Coder Legion - Recent posts tagged coldemail

The three DNS records that decide whether your cold email gets delivered at all

Tue, 13 Oct 2026 16:27:29 +0000

Most write-ups about cold email deliverability lead with sending volume and warmup schedules. Those matter, but they're the second problem. The first problem is simpler and gets skipped constantly: whether your domain is even configured to let mail pass authentication checks in the first place.

This is a checklist, not a think piece. If you're setting up a sending domain for outreach, work through it in order.

1. SPF: who's allowed to send as you

An SPF (Sender Policy Framework) record is a TXT record on your domain listing which mail servers are authorized to send on your behalf. Receiving servers check this before anything else. No SPF record, or an SPF record that doesn't include your actual sending provider, and you're already flagged as suspicious before content is even scanned.

Common failure: a domain with an SPF record covering Google Workspace for regular email, but nothing added for the SES identity or cold email tool now also sending from that domain. Two senders, one SPF record covering only one of them.

v=spf1 include:_spf.google.com include:amazonses.com ~all

Check your current record with dig TXT yourdomain.com or a free scanner. EmailQo's SPF checker runs this check without requiring a signup, useful for a quick sanity check before you go further down the list.

2. DKIM: proving the email wasn't tampered with

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing mail, generated with a private key and verified by receivers against a public key published in your DNS. It confirms the email's content matches what left your server, and that it genuinely came from a server authorized to sign for your domain.

Setting this up with SES specifically means enabling easy DKIM in the SES console, which generates CNAME records you add to your DNS, then waiting for SES to verify them, usually within 72 hours but often faster. Skipping this step is one of the most common reasons SES-based cold email setups underperform: the mail sends fine technically, but arrives unsigned, which plenty of receiving servers treat as a strong spam signal on its own.

3. DMARC: the policy that ties it together

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when SPF or DKIM checks fail, and sends you reports when they do. A minimal starting record:

v=DMARC1; p=none; rua=mailto:Emails are not allowed

Start with p=none so you get visibility without risking legitimate mail getting rejected while you're still debugging SPF and DKIM. Tighten to quarantine or reject only once reports confirm your legitimate mail is passing cleanly. Jumping straight to p=reject on a misconfigured setup is a reliable way to have your own outreach silently dropped by receiving servers, including the human who would've replied.

Why this matters more for cold email than regular business email

Receiving servers apply more scrutiny to unsolicited mail than mail that's part of an established back-and-forth conversation. A domain with clean, strict authentication is one of the few concrete signals you control that works in your favor regardless of content. Get it wrong and no amount of warmup, list quality, or copywriting compensates, because the mail is getting filtered on a technical layer before any of that is evaluated.

If you'd rather not run this by hand

This is genuinely a few hours of DNS work done once, and worth doing yourself to actually understand your setup. If you'd rather have warmup, authentication monitoring, and reply handling managed on top of your own Gmail, Outlook, or SES connection instead of stitching tools together after the fact, that's the gap EmailQo is built to cover, using the same SPF, DKIM, and DMARC fundamentals above under the hood rather than something proprietary.

Either way, run the three checks above before you debug anything else. A broken DNS record will sink a well-written campaign every time, and no sending tool, free or paid, can fix that for you.

Why your cold emails are landing in spam (and how to actually fix it)

Wed, 30 Sep 2026 11:22:42 +0000

You wrote a good email. You checked the spelling. You hit send on 200 of them this morning. And somehow, most of them are sitting in a folder nobody opens.

If you have ever wondered why your emails go to spam with no warning and no explanation, you are not imagining it and you are not alone. Cold email deliverability is not one setting you flip on. It is six or seven small things, and mailbox providers do not tell you which one you got wrong. This guide walks through every real cause, in the order worth checking, with a free way to test each one.

Quick answer

Most cold email lands in spam for one of six reasons: a missing or broken SPF, DKIM or DMARC record; a new domain or inbox that never warmed up; wording that trips spam filters; sending too many emails too fast from too few accounts; a bounce or complaint rate that is already too high; or no real one-click unsubscribe. Fix the technical record first, then warm up, then watch your pace and your numbers.

1. Your SPF, DKIM or DMARC record is missing or broken

This is the most common cause, and the easiest to check.

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email for your domain. When a message arrives, the receiving server looks at the envelope sender domain, the address used in the SMTP MAIL FROM command, fetches the SPF record for that domain, and checks whether the sending IP is listed. If it is not, and the record ends in -all, the message typically fails and gets rejected or spam foldered. SPF records also have a hard limit of 10 DNS lookups. Stack enough include: statements from different tools and you can quietly blow past that limit without any error message.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send. The receiving server checks that signature against a public key published in your DNS. If the message was altered in transit, or the signature does not match, DKIM fails.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the layer that ties the two together. It tells receiving servers what to do when SPF or DKIM fails on a message claiming to be from your domain, and it is checked against the visible From header, the address a recipient actually sees, not the hidden envelope address SPF checks. A domain can pass SPF and still get flagged if DMARC alignment fails.

