Cold Outreach Without Getting Blacklisted

Authentication, volume ramps, spam traps and the 0.3% complaint ceiling: the rules we run on our own sending domain so a cold email about a $199 name still reaches an inbox — and why a burned sending domain is a damaged asset.

Three weeks into our first real outreach batch we learned the part nobody writes about: the hard work is not composing the email. It is convincing a receiving server that the email deserves an inbox at all. Everything after that — the reply, the counter, the escrow — depends on a filter we do not control deciding we are not a nuisance.

We write to businesses that already operate under a name close to one we own, offering the exact-match domain. That is a legitimate reason to contact a stranger. It is also, mechanically, the same shape as spam: a cold list, a commercial ask, a link. The difference is not intent. Intent is invisible to a mail server; what it can see is authentication, volume, list quality and complaint rate, which makes all of it our problem.

"Blacklisted" is three different problems wearing one word

People use the word for anything from "my mail bounces" to "my domain is on Spamhaus". Those are separate failures with separate fixes, and treating them as one is how a campaign gets worse while you change the wrong thing.

A public blocklist. Your sending IP or domain appears on a list that receiving servers consult — Spamhaus, Barracuda, URIBL and the rest. The symptom is loud: messages are refused with a 5xx code that usually names the list. It is the easiest layer to check: reverse the sending IP against the list's zone, and look up the domain in its domain-based list.
Provider reputation. Gmail, Outlook and the rest score your domain and IP on their own, per recipient and per engagement pattern. This is the layer that produces "everything goes to spam" with no bounce at all. You cannot query it directly; what you can read is your spam complaint rate in Google Postmaster Tools and Microsoft's SNDS.
Content filtering. One message, one recipient, one set of signals: links, images, subject line, the ratio of text to markup. It decides marginal cases, and gets the most attention.

The order matters: authentication and volume create the reputation, and reputation decides whether content filtering ever gets a vote. Polishing subject lines on unauthenticated mail is optimising the wrong object.

The authentication floor is a floor, not a ceiling

SPF says which servers may send for your domain. DKIM signs the message so a receiver can prove it was not altered in transit. DMARC tells the receiver what to do when either fails, and — this is the part people skip — it has to be aligned with the domain in the From header. A perfectly configured SPF record for a domain you do not send from buys nothing.

Google's published sender guidelines set the current floor for anyone writing to personal Gmail accounts. Since February 2024 every sender needs SPF or DKIM plus valid forward and reverse DNS. Anyone sending 5,000 or more messages a day to Gmail needs SPF, DKIM and DMARC together, alignment, TLS, one-click unsubscribe on marketing mail, unsubscribe requests honoured within 48 hours, and a user-reported spam rate under 0.3% — with Google asking senders to keep it under 0.1% and warning that 0.3% removes access to mitigation. Enforcement has tightened since November 2025, and the volume threshold counts every subdomain of the same primary domain.

Two consequences. First, DMARC at p=none is monitoring, not protection: it passes, it reports, and it stops nobody from sending as you. Move to quarantine once the reports are clean. Second, authentication passing is table stakes. A signed, aligned, DMARC-passing email from a domain with a bad complaint history still lands in spam. Authentication gets you considered; behaviour gets you delivered.

Send from something you are willing to lose

Here is the part specific to selling domains. The address on your outreach email is usually the same domain you are trying to sell, or the portfolio root that carries your buyer correspondence, your escrow threads and your listing page. If that domain's sending reputation collapses, the loss is not one campaign. Buyer replies stop arriving, transfer emails go missing, and you are now the owner of a name with a documented bad mail history — which is a question any serious buyer will eventually ask.

So we separate the two functions. Outbound prospecting goes out from a dedicated sending subdomain with its own reputation, its own DKIM key and its own DMARC policy. The portfolio domain keeps transactional and buyer mail, where each message is expected by the recipient and almost nobody reports it. If the prospecting subdomain burns, we retire it and the asset is untouched.

The corollary: do not prospect from a domain registered last week. Register the sending domain ahead of time, publish a real page on it, and let it age — a fresh domain with a hundred cold emails in week one is the exact profile filters catch.

Volume: the ramp is the whole game

The single most reliable way to get filtered is to look like a blast. A mailbox that has sent twenty messages in its life and then sends two hundred in an afternoon is not behaving like a person, and a receiving server does not need to know why.

