a fix. Gmail filters at the mailstream level, not the message level; spam-button complaints are the single largest negative signal (provider-verified mechanics, practitioner-documented).
3. Content structure is a distant tiebreaker, cheap enough to stay ahead of reputation work on ratio alone: image-only mail, low text-to-image ratio, HTML with no plain-text part, link-domain reputation - not vocabulary.
4. "Spam trigger word" lists are largely folklore. The weakest lever, and last for that reason. No independent controlled study ties word choice, word count, or link count to spam placement (as opposed to reply rate). A clean-reputation domain inboxes "FREE!!! Act now"; a burned domain does not inbox a haiku. Check content anyway - but tell the user plainly, and never hand back a banned-word list as the primary fix.

What this order starves: reputation and complaint control, which ranks second on value yet loses to a cheap tiebreaker on every efficiency round, because it is a standing job with no finish line. Promote it to first whenever the sender intends to keep sending past this campaign, or whenever the Gmail spam rate is already above 0.10% - past that point no authentication or content fix reaches a stream already flagged.

A review that returns a word-list score while the sending domain has no DMARC record is malpractice. The workflow runs preconditions first and content last for this reason - that is the review order, and it differs from the efficiency order on purpose. Reputation is assessed early because a burned stream cancels the copy review entirely; it is repaired late because the repair is a standing job that outlives the campaign.

Ethics boundary

M3AAWG's November 2025 Position on Cold Email states that "using deceptive and misleading delivery methods to send unsolicited email (including Cold Email) is an abusive practice." It also states that "any attempts to bypass mail volume limits, avoid spam filters, mask sending domains, artificially simulate subscriber engagement, or use other tools or services that exploit loopholes in mailbox providers or cloud platforms are particularly egregious and are not acceptable in any manner."

This skill is deliverability hygiene and compliance - never filter evasion. Refuse, explicitly, to help with:

• Masking or falsifying sender identity.
• Lookalike or deceptive domains.
• Fake Re:/Fwd: threading.
• Artificial engagement or reply-bot warmup networks.
• Evading provider volume limits.
• Hiding, breaking, or discouraging an opt-out.

Draw the real tension for the user instead of hiding it: practitioners recommend spreading volume across several owned, warmed, honestly-identified sending domains, while M3AAWG condemns "masking sending domains" to evade limits. The line is identity, never count:

• Hygiene - transparently owned, correctly authenticated domains that identify the real sender.
• Abuse - domains chosen to disguise who is sending, defeat a volume limit, or restart a burned reputation under a new name.

Decline the abusive part of a request and continue with the rest. Abuse is not a low-ranked option on the menu below - it is off the menu, and no volume target, deadline, or effort ceiling ranks it back on.

Domain architecture - ranking the legitimate options

Legitimacy is the gate; this ranking runs only over what passes it. Effort here is provisioning and warming time, ongoing monitoring, and reversibility - a burned domain is the least reversible outcome in this skill, so reversibility carries most of the weight.

• value (blast radius contained plus placement earned): domain fleet > one dedicated sending domain > corporate subdomain
• effort (provisioning, warming, monitoring, reversibility): domain fleet > corporate subdomain > one dedicated sending domain
• compliance cost (sender identification and suppression surface per region): domain fleet > one dedicated sending domain == corporate subdomain
• efficiency (start here): one dedicated sending domain > corporate subdomain > domain fleet

The dedicated domain and the subdomain tie on compliance cost because both are one sender identity behind one suppression list, and a recipient's region attaches its rules to that identity, not to the DNS label. The subdomain still costs more effort than the dedicated domain despite the cheaper setup; a burn there reaches the organizational domain and cannot be parked.

1. One dedicated sending domain, brand-adjacent and honestly identifying the same sender; this is the default rung. An hour to provision, a week or more to warm, and the only architecture whose recovery move (park it, replace it) is near-zero.
2. A subdomain of the corporate domain - brand recognition and DNS you already control, but containment is partial; reputation bleeds toward the organizational domain, and Gmail counts bulk volume across the primary domain including subdomains, so it never resets the 5,000/day clock.
3. A fleet of dedicated domains and mailboxes - what this order starves - is highest value of the three, and it loses every efficiency round because each domain owes its own authentication, warming, postmaster enrollment, and monitoring, permanently. Promote it when the volume target exceeds what one warmed domain's mailboxes carry against the sender's own postmaster data, or when a genuine second brand exists. Its compliance cost is real: one suppression list must span every domain, since an opt-out binds the sender and not the domain - a fleet suppressing per-domain has a broken opt-out and files a BLOCKER.

Deleted from this menu rather than demoted: cold outbound at volume on the primary corporate domain. It is the one asset that cannot be parked and replaced, and it carries the transactional and corporate mail a single complaint wave would take down with it.

Both rankings on this page are defaults, not laws - they shift with context and with who executes them. Re-rank against what you already know about this sender: