Practical Cold Email Template That Bypasses Spam Filters Today

You do not have a copy problem. You have a pipeline problem. You can write the perfect subject line and still land in spam because your SPF record exceeds ten DNS lookups, or because your DMARC policy is set to p=none and reports compliance while enforcing nothing. The template below works, but only if you deploy it on infrastructure that can carry the load. Use the template first, then fix the architecture that delivers it.

The Template: Copy-Paste Structure

This is a plain text template designed to avoid content-based spam triggers. It contains no promotional language, no excessive punctuation, no HTML images, and no fabricated Re: or Fwd: prefixes. Fill in the bracketed fields and remove the brackets before sending.

Subject: [Specific observation about their company] - [Your Company]

Body:

Hi [First Name],

[Context sentence referencing a specific recent event: their Series B announcement, a new hire you saw on LinkedIn, or a product launch they posted about last week].

[Specific insight: Most [their industry] companies are cutting [initiative X] right now, but your [specific detail about their approach] suggests you're doubling down on it instead.

Quick question: Are you currently prioritizing [outcome A] over [outcome B] for Q3?

Worth a brief conversation to compare notes?

[Your First Name]
[Your Company]
[Phone number, optional]

Why this structure works: The subject line signals relevance without promising value you cannot prove in six words. The opening line demonstrates you are not using a scraped list by citing a time-sensitive event. The question is binary and low friction, not a request for a meeting. The signature is minimal, avoiding image-heavy footers that trigger image-based filtering and increase file size.

Authentication Does Not Buy Placement

Passing SPF, DKIM, and DMARC checks is necessary and not sufficient. These protocols prove identity. They do not prove reputation or engagement, and they do not guarantee inbox placement. This distinction breaks most campaigns.

A message can authenticate perfectly and still be filtered on reputation grounds, because the receiver answers identity and placement as separate questions. DMARC is particularly deceptive. It is a policy record, not a reputation score. A domain publishing p=none instructs the receiver to enforce nothing, so the domain reports itself as DMARC compliant while protecting exactly zero messages from spoofing or filtering. The operator checks their records, sees three green results, and concludes deliverability is handled. Placement continues to degrade because nothing they checked was measuring placement.

Treat authentication as a prerequisite to fix once, then measure placement separately. Gmail and Outlook use different reputation signals that authentication cannot touch.

The SPF Lookup Limit That Kills Campaigns

SPF permits at most ten DNS lookups when it is evaluated. Exceeding this limit fails the check for every message from that domain simultaneously. This is a hard limit defined in RFC 7208, not a suggestion.

Each service that sends on a domain's behalf is added with an include mechanism, and each include costs lookups, some of them several. The failure is invisible to anyone reading the record casually because the limit is consumed by nested includes rather than by the entries themselves. You add a new outreach tool to your stack, your SPF record now requires twelve lookups to resolve, and every message from that domain returns permerror instead of pass. Authentication that used to pass begins failing after a new tool is added, with nothing about the message itself having changed.

To recover, count the lookups your record actually performs, including nested ones. Flatten includes or consolidate vendors until you fit inside the limit. This is not optional maintenance. It is a hard ceiling that stops campaigns cold.

Volume Architecture: A Worked Example

Suppose you run an agency managing cold email for forty client domains. You ramp each domain to send thirty thousand messages per month. At week three, inbox placement collapses across half your accounts.

The failure mode is usually one of three architectural gaps. First, you are sending from a single mailbox per domain, hitting volume thresholds that trigger rate limiting regardless of your template quality. Second, you added a verification tool, a warm-up service, and a sending platform to your stack, exceeding the SPF lookup limit on twenty of those domains. Third, your sending tool meters volume by tier, so you throttle sends to avoid overage charges, which creates irregular sending patterns that reputation systems read as bot behavior.

The fix requires automatic inbox rotation across multiple mailboxes per domain, SPF flattening before you scale, and unlimited sending volume that does not punish you for consistent daily sending patterns. Volume consistency matters more than total volume for reputation building.

Syntax That Passes Content Filters

Even with perfect infrastructure, certain phrases trigger statistical classifiers. Avoid words that signal commercial solicitation or urgency manipulation. Do not use free, guarantee, act now, limited time, or no obligation. Do not use excessive punctuation such as multiple exclamation points or all capital letters.

Keep the template under one hundred twenty five words. Long messages increase the statistical probability of triggering content filters and reduce the likelihood of a complete read. Use sentence case throughout. Avoid HTML formatting when possible; plain text signals personal communication rather than marketing broadcast. If you must use HTML, keep the code-to-text ratio above eighty percent text.

Never use Re: or Fwd: in a subject line unless you are actually replying to or forwarding a message. Misleading headers violate CAN-SPAM and are weighted heavily by modern Bayesian filters.

Deployment Phases

Sending Infrastructure That Supports the Template

SpamCipher is the cold email platform for unlimited, automated, high-volume sending, built for agencies and growth teams. It is not a deliverability point tool. It is a sending engine that owns its entire deliverability pipeline, including the 90%+ inbox placement SpamCipher stands behind.

The platform handles the architectural requirements this template needs to function. Automatic inbox rotation distributes sends across mailboxes so you do not hit rate limits. Built-in warm-up runs on a real seed network before you send to prospects. Email verification and list cleaning happen inside the send flow, not as a bolt-on export. DMARC and blacklist monitoring run on the same platform as the sending automation, so you see infrastructure decay before it kills placement.

You can bring your own sending infrastructure or let SpamCipher build and manage it. Either way, the template above works because the pipeline beneath it is designed for volume, not capped by metered tiers or per-mailbox add-ons that force you to throttle sends and train reputation systems to distrust your patterns.

Monitoring and Recovery Signals

Watch for sudden shifts in delivery patterns rather than waiting for reply rates to crater. If your seed test inbox placement drops below eighty five percent, pause the campaign and check your DNS records first. A blacklist addition or SPF permerror manifests as a sudden cliff, not a gradual decline.

If placement degrades gradually, examine your sending frequency. Irregular spikes look like bot behavior to machine learning classifiers. Maintain consistent daily volume within twenty percent of your rolling seven day average. If you must scale fast, add mailboxes rather than increasing per-mailbox volume.

Recovery requires identifying whether you have a reputation problem or an authentication problem. Reputation problems fix themselves over two to four weeks of reduced volume and high engagement. Authentication problems fix immediately when you correct the DNS record, but they require propagation time.

Frequently asked questions