B2B cold email deliverability is more than getting an email server to accept a message. An outbound team needs an authenticated sending identity, a legitimate reason to contact the intended buyer, clean prospect data, an effective opt-out process, and a way to detect problems before they spread. A sequence can be well written and still fail if the underlying sending operation is unreliable—or inappropriate for the recipient.
For SaaS and ERP sales teams targeting the United States and Canada, the right order is permission and policy → technical authentication → data and message QA → controlled sending → measurement and correction. This guide explains what to check, who should own each decision, and which rules are different for Gmail, Yahoo, Outlook.com, and Canadian recipients.
Quick answer: Confirm SPF, DKIM and DMARC for the actual sending setup; understand recipient-specific sender requirements; verify account and contact eligibility; use transparent identity and a functioning suppression process; start with a controlled, reviewable program; and investigate rejects or complaints rather than increasing volume. No authentication record, sending tool, or checklist guarantees inbox placement.
Deliverability, delivery, and permission are three different things
Teams often use “deliverability” to mean every problem between clicking Send and receiving a reply. Separate the layers before diagnosing anything:
| Question | What it tells you | What it does not prove |
|---|---|---|
| Was the message accepted by a receiving server? | Delivery/acceptance at a technical handoff | That it reached the inbox instead of spam |
| Did authentication pass? | Whether the message passed the applicable identity checks | That the prospect wanted it |
| Did it reach the intended mailbox folder? | Inbox placement, where you have reliable testing or feedback | That a human read it or that it was relevant |
| Was this contact appropriate to message? | Eligibility under your targeting rules and applicable law | That the provider will accept or prioritize it |
| Did the buyer respond meaningfully? | A useful engagement outcome | That the meeting is qualified or sales-accepted |
Email authentication, legal permission, list quality, and buyer relevance are complementary controls—not substitutes for one another. Buying a “verified” list does not establish consent, and passing SPF does not make an unsolicited message appropriate.
If you already have compliant sending infrastructure and need to improve relevance, use our separate guide to SaaS cold email personalization without invented research claims. This article focuses on the system around the message.
Step 1: map every sending identity before editing DNS
Write down every place that can send email representing your business: the regular team mailbox, CRM automation, sales engagement platform, marketing system, webinar provider, and any outbound partner. For each, record the sender address, the visible From domain, the underlying mail provider, a responsible owner, and which type of email it sends.
This inventory matters because a company can configure its main mailbox correctly while an outsourced SDR tool uses a different domain, a misaligned third-party signature, or an unreviewed reply address.
A practical inventory might look like this:
| Sending stream | Example purpose | What to verify |
|---|---|---|
| Human sales mailbox | Genuine one-to-one conversations | Actual From address, provider authentication and replies |
| Sales outreach platform | Approved prospecting sequences | From-domain alignment, unsubscribe/suppression, sending limits and monitoring |
| Product or customer email | Account notices and transactional updates | Correct classification and separate operational monitoring |
| Newsletter or events | Opt-in marketing | Subscriber permission, authentication and unsubscribe headers |
| External SDR partner | Outreach under an agreed client identity | Who owns DNS, sending configuration, suppression, data and incident response |
These are hypothetical streams, not a claim about LeadUp's internal sending tools. Do not delegate DNS control simply because a partner operates the campaign. Use a documented approval process and least-privilege access.
Step 2: understand SPF, DKIM and DMARC without treating them as magic settings
SPF: which servers are authorized?
Sender Policy Framework (SPF) lets domain owners publish which sending systems are permitted for a domain used in SMTP authentication. A properly configured SPF record helps receiving systems evaluate that technical identity.
The important limitation: SPF passing for the envelope sender does not necessarily mean it aligns with the visible address in the reader's From field. That alignment question is part of DMARC.
DKIM: was the message signed by the claimed domain?
DomainKeys Identified Mail (DKIM) uses a cryptographic signature to let receivers validate that the signed content has not been improperly changed and that the signing domain is responsible for the signature. DKIM can continue to work through some mail paths where SPF cannot, but it still needs to be configured and validated for each sending service.
DMARC: does the authenticated identity align with the visible From domain?
Domain-based Message Authentication, Reporting and Conformance (DMARC) connects the visible From domain to SPF or DKIM alignment. It also publishes a policy and can provide aggregate reporting, depending on receiver support and reporting configuration.
