The complete guide to cold email deliverability in 2026: mailboxes, warmup, and infrastructure.

Most cold email campaigns fail before a single word is written. The domain is not authenticated. The mailbox was never warmed. The sending limits are too high. The contact list is dirty. By the time copy quality matters, the infrastructure has already killed the campaign. Here is how to build it correctly from the ground up.

Cameron Evans · Founder & CEO, Haku

15 May 2026 · 15 min read

Why most cold email deliverability fails

There is a useful distinction that most sales teams never learn: delivery rate and deliverability rate are not the same thing. Delivery rate measures the proportion of emails accepted by a receiving server — it did not bounce. Deliverability rate measures the proportion of those accepted emails that actually reached the inbox rather than the spam folder.

You can have a 98% delivery rate and a 60% deliverability rate simultaneously. Your ESP dashboard will show the former and tell you nothing about the latter. The 40% of emails that landed in spam are counted as delivered. Nobody knows they went there. Reply rates crater and nobody understands why.

With 392.5 billion emails expected daily in 2026, Gmail, Outlook, and Yahoo are ruthless about filtering. They are not just checking whether your email is technically valid — they are scoring your sender reputation, domain age, authentication records, engagement history, sending volume, and bounce rate in real time, on every send. The bar has risen every year since 2022 and it will continue rising.

The teams hitting 90%+ inbox placement rates are not doing so through better subject lines. They are doing it through disciplined infrastructure — the right domain strategy, correctly configured authentication records, properly warmed mailboxes, and clean contact data. Everything else is built on top of that foundation.

Domain setup — never send from your primary domain

The single most important rule in cold email infrastructure is also the most frequently broken: never send cold email from your primary business domain. Sending cold outreach from cameron@hakulabs.ai puts the domain that hosts Haku's website, product, and transactional email at risk. One complaint-heavy campaign, one bad list, one misconfigured sequence — and the domain that your entire business runs on is blacklisted.

The correct approach is to buy two or three secondary sending domains — close variants of your primary domain — and use those exclusively for cold outreach. These domains forward to your main website, so links in emails still resolve correctly, but the sender reputation of your primary domain is completely isolated from your outbound activity.

Run 3 to 5 mailboxes per domain, capped at 30 to 50 cold emails per mailbox per day after full warmup. If you need higher volume, add more domains — do not push individual mailboxes beyond their safe limit. Most practitioners run 8 to 20 domains per outbound operation at scale, each with 2 to 3 mailboxes sending conservatively.

SPF, DKIM, and DMARC — the non-negotiable foundation

In February 2024, Gmail and Yahoo made SPF, DKIM, and DMARC mandatory for bulk senders. Microsoft followed for Outlook in May 2025. This is no longer optional. Without all three correctly configured, your emails will be junked or rejected outright by the major providers.

Think of the three records this way: SPF is the guest list — it specifies which servers are authorised to send email from your domain. DKIM is a cryptographic signature — it proves the email was not tampered with in transit and actually came from your domain. DMARC is the bouncer — it tells receiving servers what to do when an email fails SPF or DKIM checks, and it reports back to you when failures occur.

SPF record

Your SPF record is a TXT record added to your domain's DNS. It lists every service authorised to send on your behalf — your email provider, your sequencing tool, any other services that send email from your domain. Keep it under 10 DNS lookups or it will silently fail.

# Example SPF record for Google Workspace + Instantly
Type:  TXT
Name:  @
Value: v=spf1 include:_spf.google.com include:spf.instantlyai.com ~all

# ~all = softfail (recommended to start)
# -all = hardfail (use after confirming all senders are listed)

DKIM record

DKIM adds a cryptographic signature to every email you send. Your email provider generates a public/private key pair — the private key signs outgoing emails, the public key is published in your DNS so receiving servers can verify the signature. Google Workspace, Microsoft 365, and most mailbox providers handle DKIM generation through their admin consoles.

# DKIM selector record (Google Workspace example)
Type:  TXT
Name:  google._domainkey
Value: v=DKIM1; k=rsa; p=[your-public-key-here]

# Generate via Google Admin Console:
# Apps → Google Workspace → Gmail → Authenticate email

DMARC record

DMARC ties SPF and DKIM together and provides visibility through aggregate reports. Always start with p=none to monitor without enforcing — switching immediately to p=reject before all your email pipelines are properly authenticated will block legitimate transactional emails.

# DMARC record — start with p=none, move to p=quarantine after 30 days
Type:  TXT
Name:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100

# After 30 days with clean reports, move to p=quarantine
# After 60 days, consider p=reject for maximum protection

Mailbox infrastructure — Maildoso, Instantly, and Salesforge compared

Once your domains are set up and authenticated, you need to provision mailboxes. The choice of mailbox provider affects your deliverability, your cost structure, and how much operational overhead you carry. Three tools dominate the conversation for UK and European outbound teams in 2026.

Which to use and when

For most mid-market sales teams running outbound at moderate scale — 500 to 2,000 emails per day across the team — the most common and effective setup is Google Workspace mailboxes provisioned through Maildoso or Mailforge, running sequences through Instantly, with Instantly's built-in warmup handling reputation maintenance. This separates infrastructure (mailboxes) from execution (sequencing) cleanly and keeps costs manageable.

