Cold email deliverability in 2026: domains, warmup, and the links question

Deliverability advice tends to come as a list of forty tips. Most of them are noise. There are four decisions that account for nearly all of the outcome, and they are made before you write a word: which domain you send from, how you ramp it, what you put in the message that a machine can follow, and whether the message is a reply. This post is about the first three; the fourth has its own post.

1. Never send cold from your real domain

Your company's main domain carries your customer email, your password resets, your invoices, your newsletter. Its reputation is an asset you built over years. Cold outreach is, by definition, mail to people who did not ask for it, and some fraction of them will mark it as spam no matter how good it is. You do not put that risk on the domain that pays the bills.

Hosted mailbox providers agree with this in the bluntest way possible. Microsoft 365 caps an individual mailbox at a fixed number of external recipients per day and will route a mailbox that trips its outbound spam heuristics into a restricted pool, then block it — and that block lands on the person's actual working inbox. Google Workspace has equivalent limits. Neither is designed for cold volume, and both will remind you of that at the worst moment.

The practice, then, is lookalike sending domains: trycompany.com, getcompany.com, companyapp.com. Two or three per product line. Each one redirects at the root to your real site, so a curious prospect who types it in lands somewhere real — a sending domain that resolves to nothing is itself a trust signal against you.

Set up each one properly: SPF that authorises only your relay and hard-fails everything else, a 2048-bit DKIM key, DMARC with a quarantine policy and aggregate reports going somewhere you actually read, and reverse DNS on the sending IP. That last one is the most-skipped and the most-telling. Aligned DKIM is what earns a full authentication pass at both Microsoft and Google; everything else is what you do with that pass.

2. Warmup takes three to four weeks, and there is no shortcut

A fresh domain has no reputation. Mailbox providers watch how mail from it behaves — is it opened, replied to, moved to spam, deleted unread — and only extend trust as the pattern looks human. That takes weeks of gradually increasing, real-looking volume before the domain can carry a meaningful daily send.

A ramp that holds: ten sends a day per sender in week one, twenty in week two, thirty in week three, advancing only while every health signal stays green. Reputation attaches to the sending address as well as the domain, so two people on one domain is two separate ramps. Register each domain in Google Postmaster Tools on day one — it shows nothing until there is history, so the sooner it is verified, the sooner you have a reading.

The practical consequence is that domain purchase and warmup are the critical path of any outreach project. If you are building a list, writing sequences, and setting up a tool, none of that is what determines your go-live date. The warmup clock is. Start it first.

3. The links question

"Should a cold email have links?" is the wrong question. The right one is "what in this email can a machine follow?" — and the answer decides more about inbox placement than the words do. Ranked from worst to least bad:

Open-tracking pixels

The single largest avoidable hit. The pixel is an image loaded from a tracking domain that thousands of other senders share; one spammer on that domain burns it for everyone. And the data is garbage anyway — mail privacy features that prefetch images inflate opens by something like half. Turn it off, permanently. Measure replies.

Click-tracking link rewriting

Rewriting yourproduct.com into track.tool.io/x7f2 so the tool can count clicks. The visible domain no longer matches the destination, which is the textbook shape of a phishing link; secure email gateways quarantine it outright. This is worse than the raw link would have been. Turn it off, or use a tracking domain you own — and at cold-outreach volume, just turn it off.

Calendar booking links

Heavily abused in cold email and carrying a mild negative signal on their own. Also the wrong ask: "book thirty minutes" is a twenty-minute commitment from a stranger. Cold, the reply ask wins by a wide margin. Send the booking link after they answer.

A single plain link to your own domain

Near zero risk if the domain is clean and the anchor text is the visible URL, not "click here." Earn it, though: steps one and two of a sequence should carry no links at all, and the link in step three should point at your real product domain directly, not through the lookalike's redirect — filters follow redirects, and the extra hop is a small unnecessary signal.

4. Things that are not about deliverability but will get you anyway

The postal address. CAN-SPAM requires a physical mailing address in commercial email. Most cold senders omit it. It goes in the signature; it costs nothing.

The opt-out. A List-Unsubscribe header reads as bulk to filters, so cold senders skip it — but the law still wants a working way to opt out. A plain-text line does the job and reads as human: "Not the right person? Reply 'no' and I'll close the file." It also doubles as a reply prompt. And an opt-out anywhere must suppress everywhere: every domain, every product, permanently.

Volume across products. If you sell more than one thing, the same company must never hear from product A on one domain and product B on another in the same fortnight. To the recipient that is two strangers from the same shop, which reads as an operation. One company, one active conversation at a time.

What a monitor should watch

Per sending domain, refreshed daily: DMARC pass rate from the aggregate reports, domain reputation and spam rate from Google Postmaster Tools, blocklist status for the domain and the relay IP, and your own bounce and reply rates over the last seven days. Set thresholds that throttle before they pause — halve the cap at a 3% bounce rate, stop at 5% — and let the monitor enforce the ramp rather than trusting yourself to. A domain that drifts should be throttled before you would have noticed it.