Most people set up SPF once, when they first configure their sender, and never check it again. Then they add a new tool, a new subdomain, or a new sending platform six months later and the record silently breaks.

Check yours for free: SPF checker · DKIM checker · DMARC checker

2. You're sending from a domain or inbox that never warmed up

A brand-new domain, or a new mailbox on an old domain, has no sending history. Mailbox providers do not know if you are a real person or a spam operation on day one, so they place mail from unknown senders with extra caution, regardless of how clean your SPF and DKIM are.
A gradual warmup, typically 2 to 4 weeks, spread across a slowly increasing daily volume, is what builds that reputation before you send at full scale. Skip it and send 500 cold emails from a domain that is three days old, and you will likely see most of them land in spam even though nothing is technically misconfigured.

Build a warmup schedule for your target volume: Warmup schedule generator

3. Your email reads like spam to content filters

Spam filters score the actual words, formatting and structure of your message, separately from your domain's reputation. All caps in a subject line, certain phrases mailbox providers associate with spam, excessive links, image-only bodies, or a mismatch between your display name and your actual sending domain, all raise that score.

None of this is guesswork you have to do by eye. A spam word checker scans your subject and body against known trigger patterns before you send, the same category of check a filter would run on the other end.

Scan your draft before sending: Spam word checker

4. You're sending too many emails, too fast, from too few accounts

Every mailbox provider enforces a sending cap, and it exists for exactly this reason: a sudden burst of outbound mail from one account is the clearest signal of automated sending a filter can see. Google Workspace paid accounts, for example, are capped at 2,000 messages per user per 24 hours, and that is a ceiling, not a target. All providers can throttle you below their published cap if your bounce rate climbs above roughly 5 percent or your complaint rate above roughly 0.1 percent, so the practical safe volume is often lower than the number on the page.

Spacing sends at a human pace, and rotating across multiple sender accounts instead of pushing everything through one, keeps you well inside those limits instead of testing them.

See the real caps for your provider: ESP sending limits reference

Your bounce or complaint rate is already too high

This compounds every other problem on this list. A high bounce rate usually means your list has stale or invalid addresses. A high complaint rate means real people are marking your mail as spam, which mailbox providers weight far more heavily than a simple unsubscribe. Once either number climbs, providers start routing more of your mail to spam by default, on top of anything else already working against you, and that reputation damage does not reset the moment you fix the underlying cause.

Verifying your list before you send, and keeping an eye on your infrastructure score as a whole, catches this before it becomes a reputation problem.

Check your overall score: Email infrastructure grader

6. You don't have a working one-click unsubscribe

Gmail and Yahoo both require bulk senders to support one-click unsubscribe (RFC 8058), and mail that does not comply gets penalized independent of everything else. Beyond the compliance angle, a real unsubscribe link reduces the single strongest negative signal you can send: someone hitting spam instead, because leaving your list was harder than that one click.

The six-cause checklist

Broken SPF, DKIM or DMARC. Check it with a free checker, takes seconds. Fix it by correcting the DNS TXT records with your domain host.

No warmup on a new domain or inbox. Check it by comparing domain or inbox age against your sending volume. Fix it with a 2 to 4 week gradual warmup schedule.

Spam-triggering wording. Check it by running your draft through a free spam word scanner. Fix it by rewriting the subject line and any flagged phrases.

Sending too fast from too few accounts. Check it by comparing your volume to your provider's caps. Fix it by throttling sends and rotating sender accounts.

High bounce or complaint rate. Check it by verifying your list and reviewing your infrastructure score. Fix it by cleaning your list and slowing down while you rebuild reputation.

No real unsubscribe. Check it by clicking it yourself. Fix it by adding a one-click unsubscribe that complies with RFC 8058.

Frequently asked questions

Why do my emails go to spam even though I didn't do anything wrong? Deliverability is rarely one mistake. A domain can have a correct SPF record and still get spam foldered because of sending volume, wording, or a stale SPF record that broke after you added a new tool months ago. Check all six causes above rather than assuming it is just one.

What is the difference between SPF, DKIM and DMARC? SPF authorizes which servers can send for your domain. DKIM cryptographically signs the message so it cannot be altered in transit without detection. DMARC is the policy layer that ties both together and tells receiving servers what to do when either check fails, evaluated against the domain a recipient actually sees in their inbox.

How long does email warmup take? Typically 2 to 4 weeks of gradually increasing volume before sending at full scale, though the right length depends on how much daily volume you are warming up toward.

How many cold emails can I send per day without hurting deliverability? It depends on your provider and your account's age and reputation, not a single universal number. Google Workspace paid accounts cap at 2,000 per user per 24 hours, but providers throttle well below their published cap once bounce rate or complaint rate climbs, so the safe practical number is usually lower than the ceiling.

Is there a free way to test cold email deliverability before sending a full campaign? Yes. Checking SPF, DKIM and DMARC, scanning your draft for spam-triggering wording, and reviewing your infrastructure as a whole are all free checks you can run before a campaign goes out, rather than finding out after open rates come back low.