Our rules are deliberately unambitious:

Start at ten to twenty a day per mailbox for the first week, to plausible, verified addresses.
Roughly double weekly , and only while hard bounces stay under 2% and complaints are at or near zero. Any complaint pauses the campaign and the next batch goes out at half volume.
One message per company, not per contact. Two emails to the same firm in a week reads as a sequence, and sequences get reported.
Stop the clock the moment a thread opens. A reply moves the address out of the campaign and into a conversation, where normal mail rules apply.

A hundred-name batch sent in one sitting is a hundred chances for someone who does not recognise you to press "report spam" — the one metric here that can end a campaign on its own.

List hygiene: the invisible cost is the trap

Spam traps are addresses that exist to catch senders who did not build their list. Some are pristine — never belonged to anyone, published nowhere, so the only way to have one is to have guessed or bought. Others are recycled: a real inbox, abandoned, now run as a trap. Hit one, and the signal is unambiguous.

What that changes in practice:

Check for a mail exchanger before you write. An address at a domain with no MX record is a hard bounce, and a batch of them is a pattern.
Do not guess catch-all addresses. If the site lists one person, write to that person. If it lists nobody, the company is not a prospect — it is a bounce with extra steps.
Treat role addresses as a lower tier. info@ and sales@ reach people who cannot decide, and shared inboxes report more readily than individuals. Use them only when nothing better exists.
Never buy a list. The price is low because the addresses have already been sold, and the traps come free with them.
Suppress permanently. Every address that ever bounced or complained goes on a do-not-contact file no future campaign reads. A suppressed address is the cheapest insurance in the system.

The message: give people less to object to

A cold email is judged in the preview pane, and everything that looks like marketing is a reason to report.

Plain, text-heavy HTML. One link, to the domain or the listing page. No tracking pixel, no images, no attachment, no HTML email template with a header banner.
A subject line that names the domain and nothing else. No urgency, no "quick question", no "following up" on a first contact.
Under about a hundred and fifty words, one specific reason you are writing, one question. The reason has to be checkable — the site uses the name, the name is their brand with the wrong extension, the redirect points somewhere odd.
A real signature: your name, the entity, a physical postal address, and a working way to opt out. US CAN-SPAM requires accurate headers, no deceptive subject, a valid physical postal address and opt-outs honoured within ten business days.
A plain opt-out line, even where the law does not demand it. "Reply 'no thanks' and I will not write again" costs one sentence and converts a potential complaint into a clean removal. We honour those within 48 hours — Google's number, and also the decent one.

None of this settles whether the contact is lawful. B2B rules differ by jurisdiction: the UK's PECR exempts corporate subscribers but not sole traders, GDPR's legitimate-interest basis needs a documented assessment and some member states read it narrowly, and CAN-SPAM is opt-out, not permission-free. The technical work in this article keeps you out of spam folders. It does not make an unlawful campaign lawful.

What we check, and what we changed

Our checklist before any batch leaves:

SPF, DKIM and DMARC verified by sending a test message and reading the received headers, not by trusting the DNS panel.
PTR record on the sending IP resolving forward and back to the same host.
Volume inside the ramp; per-mailbox daily cap written down.
Every address verified, de-duplicated by company, and checked against the suppression file.
Link count at one, tracking pixels off, plain-text alternative included.
Blocklist lookup on the sending IP and domain — weekly, not only when something fails.
Complaint rate read from Postmaster Tools, not estimated from replies.

The one number we refuse to use as a scoreboard is reply rate over a short window. In our own inbox audit this year, a hundred scanned messages produced fifty-seven pieces of real inbox traffic, twenty-three of them threaded replies, and exactly two written by a human being. That is the honest shape of cold outreach: mostly silence, and silence is not proof the email failed to arrive.

Why this belongs in a domain portfolio, not a marketing playbook

A domain has two histories buyers care about: what was on it, and what was sent from it. The first shows up in a Wayback lookup; the second shows up when a buyer's IT person runs a reputation check and finds a year of complaints. Sending well is asset maintenance. The rules above are unglamorous — slower batches, plainer emails, a suppression file nobody wants to maintain — and they are the reason a two-hundred-dollar offer can still reach an inbox eleven months from now, when the fast version of the same campaign has already been filtered into a folder nobody opens.