For agencies or teams running at higher volume — multiple clients, 5,000+ emails per day — the Salesforge ecosystem's dedicated IP infrastructure through Infraforge provides meaningful protection: your sender reputation is not shared with other users on the same IP pool, so one campaign going wrong does not affect your other sending domains.

Maildoso's SMTP mailboxes are a genuine budget option — at $1.80 to $3.10 per mailbox, they are significantly cheaper than Google Workspace at $6 per user per month. The trade-off is shared infrastructure and marginally lower inbox placement in controlled tests. For most teams, that trade-off is acceptable. For high-stakes campaigns into senior enterprise contacts, Google Workspace or Microsoft 365 mailboxes are worth the premium.

Warmup — the schedule that protects your reputation

Email warmup is the practice of gradually increasing sending volume from a new domain or mailbox over several weeks, building inbox placement history before launching full campaigns. Without warmup, a cold send of 50 emails on day one from a brand-new domain looks like spam — because it is, from a technical reputation standpoint. The domain has no history, no engagement signals, no established relationship with receiving servers.

Warmup tools work by connecting your mailbox to a network of other mailboxes and exchanging emails automatically — sending to the network, receiving from it, opening messages, and occasionally replying. These interactions create the positive engagement signals that inbox placement algorithms use to judge sender reputation: this domain sends emails that people actually open and reply to.

The most common mistake is stopping warmup once campaigns launch. Warmup should run indefinitely alongside cold sends — most practitioners maintain automated warmup at roughly 20% of daily send volume permanently. The warmup network's engagement signals continuously counterbalance the negative signals generated by cold outreach, holding domain reputation steady over time.

Sending limits and inbox rotation

Even after a full warmup period, there are hard limits that experienced practitioners never exceed. These are not arbitrary — they reflect the thresholds at which email providers' volume-detection algorithms begin treating senders as bulk mailers and applying stricter filtering.

30 to 50 cold emails per mailbox per day is the safe operating range for most teams. Maildoso recommends 15 cold emails plus 80 warmup emails per SMTP mailbox. Most practitioners operating Google Workspace mailboxes cap at 25 to 30 cold sends per day per inbox. Above 50, you are fighting volume-based spam filters regardless of your copy quality or data cleanliness.

Inbox rotation — distributing sends across multiple mailboxes rather than hammering a single inbox — is how you scale volume while respecting per-mailbox limits. A team targeting 300 cold emails per day needs 6 to 10 mailboxes, each sending at 30 to 50 per day. Instantly and Salesforge both handle inbox rotation automatically, cycling sends across connected mailboxes to distribute volume and maintain consistent per-inbox rates.

Never send from your primary domain at scale regardless of warmup status. The primary domain risk is asymmetric — one bad campaign damages every email that domain sends, including transactional ones. Keep outbound and primary domain strictly separated.

Ongoing monitoring and maintenance

Deliverability is not a one-time setup. It requires active monitoring and maintenance throughout the life of the sending programme. The signals to track and the tools to track them with are as follows.

Bounce rate

Keep hard bounce rate below 2%. Above 3% is a warning signal; above 5% means the domain is actively being damaged. A sudden bounce rate increase is typically caused by a stale contact list — contacts who have changed roles since the data was sourced. The fix is not a deliverability tool. It is better contact data, validated at the point of outreach rather than at the point of database purchase.

Spam complaint rate

Google's tolerance threshold is 0.3% spam complaints. Above 0.1% is worth investigating. Above 0.3% triggers automated filtering that affects all outbound from that domain. Spam complaints are driven by irrelevant outreach — people marking messages as spam because they have no idea why they received them. The fix is signal-based targeting: only reach out when a genuine trigger exists that makes the contact's relevance obvious.

Blacklist monitoring

Check your sending domains and IP addresses against major blacklists — Spamhaus, Barracuda, SURBL — at least weekly. Both Instantly and Salesforge include blacklist monitoring in their dashboards. If a domain appears on a blacklist, pause sending immediately, identify the cause, and request removal through the blacklist provider's delisting process.

Inbox placement testing

Tools like MXToolbox, GlockApps, and the inbox placement testing built into Maildoso (every three days per mailbox) let you see where your emails are actually landing — primary inbox, promotions, spam — before you launch at scale. Run a placement test after every significant change to copy, sending volume, or contact list source.

The data layer — why infrastructure alone is not enough

Perfect infrastructure with dirty data still fails. This is the most important thing to understand about cold email deliverability in 2026 — the two problems are distinct but equally important, and fixing one without the other does not produce good results.

A bounce rate above 3% damages your sender domain regardless of how well-configured your authentication records are or how diligently you have run warmup. Every hard bounce is a signal to Gmail and Outlook that you are sending to addresses that do not exist — and that signal accumulates.

The data problem is not solved by infrastructure tools. It is solved upstream — by sourcing contact data from multiple providers through waterfall enrichment rather than a single static database, and by validating every email address against live SMTP checks at the point of outreach rather than relying on a database verification stamp that may be weeks or months old.

Deliverability is infrastructure. It requires the same upfront investment and ongoing maintenance discipline as any other business system. Teams that treat it as an afterthought — spinning up a domain, sending immediately, wondering why reply rates are low — are building on sand. Teams that build it correctly from the start compound their advantage over time: a domain with six months of clean sending history is dramatically more valuable than one spun up last week, and that advantage only grows.