A DMARC policy such as p=none is a monitoring policy, not a security guarantee or an inbox-delivery shortcut. Stricter policies should follow a review of legitimate sending streams so they do not inadvertently disrupt business email.
| Control | The basic question | Common review mistake |
|---|---|---|
| SPF | Is this infrastructure authorized for the SMTP domain? | Assuming it proves visible From alignment |
| DKIM | Is the message signed and verifiable? | Assuming every third-party sending tool is configured automatically |
| DMARC | Does SPF or DKIM align with the visible From domain, and what is the policy? | Publishing a record without checking live message results |
Do this in practice: have your administrator inspect the DNS records, send authorized test messages through each actual platform, and review the resulting authentication headers and DMARC reports. The precise record values depend on your provider and architecture; copying a generic SPF record from a blog post is not a safe configuration method.
Step 3: apply the recipient provider's real rules—not a universal threshold
The email address on the receiving side affects what technical requirements apply. Rules for personal Gmail inboxes, Yahoo addresses and Outlook.com consumer domains should not be described as identical to every company's Google Workspace or Microsoft 365 environment.
Gmail: all senders versus bulk senders
Google's official Email sender guidelines distinguish senders generally from those sending more than 5,000 messages per day to personal Gmail accounts. All senders must meet requirements including SPF or DKIM, appropriate DNS, TLS, correct message formatting and low user-reported spam. The higher-volume category requires SPF and DKIM, DMARC, alignment and additional controls. For qualifying marketing and subscribed messages, Gmail's bulk-sender rules require one-click unsubscribe and a visible opt-out.
The point for an SDR leader is not to engineer a program just below a numeric threshold. Good authentication, recipient relevance and easy opt-out are sensible controls even for a smaller operation. Google also advises keeping user-reported spam well below its maximum threshold and checking Postmaster Tools where enough relevant data is available.
Yahoo: authentication, alignment and easy unsubscribe
Yahoo's Sender Best Practices similarly distinguish general senders from bulk senders. Its bulk-sender guidance includes SPF, DKIM, DMARC with acceptable alignment, usable unsubscribe mechanisms for marketing/subscription messages, and low complaint rates. Check the current Yahoo guidance before launch rather than relying on an outreach platform's generic “compliant” badge.
Outlook.com: be precise about scope
Microsoft's high-volume Outlook sender announcement introduced SPF, DKIM and DMARC requirements for domains sending more than 5,000 emails daily to its consumer Outlook.com family, including Hotmail and Live addresses. The announced enforcement began in May 2025.
That source explicitly concerns Microsoft's consumer service; do not generalize its stated threshold to every Microsoft 365 enterprise tenant. An enterprise recipient may have additional organization-specific filters, policies and expectations.
A decision table for an SDR program
| Recipient situation | Practical operating rule |
|---|---|
| Low-volume Gmail prospecting | Meet applicable all-sender requirements; authenticate, verify eligibility, suppress refusals and monitor outcomes |
| Gmail high-volume or qualifying marketing mail | Apply the corresponding bulk-sender authentication, alignment and unsubscribe rules |
| Yahoo recipients | Check Yahoo's published all-sender/bulk-sender requirements for your activity |
| Outlook.com consumer recipients | Account for Microsoft's applicable high-volume authentication policy |
| Corporate custom domains | Honor the organization's security posture; investigate specific rejects rather than assuming consumer rules explain them |
| Recipients in Canada | Review CASL consent/exceptions in addition to technical email rules |
This is a planning framework. It is not a substitute for checking the recipient mix, email classification, the latest provider requirements or qualified legal advice.
Step 4: build a contact-quality and eligibility gate
Even perfectly authenticated email becomes an operational problem if the source list is careless or the prospect should never have been contacted.
Review each segment for a legitimate account fit, the correct business role, verified domain/address syntax, duplicate contact records, prior opt-outs, customer or open-opportunity ownership, and regional restrictions. Decide who can override an exclusion and require the reason to be recorded.
For SaaS teams, fit might depend on the workflow, company segment and role. For ERP providers, it might depend on whether finance, operations and IT are appropriate for the specific discussion. Neither is simply a list of titles.
Our B2B SaaS ICP guide and ERP buying committee guide explain those upstream choices in more detail.
List verification is not consent. Do not translate “the address exists,” “the person works there,” or “the address appears on a website” into a blanket legal permission to send commercial messages.
