Cold email: a complete practical guide

Cold email - a first message to someone with no prior relationship with your company - sits at the intersection of three separate concerns: whether it's legal, whether it's deliverable, and whether it actually gets a reply. Most failed cold-email programs fail on one of these three and misdiagnose it as a problem with the other two.

Is it legal?

In the US, CAN-SPAM permits commercial email without prior opt-in, provided it includes a working unsubscribe mechanism, a valid physical address, and non-deceptive subject lines and sender information. In the EU/UK, the position is narrower: GDPR and PECR generally require consent for marketing email to individuals, with a limited "soft opt-in" or legitimate-interest exception that mostly applies to existing customers or closely relevant B2B outreach - not blanket cold prospecting. Check which regime applies to your recipients, not just your own location; sending to EU-based contacts from a US company still triggers EU rules for those recipients.

Is it deliverable?

Cold email to a domain with no sending history is the single highest-risk pattern for a mailbox provider to evaluate - no prior relationship, often no prior sending history on the domain, and content inherently selling something. The infrastructure checklist:

1. Dedicated sending domain (not your primary company domain) - isolates cold-send
   reputation risk from transactional and other marketing mail.
2. SPF, DKIM, DMARC published and passing on that domain specifically.
3. Gradual warm-up: start at low daily volume (commonly 20-50/day per mailbox) and
   increase only as bounce and complaint rates stay low.
4. Verified, not purchased, contact data - syntax and domain validation at minimum.

Does it get replies?

• Specificity beats volume. A smaller list of genuinely relevant, researched contacts consistently outperforms a larger, loosely targeted one on both reply rate and complaint rate.
• One clear, low-friction ask - a yes/no question or a short reply request - converts better than an immediate pitch or meeting request.
• Limit links and avoid shorteners. Multiple tracked links or shortened URLs are a long-standing spam-filter signal, independent of how relevant the content is.
• Stop on a clear negative signal. Continuing a sequence after an explicit "no" or an unsubscribe is both a complaint-rate risk and, in consent-based jurisdictions, a compliance one.

A realistic sequence structure

Sequences longer than three to four touches without a response show diminishing returns and rising complaint risk - stopping on schedule matters as much as the content of each message.

What not to do

• Don't buy or scrape contact lists - this is both the fastest way to hit a spam trap and, in consent-based jurisdictions, a direct compliance violation.
• Don't send cold email from your primary company domain at volume - isolate it on a dedicated, warmed domain so a complaint-rate problem never touches transactional or internal mail.
• Don't skip warm-up because the list is small - even a small cold-send list, mailed all at once from a domain with zero sending history, is a meaningful anomaly to a mailbox provider.
• Don't continue a sequence past an explicit opt-out, regardless of how the recipient expressed it (reply, unsubscribe link, or spam report).

A worked warm-up example

A B2B team buys a new domain, hello-example.com, specifically for a cold outreach campaign, with two mailboxes on it. A realistic ramp looks like this:

Two mailboxes at a steady 50-80/day each cap out around 100-160 contacted per day for the whole domain - which is a deliberate ceiling, not a limitation to work around. Teams that need higher daily volume should add more warmed mailboxes on the same domain rather than pushing existing ones past the range where bounce and complaint rates stay low; a single mailbox sending 300+/day cold, regardless of warm-up history, reads as anomalous to every major mailbox provider.

A note on reply rate caps and realistic expectations

Even a well-run cold program converts a minority of sends to replies. A 1-3% reply rate on a genuinely researched, well-targeted list is realistic; rates meaningfully above that over a sustained campaign usually mean the list is small enough that a handful of enthusiastic responses are skewing the percentage, not that the approach has found some repeatable edge. Treating a short-term spike as the new baseline is how teams end up scaling volume on an approach that was never actually working at that rate.

MailPilot handles the infrastructure side of a cold-email program: warming a dedicated sending domain gradually over OAuth or SMTP/IMAP, checking SPF/DKIM/DMARC against what's actually published, and tracking per-mailbox reputation daily - so the legal and messaging work above isn't undermined by a domain that was never properly warmed.