Where to start

If you have not checked your domain in the last few months, start with SPF, DKIM and DMARC. It is the fastest of the six to check and the most common cause of silent, unexplained spam foldering.

EmailQo checks your domain, your sending account and every message you write before it sends, then sends at a safe, human pace instead of leaving that up to guesswork. Start a 7-day free trial, no card needed.

Using AWS SES for Cold Email: What Breaks and How to Actually Make It Work

Mon, 24 Aug 2026 07:48:05 +0000

Every founder who has looked at their email tool bill has had the same thought.

Wait, I can send through Amazon SES for ten cents per thousand emails? Why am I paying $99 a month for a sequencing tool?

The math is real. SES is the cheapest sending option out there. If you're a founder watching every dollar, an agency running email for a dozen clients, or an SDR team trying to scale outreach without scaling the budget, SES looks like the obvious move.

Then you try to set it up, and you hit a wall.

What nobody tells you before you start

Amazon built SES for developers sending transactional email. Order confirmations. Password resets. Receipts. It was never meant for a founder or a sales team who wants to send outreach and get replies.

That mismatch shows up fast.

To send your first cold email through raw SES, you file a request to exit the sandbox and wait for approval that isn't guaranteed. You create access credentials with the right permissions. You set up a system to catch bounces and complaints, because if you don't track those, AWS pauses your account the moment your numbers climb. You configure your own authentication records. And you build some way to actually see what's happening, because SES gives you raw metrics and nothing that looks like a campaign dashboard.

None of that has anything to do with writing a good email or booking a meeting. It's plumbing. And most founders, SDRs, and agency owners are not plumbers.

The part that actually hurts

Here's the failure that catches people off guard.

The risk with SES isn't whether it can send your email. It can. The risk is what happens after you send.

Cold outreach naturally produces some bounces and some complaints. That's normal. But AWS watches those numbers closely, and if your complaint rate crosses a threshold, they can pause your entire account with little warning. Your pipeline goes silent. The campaign you spent a week building stops mid-send. And because raw SES gives you almost no early warning, you often find out only after the damage is done.

This is the quiet reason so many teams try SES, get burned once, and go back to paying for a tool that shields them from all of it.

The frustrating part is that the shield isn't complicated. You need warmup running so your sending reputation stays healthy. You need a check before each campaign that catches problems before they go out. You need bounce and complaint handling that runs automatically instead of something you build by hand. That's it. Raw SES gives you none of it, which is why almost everyone ends up putting a layer on top.

But isn't SES worse for deliverability than Gmail?

This is where people get confused, so it's worth clearing up.

On day one, yes, Gmail is easier. Google lends you some of its own sending reputation, so a fresh Gmail account can start landing in inboxes faster than a fresh SES setup. SES starts your reputation from zero, which means a real warmup period before you send at volume.

But that early convenience has a catch. On Gmail, the reputation underneath is Google's, not yours. If Google has an infrastructure problem affecting your account, you have no visibility and no recourse. You're also boxed in by Gmail's sending limits, which sit well below what serious outbound needs. On SES, once you build the reputation, it belongs entirely to your account and no other sender can touch it, and your volume ceiling is whatever AWS approves.

The honest rule of thumb: Gmail or Outlook to test and get started, SES for owned, isolated infrastructure once you're serious about volume.

What actually keeps you in the inbox

Strip away the tooling debate and the fundamentals are identical no matter what you send through. These decide whether your cold email lands, and most deliverability disasters trace back to one of them quietly breaking.

Authentication that actually passes, checked before every send. Your sender authentication is not set-and-forget. DNS records change and expire, and a record that verified three months ago can break with no warning. Confirm it before a real campaign, not once at setup.

A policy that enforces, not just monitors. A huge number of senders configure DMARC in monitoring mode, see no errors, and assume they're protected. Monitoring mode watches and does nothing. Filters can tell the difference between a domain that enforces and one that's just observing, and they treat them differently.

Content scanned before it goes out. Spam trigger words, too many links, a bad text-to-image ratio. Filters score all of this before a human ever opens the email. Catching it before a 2,000-contact send costs nothing. Catching it after costs you the whole list.

Blacklist status checked close to send time. A clean domain can get listed overnight. Checking once when you set up and never again is how teams get blindsided mid-campaign.

Bounce and complaint rates watched per campaign. The 90-day average looks fine right up until it doesn't. The rate on your most recent send is the one that predicts trouble, and on SES specifically it's the number that gets your account paused.

Warmup that runs continuously, not just at launch. Reputation isn't built once. Background warmup between active campaigns keeps your sending history healthy during the quiet gaps.

Follow-ups that stop the instant someone replies. Sending a scheduled follow-up to a person who already responded is one of the fastest ways to earn a spam complaint. If your sequencing doesn't pause automatically on reply, that's a risk hiding inside your own automation.

