Choosing a cold email agency without buying a spam problem

The most important question to ask a cold email agency is not about results. It is: whose domain does the mail leave from? If the answer is your primary company domain, the downside of a bad campaign is not a wasted retainer — it is the deliverability of your invoices, your support replies and your password resets. Everything else on this page is secondary to that.

Good outbound agencies exist, and for a team without the time to build a sending operation they are a reasonable buy. The variance between the good and the bad is unusually wide, and it is almost entirely predictable from the answers below.

Ask these before you discuss price

Sending identity

• Which domains will you send from, and who registers them? Separate outreach domains, registered in your account, is the correct answer.
• Who holds the registrar and DNS access? You should, with them delegated access you can revoke.
• Will DKIM be signed with my domain in the d= tag?
• How many mailboxes, and what daily volume per mailbox? A number far below the theoretical cap is a sign they know what they are doing.
• What is the warm-up plan before live sending starts, and how long does it run?

List sourcing and law

• Where do contacts come from? "Purchased list" or "scraped" should end the conversation.
• How are addresses verified before sending, and what bounce rate do you target?
• For EU and UK contacts, what is the lawful basis under GDPR, and do you have a documented legitimate-interest assessment? Who is controller and who is processor, and is there a data processing agreement?
• How do you handle opt-outs, objections and deletion requests, and how fast?
• What physical postal address appears in the mail, and is there a clear opt-out in every message? Both are CAN-SPAM requirements.
• At bulk volumes, do messages carry List-Unsubscribe with an HTTPS URL and a mailto, plus List-Unsubscribe-Post: List-Unsubscribe=One-Click?

Measurement

• Do you report inbox placement per provider, or only sends, opens and "delivered"? Delivered means a receiving server returned a 250; it says nothing about which folder.
• Do you report bounce rate and spam complaint rate per sending domain, and what thresholds trigger you to pause?
• Do you track open rates, and do you know that Apple Mail Privacy Protection and corporate proxies inflate them?

Exit

• When we stop, what do we keep? Domains, mailboxes, warm-up history, the contact database, the reply threads, the sequences.
• Is there a notice period, and does the data come out in a standard format?

Engagement models and what they do to your sending

A guarantee is not a quality signal. It is a commitment to hit a number, and the cheapest way to hit a number in outbound is more addresses.

Red flags

• Guaranteed meetings or a guaranteed reply rate. Nobody can guarantee a stranger's behaviour.
• No mention of warm-up, or a claim that their mailboxes are already warmed. Reputation belongs to a sending identity engaging with real recipients; a mailbox warmed before you owned it has no useful history, and one that already sent cold mail for another client has the wrong kind.
• Reporting that stops at opens. Open rate has been unreliable since image pre-fetching became normal. If opens are the headline metric, they are not measuring deliverability.
• Willingness to send from your main domain. This is the single clearest competence signal.
• Vague list sourcing. "Our proprietary database" with no provenance usually means purchased data, which is both a GDPR problem and a bounce-rate problem.
• Volume as the growth plan. If the proposal for month three is "double the mailboxes", the plan is not working in month one.
• No pause threshold. Ask what spam complaint rate makes them stop. Google asks bulk senders to stay under 0.3%; an agency that cannot name a number is not watching one.

Set up the engagement so it cannot hurt you

1. Register outreach domains yourself, in your own registrar account, on names clearly related to your brand but distinct from your primary domain.
2. Keep DNS control. Publish SPF, DKIM and DMARC yourself, starting at p=none with a reporting address you read.
3. Give the agency mailbox and sequencer access, not registrar access.
4. Agree the warm-up period in the contract, before the first live send.
5. Require per-provider placement, bounce and complaint reporting in the monthly report, and define the thresholds that pause sending.
6. Write the exit terms at the start: domains, mailboxes, data and reply history return to you.
7. Measure placement yourself, independently of their reporting. An agency grading its own deliverability homework is the most common way this goes wrong quietly.

Where MailPilot fits

MailPilot gives both sides of an agency relationship the same independent numbers. It warms each mailbox over OAuth on Gmail and Outlook or over SMTP/IMAP for SendGrid, Amazon SES, Mailgun, Postmark and custom SMTP, checks SPF, DKIM and DMARC on every sending domain, measures real inbox placement per provider through a seed-inbox network, and tracks per-mailbox reputation daily. Every plan includes unlimited mailboxes, so an agency running many client domains and a client checking one are looking at the same data.