Every cold email tool tells you to set up SPF, DKIM, and DMARC. That's necessary, but it's the entry fee, not the strategy — plenty of fully-authenticated domains still land in spam. Deliverability is a reputation problem, and reputation is built (or destroyed) by everything that happens after authentication passes.

Start with authentication, but don't stop there

SPF tells receiving servers which servers are allowed to send on your domain's behalf. DKIM signs each message cryptographically so it can't be tampered with in transit. DMARC tells receivers what to do when a message fails either check, and — just as importantly — gives you a reporting address (the rua tag) so you can see when someone else is trying to spoof your domain.

• Add the TXT record for SPF and the CNAME records for DKIM at your DNS registrar — most cold email platforms generate the exact records for you.
• Set DMARC to p=quarantine (not p=none) once SPF/DKIM are confirmed working — p=none collects data but does nothing to protect you.
• Add a rua= reporting address so you actually see DMARC aggregate reports instead of authentication silently failing somewhere.
• Give DNS changes up to 48 hours to propagate before assuming something's broken.

Warm up before you scale up

A brand-new domain sending 500 emails on day one looks exactly like a spam operation to a receiving mail server, regardless of how well-authenticated it is. Mailbox providers build a sending reputation for your domain and IP over time, based on engagement — opens, replies, and crucially, how often people mark you as spam or simply never open a thing.

Keep bounce rate near zero

Bounce rate is the single fastest way to torch a domain's reputation. A hard bounce (invalid address) tells receiving servers you're sending to lists you haven't verified — and receiving servers respond by trusting everything else from that domain less.

• Verify email addresses before a first send, not after — catching bad addresses at import time is far cheaper than a bounce.
• Require both email and first name on import; incomplete rows are usually scraped, low-quality data.
• Watch bounce rate per campaign, not just in aggregate — one bad list can quietly damage a domain that's otherwise healthy.

Write for people, not spam filters — but know the trigger words anyway

Modern spam filtering is mostly a machine-learning classifier trained on how recipients actually behave (opens, replies, deletes-without-reading), not a keyword blocklist. That said, some patterns still correlate strongly with spam and are worth avoiding on principle: ALL CAPS SUBJECT LINES, excessive exclamation points, a wall of tracked links, or an email that's entirely one large image (common in template-heavy marketing tools, rare — and safer — in plain-text cold outreach).

Personalization matters here too, and not cosmetically. A message that only swaps in {{firstName}} reads as a template to both the recipient and, increasingly, to the filters trained on recipient behavior. A short paragraph that references something real and specific about the recipient's company gets opened, read, and replied to — and every one of those signals compounds into better deliverability for the next send.

Monitor domain reputation directly

Don't wait for open rates to tell you something's wrong — by then it's already happened. Google Postmaster Tools gives you a direct reputation signal for any domain sending meaningful volume to Gmail addresses, including spam-rate data most other reporting can't see. It's free, and if your outreach touches Gmail recipients at all (it does), it's worth connecting on day one, not after a domain gets throttled.

The throughline across all of this: deliverability isn't a setup task you finish once. It's an ongoing property of how a domain is used — ramped gradually, kept clean of bad addresses, sent from real personalized content, and watched continuously. Get the mechanics right once and keep the habits going, and the inbox stays the default outcome instead of the exception.