The setup most teams actually land on

After the burned-once cycle, most founders and agencies arrive at the same conclusion. They don't want raw SES, and they don't want a $99 tool that hides the fact they're overpaying to send. They want the cheap SES rate with the guardrails already handled.

That means connecting your own SES account, then letting a layer on top handle the authentication setup, the warmup, the bounce and complaint processing, and the pre-send checks. You pay AWS directly for what you send, and a flat predictable rate for the software that keeps you out of trouble. A handful of tools now do exactly this. EmailQo is one built specifically around connecting your own AWS SES account for cold email, which is worth a look if you want the ten-cents-per-thousand economics without becoming your own deliverability engineer.

The reason this shape wins for the people reading this is simple. A founder gets SES economics without needing an engineer. An agency runs each client on isolated, owned infrastructure instead of a shared pool where one bad client tanks everyone. An SDR team sends at volume without one paused account killing the quarter.

The takeaway

SES being cheap was never the hard part. Ten cents per thousand emails is real, and for founders, agencies, and outbound teams it's a genuinely good deal on paper.

The hard part is everything around the sending. The setup that has nothing to do with your actual job. The account pause that hits without warning. The reputation you have to build and then protect. Whether you run raw SES, put a tool on top, or stay on Gmail and Outlook for now, the checklist above is what keeps you in the inbox.

Sort that out first. Then the cheap sending rate finally starts to mean something.

AWS SES Is the Cheapest Way to Send Cold Email. It's Also the Fastest Way to Get Stuck.

Mon, 24 Aug 2026 07:47:25 +0000

Every founder who has looked at their email tool bill has had the same thought.

Wait, I can send through Amazon SES for ten cents per thousand emails? Why am I paying $99 a month for a sequencing tool?

Then you try to set it up, and you hit a wall.

What nobody tells you before you start

That mismatch shows up fast.

None of that has anything to do with writing a good email or booking a meeting. It's plumbing. And most founders, SDRs, and agency owners are not plumbers.

The part that actually hurts

Here's the failure that catches people off guard.

The risk with SES isn't whether it can send your email. It can. The risk is what happens after you send.

This is the quiet reason so many teams try SES, get burned once, and go back to paying for a tool that shields them from all of it.

But isn't SES worse for deliverability than Gmail?

This is where people get confused, so it's worth clearing up.

The honest rule of thumb: Gmail or Outlook to test and get started, SES for owned, isolated infrastructure once you're serious about volume.

What actually keeps you in the inbox

Blacklist status checked close to send time. A clean domain can get listed overnight. Checking once when you set up and never again is how teams get blindsided mid-campaign.

Warmup that runs continuously, not just at launch. Reputation isn't built once. Background warmup between active campaigns keeps your sending history healthy during the quiet gaps.

The setup most teams actually land on

The takeaway

SES being cheap was never the hard part. Ten cents per thousand emails is real, and for founders, agencies, and outbound teams it's a genuinely good deal on paper.

Sort that out first. Then the cheap sending rate finally starts to mean something.

AWS SES Cold Email Tools Compared (2026)

Wed, 22 Jul 2026 06:12:11 +0000

Amazon SES is the cheapest way to send cold email at scale, $0.10 per 1,000 emails, but SES on its own has no campaign builder, no sequences, and no reply tracking. You need a tool on top of it. Here's how the main options actually differ.

Quick comparison

EmailQo connects your own AWS SES account natively. Flat monthly pricing, $19 to $89. Built-in warmup on every plan. Best for founders and small teams who want full control of their own sending infrastructure.

Instantly does not connect your own SES account, it uses managed sending pools instead. Volume and contact-tiered pricing. Built-in warmup. Best for teams that want a fully managed platform and don't want to touch AWS.

Smartlead uses the same managed-pool model as Instantly. Per-seat plus volume pricing. Built-in warmup. Best for agencies running many client accounts through one dashboard.

Mailforge connects your own AWS SES account, but infrastructure only, with no campaign layer. Flat pricing. Built-in warmup. Best for teams that want SES-based infrastructure but plan to use a separate tool for campaigns.

Mailgun and SMTP2Go connect to your own SES setup, but as a raw SMTP relay only, with no campaign or sequence features. Usage-based pricing, no warmup. Best for developers who want raw SMTP delivery, not a campaign tool.

Which cold email tools let you connect your own AWS SES account?

Most well-known cold email platforms, Instantly and Smartlead included, route your campaigns through infrastructure they manage. You don't configure your own AWS account, and your domain's reputation sits alongside other users on the same shared pools. That's a reasonable tradeoff if you want the lowest setup effort, but it means your deliverability partly depends on how well other customers on the platform are behaving.

A smaller group of tools take the opposite approach: you bring your own AWS SES account, and the platform only handles campaign logic, sequences, warmup, and reply detection, on top of it. EmailQo and Mailforge both work this way. The difference between them is scope: Mailforge is infrastructure-only, so you'd still need a separate campaign tool. EmailQo includes the campaign layer, sequences, AI reply classification, pre-send deliverability checks, on top of your own SES connection, so it's the full stack rather than half of it.