Step 5: make unsubscribe and suppression operational—not decorative
An opt-out must work as a process, not just a link in a footer.
Define where requests enter, which system holds the suppression status, how quickly changes propagate to every campaign and provider, who resolves exceptions, and how the team verifies that suppressed contacts cannot be reintroduced by a refreshed list.
Google's sender FAQ explains the scope and mechanics of its required one-click unsubscribe for qualifying promotional messages. A link to a preferences page in the email body alone does not implement Gmail's RFC 8058 one-click mechanism where that requirement applies.
A good suppression test is deliberately simple:
- Use an authorized internal test contact.
- Send a properly classified test message through the actual sending platform.
- Exercise the intended unsubscribe or opt-out path.
- Confirm the central contact record changes.
- Confirm the same address is excluded from follow-up sequences and imports.
- Record the result, date and owner.
Don't assume an SDR marking “not interested” is the same as an explicit do-not-contact request. Your system should distinguish sentiment, scheduling, and legally relevant communication preferences.
Step 6: keep U.S. and Canadian rules separate
United States: CAN-SPAM applies to commercial B2B email
The FTC's CAN-SPAM business guide is explicit that commercial business-to-business email is not categorically exempt. It describes truthful sender information and subject lines, appropriate advertising identification, a valid postal address, a clear opt-out mechanism, timely honoring of opt-outs, and responsibilities when a vendor sends messages on your behalf.
As a concrete example, the FTC states that applicable opt-out requests must be honored within 10 business days. This is a legal limit, not an invitation to keep sending unwanted outreach for ten days. A well-run operation should suppress promptly.
Canada: CASL generally requires a legal basis before sending
The CRTC's CASL FAQ explains consent, identification and unsubscribe requirements for commercial electronic messages sent to recipients in Canada, including cross-border messages. CASL has specific exemptions and concepts of express and implied consent; applicability depends on the relationship and facts.
Do not reuse a U.S. campaign rule for Canadian recipients without review. B2B status, public availability of contact details, and an existing industry relationship are not universal permission slips.
Outreach is also subject to privacy, contractual, and platform-specific restrictions beyond these two laws. Have qualified advisers confirm your intended acquisition, use, retention and suppression practices. This article is general operational information, not legal advice.
Step 7: launch a controlled program and monitor real signals
A responsible launch does not require a universal “warm-up” formula, an arbitrary daily quota, or a promise to reach a certain inbox placement rate. Begin with a segment small enough that reps and operators can review actual outcomes and stop a problematic stream.
Track the measures that help answer different questions:
| Signal | Interpretation | Follow-up |
|---|---|---|
| Hard rejects and permanent failures | Receiver refused an address or message | Inspect error codes and address quality; suppress invalid contacts |
| Temporary deferrals | Message accepted later or held due to a temporary condition | Check provider guidance; avoid aggressive retries |
| Authentication pass/fail | SPF, DKIM and alignment outcomes | Review the true sending path and DNS configuration |
| Spam complaints | Recipients reported messages as unwanted | Review eligibility, source, messaging and suppression immediately |
| Opt-out requests | Recipients want marketing contact stopped | Suppress promptly and test propagation |
| Human replies | Some conversations are reaching people | Classify genuine interest separately from objections/referrals |
| Sales-accepted meetings | Downstream opportunity quality | Check the agreed sales criteria, not only booking totals |
Use consistent denominators and time windows. For example, a bounce rate can be described as rejected messages divided by attempted sends for a defined campaign, but be explicit about whether your provider counts temporary deferrals, permanent failures, and retries. Do not compare two dashboards without reconciling definitions.
A “delivered” event often reflects server acceptance, not placement in a human's inbox. Opens and clicks are imperfect signals and should not serve as substitutes for authenticated mail, buyer permission, or sales relevance.
The reporting side of outbound is covered in our appointment-setting metrics guide. To understand why a human response does not automatically become a qualified meeting, see our reply-management workflow.
When should the team pause sending?
Define stop rules before launch. Pause the affected stream when a sending tool starts failing authentication, produces unexplained blocks, cannot honor opt-outs, shows clear targeting errors, or receives a serious policy complaint.
Do not solve these incidents by changing domains repeatedly, spreading traffic across more inboxes, or disguising sender identity. The corrective sequence is stop → investigate → fix → verify → resume only when appropriate.
