Cold email deliverability for agencies

The most common deliverability mistake isn't a missing DNS record. It's sending cold outreach from the same domain and inbox a business depends on for everything else: client invoices, contracts, internal threads. The moment a cold campaign from that inbox gets a few spam complaints, and it will, because cold email always generates some no matter how targeted it is, the reputation hit lands on the domain that also has to deliver an invoice next Tuesday. Agencies that separate cold outreach onto its own sending domain aren't being paranoid. They're containing a blast radius that's obvious in hindsight and easy to miss in advance.

Before any of that, though, the three DNS records actually have to be right: SPF, DKIM, and DMARC. SPF tells receiving mail servers which servers are allowed to send on behalf of your domain. DKIM cryptographically signs each message so a receiver can verify it wasn't altered or spoofed in transit. DMARC tells receivers what to do if a message fails either check, and publishes a policy other domains can see. Getting these wrong doesn't usually mean total failure; it means a meaningfully worse chance of landing in the primary inbox instead of spam or promotions, spread across every message sent, which compounds fast at agency volume. Most sending platforms will generate the exact records to add and tell you when they're verified. There's no reason to guess at this part or skip it because it's tedious.

Warming up a new sending domain matters more than most agencies budget time for. A brand-new domain with zero sending history that suddenly starts pushing out hundreds of cold emails a day looks exactly like what spam filters are built to catch, regardless of how well-targeted the list is or how carefully the copy was written. The fix is unglamorous: start at a low daily volume, on the order of tens of emails rather than hundreds, and increase gradually over one to two weeks as the domain builds a track record of being opened and replied to rather than reported. It's slower than agencies want it to be, especially with a client waiting on results, but the alternative is burning a domain's reputation in the first week and needing a new one.

Once a domain is warmed and correctly configured, the sending pattern still matters day to day. A hard daily send cap, enforced consistently rather than spiking on days when a new list comes in, keeps volume looking like a real business sending real email instead of a blast tool. Reply rate and bounce rate are the two numbers worth actually watching, more than opens, which are increasingly unreliable as a metric since image-blocking and privacy features distort them. A bounce rate that creeps up is usually a sign the list itself has gone stale or was scraped from somewhere unreliable, and no amount of technical configuration fixes a bad list; it just makes it fail a little more slowly.

List quality is worth dwelling on separately from all the technical setup, because it's the one factor most likely to sink a technically perfect setup anyway. A list of addresses bought or scraped in bulk, without any verification that the mailboxes still exist and belong to the business they're attributed to, produces a wave of hard bounces the moment it's used, and hard bounces are one of the strongest negative signals a sending domain can generate. Addresses sourced from a business's own current, public listing, its actual website or verified business profile, bounce far less because they're more likely to be current and actually monitored. The upfront cost of better sourcing is almost always cheaper than the deliverability damage of a bad one.

Suppression handling is the last piece, and it's as much a compliance requirement as a deliverability one. Every message needs a working, honored unsubscribe path, and anyone who unsubscribes or whose message bounces needs to be permanently excluded from every future send, not just the current campaign. Beyond being required under GDPR and similar rules almost everywhere agencies operate, mailing a suppressed address again is one of the fastest ways to generate a spam complaint from someone who already told you no once. This has to be automatic, not a manual list an account manager remembers to update, because the one time it's forgotten is the one time it costs the domain's reputation.

None of this is a secret, and none of it is agency-specific advice dressed up. It's the same fundamentals any cold sender needs to get right, just harder to hold consistent across multiple client accounts and higher volume without something automating the daily caps, the suppression list, and the warm-up schedule behind the scenes. The agencies that struggle with deliverability are rarely missing some clever trick. They're usually skipping one of these unglamorous basics under time pressure, and it shows up in the numbers a few weeks later.