Why does the sending infrastructure choice matter for deliverability?

Your sender reputation is tracked by receiving mail servers against the domain and IP you send from. On a shared platform, your reputation exists alongside every other customer using the same pool. If another sender on that pool triggers spam complaints, mailbox providers can associate that behavior with the shared infrastructure, which can affect your inbox placement even if your own sending is clean.

Connecting your own AWS SES account removes that shared-pool variable entirely. Your domain's reputation reflects only your own sending history. The tradeoff is setup: you need to verify a domain, configure SPF, DKIM, and DMARC records, and request SES production access before you can send freely, none of which is required on a fully managed platform like Instantly.

What does Amazon SES actually cost for cold email?

AWS bills $0.10 per 1,000 emails sent through SES, with no monthly minimum and no per-contact fee. Sending 50,000 emails a month costs about $5 in AWS charges. Compare that to Instantly's Hypergrowth plan at $97/month for 100,000 sends, or Smartlead's per-seat pricing, and the gap widens the more volume you send. The catch is that SES pricing only covers the sending itself; whichever campaign tool you use on top (EmailQo, Mailforge, or a self-built solution) is billed separately.

Do I need SES production access before I can send cold email?

Yes. Every new SES account starts in a sandbox that only allows sending to email addresses you've manually verified, capped at 200 messages per day. You request production access from the SES console, describing your use case, expected volume, and how you handle bounces and complaints. AWS typically responds within one to three business days. EmailQo has a full walkthrough of this process, including the exact form fields AWS asks for.

How does EmailQo compare on pre-send deliverability checks?

Before sending a campaign, EmailQo checks SPF, DKIM, and DMARC record validity, scans the message for spam-trigger words, and checks the sending domain against major blacklists, all automatically, before the first email goes out. This runs whether you've connected Gmail, Outlook, Zoho, or Amazon SES. Instantly and Smartlead don't run this kind of check as a built-in step; catching a bad DNS record or a blacklisted domain generally means testing it yourself first.

The honest tradeoffs

Choose a managed platform like Instantly or Smartlead if you want the lowest setup effort and don't want to configure AWS, DNS records, or SMTP credentials yourself, or if you need a built-in lead database, which EmailQo does not offer.

Choose EmailQo if you want your domain reputation fully isolated from other senders, you're already using or open to using Amazon SES, and you want flat pricing that doesn't scale with contact count. EmailQo's plans start at $19/month with a 7-day free trial.

FAQ

Can I use Amazon SES directly for cold email without another tool? Technically yes, but SES has no campaign builder, sequence logic, or reply tracking on its own. Most cold email senders use SES as the delivery layer underneath a separate campaign tool.

Is Amazon SES cheaper than Instantly or Smartlead? The sending cost is cheaper, $0.10 per 1,000 emails versus tiered platform pricing, but you pay separately for whatever campaign tool sits on top of SES.

Which tools connect directly to my own AWS SES account? EmailQo and Mailforge both connect to a user's own SES account. Instantly and Smartlead manage their own sending infrastructure instead.

Does using my own AWS SES account improve deliverability? It removes the shared-pool risk, where another user's bad sending behavior on the same platform can affect your inbox placement. It does not automatically guarantee better deliverability; you still need proper authentication, warmup, and list hygiene.

Last updated July 2026.

Why Your First Cold Email Through Amazon SES Didn't Send

Wed, 15 Jul 2026 11:22:04 +0000

If you just set up Amazon SES to send cold email and your first test message never showed up, you didn't break anything. This happens to almost everyone. It's called the sandbox, and every new SES account starts inside it.

What the sandbox actually is

When you create a new Amazon SES account, AWS doesn't let you send freely right away. You're placed in a sandbox with three rules:

You can only send to email addresses you've manually verified in the SES console. You're capped at 200 messages in a 24 hour period. You can send at most 1 message per second.

For cold email, the verified addresses rule is the one that trips people up. Cold email means reaching people who haven't given you their address ahead of time. But the sandbox only lets you send to addresses you've already added and confirmed yourself. So your first real cold email, to a prospect who never verified anything with AWS, just won't go out. No dramatic error, it simply won't deliver.

Why AWS does this

This isn't AWS being difficult. New accounts with no sending history are the most common source of spam on any email platform. The sandbox is AWS's way of making sure new accounts prove they send legitimate mail with real bounce and complaint handling before they're allowed to send widely. It protects their own sending reputation, which in turn protects everyone using SES.

How to get out of it

You request production access from the SES console. Go to your Account Dashboard, then "Get set up," then "Request production access." AWS asks for a few specific things:

Your mail type, marketing or transactional. For cold email, marketing is usually the right answer. A website URL, so AWS can see that what you're describing matches what your site actually does. Up to four additional contact emails. Your preferred contact language. A checkbox confirming you only send to people who've asked to hear from you, and that you have a process for handling bounces and complaints.

