Deliverability · 11 min read

Cold email deliverability in 2026: the rules that actually matter.

Around the second week of February, every campaign we run started landing slightly worse. Not catastrophically worse — reply rates dipped maybe 12% — but the kind of slow drift that, if you ignore it for a quarter, ends up with half your sequences in spam. We pulled the data, ran a few controlled tests, and traced most of it back to a quiet update Google rolled out to its bulk-sender filtering.

This article is the short version of what we found, what we changed across our sending stack as a result, and what we stopped doing entirely.

What actually changed

The headline change isn't new — it's the continuation of the bulk-sender requirements Google and Microsoft started rolling out in early 2024. What's different in 2026 is that the thresholds are tighter and they apply to a much broader definition of "bulk".

If you authenticate properly, keep your spam complaint rate under 0.1%, and provide a one-click unsubscribe header, you're inside the rules. If any of those three things is wrong, you start drifting toward the spam folder regardless of how clever your subject line is. The hard part is that the receiving filter doesn't tell you you've drifted — it just stops showing your emails to people.

The three checks the receiving inbox runs

Every email lands in a filter that runs roughly three checks before deciding where to put it.

  1. Is the sender authenticated? SPF, DKIM and DMARC must all align with the visible "from" domain.
  2. Does the sender have a complaint history? Spam button presses, unsubscribe rates, and historical bounces are all weighted.
  3. Does the email look like normal correspondence? Length, link density, image-to-text ratio, formatting, and sender reputation around the recipient's specific account.

Of those, authentication is the only one you have full control over. Complaint history is a slow build and a fast destroy. The "looks like normal correspondence" check is the most intuitive, and the most ignored.

What we changed

1. We stopped sending more than 30 emails per inbox per day

The temptation when you take on a new client is to crank the daily volume up to whatever the sending platform allows. We used to run mailboxes at 60 emails per day during peak. We've cut every mailbox to a maximum of 30, and most run at 20.

The reason is simple: per-mailbox volume is one of the strongest signals in Google's classification. A mailbox that suddenly sends 60 emails on a Tuesday morning, where it was sending zero a week earlier, looks like a mass-mailing tool. A mailbox that sends 18–25 a day with some variation looks like a person who happens to have a lot of meetings.

2. We doubled the warm-up period

The "two-week warm-up" advice everywhere online is no longer enough. We now run a five-week warm-up on every fresh domain before it carries any production traffic. Yes, it's slow. Yes, clients ask why their first emails aren't going out on day three. The answer is: because the alternative is your first emails going to spam.

The pattern that has worked best for us is roughly: five emails per day in week one, ten in week two, eighteen in week three, twenty-four in week four, full volume in week five. We use a network of warm-up partners (real corporate inboxes that exchange messages with each other) rather than the auto-warm features built into most outbound tools, which are increasingly fingerprintable.

3. We removed every tracking pixel from cold sequences

This one took us the longest to commit to. Tracking pixels are useful — open rates are a useful signal — but they have become a liability. Filters on the receiving end are getting better at flagging emails with embedded pixels, especially when the pixel is loaded from a third-party domain.

We pulled tracking pixels from all cold sequences in March. Reply rate went up by 9% in the following four weeks across the portfolio. Open rate became unmeasurable, which felt strange for about a week and then turned out not to matter — the metric we actually care about is replies, and the replies got better.

4. We hardened the link policy

One link in the email body, maximum. Branded short links are out — they're trivially identifiable as outbound tooling. We use direct, full URLs to the canonical destination, and we never use URL parameters that look like UTM tags in the first email. UTM tags can come back in for follow-ups, where the recipient has already engaged.

5. We changed how we handle replies

An out-of-office reply is not a positive signal. A "not interested" reply, replied to politely, is. We used to mark "not interested" as a hard stop — close the conversation, move on. Now we send a single, short, gracious reply ("Understood — thanks for the quick note. Closing the loop on my side."). That single reply does two things: it shows the receiving filter that the conversation is real, and it leaves the prospect with a positive last impression.

What we stopped doing entirely

Three things we'd been doing for years that don't survive 2026:

  • Spintax variation in the body. The receiving filters now actively look for spintax-style variation patterns. Hand-written variants beat machine-spun variants by a wide margin.
  • "Hey {{first_name}}!" style openings. Triggers the templated-content classifier on Google's side. Even when the merge field works, the formality break ("Hey!") plus exclamation mark is a flag. We open every email differently now.
  • Sending from .com lookalikes. If your real domain is acme.com, sending from acme-team.com is asking to be flagged. Use the real domain, just on a different mailbox prefix (e.g. [email protected] not [email protected]).

The single best thing you can do

If you do one thing this quarter, set up DMARC properly, with the policy set to p=quarantine (or stricter), and an aggregate report mailbox actually being read by a human. Most agencies set DMARC to p=none and forget about it, which is the worst of both worlds — the receiving inboxes know you've published a DMARC record, so expect strict alignment, and they punish you when alignment fails.

If your DMARC policy is p=none and you haven't read the aggregate reports in six months, your deliverability is worse than you think.

The fix is a one-day project that pays back for years. We can talk through it on a discovery call if it would help — or you can find every detail in the Cold Email Playbook 2026.


If you'd like the next set of field notes in your inbox, the Bold Bookings newsletter goes out every other Tuesday. One email, one campaign, one number that surprised us.

EV
Eli Voss
COO & co-founder, Bold Bookings
Talk to Eli →

Want us to run this for you?

If your offer's strong and your TAM's the right size, we can have your sender stack live and producing meetings in seventeen days.

Book a call