BlogGrowth

Cold Emails Going to Spam? A Founder's Fix List for 2026

In short

If cold email from your company address lands in spam, check four things in order: SPF, DKIM and DMARC (two SPF records make SPF fail), sudden volume jumps, spam reports from a weak list, and links or tracking in the message. Read the headers in Gmail's Show original first. For mail to personal Gmail accounts, Google says to keep the daily spam rate below 0.1%, as of 24 October 2026.

Why are your cold emails going to spam?

When cold email from a real company address lands in spam, check four things in this order: authentication (SPF, DKIM, DMARC), sending pace, spam reports and bounces from your list, and the content itself. Authentication comes first because one test email to a colleague shows whether it passes.

Google's email sender guidelines are the clearest public statement of what Gmail checks, though they are written for mail sent to personal Gmail accounts (more on that in step 3). They say unauthenticated messages may be sent to spam or rejected, that sudden volume spikes can cause rate limiting or reputation drops, and that frequent spam reports make future messages more likely to go to spam. Each step below maps to one of those rules.

One caveat before you change anything. Sometimes the filter itself breaks. On 24 January 2026, Gmail had high failure rates in spam checking for 4 hours and 53 minutes, according to Google's incident report, and a Hacker News thread that day filled with people seeing mail mislabelled. If your placement changes overnight with no change on your side, check the Google Workspace Status Dashboard first.

Step 1: Are SPF, DKIM and DMARC actually passing?

Send a test to a Gmail or Google Workspace address someone else owns, open it, click More, then Show original, and read the Authentication-Results lines. Google's DKIM setup page notes you can't verify DKIM by sending a test message to yourself, so use a colleague or friend.

CheckWhat you want to seeCommon mistake
SPFspf=pass, with one record that starts v=spf1Two or more SPF records on the domain. The SPF standard, RFC 7208, says more than one record produces a "permerror" result
SPF lookupsNo more than 10 DNS-lookup termsAdding include: for every tool you've tried. RFC 7208 caps lookup terms at 10 and returns permerror above that
DKIMDKIM=pass for your own domainNever generating the key. In Google Workspace you create it in the Admin console, and it can take up to 48 hours to start working
DMARCA DMARC record exists, and dmarc=passNo record at all, or a strict policy published before SPF and DKIM work

If you send only through Google Workspace, Google's SPF help page gives the record to copy: v=spf1 include:_spf.google.com ~all. Every other tool that sends as your domain needs its own include: in that same single record, not a second record. For DMARC, Google's DMARC setup page recommends starting with p=none, waiting 48 hours after SPF and DKIM are set up, and moving to quarantine or reject over time.

One r/coldemail thread from May 2026 (about 13 comments when checked on 24 October 2026) shows how this plays out. A freelance motion designer had 12 replies from 180 emails, then everything started landing in spam. The first suspect on the poster's list was four SPF lines on the domain, but fixing them did not get the mail out of spam. Commenters also pointed to skipped warm-up and a link in the first email. That is one person's case, but it is a reason to check DNS before the first send, not after.

Step 2: Are you sending too much, too fast?

A new domain or mailbox that jumps from zero to dozens of cold emails a day looks like a spammer, even with perfect DNS. For senders of large amounts of email, Google's sender guidelines recommend starting with a low volume to engaged users, increasing slowly, sending at a consistent rate and avoiding bursts. They give one concrete warning: "immediately doubling previously sent volumes suddenly could result in rate limiting or reputation drops."

Two practical rules follow from that. Space your sends through the day instead of firing a batch at 9am. And when you raise volume, raise it in small steps and watch replies and bounces before the next step. If messages start bouncing or getting deferred, the same page says to reduce volume until the error rate drops, then increase slowly again.

Our guide to how many cold emails to send per inbox each day compares what the main cold email tools recommend. For the ramp itself, our piece on how long to warm up a new domain gives an eight-week schedule.

Step 3: How much damage does one spam report do?

At founder volumes, a single "Report spam" click is a large share of a day's mail. Google's sender guidelines FAQ says spam rate is calculated daily, and that senders should keep it below 0.1% and never let it reach 0.3%. Here is what one report a day means at different volumes, based on our own arithmetic (1 divided by messages sent):

Emails sent to Gmail users that daySpam rate from one reportCompared with Google's 0.1% target
205%50 times higher
402.5%25 times higher
1500.67%About 7 times higher
1,0000.1%At the limit, not below it

Two limits on reading this table. Google's spam-rate figures are reported in Postmaster Tools for mail to personal Gmail accounts, and the FAQ says the sender guidelines don't apply to messages sent to Google Workspace accounts, which is where many B2B prospects are. So treat the table as a sense of scale, not a rule. The point holds either way: with small lists, you can't dilute complaints with volume, so the only fix is sending to people who will not report you.

That means a tight list. Google's guidelines say not to buy email addresses and note that messages from an address in the recipient's contacts are less likely to be marked as spam. Verify addresses before sending, drop anyone who bounces, and stop at the first "not interested".

Step 4: Is something in the email itself triggering filters?

Content matters less than authentication and reputation, but a few things in the message can push a borderline sender into spam. Google's sender guidelines list several:

  • Links. Google says links should be clearly visible and easy to understand. Google also advises checking that your domain, and any domain linked to yours, isn't listed as unsafe in Google Safe Browsing.
  • Hidden content. Don't use HTML and CSS to hide content; Google says it might cause messages to be marked as spam.
  • Fake replies. Don't start a subject line with Re: or Fwd: unless the message really is a reply or forward.
  • Open rates. Google says it doesn't track open rates and that low open rates aren't necessarily an accurate indicator of spam classification.

The last point matters because open rate is a common spam test: in the May 2026 thread linked below, one commenter said opens under 30% probably mean you are in spam. Google says it doesn't track open rates. Our post on whether open tracking hurts deliverability goes into this.

Practitioners often go further. The author of a January 2025 r/coldemail tips thread (about 32 comments) advised dropping open tracking and sending plain text with no HTML at all. That is one sender's experience, but it is a cheap test: send your first email as plain text with no links and no images, and see if placement improves.

How do you test whether your emails land in spam?

Use more than one method, because each one has a blind spot:

MethodWhat it tells youBlind spot
Send to a separate Gmail account you ownWhether authentication passes (via Show original)Commenters say your own accounts have history with you, so placement can look better than it is
Send to a friend's Gmail, Outlook and Yahoo addressesReal placement at each providerA tiny sample; ask them not to open or reply first
Inbox placement tools with seed accountsPlacement across many providers at onceSeed accounts are not real prospects
Google Postmaster ToolsGoogle's own view of spam rate and reputationOnly covers mail to personal Gmail, and data may be missing when daily volume is low
Replies and bouncesWhether real people see and answer youSlow; takes a week or two of sending

The own-inbox problem comes up again and again. In a May 2026 thread on checking placement (about 24 comments), one commenter wrote: "Sending to your own Gmails is a bad metric because those accounts already have 'interaction history' with you." Several others recommended seed-inbox tests such as GlockApps or Mail-Tester instead, and one suggested comparing several tests rather than trusting a single score.

Postmaster Tools is free, but its help page says data might be missing if the total number of messages for a day is too low. At 30 cold emails a day, mostly to company domains, expect little or no data.

A spam fix list for this week

  1. Read your own headers

    Send a test to someone else's Gmail and check spf=pass, DKIM=pass and dmarc=pass in Show original. Fix any fail before sending another cold email.

    10 minutes
  2. Merge duplicate SPF records

    Look up your domain's TXT records. If more than one starts with v=spf1, merge them into one and count the include: terms.