AWS says they typically respond within 24 hours. Sometimes they'll ask a follow up question before approving, which adds time.

One thing worth doing before you even request access: verify a full domain, not just a single email address. AWS calls this out directly as something that helps your request move faster.

What changes once you're approved

The verified recipients restriction goes away, so you can send to anyone. The 200 message and 1 per second caps lift too, though your new limits start modest and rise automatically as you build a clean sending history with low bounces and complaints. You can request a higher limit directly once you need it.

One thing that doesn't change: you still have to verify whatever address or domain you're sending from. Production access removes the restriction on who you can send to, not the requirement to prove you own what you're sending from.

If you want the full walkthrough, from creating the AWS account through your first real campaign, EmailQo has a step by step guide for setting up cold email on Amazon SES.

The Deliverability Black Box: Why Your Warmup Score Says "Healthy" While Your Emails Sit in Spam

Fri, 19 Jun 2026 07:13:14 +0000

If you run outbound for a living, you've lived this exact moment.

Your warmup dashboard shows green. Your sender score looks fine. Whatever platform you're using tells you everything is healthy. Then you check a seed inbox or a friend's Gmail and your email is sitting in the spam folder anyway.

Nobody tells you why. There's no alert. No root cause. Just a healthy looking dashboard and a campaign that quietly failed.

This is one of the most common frustrations among SDRs, founders, and agencies running cold outreach today, regardless of which tool sits behind their sequences. It shows up so often in practitioner communities that it has a name now: the deliverability black box.

Why this keeps happening

It's not that the popular platforms are badly built. Tools like Instantly, Smartlead, Lemlist, and dozens of others have genuinely useful sequencing, warmup, and reporting features, and plenty of teams run them successfully. The issue is structural, not a flaw in any one product.

Warmup and pre-send verification are two different jobs, and most platforms only do one of them well.

Warmup is a slow, background process. It sends low volume engagement emails over weeks to build a sending history with Gmail, Outlook, and other providers. That's genuinely valuable, but it's a lagging indicator. It tells you about your reputation over time. It says nothing about whether the specific email you're about to send right now has a broken DKIM record, a DMARC policy that will reject it, or a subject line that trips a spam filter today.

Those are two separate problems, and conflating them is where the black box comes from. A dashboard showing "warmup: healthy" is answering a different question than "will this exact campaign land in the inbox."

This is true whether you're sending through a dedicated sequencing platform, connecting your own Gmail and Outlook accounts directly, or running campaigns through Amazon SES. The infrastructure changes. The blind spot doesn't, unless something is specifically built to check for it.

The checklist that actually closes the gap

Whatever tool you're using, here's what separates teams who consistently land in the inbox from teams stuck guessing.

Authentication, checked live, not just set once

SPF, DKIM, and DMARC need to be verified before every meaningful send, not just configured once at setup. DNS records change, TTLs expire, and a record that passed verification three months ago can silently break.

A real pre-send scan on content

Spam trigger words, excessive punctuation, image to text ratio, and link count all get scored by enterprise filters before a human ever opens the email. Catching this before sending costs nothing. Catching it after a 2,000 contact send has already gone out costs you the whole list.

Blacklist status checked within 24 hours of sending, not once at setup

A clean domain can land on Spamhaus or Barracuda overnight. Checking once when you configure a sending domain and never again is how teams get blindsided.

Bounce and complaint thresholds tracked per campaign, not just in aggregate

Most platforms show an overall bounce rate. The number that actually predicts trouble is the rate on your most recent campaign specifically. A clean 90-day average can hide a single bad send that's already damaging your reputation right now.

Reply detection that pauses follow-ups instantly

Sending a scheduled follow-up to someone who already replied is one of the fastest ways to generate a spam complaint. If your sequence doesn't pause the moment a reply lands, that's a deliverability risk hiding inside your own automation.

Warmup that runs continuously, not just at launch

Reputation isn't something you build once. Background warmup that continues quietly between active campaigns keeps your sending history positive during the gaps, which matters more than most people realize.

Where the category is heading

The honest pattern across the cold email space right now is that sequencing and infrastructure verification are slowly converging. Some teams run a dedicated warmup or verification layer alongside whatever sequencing tool they already use, specifically because a warmup score alone wasn't giving them the full picture of what was actually happening in the inbox.

That convergence is also what a newer set of deliverability-first tools is built around, treating pre-send verification as the core feature rather than something bolted on after the fact. EmailQo is one example, built around checking a campaign against live DNS, blacklist, and content signals immediately before it sends, on top of your own Gmail, Outlook, or Amazon SES account.

Whatever tool you land on, you don't need to take any dashboard's word for whether your setup is actually working. A few free checks take less than five minutes and tell you more than a warmup score ever will.

Run your domain through a free infrastructure grader to see your SPF, DKIM, DMARC, and MX status scored out of 100.

Check your actual DMARC alignment and confirm whether you're still sitting on monitoring mode without realizing it.

Run a draft subject line and body through a spam score checker before your next send, not after.

