Why your cold emails go to spam, and how to fix it

Paste one email and the sending domain into the checker on the home page. It flags spam wording, broken merge tags, AI-sounding lines, and SPF, DKIM, DMARC, and MX. Then use the steps below to see which folder a real copy uses.

First, confirm it's really spam (and not just no replies)

People ignore mail that reached the inbox. Promotions in Gmail is not spam. Spam, and Junk in Outlook, mean a filter set the message aside.

• Send the same email to a Gmail account and an Outlook account you control, using addresses that are not on the sending domain. Read Inbox, Promotions, Spam, or Junk.
• In Gmail, open the three-dot menu and choose Show original. SPF, DKIM, and DMARC should each say pass. Compare the DKIM d= domain with the From domain.
• Do not trust opens. Apple Mail Privacy Protection prefetches images, and some security tools click links. An open is not the folder.

One seed inbox can be an outlier. A pass in Show original looks like this. header.d and header.from should be your From domain.

spf=pass
dkim=pass header.d=yourdomain.com
dmarc=pass header.from=yourdomain.com

Authentication is failing or missing

SPF, DKIM, and DMARC tell a receiver whether the message is from the From domain. A failure here puts mail in spam when the sentences are fine. Instantly, Smartlead, and Apollo send the mail. They do not publish the DNS.

• SPF has to be one TXT record starting with v=spf1. A second record is a permanent error, and so is crossing 10 DNS lookups. include counts toward that 10.
• DKIM has to be signed by the tool that sends, on the From domain. A Google Workspace key does not cover a sequencer.
• No DMARC record on _dmarc means no policy. Start at p=none. SPF or DKIM can pass on another domain and DMARC still fails.

Google requires SPF or DKIM for personal Gmail. At about 5,000 messages a day to those accounts it requires both, DMARC aligned with From, and a Postmaster Tools spam rate under 0.3%. Google treats 0.1% as already high. Yahoo's bulk rules match: SPF, DKIM, DMARC, and the same 0.3% cap. p=none publishes DMARC. ColdLint does not look up PTR on the sending IP.

Record shapes and dig commands are in the SPF, DKIM, and DMARC guide. The domain checker reads live DNS and follows CNAMEs on common selectors. A missing custom selector is not proof the key is absent, and the check does not count the 10 SPF lookups.

The domain is too new, or you send too much

A domain with no history, or a mailbox that jumps to hundreds of cold notes, is easier to filter. Providers publish ceilings for all mail, not a cold-email allowance.

• Send from a separate domain you can afford to damage. Keep invoices and password resets on another domain. Give the sending domain its own SPF, DKIM, DMARC, and MX.
• Warm the mailbox first. Mail people who expect it, answer replies, and raise volume only while bounces stay rare. Many sequencers start near 20 to 30 sends a day per inbox. That ramp is their habit, not a Gmail or Yahoo number.
• Google publishes 2,000 messages a day for most paid Google Workspace accounts, and less on trial accounts. Microsoft publishes 10,000 recipients a day for Exchange Online. Stay under both. ColdLint does not see mailbox age or yesterday's volume.

Links, tracking, and HTML

The first email does not need a link. If you include one, use a real page on a domain you control.

• Skip shared shorteners such as bit.ly, tinyurl.com, and t.co. ColdLint warns at two links, treats three or more as high risk, and flags a shortener on its own.
• Turn off open tracking and click tracking on the first touch. Open tracking is a hidden image, and some inboxes prefetch it. Click tracking rewrites the URL onto another host. ColdLint counts links in the paste and does not see a pixel added later.
• Prefer plain text. Skip the banner and the logo. ColdLint flags an image in the paste and does not render HTML.

Wording that reads like spam or like AI

Filters have weighed act now, limited time, click here, buy now, this isn't spam, guaranteed, and 100% free for years. One mild phrase is rarely the whole problem. Several, next to a hard sell, are a pattern. Write the sentence you would say to one person.

Quick one is not a banned subject. It is a common one. Gmail does not publish a rule against mail a model wrote. Generic copy still gets filtered: I wanted to reach out, feel free to reach out, leverage, synergy, an empty compliment, and a stack of em dashes.

The spam word checker uses a fixed list. It is not Gmail's filter, and it will flag a phrase you meant literally. The AI email detector marks those stock lines and suggests an edit. Scoring does not call a model, so the same paste always gets the same result.

Broken merge tags and bad lists

A broken tag ships as the characters you typed. {{firstName} with a missing brace, {firstName}, [First Name], and %FIRST_NAME% all do. Instantly and Smartlead want {{firstName}}, double braces and no spaces. A correct tag still renders blank when the column is empty. Send one copy from a real row. ColdLint cannot see the spreadsheet.

Unverified lists bounce. Google and Yahoo publish no bounce percentage. They do tell bulk senders to keep the spam complaint rate under 0.3%. Stop when hard bounces are no longer rare. A rate above about 2% is a common pause point in sending tools, not a Gmail rule.

End with a plain opt-out and honor it. CAN-SPAM requires that line and a postal address for commercial mail to people in the United States. At about 5,000 messages a day to personal Gmail, Google also wants a one-click List-Unsubscribe header. This page is not legal advice.

A 10-minute diagnosis order

Stop when you find the break. A rewrite does nothing for a missing DKIM signature.

1. Send the email to your own Gmail and Outlook. Read the folder, then Show original for SPF, DKIM, DMARC, and whether d= matches From.
2. If those fail, fix DNS before the copy. Use the SPF, DKIM, and DMARC guide and the domain checker. The tool that sends has to be the one that signs.
3. If authentication passes and the mail is still in spam, lower the daily cap. A new domain or a jump in volume is enough.
4. Send plain text with no link, no tracking, and no image. If that copy reaches the inbox, put back one URL only.
5. Run the spam word checker and the AI email detector. Cut the lines they flag.
6. Send a copy from a real row and look for a literal merge tag. Pause if bounces or complaints climb.
7. Paste the email and the domain into the home checker, then read the pre-send checklist before the next launch. A passing score does not predict the inbox.

Questions