Cold email

How cold email works

Cold email is the written version of a cold call. The sender has no prior relationship with the recipient, and the recipient did not ask to hear from the sender. It is the most common channel in outbound sales, because it is cheap per message and lets a rep reach many accounts without a phone call.

A working cold email program has four parts.

• A target list. Accounts that match the ideal customer profile, with the right people at each one.
• Verified addresses. Every address is checked before it reaches a sequencer, which keeps the bounce rate low.
• A sending setup. Authenticated domains, sensible daily volumes and a working unsubscribe.
• A message. A few sentences that explain why this person, why now and what the next step is.

The sender has to meet two sets of rules at once. The first is the law where recipients live. In the United States, Section 7704 of Title 15 of the US Code requires commercial email to clearly identify itself as an advertisement or solicitation, give notice of the chance to opt out and include a valid physical postal address 1. It also prohibits subject headings likely to mislead the recipient about the content 1. Other countries set their own rules, and some are stricter about contacting people without consent.

The second set is the mailbox providers' rules. Google and Yahoo both publish sender requirements, and messages that fail them land in spam or get rejected 2. Those rules focus on authentication, spam complaints and unsubscribes.

Cold email and spam differ mostly in execution. A relevant message to a verified work address with a clear opt-out reads as prospecting. A generic message blasted to a bought list reads as spam, to recipients and to filters alike.

The rules that decide delivery

A lot of cold email fails before anyone reads it, because the message bounces, lands in spam or gets reported. Each of those outcomes feeds back into the sender's domain reputation.

Authentication comes first. Google requires everyone sending to Gmail accounts to set up SPF or DKIM, have valid forward and reverse DNS for sending servers and use a secure connection 2. Senders of more than 5,000 messages a day to Gmail must set up SPF, DKIM and DMARC together and align the From domain 2. Yahoo's requirements for bulk senders are similar, with DMARC at a policy of at least none 3.

Complaints come second. Google asks senders to keep the spam rate below 0.3% 2. Yahoo sets the same 0.3% ceiling 3. A single campaign to a poorly targeted list can push a domain past that line.

Unsubscribes come third. US law requires that an opt-out request be honored within 10 business days and that the opt-out mechanism keep working for at least 30 days after the message is sent 1. Yahoo asks for unsubscribes to be processed within 2 days and supports one-click unsubscribe for marketing messages 3.

Bad addresses do damage too. Sending to mailboxes that do not exist raises the bounce rate, and a catch-all email domain can accept a message even when no such person exists. Yahoo explicitly advises against purchasing mailing lists 3. Verification before the send is the cheapest control a team has, because it removes bad addresses before they ever cost reputation.

Example of a cold email workflow

A RevOps lead runs enrichment overnight and pushes new contacts into a sequencer each morning. The rule is that no row reaches the sequencer without a verification verdict, a gate described in RichAPI's verify-before-push playbook 4.

Nightly gate before the sequencer
  enriched rows             verification_status = null
  email_verifier per row    write back the verdict
  route on verdict
    valid       -> push to sequencer
    invalid     -> mark the address dead, never push
    catch-all   -> hold for a policy decision
    no verdict  -> requeue for a later run
  push step selects verdict = valid only

The playbook calls one bug the most common version of this failure. A push job that excludes invalid rows instead of selecting valid ones also pushes every row that was never verified 4. Selecting for the positive verdict closes that gap 4.

Budgeting follows the billing rules. email_verifier costs 2 credits per call, and a verdict of invalid or catch-all is a real answer that bills at the full rate 4. The team plans as though nearly every verification call bills.

Catch-all rows need a policy decision. The playbook describes teams that send at low volume from a secondary domain, teams that switch to another channel and teams that drop the row 4. RichAPI has no sending product, so authentication, warmup and volume stay with the team's own email setup 4.

The gate changes what the sequencer sees. Every row it receives carries a verdict and the date of that verdict, so the team can trace any bounce back to the run that approved the address. Old verdicts are treated as history rather than permission, and contacts are verified again before a campaign reuses an old list 4.

Cold email vs spam

Both are unsolicited, and filters judge them by the same signals. The difference shows in who receives the message, what it says and how the sender handles bounces and opt-outs.