None of these require switching tools or signing up for anything. They just answer the one question every dashboard seems to dance around: is this email actually going to reach the inbox, right now, as written.

That's the question worth answering before you hit send, not after your reply rate quietly drops and you start rewriting subject lines that were never the problem in the first place.

Your Emails Are Not Landing in Enterprise Inboxes. Here’s Why (And What to Actually Do About It)

Mon, 15 Jun 2026 08:52:00 +0000

Let’s skip the fluff.

You set up SPF, DKIM, and DMARC. You kept your complaint rate clean. You ran warmup for three weeks. You checked the boxes. And your emails are still showing up in spam for half your prospects.

Welcome to email deliverability in 2026, where the rules changed faster than most people noticed and doing the basics right is no longer enough.

This is not a guide for beginners. This is for people already doing outreach who are watching their inbox placement slowly die and can’t figure out why.

What Actually Changed in the Last 12 Months
Two things happened that broke a lot of sending setups that used to work fine.

Gmail got serious about enforcement.

February 2024 was the warning. Google told senders to get their authentication in order or face consequences. Most people updated their records, ticked the compliance box, and moved on. What they didn’t notice was that in November 2025, Google quietly escalated from soft deferrals to hard rejections. That means your emails don’t just land in spam anymore. They don’t land at all. A 5xx rejection from Gmail is permanent. The message is gone.

The gap between senders who sailed through and senders who got wrecked wasn’t just authentication. It was engagement history. Google’s AI-driven filtering now weighs how recipients have historically interacted with your domain. A clean SPF record means nothing if your last three campaigns generated low opens and zero replies.

Microsoft Outlook became a nightmare.

Outlook’s inbox placement dropped from 77.43% in early 2024 to 50.70% on Exchange and 26.77% on consumer Outlook by Q1 2025. Those are brutal numbers. One in four emails reaching consumer Outlook addresses is landing in junk even from senders with perfect authentication.

Why? Microsoft rolled out Exchange Online Protection updates that added tenant-level admin controls on top of their SmartScreen filter. Every enterprise IT department running Microsoft 365 can configure custom blocklists and content rules. The same email can land in the inbox at one company and get quarantined as “mass messaging” at another, from the same sending IP.

There is no single fix for M365. Every inbox is configured differently. What you can control is how you look going in.

The Thing Most People Still Get Wrong
The most common deliverability mistake in 2026 is treating authentication as a destination rather than a starting point.

You set up DMARC, you move on. But DMARC adoption has jumped massively over the last two years. Domains with valid DMARC records went from 523,000 in 2023 to nearly 938,000 by early 2026. The thing is, only about 412,000 of those records actually enforce anything. More than half are sitting on p=none, which is monitoring mode. You're watching the problem, not stopping it.

Enterprise spam filters know this. A p=none record tells their system you're still figuring it out. A p=quarantine or p=reject tells them you're serious about your domain. It's a trust signal, not just a technical setting.

The other thing people get wrong is thinking shared infrastructure is fine as long as their own campaigns are clean. It’s not.

When you send through a shared IP pool, your deliverability depends partly on what every other sender on that pool is doing. One neighbor with a dirty list or a spammy campaign raises complaint rates for everyone on the same IP range. You absorb that penalty even if your own setup is immaculate. Enterprise filters that query Spamhaus or Barracuda don’t care that you personally followed the rules. They see the IP.

What Enterprise Filters Are Actually Evaluating
Here’s a practical breakdown of how your email gets scored when it hits an enterprise inbox in 2026.

Authentication alignment, not just authentication passing. Your SPF needs to pass on the envelope-from domain, not just on Amazon’s domain. Your DKIM signature needs to be from your domain, not your ESP’s. DMARC alignment fails when those don’t match. This is the most common silent deliverability killer for people using sending tools without proper MAIL FROM configuration.

Sending behavior patterns. Consistent daily sends beat sporadic bursts every time. Microsoft’s filters flag domains that send 500 emails one day and nothing for a week. Enterprise filters learn the normal sending pattern for a domain over time. Deviations read as suspicious activity.

Content against enterprise filter models. Gmail’s consumer filters and Microsoft Defender use different scoring models. Something that passes Gmail’s content check can get quarantined by Defender. There’s no single spam word list you can avoid and be safe. Enterprise filters run ML models trained on behavior and sender history, not just word matching.

Engagement signals from prior sends. Your last 30–90 days of sending behavior with each provider affects how your next campaign gets scored. Low opens, high deletions without reading, and spam clicks build a negative prior that takes months to clear.

Recipient-level signals. Individual Outlook recipients who previously marked your domain as junk will not receive your mail regardless of your domain’s overall reputation. This is invisible to you. You can have a Sender Score of 90 and still hit junk for specific contacts at specific companies.

How to Actually Navigate Enterprise Inboxes
None of this is magic. It’s operational hygiene treated with the same seriousness as conversion rate optimization.

