Cold email that lands, from a domain you just bought

Here is the sequence of events that produces almost every "cold email doesn't work" conclusion. A founder buys a domain on Monday, sets up a mailbox on Tuesday, exports two hundred addresses on Wednesday and sends them all on Thursday. Nothing comes back. There is no error, no bounce, no warning — a large share of those emails were quietly filed in spam folders, and spam folders are not a place anyone looks. The founder concludes the message was wrong and rewrites it. The message was never read.

Mailbox providers decide where your email goes largely on the reputation of the domain it came from, and a domain nobody has ever received mail from has no reputation at all. It isn't trusted and it isn't distrusted — it's unknown, and unknown plus two hundred messages in one afternoon looks exactly like the thing spam filters were built to catch. The fix is not better copy. It's three DNS records, three weeks of patience and a daily number small enough to look like a person.

The rest of this page is that, in order, checked against Google's and Microsoft's own published requirements rather than against other people's summaries of them. That matters more than usual here: the rules changed in February 2024, changed again for Outlook in May 2025, and Gmail moved from delaying non-compliant mail to permanently rejecting it in November 2025. A guide written before any of those is not slightly out of date; it is describing a system that no longer exists.

Email was designed without any way of proving who sent a message. Anyone can put anything in the From: line — that's not a bug being fixed, it's how SMTP works. The three records below are the layer bolted on top to answer three different questions, and they only work together. All three are free, all three are DNS entries you add once at your registrar, and all three take about fifteen minutes.

Both have published sender requirements with two tiers: things every sender must do, and extra things demanded of high-volume senders. The threshold in both cases is 5,000 messages a day — to personal Gmail accounts for Google, to Outlook.com, Hotmail.com and Live.com addresses for Microsoft. A one-person business sending thirty a day is nowhere near it, which leads to the most common misreading of these rules: that they don't apply to you. The requirements don't; the filters absolutely do, and the requirements are simply the published version of what the filters were already rewarding.

Three things about that table matter more than the rest, and none of them is in most guides.

Gmail now permanently rejects, not just delays

Google's own FAQ: "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections." The distinction is the whole game. A temporary failure — a 4.x.x code — means your sending tool retries and the message eventually arrives. A permanent one — 5.x.x — means it is gone, and unless you read your bounce log you will never know. Microsoft went the same way from 5 May 2025, starting by routing non-compliant mail from high-volume senders to Junk, with outright rejection promised for persistent offenders and a specific error waiting for them: 550 5.7.515 Access denied, sending domain does not meet the required authentication level.

Bulk sender status, once earned, never expires

Also from Google's FAQ: "Bulk sender status doesn't have an expiration date. Email senders that have been classified as bulk senders are permanently classified as such." One enthusiastic afternoon over the threshold and the stricter tier applies to your domain for good. For a small business this is an argument for never testing the ceiling — there is no route back.

The rules mostly don't apply to the people you're emailing

This is the one worth sitting with if you sell B2B. Google states plainly that the sender guidelines "don't apply to messages sent to Google Workspace accounts" — enforcement covers personal Gmail addresses only. Almost every business you cold-email is on Workspace or Microsoft 365, so the published rules technically govern very little of your outbound. What governs it instead is the ordinary spam filtering on those tenants, which is if anything stricter, less predictable, and configured by an IT person who doesn't like you. Meeting the bulk-sender requirements is still the right thing to do; it just isn't why. You do it because passing authentication is the price of being considered at all.

Follow-ups are not optional and they are not nagging. In the 2026 analysis of 53 million cold emails, 44% of all positive replies came from follow-ups rather than the first message, and the first follow-up alone accounted for about a quarter of every positive reply received. A founder who sends one email and stops throws away roughly half of what the list was worth. Four to seven touches is the range that keeps paying; past seven, you're annoying people for a rounding error.

Three shapes cover almost everything a small business needs. Pick by what you know about the company, not by what you're selling.

Northline Bike Repair runs the partner sequence at thirty-five Denver bike shops. Here is the whole thing for one of them — the shop from the qualification example, which has had a mechanic vacancy open since July.

The specifics that the data supports, briefly: under 80 words for a first email; a four- or five-word subject; a soft ask ("worth ten minutes?") rather than a hard one ("book here") — soft calls to action produced 78% more positive replies in the same 2026 analysis. Plain text, no images, no tracking pixel, at most one link, and never a link in the first email if you can avoid it. Everything you add to make it look professional makes it look like marketing, and marketing is what the filter is looking for.

This is the single rule most likely to be broken by a founder doing outreach by hand, and it does more damage than any DNS mistake. Someone answers your first email — "thanks, not right now" — and four days later your scheduled follow-up arrives asking whether they saw the last one. You have now proved, in writing, that nobody read their reply. That is worse than never having emailed them, because it converts a polite no into a person who tells other people about you.

Every reply stops everything, regardless of what it says. Interested, not now, wrong person, or a flat no — all four remove that address from every remaining touch in the sequence, immediately, and add it to a suppression list that every future campaign checks before it sends. So does an out-of-office, until the date it says they're back. So does a bounce, permanently and after a single occurrence.

The mechanical version of this is a suppression list that is checked at send time, not at list-build time, and that is global rather than per-campaign. The manual version is a spreadsheet column you update the same day. Either works; what doesn't work is intending to remember.

Cold email is legal in the US and, to businesses, largely legal in the UK and EU. It is not unregulated in either, and the two regimes are built on opposite defaults: the US says you may email until told to stop, Europe says it depends entirely on whether the recipient is a company or a person. None of what follows is legal advice — it's the shape of the thing, and the shape is worth knowing before you send a thousand of anything.

In practice, a small business writing to forty researched companies with a real name, a real address, an easy way to say stop and an actual reason for writing sits comfortably inside all of it. The businesses that get into trouble are the ones sending to bought lists at volume, and the legal exposure tends to arrive at the same time as the deliverability collapse, for the same underlying reason: nobody asked to hear from them and the sender didn't care.