Cold email, start to finish

What cold email is, and what it isn’t

A cold email is a message to someone who doesn’t know you yet, sent because you have a specific reason to think what you do is relevant to their job. It is one-to-one in tone even when you send many of them: a named sender, a real reply-to address, plain text, and a question a person can answer in a line.

It is not a newsletter sent to people who never subscribed, and it is not a numbers game played with bought lists. Mailbox providers judge you by how recipients react. If people ignore, delete or report your emails, your messages go to spam for everyone, including the people who would have said yes. So the practical rules and the ethical ones point the same way: email fewer, better-chosen people, and make it easy to say no.

Is cold email legal?

In most places, yes, if you follow the rules for that place. The rules differ a lot. The US CAN-SPAM Act allows unsolicited commercial email if it is honest, identifies you, includes a postal address and honours opt-outs. Canada’s CASL needs consent first, though consent can be implied when someone publishes their business address without saying they don’t want messages and your email relates to their role. In the EU, GDPR and national ePrivacy laws apply, and countries differ: Germany requires prior express consent for email advertising, including to businesses. The UK’s PECR and UK GDPR treat companies differently from sole traders, and Australia’s Spam Act needs consent, which can be inferred from a conspicuously published work address.

Read the cold email laws overview before your first campaign to a new country. It is general information, not legal advice.

Before you send: the setup

Use a sending domain you can afford to experiment with

Many teams send cold email from a second domain (for example getacme.com next to acme.com), so a mistake with cold outreach doesn’t touch the reputation of the domain their invoices and support emails come from. Whatever you choose, the domain should have a real website, and the sender should be a real person who reads the replies.

Authenticate the domain

Gmail requires every sender to set up SPF or DKIM, and senders of more than 5,000 messages a day to Gmail accounts to set up SPF, DKIM and DMARC (Google). Yahoo’s rules are similar (Yahoo), and Outlook.com has rejected mail from high-volume domains that fail these checks since 5 May 2025 (Microsoft). Set all three up even at low volume. The deliverability guide explains each one, and the free domain checker looks up your SPF, DKIM, DMARC and MX records and explains how to fix what’s wrong.

Warm up new mailboxes

A mailbox that has never sent mail and suddenly sends a hundred cold emails a day looks like a compromised account. Warmup builds a sending history gradually. In Inboxed it is free for every mailbox: each connected mailbox starts at 2 warmup emails a day and adds 2 a day up to 40, and its health score shows the share of warmup emails that reached the inbox over the last 14 days (how warmup works).

Build a list worth emailing

The list decides most of the outcome. A great email to the wrong person is still spam to them.

• Start from a reason, not a database. Write down why a company would need you now: they are hiring for a role you support, they use a tool you integrate with, they just opened an office in your region. Then find companies that match.
• Find the right person. The person who owns the problem, not the most senior name you can find. If you aren’t sure, ask: “Is this something you look after?” is a perfectly good cold email.
• Avoid bought lists. Addresses on them were usually never given for this purpose, many are old, and some are spam traps. Several laws also make you responsible for consent on every address you use.
• Prefer named business addresses to generic ones like info@ for outreach. Role addresses reach shared inboxes where a complaint is more likely; Inboxed flags them.
• Verify every address. Sending to addresses that don’t exist produces hard bounces, and a high bounce rate is one of the fastest ways to lose reputation. See email verification and catch-all domains.

In Inboxed, every lead you add to a campaign is verified for free: format, known disposable domains, role addresses, common typos and a live MX lookup. Addresses that fail are removed before the campaign is priced, so you never pay for them. Confirming that an individual mailbox exists and scoring catch-all domains needs a verification provider connected with your own account. You can also check a list with the free email verifier.

Write the email

Keep it short, plain and about them. A good structure is: why you’re writing to this person, the one thing you can do for them, and an easy question. Avoid images, attachments, heavy formatting and more than one link in a first email. The full method, with examples, is in how to write a cold email. You can also start from a template and check your copy with the spam word checker and the subject line tester.