Stop sending before you’ve checked your authentication stack. Not “I set it up six months ago,” but actually run your domain through a live check right now. DMARC records can break silently. A SPF record can accumulate too many DNS lookups over time as you add new sending tools. A DKIM selector can expire or get misconfigured during an account migration. These things fail quietly while your campaign stats show normal bounce rates.

Before your next send, run a free check on your domain’s SPF record, DKIM signature, and DMARC alignment. Tools like EmailQo’s DMARC checker will show you exactly what enterprise filters see when they look up your domain. Not what you think is configured. What’s actually live in DNS right now.

Get off p=none. If your DMARC is still in monitoring mode, move it. The process is: check your aggregate reports for two weeks and confirm all legitimate sending sources are passing. Then move to p=quarantine. Two more weeks of reports confirming nothing legitimate is being caught. Then p=reject. This is a four-week process that most people never finish.

Build sending history on providers you own. If you’re sending cold outreach through shared pools, you’re building reputation on infrastructure you don’t control. When you leave the platform or the platform has a problem, that history is gone. Sending through your own Gmail, Outlook, or AWS SES account means the reputation you build belongs to your domain, not to whoever owns the sending pool.

Treat Outlook differently from Gmail. They use different scoring systems. An email that passes Gmail’s content filter can fail Defender’s ML model. The single most useful thing you can do for Outlook placement is end your outreach emails with a question. Getting a reply is one of the strongest positive signals you can send to Microsoft’s filters. A conversation is happening. That’s what they’re looking for.

Enroll in Microsoft’s SNDS and JMRP. Most people have never done this. SNDS shows you sending data for your IP addresses including spam trap hits and complaint rates as Microsoft sees them. JMRP sends you copies of emails Outlook.com users marked as junk. If you’re not enrolled, you’re flying blind on a provider that controls 25–30% of enterprise inboxes worldwide.

Watch your volume consistency. A domain that sends 40–50 emails per day, consistently, will outperform one that sends 500 on campaign launch day and nothing for the next two weeks. This is not intuition. Enterprise filters build expectation models for domain sending patterns. Consistency is a trust signal.

The Infrastructure Question Nobody Wants to Answer
Here’s the uncomfortable reality of 2026 deliverability.

The B2B SaaS sector sits at 92% median inbox placement. That’s 6 points above the overall average. The difference isn’t better copy or smarter subject lines. It’s structural. B2B SaaS senders tend to use opt-in friction, which means cleaner lists. They tend to run on dedicated or owned infrastructure. And they monitor deliverability as a first-class metric.

Most outreach teams don’t. They watch open rates. By the time open rates drop, the reputation damage is usually 2–4 weeks old.

The metric that tells you the problem is coming is complaint rate. AWS SES enforces a 0.1% complaint threshold. Google publicly flags domains generating elevated complaints. Microsoft’s filters respond faster than either. If your complaint rate is climbing, you have a week or two before it shows up in your inbox placement numbers.

You cannot watch this metric if you don’t have access to it. Most shared sending platforms don’t surface complaint rate per campaign. They show you the aggregate. That’s too late.

Owning your sending infrastructure, even at Gmail or Outlook level, gives you visibility into your own reputation signals. Sending through AWS SES and processing bounce and complaint SNS notifications gives you real-time complaint rate data per campaign. You know something is wrong on day one, not week three.

The Checklist Before Your Next Campaign
Here’s what a technically sound send looks like in 2026:

Authentication: SPF passes on your sending domain (not your ESP’s). DKIM signed with your domain. DMARC at p=quarantine minimum, with rua= set to an inbox you actually read. Run a live check before sending, not once at setup. EmailQo's free email infrastructure grader gives you a 100-point score across all four authentication signals in one place, no signup needed.

Domain health: Your sending domain is not listed on Spamhaus ZEN, Barracuda, or SURBL. Check this within 24 hours of sending, not once at setup. IP and domain reputation can change overnight.

Content: No spam trigger stacking in the subject line. One link maximum in cold outreach. Text-heavy over HTML-heavy. Specific CTA with a yes or no answer, not a vague “let me know your thoughts.”

List quality: Verified within 30 days. Suppression list applied from all previous campaigns. Hard bounces from prior sends excluded. Catch-all domains treated separately.

Volume: Daily send count per account within the established pattern for that account’s age and history. No burst sending.

Post-send monitoring: Bounce and complaint data processed within 24 hours. Hard bounces suppressed globally immediately.

One More Thing
The deliverability gap in 2026 is not closing. It’s widening.

Senders above Sender Score 90 are pulling further ahead every quarter. Senders below a certain threshold are staying there for 18 months or more. Reputation has become durable in both directions.

The teams that are winning inbox placement in enterprise accounts right now are not doing anything exotic. They’re doing the basics consistently and they’re treating deliverability as a metric they check before every campaign, not a problem they fix after something breaks.

That’s the whole game.

Nilesh M has 15+ years in B2B SaaS marketing. He built EmailQo to give senders pre-send deliverability checks on every campaign, free tools to diagnose authentication problems, and sending infrastructure they actually own.