Why cold emails go to spam (and the fix for each cause)
Why cold emails go to spam and how to land in the inbox: the real causes (authentication, reputation, content, volume, list quality) and the fix for each.
Most people guess at why cold emails go to spam, change the subject line, and wonder why nothing improves. The real answer has little to do with the words in any single message and almost everything to do with the signals a receiving server reads before it parses your copy: who you are, whether you are who you claim to be, how your domain has behaved, and how real people have reacted to your mail.
Filters at Gmail, Outlook and Yahoo score those signals in roughly a fixed order. Fix them in that order and placement follows. Here are the six real causes, what each one looks like to a filter, and the specific fix.
The real reasons cold emails go to spam
| Cause | What the filter sees | The fix |
|---|---|---|
| Authentication | SPF, DKIM or DMARC fails or is missing | Set all three; DMARC at p=none is a fine start |
| Domain reputation | A new or burned domain sending cold mail | Warm up for weeks before the first cold send |
| Content and links | A link domain that does not match the sender | Keep links on domains you own; write like a person |
| Volume and pattern | A sudden burst, or identical sends every morning | Ramp slowly, add a gap and jitter between sends |
| List quality | Bounces and spam-trap hits | Verify addresses before sending |
| Engagement | Nobody opens or replies; many delete on sight | Target tightly, warm up, earn real replies |
Authentication: the first gate a filter checks
Before a receiving server reads a word, it checks whether your mail is authenticated. SPF, DKIM and DMARC tell the server the message really came from your domain and was not forged. If any of the three fails, or DMARC is missing entirely, Gmail and Yahoo treat the message as suspect, and bulk senders get filtered outright.
This is the cheapest fix on the list because it is a one-time DNS change. Publish an SPF record, enable DKIM signing on every sending domain, and add a DMARC record (p=none is a safe start; tighten to quarantine or reject later). In MailFleet the Mailboxes page has a Domains tab that shows SPF, DKIM and DMARC per sending domain, and Final Review will not let a campaign deploy while SPF or DKIM is missing, so a broken record cannot slip into a live send.
Domain and sender reputation
A brand new domain has no reputation, and cold email is the worst possible way to introduce one. Every provider that sees first-time mail from your domain has nothing to judge it on except the message and the pattern, and a domain with no history that suddenly sends outreach looks exactly like spam.
The fix is to build a history before you need one. Warm up the domain for about two weeks of warmup-only sending, then ramp cold volume over another two weeks. Warmup works by producing the engagement filters score: real inboxes open your mail, reply to a share of it, and (the single most valuable signal) move it out of spam when it lands there, which tells the provider its filter was wrong about you. MailFleet runs this across its whole network with sensible defaults: 20 warmup emails a day per mailbox, a 30-minute gap, and a 30% reply rate. It keeps running after a mailbox is warm, because reputation decays without engagement.
Content and links
Copy matters less than people think, but a few things reliably trip filters. The biggest is a mismatch between your sending domain and the domains you link to. A tracking or call-to-action link pointing at a generic shared domain used by thousands of other senders carries their reputation, not yours, and a link domain that does not match the sender is a signal filters weigh heavily.
If you track opens and clicks, serve those links from a tracking domain you own rather than a shared default host. MailFleet lets you set a custom tracking domain per workspace (a CNAME to fltrk.com), and it keeps the real click destination off the URL so the link cannot be turned into an open redirect. Beyond links, write plain, short, human copy. Campaigns in MailFleet default to plain-text mode (which disables tracking) precisely because a plain-text message with one clear ask reads like a person wrote it, not a marketing blast. Skip image-heavy templates, long link lists, and the obvious trigger words.
Volume and sending patterns
A filter does not just read one message, it watches the shape of your sending. Blasting a full list on day one, or sending the exact same volume at the exact same minute every morning, both read as automation. How many cold emails you send per day, and how evenly you spread them, matters more than the raw total.
Pace like a human. MailFleet spaces first emails with a default gap of one every 20 minutes plus random jitter, caps new leads entering a campaign at 100 a day so volume ramps instead of spiking, and rotates across your mailboxes so no single sender carries the whole load. A newly connected mailbox starts capped at 30 sends a day. These are not arbitrary throttles; they keep each mailbox inside the range a real person could plausibly send.
List quality and engagement
Sending to dead addresses is one of the fastest ways to earn a spam folder. Every hard bounce and every spam-trap hit tells the provider you did not clean your list, and reputation falls for the whole domain. A bounce rate over 2% is the point where most teams should stop and investigate.
Verify your addresses before they enter a campaign. MailFleet strips duplicates, unsubscribes and previously bounced addresses on import automatically, and Pro and Scale plans include daily verification (300 a day on Pro, 1,000 on Scale) that flags invalid, disabled, disposable and spam-trap addresses before you send to them. On top of clean lists, engagement is the long game: tightly targeted lists get opened and answered, and opens and replies are exactly the signals that keep you in the inbox.
A short recovery checklist
If your mail is already landing in spam, work the causes in order rather than guessing:
- Confirm SPF, DKIM and DMARC pass on a real test message from each sending domain.
- Check your bounce rate per domain. Above 2%, stop adding new leads and verify the list; above 4%, pause the domain and let it recover.
- Separate bad-address bounces from policy blocks. A "no such user" bounce is a list problem; a "rejected due to reputation" refusal is a domain problem, and the second means slow down now.
- Halve cold volume on the affected mailboxes rather than stopping dead, which looks worse than steady low volume.
- Keep warmup running, and nudge the reply rate up.
- Move tracking links onto a domain you own, or turn tracking off and send plain text.
- Give it one to three weeks. Reputation recovers on the same timescale it was built.
The deliverability checklist walks through the full setup end to end. The short version: authenticate, warm up, send clean lists at a human pace, and let real engagement do the rest.
FAQ
Why do my cold emails go to spam even with SPF and DKIM set up?
Authentication only clears the first gate. If SPF and DKIM pass but your mail still lands in spam, the cause is almost always reputation, list quality or pattern: a cold domain with no warmup, a list with dead addresses, or a sudden burst of identical sends. Work through reputation and volume next.
Does using a shared tracking domain send cold emails to spam?
It can contribute. A tracking or link domain shared across many senders carries their combined reputation, and a link domain that does not match your sending domain is a signal filters weigh. Serving click links from a domain you own, or sending plain text with no tracking at all, removes that risk.
How long does it take to get out of the spam folder?
Reputation recovers on roughly the same timescale it was damaged, usually one to three weeks of corrected sending: authenticated mail, clean lists, lower volume and steady warmup. A domain that has been badly burned can take months, and is often cheaper to retire in favour of a fresh, properly warmed lookalike.