Plan the follow-ups

Most people don’t answer the first email because they are busy, not because they said no. A short sequence of two to four emails, each adding something new and spaced a few days apart, is normal and polite. Stop the moment someone replies, bounces or unsubscribes. The follow-up guide covers timing, threading, the last email and what to do with “try me next quarter”.

Sending: volume, pacing and rotation

Send like a person. That means a modest number of emails per mailbox per day, during working hours in the recipient’s time zone, with gaps between them. If you need more volume, add mailboxes rather than pushing one mailbox harder, and spread sends across them (inbox rotation).

Inboxed does this by default. A new mailbox has a daily limit of 30 emails, which you can change. Campaigns send inside your sending hours, in each lead’s local time when it’s known, with a random gap of 60 to 180 seconds between one mailbox’s emails, rotating across the mailboxes you pick. Warmup keeps running alongside and doesn’t count toward the limit. New workspaces can send up to 300 emails a day until we’ve reviewed them.

Handle replies quickly and honestly

A reply is the point of the whole exercise, so treat it like an inbound lead. Answer interested replies the same day if you can. Answer “not interested” politely and stop. If someone asks how you got their address, tell them. If they ask you to delete their data, do it.

Inboxed collects replies from every mailbox in one team inbox, where you can assign them, comment and approve drafts. Replies stop that lead’s sequence, and by default stop the rest of their company’s sequences in the same campaign too. Out-of-office replies pause the lead until they’re back. A reply that asks to be removed (“unsubscribe”, “remove me”, “stop emailing”) adds the address to your suppression list automatically.

Measure what matters

Replies, and positive replies in particular, are the only numbers that reliably tell you whether a campaign works. Open tracking has become unreliable: Apple’s Mail Privacy Protection downloads remote content privately in the background when a message is received (Apple), so a tracked “open” may not be a person, and corporate security scanners open and click links automatically. Tracking also adds an image and rewritten links, which makes a plain email look more like a marketing email.

That’s why open and click tracking are off by default in Inboxed. If you turn them on, use a custom tracking domain and read opens as a rough signal: Inboxed counts machine opens (Apple’s prefetching, link scanners) separately from human ones.

Watch three health numbers per campaign and per mailbox: bounce rate, spam complaint rate and reply rate. Google asks senders to keep the spam rate reported in Postmaster Tools below 0.1% and never to reach 0.3% (Google).

Stay compliant and respected

Every cold email should tell people who you are, where you are and how to stop hearing from you, and you must honour that request. Inboxed adds a footer with your company name and postal address to every campaign email and blocks launch until you’ve entered them. Every email carries a visible unsubscribe link and the one-click unsubscribe headers. Unsubscribes, bounces and spam complaints go on the workspace’s suppression list, which every campaign checks before sending; you can also block whole companies by domain. For GDPR erasure requests, Erase a person in Settings → Compliance removes what the workspace holds about an address and keeps a one-way hash so it can’t be emailed again.

What stays with you: choosing who to email, having a lawful basis for it where you send, being honest in the subject and body, and answering requests from the people you contact. The laws pages split this out for each country.

A launch checklist

1. SPF, DKIM and DMARC pass for the sending domain (check it).
2. Each mailbox has been warming up, and its health score looks good.
3. The list is built from a clear reason to contact each company, with no bought addresses.
4. Every address is verified, and you’ve decided what to do with catch-all and risky results.
5. The first email is short, plain text, has one clear question and no attachments.
6. Follow-ups add something new and stop on reply.
7. Your company name, postal address and unsubscribe line are in the footer.
8. Daily limits and sending hours are set, and volume is spread over enough mailboxes.
9. You know which law applies to the countries you’re emailing, and what it requires.
10. Someone owns the replies and will answer them quickly.

Common questions

Try it with Inboxed

Warmup, verification and the team inbox are free. Start free; you pay $1 per 1,000 emails that send, from a prepaid wallet, with no subscription. How pricing works.