Why Cold Email Goes to Spam, Ranked by What We Actually Found

Most advice about cold email landing in spam starts with the words in your message. That is the wrong end of the problem. Mailbox providers decide where your mail goes mostly before they read a single sentence, based on whether they can prove who sent it and whether your domain has a history worth trusting. To see how often that first check fails, we scanned the live DNS of 262 real founder and e-commerce sending domains on July 27, 2026. The results explain a lot of spam-foldered cold email.

What the receiver checks before it reads a word

When a message arrives, Gmail, Outlook, and Yahoo run three fast authentication checks: SPF confirms the sending server is allowed to send for your domain, DKIM confirms the message was signed by your domain and not altered, and DMARC ties those two to the address your recipient actually sees. If those checks are missing or misaligned, the provider has no way to distinguish you from someone spoofing you, so it leans toward the spam folder and stays there until you give it a reason not to.

The uncomfortable part is how often the checks simply are not set up. Across the 262 domains we scanned, the average infrastructure score was 40 out of 100. These are people actively sending cold email, and more than half were missing the basics that decide their fate before content ever matters.

The single most common gap: no DKIM

64.9 percent of the 262 domains we scanned had no detectable DKIM key. That is the biggest hole we found, and it is the one senders overlook most, because a domain can send mail that looks fine to the human eye without ever signing it.

DKIM matters more than SPF for cold email because it survives forwarding and it is the signature DMARC prefers to align against. Without it, you are asking a provider to trust unsigned mail from a domain it has no relationship with. Setting it up is a single DNS TXT record from your sending platform. If you fix one thing after reading this, fix this one.

DMARC that is present but toothless

37.4 percent of the domains had no DMARC record at all. That number is bad enough, but the more revealing figure is what the rest had published. Of the domains that did have DMARC, 62.8 percent were still on p=none, a policy that monitors but instructs the receiver to do nothing. Only 23.3 percent of all the domains we scanned enforced DMARC with p=quarantine or p=reject.

A p=none record is easy to mistake for being done. It is not. It tells receivers you are watching, not that you are vouching. Providers treat an enforced policy as a stronger trust signal, and getting to enforcement is the difference between a domain that looks configured and one that looks committed. The path is to publish p=none, read the aggregate reports until you can see every legitimate source, then move to quarantine and finally reject.

A history you did not know you had: blocklists

55.3 percent of the 262 domains were listed on at least one DNS blocklist at scan time. More than half. A blocklist listing is a reputation problem rather than a configuration one, and it is often the reason a perfectly authenticated message still lands in spam. Listings come from a shared IP that a neighbor abused, a spam trap that ended up on your list, a sudden spike in volume from a cold domain, or complaints from recipients who never asked to hear from you.

The fix depends on the cause. If your domain or its sending IP is listed, you request delisting from the specific blocklist and then remove the behavior that caused it, because a re-list after delisting is far harder to clear. If you are on a shared IP with bad neighbors, you move to sending infrastructure where your reputation is your own.

SPF, and the myth that gets too much attention

SPF was the healthiest of the three checks in our data. Only 13.4 percent of the domains had no SPF record, and notably, none of the domains that did have SPF exceeded the 10-lookup limit that breaks Gmail evaluation. That last point is worth stating plainly, because the SPF 10-lookup problem gets written about constantly. In a population of small senders it was a non-issue. It becomes a real risk once you stack several email platforms onto one domain, but it is not what is sending most cold email to spam. DKIM and DMARC are.

Authentication is necessary, not sufficient

Passing all three checks gets you considered. It does not get you delivered. Once your identity is provable, providers watch how you behave: whether you ramp volume gradually on a new domain or blast from cold, whether recipients open and reply or mark you as spam, and whether the addresses you send to actually exist. A new domain that sends 500 cold emails on day one looks exactly like the thing spam filters are built to stop, no matter how clean its DNS is.

This is why warm-up and list hygiene sit alongside authentication rather than after it. Warm-up builds the sending history that a cold domain lacks. Verifying your list before you send removes the invalid addresses that generate the bounces and trap hits that get domains listed in the first place.

The order to fix things in

Based on how often each gap showed up and how much it costs you, this is the sequence that moves the needle fastest:

• Publish DKIM. It was missing on nearly two thirds of domains and it is a single record. Start here.
• Publish DMARC and get off p=none. Read your aggregate reports, confirm every real source aligns, then move to quarantine and reject.
• Confirm SPF exists and stays under 10 lookups. Simple for most senders, worth a check if you run several platforms.
• Check your domain and IP against blocklists. More than half of the domains we scanned were listed. If yours is, delist and fix the cause before you send more.
• Warm the domain and verify the list before you scale volume, so your provable identity is backed by trustworthy behavior.

How SpamCipher handles this

SpamCipher is the cold email platform for unlimited, automated sending. It runs the same authentication and blocklist checks you just read about against your own domain, then walks you through fixing each gap in the order above. It warms your sending domains on real inboxes, verifies your list before send, and monitors your DMARC reports and blocklist status so a new listing is something you catch in a day rather than discover from a dead campaign. You can run the free check on your domain in under a minute and see exactly which of these gaps applies to you.

Frequently asked questions