    15 minutes
  3. Pause, then restart slowly

    If you are already in spam, stop cold sends for a few days, then restart at a lower daily number spread across the day.

    This week
  4. Strip the first email

    Plain text, no images, no tracking, at most one link. Save the deck or reel for people who reply. Our cold email templates are written this way.

    20 minutes
  5. Clean the list

    Verify every address, remove anyone who bounced, and cut anyone you can't explain a reason to email.

    An hour

If your company domain is already damaged, our guide to cold email from your main domain or a secondary one covers whether to move. For a tool that spaces sends out, Siela's AI SDR sends from your own Gmail mailbox, up to 150 emails a day per mailbox and 2 to 5 minutes apart, and only emails addresses it has verified as deliverable.

Frequently asked questions

Why do my cold emails go to spam even with SPF and DKIM set up?

Passing authentication is only the first check. Gmail also weighs sending pace, spam reports and the content of the message. Google's sender guidelines warn that sudden volume spikes can cause rate limiting or reputation drops, and that frequent spam reports make future messages more likely to land in spam. Check for duplicate SPF records too: more than one SPF record makes SPF fail.

Can I have two SPF records on one domain?

No. The SPF standard, RFC 7208, says that if a domain publishes more than one SPF record, the check returns a permerror result, which means SPF fails. Merge every sender into one record that starts with v=spf1, with an include: for each service. The same standard caps DNS-lookup terms such as include at 10.

Does Postmaster Tools work for small cold email senders?

Often not. Google's Postmaster Tools help page says data might be missing when a domain's daily message volume is too low, and its data only covers messages sent to personal Gmail accounts. A founder sending a few dozen cold emails a day, mostly to company domains, may see empty dashboards. Use header checks, seed tests and reply rates instead.

What spam complaint rate does Gmail allow?

Google's sender guidelines FAQ says spam rate is calculated daily and that senders should keep it below 0.1% and never let it reach 0.3%. At small volumes a single report moves the number a lot: one report on a day you send 40 emails to Gmail users is 2.5%, so list quality matters more than volume.

Is a low open rate a sign my emails are in spam?

Not reliably. Google's sender guidelines say Google doesn't track open rates, can't verify open rates reported by third parties, and that low open rates aren't necessarily an accurate indicator of spam classification. Check authentication headers and run a placement test with real inboxes at several providers before drawing conclusions from opens.

Sources

  1. Gmail Help: Email sender guidelines (checked 24 Oct 2026)
  2. Gmail Help: Email sender guidelines FAQ (checked 24 Oct 2026)
  3. Google Workspace Admin Help: Set up SPF (checked 24 Oct 2026)
  4. Google Workspace Admin Help: Set up DKIM (checked 24 Oct 2026)
  5. Google Workspace Admin Help: Set up DMARC (checked 24 Oct 2026)
  6. IETF RFC 7208: Sender Policy Framework (SPF) (April 2014)
  7. Gmail Help: Postmaster Tools (checked 24 Oct 2026)
  8. Google Workspace Status Dashboard: Gmail incident, 24 January 2026 (incident report 6 Feb 2026)
  9. Hacker News: Ask HN: Gmail spam filtering suddenly marking everything as spam? (24 Jan 2026)
  10. r/coldemail: My tips to avoid spam folder while sending cold emails (Jan 2025, checked 24 Oct 2026)
  11. r/coldemail: How to know if my cold emails from Gmail are going to spam? (May 2026, checked 24 Oct 2026)
  12. r/coldemail: Sent 180 emails, got 12 replies, 0 gigs, and now I'm stuck in the spam folder (May 2026, checked 24 Oct 2026)
  13. Siela AI SDR (checked 24 Oct 2026)
Danish Khan

Danish Khan

CEO & Founder, Siela

Danish Khan is the CEO and founder of Siela AI, which gives small teams AI marketing agents that find high-intent leads, reach out on LinkedIn, X and email, and run their social.

Connect on LinkedIn

Published