Builtplain
Join free
Business

Cold Outreach in 2026: Google's Sender Rules and the Math That Kills Campaigns

Three spam complaints per thousand emails is now a compliance line, not a suggestion. Google's published sender requirements, what they mean for small senders, and an outreach structure that survives the arithmetic.

Clara Voss 3 min read

If your outreach emails are landing in spam, the answer is usually not your subject line, it is that email's rules changed and most small senders never read them. Google publishes exact sender requirements, and they are mechanical: authentication (SPF, DKIM, DMARC), valid DNS, and a spam-complaint rate that must stay below 0.30%, three complaints per thousand messages. Cross the lines and Gmail doesn't argue with you; your mail stops arriving. This article explains the published rules as of July 23, 2026, and the outreach structure that survives them.

What Google actually requires

All figures below are from Google's Email Sender Guidelines, which apply to anyone sending to Gmail accounts.

Every sender, any volume

  • SPF or DKIM authentication on the sending domain.
  • Valid forward and reverse DNS (PTR records) for sending IPs.
  • TLS for transmission, and correctly formatted messages (RFC 5322).

Bulk senders, 5,000+ messages a day to Gmail

  • SPF and DKIM and DMARC, with the From: domain aligned with the SPF or DKIM domain.
  • One-click unsubscribe on marketing and subscribed messages (the List-Unsubscribe and List-Unsubscribe-Post headers), plus a visible unsubscribe link in the body.

The spam-rate thresholds, the part that ends campaigns

Google states two numbers: keep the spam rate reported in Postmaster Tools below 0.10%, and never reach 0.30%. The consequences of non-compliance, in Google's words: mail "might not be delivered as expected, or might be marked as spam," with rejection errors and rate limiting on the menu.

The arithmetic nobody runs

Translate 0.30% into campaign terms and the problem gets vivid: three annoyed recipients per thousand delivered emails is the ceiling, and the monitoring target is one per thousand. Now consider what cold outreach is: unsolicited email to people who never asked. If even a small fraction of a poorly-targeted list clicks "report spam", and "vaguely relevant to my job title" is poor targeting, a few hundred sends can put a domain over the line. This is our own arithmetic applied to Google's published thresholds, and it explains the graveyard of burned outreach domains better than any content-filter theory.

It also explains the industry workaround of buying disposable secondary domains to burn, which we won't recommend: it is an arms race against the exact reputation systems described above, it degrades fast, and a business that plans to burn identities is telling on itself.

The compliance checklist

Whatever your volume, do these once, in an afternoon, they are the difference between being judged on your merits and being filtered on arrival:

  • SPF record covering every service that sends as your domain; DKIM signing enabled at your email provider; a DMARC record (even p=none to start), all three, regardless of the bulk threshold, because requirements have only moved in one direction.
  • Send from a domain you intend to keep. Reputation compounds like the other durable assets, slowly, and only if you don't reset it.
  • Register for Google Postmaster Tools and actually watch the spam-rate graph; it is the only scoreboard that matters and it is free.
  • Keep transactional/product mail and outreach on separate subdomains, so a bad campaign cannot take down your receipts and password resets.

Outreach that survives the math

Given the ceiling, compliant cold outreach at small scale has one viable shape: low volume, high relevance, real opt-outs.

  • Tens per week, not thousands per day. Below bulk thresholds, and small enough that every recipient is individually chosen. If the list was exported, not chosen, it is too big.
  • Warm-adjacent targeting. The recipient should recognize the problem in the first sentence because you found them through the problem, a public complaint, a forum thread, a job posting. This is the same sourcing we use for first customers and it is why complaint-led outreach draws so few spam reports: relevance is the real deliverability strategy.
  • An easy exit. A working reply-to and a plain "tell me to stop and I will" beat clever persistence; every sequence tool's "follow up seven times" default is a complaint-rate machine.

Limitations

Requirements were checked against Google's published guidelines on July 23, 2026 and change over time; Yahoo and Microsoft maintain their own similar-but-not-identical rules that we did not review here. Separately from deliverability, unsolicited commercial email is regulated law in many jurisdictions (CAN-SPAM in the US, GDPR/ePrivacy in the EU, and others), nothing here is legal advice, and volume-based cold email to EU recipients in particular needs a lawyer's opinion, not a growth hack.

The bottom line

Authenticate everything, watch Postmaster Tools, and keep outreach small and genuinely relevant. The senders in trouble are not the ones emailing twenty well-chosen people a week, they are the ones treating strangers' inboxes as a numbers game that Google has now priced at three mistakes per thousand.

Discussion

Sign in with Google or just a name. No email link, no password to remember.