Outbound Deliverability: The Checks That Actually Matter

Outbound deliverability is now a gating factor, not a hygiene task

Last quarter we paused a client's campaign on day four. Reply rate was fine. Open tracking looked fine. But 41% of the sends were going to Microsoft-hosted domains, and Microsoft was silently rejecting a chunk of them at the gateway — not junking them, rejecting them. The client had been "running outbound" for six weeks and about a third of their list had never received anything at all.

That is what outbound deliverability means in 2026. Not a spam-word checklist. A set of infrastructure conditions that decide whether your mail is even accepted.

Direct answer: outbound deliverability is whether your cold email is accepted and placed in the primary inbox by the receiving mailbox provider. The checks that actually matter are domain authentication (SPF, DKIM, DMARC alignment), sending domain separation from your primary domain, list validity and bounce rate, complaint rate under 0.3%, and per-inbox volume discipline. Content and spam words come last, not first.

The three checks that decide most of it

1. Authentication that aligns, not just exists

Almost every founder I talk to says "yes, we've got SPF and DKIM." Then I check and DMARC is missing, or it exists at p=none with no alignment on either SPF or DKIM. That passes a naive test and fails at the gateway.

Microsoft began enforcing SPF, DKIM and DMARC for high-volume senders into outlook.com, hotmail.com and live.com from 5 May 2025, and non-compliant mail is rejected rather than junked (Microsoft Defender for Office 365 blog). Google's sender guidelines run on similar logic for bulk senders (Gmail Help).

Here's what most people get wrong: the thresholds are written for bulk senders at thousands of messages a day, so cold outbound teams assume they're exempt. You are not sending 5,000 a day from one domain. But you are sending from thirty inboxes across six domains with weak alignment, into a filter that scores reputation at the domain and IP level. The threshold is where enforcement starts. It is not where scoring starts.

Check it properly: publish DMARC, confirm SPF or DKIM alignment on the visible From domain, and read the aggregate reports for two weeks before you scale sends.

2. Sending domains that are not your money domain

Never send cold outbound from the domain your invoices and demo confirmations run on. If reputation goes, it takes your booked meetings with it.

We run 30 warmed inboxes across separate lookalike domains for a typical client build. Each one redirects to the main site. Each one is authenticated independently. If one burns, we pull it and the primary domain never notices.

3. Volume per inbox, not volume per campaign

The number that gets teams in trouble is per-mailbox daily send. Founders think in campaign size — "we're doing 3,000 a month" — and then push it through five inboxes because that's what they bought. That's 20 a day per inbox on paper and 60 in practice once follow-ups stack.

Keep sends per mailbox conservative and add inboxes to grow volume. It is the least clever fix on this list and the one that moves the most.

The checks that matter less than the internet says

Spam words. I have tested this repeatedly. "Free", "guarantee" and an exclamation mark are not what is killing a campaign that has broken authentication and a 9% bounce rate.

Open-tracking pixels are a real, small negative — they add a third-party image domain to every message. We turn tracking off on first touch by default and lose almost nothing, because open rate on cold outbound has been a fiction since Apple Mail Privacy Protection.

Link count matters more than link wording. One link, on the second or third touch, is a reasonable rule.

The pre-send checklist we actually run

Before a single campaign goes live on a new build, we clear all of this:

• SPF, DKIM and DMARC published and aligned on every sending domain
• MX and A records resolving; no orphaned subdomain sends
• Domains aged and inboxes warmed for a minimum window before real sends
• Full list verification, with catch-all domains segmented separately rather than blended in
• Bounce rate held under 2% on the first 500 sends, or the list goes back for rework
• A visible way to opt out on every message
• Reply monitoring in place from day one, because a positive reply that sits for two days is a deliverability signal you wasted
• Per-mailbox caps set in the sequencer, not left at the tool's default

None of that is exciting. All of it is the difference between a 6% reply rate on HVAC outreach and a campaign that quietly delivers to nobody.

How to tell if you already have a problem

Three tells, in order of how often I see them.

Your reply rate is fine but your volume-to-reply ratio does not move when you add inboxes. That usually means the new inboxes are not landing.

Your bounce rate is low and your reply rate is near zero. Low bounce plus no replies often means acceptance without placement — you are in spam, not rejected.

Your Microsoft-hosted prospects never respond and your Google-hosted ones do. That split is the loudest signal there is, and it is nearly always authentication.

Run the split before you rewrite the copy. Most teams rewrite the copy.

FAQ

What is a good bounce rate for cold email?

Under 2% on a verified list. Above 5% and you should stop the campaign and re-verify rather than push through — the bounce rate itself becomes a reputation signal.

Do I need DMARC for cold outbound?

Yes. Microsoft requires it for high-volume senders into its consumer domains and rejects mail that fails, and Google's guidelines expect authentication for bulk sending. Publishing DMARC with alignment is table stakes now, not an optimisation.

How many emails per day can I send from one inbox?

Fewer than the tool lets you. Treat per-mailbox daily volume as a hard cap you set deliberately, and grow total volume by adding warmed inboxes rather than raising the cap.

How long should I warm a new domain before sending?

Long enough that you are not the first traffic that domain has ever produced. Age the domain, warm the inbox, and start real sends at a fraction of target volume.

Does email warmup software actually work?

It helps establish a baseline and it is not a substitute for anything else on this list. Warmup with broken authentication is a very expensive way to feel productive.

Should I use a subdomain or a separate domain for outbound?

Separate domain. A subdomain still shares reputation surface with the parent in ways you do not fully control.

Why did my reply rate collapse without any change to the copy?

Almost always infrastructure: a domain hit a complaint threshold, a provider tightened enforcement, or an inbox silently stopped landing. Check placement before you touch the messaging.

Can I fix a burned domain?

Sometimes, slowly. Usually it is cheaper to retire it and stand up a new one properly than to spend two months rehabilitating reputation.

What to do next

Pick your last completed campaign. Split the send list by mailbox provider and compare reply rates between Microsoft-hosted and Google-hosted prospects. If the gap is more than about two to one, you have an authentication problem, not a copy problem.

If you want us to run that split and the full infrastructure audit against your setup, book a GTM audit. We do it before any engagement starts, and we do the same checks on our own builds.

Related reading: How to Audit an Outbound Agency Before You Sign and Why AI SDR Pilots Fail in the First 60 Days. Our engagement models and what's included are on the pricing page.

Sources: Microsoft, Strengthening the Email Ecosystem: Outlook's New Requirements for High-Volume Senders; Google, Email sender guidelines FAQ.