Email Deliverability in 2026: Warmup, Spam & Compliance

Cold email has two failure modes. The reputation one: if too many of your emails bounce, get marked as spam, or hit spam traps, inbox providers (Gmail, Outlook) start sending everything from your domain to the spam folder — and in the worst case your domain lands on a blocklist, which can also hurt your normal business email. The legal one: cold outreach is regulated (CAN-SPAM in the US, GDPR/PECR in the EU/UK), so you must identify yourself, include a real address, offer a one-click opt-out, and honor it.

The good news: both are manageable. Keep volume sane, authenticate your domain, only email real addresses, and always include an unsubscribe. BusinessMCP does most of this for you — this guide explains what it handles and the two or three things only you can do.

The single most important decision: do not send cold outreach from your main company domain (the one your team uses for real email). Use a dedicated sending domain or subdomain — for example send from a domain like "getacme.com" or "mail.acme.com" instead of "acme.com". That way, if cold outreach ever damages the sending domain’s reputation, your primary domain — invoices, support, the email your customers rely on — is untouched.

Connect that dedicated domain under Connections → Email sending domain. BusinessMCP verifies it through Resend and gives you the DNS records to add.

Authentication is how inbox providers know an email really came from your domain and was not spoofed. When you verify your sending domain, Resend gives you SPF and DKIM records to paste into your DNS — add all of them, and do not send until the domain shows Verified.

The one Resend does not set for you is DMARC. DMARC ties SPF and DKIM together and tells inbox providers what to do with mail that fails — and Gmail and Yahoo now effectively require it for anyone sending in volume. Add a DNS TXT record at "_dmarc.yourdomain.com" with a value like "v=DMARC1; p=none; rua=mailto:you@yourdomain.com". Start with p=none (monitor only, nothing gets blocked), watch the reports for a couple of weeks, then tighten to p=quarantine. The Email sending-domain card shows you this exact record. For a full plain-English walkthrough of all three records — with copy-paste examples and a rollout plan — see the SPF, DKIM, and DMARC setup guide.

_dmarc.yourdomain.com   TXT   "v=DMARC1; p=none; rua=mailto:you@yourdomain.com"

The authoritative requirement list lives in Google’s email sender guidelines, and the verification flow itself is documented in Resend’s docs — ten minutes of reading that saves weeks of spam-folder debugging.

Since early 2024, Gmail and Yahoo enforce explicit requirements on anyone sending volume to their users, and they have only tightened since. The headline rules: authenticate with SPF and DKIM plus a DMARC policy on your domain, include a working one-click unsubscribe and honor it within two days, and keep your spam-complaint rate below 0.3% — ideally under 0.1%.

The thresholds formally kick in around five thousand messages a day, but treat them as the baseline at any scale — the same signals feed the same filters. BusinessMCP satisfies the mechanical parts automatically: SPF and DKIM via domain verification, a one-click unsubscribe on every outreach email, and automatic suppression of anyone who complains. The complaint rate itself is yours to protect with good targeting.

A brand-new sending domain has no reputation, so blasting hundreds of emails on day one is the fastest way to land in spam. There is no official number, but a commonly used ramp looks like this: days one to three, 10–15 emails a day; the rest of week one, 20–30; week two, 40–60; week three, 75–100; week four, up toward your ceiling. Send your best-targeted, most-likely-to-reply prospects first — early replies actively build reputation.

BusinessMCP automates this: the first email you send from a cold domain starts a warmup clock, and the engine ramps your allowed daily volume from a small floor up to the 200-a-day per-domain ceiling over roughly ten days — enforced across all campaigns, so three campaigns cannot secretly stack volume on one domain. You can always send less than the cap; steady, consistent volume beats bursts every time, for deliverability and for replies.

Bounce rate is one of the biggest reputation signals. BusinessMCP protects it two ways. First, in Autonomous mode it only auto-sends to addresses our enrichment verified as valid; anything catch-all or unknown is held as a draft for you to review, so it never spray-sends to guessed addresses. Second, if an address ever hard-bounces or someone files a spam complaint, we automatically suppress that contact — you will never email them again — because repeatedly hitting dead or complaining addresses is exactly what wrecks a domain.

You should also avoid buying email lists. Purchased lists are full of spam traps and stale addresses, and one campaign to a bad list can blocklist a domain for months.

Inbox providers judge you mostly on two rates. Bounce rate: under about 2% is healthy, 2–5% is a warning, and above roughly 5% is the danger zone where filtering typically starts. Complaint (spam-report) rate: under 0.1% is comfortable, and 0.3% is the line Gmail itself publishes — cross it and deliverability drops fast. These bands are commonly cited rather than official guarantees, but they are the ones practitioners steer by.

Watch them in two places. Google Postmaster Tools is free and shows how Gmail specifically sees your domain — reputation, spam rate, authentication. Inside BusinessMCP, the Sending health card on the Sales Automation console aggregates bounce and complaint rates per sending domain with green, amber, and red bands, and the platform alerts you automatically when a domain drifts into the danger band.

Every outreach email BusinessMCP sends automatically includes a compliance footer: who you are, an optional physical mailing address, and a one-click unsubscribe link. Two things you should do: set your sender postal address in Settings → Sales (required by CAN-SPAM for US recipients), and honor opt-outs — which the platform already does for you (unsubscribes, spam complaints, and do-not-contact are all suppressed before any send).

For EU/UK recipients, B2B cold email is generally defensible as legitimate interest when it is relevant and offers an easy opt-out — which is exactly the model here — but keep it targeted and stop the moment someone asks.

• Identify yourself honestly — no deceptive From names or subject lines, a core requirement of the CAN-SPAM Act.
• Include a physical mailing address — set yours once in Settings → Sales and it rides on every outreach email.
• Offer a working opt-out and honor it promptly — the one-click unsubscribe is added for you and suppression is automatic.
• Keep EU/UK outreach relevant and targeted so the legitimate-interest basis actually holds up.

The EU is not one legal regime for cold email. In much of the EU and the UK, B2B cold email to relevant business contacts is generally run on legitimate interest: identify yourself, keep it targeted, and offer an easy opt-out — the model this platform enforces. That posture is widely used, but it is not a blanket permission.

Germany and Austria are the exception you must respect. Under the German UWG (the unfair-competition act), email marketing without prior express consent is generally considered unlawful even for B2B, and enforcement is real: competitors and industry associations routinely send cease-and-desist letters (Abmahnungen) with attached legal costs. Double opt-in is the working norm there, and "but it was B2B" is not a defense you want to test.

The practical playbook for DACH: make LinkedIn your first cold channel — a connection request and a message to a relevant business contact sit on much safer ground than an unsolicited email — and reserve email for people who replied or opted in. This is information from operating experience, not legal advice; if DACH is a core market, spend an hour with a lawyer before your first campaign.

It does: send from your verified domain (or your connected Gmail) with a compliant footer + unsubscribe on every message; only auto-send to valid addresses; suppress customers, unsubscribes, spam complaints, hard bounces, and do-not-contact; cap total daily volume per sending domain across all campaigns; automatically warm up a cold domain (ramping from a small floor to the ceiling over roughly ten days); and hold autonomous sends to business hours in the prospect’s timezone.

It does NOT: email purchased lists for you, guarantee inbox placement (no tool can — that depends on your domain, content, and volume), or set up DMARC for you — that TXT record is yours to add, and it is the one piece of authentication most senders forget.