Who owns deliverability in an outsourced SDR engagement?
A provider may operate the sequences, but the client still has a reputation and compliance interest. Make responsibilities explicit in the onboarding agreement.
| Responsibility | Client sales/RevOps | SDR partner | IT/mail administrator |
|---|---|---|---|
| Approve targeting and exclusions | Accountable | Implements | Consulted |
| Approve outreach claims and channel policy | Accountable | Implements | Consulted |
| Configure SPF, DKIM and DMARC | Approves domain ownership | Provides sending requirements | Responsible for technical configuration |
| Test real messages and authentication | Reviews evidence | Executes approved tests | Validates headers and DNS |
| Maintain suppression and opt-outs | Owns policy and data expectations | Executes and records | Supports integrations |
| Monitor sending exceptions | Reviews escalations | Monitors daily operations | Diagnoses technical errors |
| Stop or restart an affected campaign | Approves high-impact decisions | Can immediately stop unsafe activity | Verifies technical readiness |
This matrix is a suggested starting point, not a universal organization chart. If a smaller team combines roles, name the actual person who owns each decision.
For a complete post-contract launch framework, see our outsourced SDR onboarding checklist.
Copyable B2B cold email deliverability checklist
Use these review items as a launch gate, not as a promise of deliverability.
Identity and technical setup
- Every authorized sending service and From domain is inventoried.
- SPF, DKIM and DMARC are configured appropriately for each actual sending path.
- Live test messages show the expected authentication results and DMARC alignment.
- Domain, DNS, TLS and formatting requirements of the receiving providers have been reviewed.
- A named technical owner can diagnose rejects and authentication failures.
Eligibility, messages and suppression
- ICP, eligible roles, target countries and exclusions are approved.
- Contact data has an identifiable source and any legally required consent or other basis has been checked.
- All copy uses truthful identity, relevant claims and an approved offer.
- The unsubscribe and suppression workflow is tested end-to-end.
- U.S., Canadian and applicable channel/platform requirements are reviewed.
- Duplicate, customer-owned and previously opted-out contacts are excluded.
Launch and measurement
- A controlled launch scope and a responsible approver are defined.
- Bounce, authentication, complaint, opt-out and reply signals have owners and review rules.
- Serious failure or policy incidents trigger a documented pause and correction.
- Reports distinguish attempted, accepted, replied, booked and sales-accepted outcomes.
Frequently asked questions
Does SPF, DKIM and DMARC guarantee my cold emails reach the inbox?
No. Authentication helps receivers verify identity and is required in various forms by major providers, but inbox placement also depends on policy, reputation, content, recipient engagement and filtering. The recipient must still be appropriate to contact.
Should a small SDR team care about the 5,000-email Gmail threshold?
Yes, but not because it is a recommended sending target. Google's all-sender requirements still apply below its bulk threshold. Review all relevant controls and do not structure a program to evade policy.
Is a separate sending domain always necessary?
No single answer fits every organization. Domain architecture affects risk isolation, brand recognition, administration and record alignment. Choose it with your mail administrator based on legitimate business needs; it should not be used to conceal identity or evade complaints.
Can a contact-verification tool make a Canadian cold email compliant?
No. Address verification does not establish consent or a CASL exception. Check the facts of the relationship and applicable requirements before sending.
What if emails show delivered but no one replies?
Start by verifying what “delivered” means in the provider, then examine fit, message relevance, buyer role, reply handling and sample feedback. A low reply rate alone does not prove a DNS problem. Our coordinated calls, email and LinkedIn outreach guide covers designing the broader conversation.
Build an outreach operation that buyers and sales teams can trust
B2B cold email deliverability improves when teams stop treating it as a trick for pushing more messages through filters and start treating it as an operational system: authentic sender identity, suitable contacts, useful messaging, responsible consent and suppression, and accountable reporting.
LeadUp Solutions offers B2B cold email outreach alongside cold calling, prospect research, appointment setting and lead qualification. Our public services overview describes those offerings, including attention to domain health and opt-outs. Every engagement should begin with agreement on your audience, outreach rules and what a qualified opportunity means.
If you are evaluating or refining an outbound program for a SaaS or ERP company in the U.S. or Canada, contact LeadUp Solutions to discuss your ICP, sending controls and qualification process.