Why Your MSP Cold Email Lands in Spam (and How to Fix It)

An MSP decides to try outbound. Someone writes a solid sequence, loads a few thousand contacts into a sending tool, and connects the company's main mailbox. Replies are thin for a couple of weeks. Then a client mentions that your invoices have started landing in their junk folder.

That is the expensive version of a deliverability problem, and most of it is preventable. MSPs already understand the DNS side better than most senders; the gap is usually how mailbox providers judge behavior.

This post walks through the reasons outbound email ends up in spam, in roughly the order they matter, and ends with a checklist.

How inbox placement actually works

Gmail, Yahoo and Microsoft decide where your message lands using two broad kinds of evidence:

1. Authentication — can the sending domain prove the message is really from it? This is binary-ish and fully under your control.
2. Reputation — how have recipients treated mail from this domain, these mailboxes and these sending IPs over time? Do they open, reply, delete unread, or mark it as spam?

Authentication gets you considered. Reputation decides where you land. Most cold-email failures are reputation failures that start with an authentication gap.

Step 1: SPF, DKIM and DMARC — and alignment

• SPF lists the servers allowed to send for your domain. If your sending tool is not included, mail can fail SPF.
• DKIM signs each message so the receiver can verify it was not altered and came from an authorized sender. Sending tools need their own DKIM key published for your domain.
• DMARC tells receivers what to do when a message fails, and — importantly — requires alignment: the domain in the visible From: address must match the domain that passed SPF or DKIM.

Alignment is where outbound setups most often break. A sending platform may pass SPF and DKIM for its own domain while your From: address shows yours. Technically authenticated, but not aligned — and that increasingly counts as a failure.

Step 2: Know the bulk-sender rules

In February 2024, Google and Yahoo began enforcing requirements for bulk senders. Google's guidelines, for senders of more than 5,000 messages a day to Gmail accounts, require:

• SPF and DKIM set up for the sending domain
• A DMARC record (a policy of p=none is acceptable), with the From: domain aligned with SPF or DKIM
• One-click unsubscribe for marketing and subscribed messages, plus a visible unsubscribe link
• A spam rate, as reported in Google Postmaster Tools, kept below 0.3% — with Google recommending staying below 0.1%

Microsoft followed with requirements for high-volume senders to Outlook.com, Hotmail.com and Live.com consumer addresses, enforced from May 5, 2025: SPF, DKIM and DMARC are required for domains sending more than 5,000 messages a day, and non-compliant mail risks the junk folder or outright rejection.

Two things matter for MSPs here. First, most MSP outbound programs are well under 5,000 messages a day, so the bulk thresholds may not apply to you — but Google also publishes a shorter set of requirements for all senders, including authentication and the same spam-rate ceiling, and filtering judges reputation at any volume. Second, many of your prospects use Microsoft 365 or Google Workspace business mail, which applies its own filtering on top. Meeting the consumer bulk rules is the floor, not the finish line.

Step 3: Never cold-email from your primary domain

Your primary domain carries client communication, invoices, ticket notifications and password resets. If outbound damages its reputation, all of that suffers.

The standard practice is to send outbound from separate, related domains — a variation of your brand name that redirects to your main website — each with its own mailboxes and its own SPF, DKIM and DMARC. If one sending domain develops a reputation problem, you retire it; your primary domain never sees the damage.

A few specifics:

• Register sending domains that a prospect would reasonably recognize as yours. Deceptive look-alikes damage trust and invite complaints.
• Give each domain a basic redirect or simple site, so it does not look abandoned.
• Keep your primary domain's DMARC policy strict, and keep outbound off it entirely.

Step 4: Warm up, then stay under a sane volume

A brand-new domain and mailbox with no history that suddenly sends hundreds of cold emails looks exactly like a spammer, because that is what spammers do.

Warmup means building history gradually: low volume at first, increasing over several weeks, with mail that gets opened and replied to. Most sending platforms include a warmup service for this.

After warmup, keep per-mailbox volume modest and spread the load across several mailboxes and domains rather than pushing one mailbox hard. There is no published magic number; providers do not disclose thresholds, and conservative is cheaper than recovering a burned domain. Ramp slowly and watch the signals in Step 7.

Step 5: List hygiene is reputation hygiene

Every email to an address that does not exist produces a hard bounce, and a high bounce rate is one of the clearest signals of a purchased or scraped list.

• Verify every address before sending, especially anything more than a few weeks old. People change jobs; companies change domains.
• Remove role addresses such as info@ and sales@ from cold sequences. They rarely reach a decision-maker and often go to shared inboxes where someone hits "spam."
• Honor unsubscribes immediately and suppress them across every domain and tool you use.
• Watch for spam traps — addresses that exist only to catch senders using old or harvested lists. You cannot see them; the only defense is a clean, sourced list.

Step 6: Write like a person, about something relevant

Content filters are a smaller factor than most people assume, but a few habits help:

• Plain text over designed HTML for first-touch outreach. A short note from a person looks like a short note from a person.
• Few or no links, no images, no attachments on the first email. One link, if any.
• Avoid tracking pixels where you can. Open tracking adds an image request that some filters treat as a marketing signal, and the open data is unreliable anyway.
• Personalize the reason, not just the first name. A merge field does not make an email relevant.

That last point matters most, because the strongest reputation signal is how recipients respond. Replies help. "Mark as spam" hurts — badly.

Why a signal-based list protects your reputation

This is where list strategy becomes a deliverability issue.

A cold list sends the same message to thousands of people with no particular reason to care. A meaningful share of them will ignore it, delete it or report it. Those reactions are exactly what mailbox providers measure.

A signal-based list is smaller and has a reason attached to every name: the company just posted an IT role, a compliance deadline is approaching, their insurance renewal is coming up. You send fewer messages, each one references something real, and more of them get a reply instead of a complaint. Lower volume plus higher relevance is the healthiest pattern a sender can show. We made the broader case in why cold outreach stopped working for MSPs; Lead Signals is how MSProspector delivers that kind of list, with verified contacts, in your territory.

Email should also never be your only channel. A multi-touch cadence that adds phone and LinkedIn lets you send fewer emails per prospect while reaching more of them.

Step 7: Monitor before it breaks

• Google Postmaster Tools shows your domain's spam rate and authentication results for Gmail traffic, once volume is high enough to report.
• DMARC aggregate reports show who is sending as your domain and whether it passes — useful for catching both misconfigured tools and spoofing.
• Your sending platform's bounce and reply data is the earliest warning. Rising bounces or falling replies mean stop, investigate, and fix before sending more.

The deliverability checklist

• Outbound sends from separate, recognizable domains — never the primary domain
• SPF includes every sending service for each sending domain
• DKIM keys published for each sending service
• DMARC record published, with the From: domain aligned to SPF or DKIM
• Unsubscribe is easy, honored immediately and suppressed everywhere
• New domains and mailboxes warmed up over several weeks before outreach
• Per-mailbox volume kept modest and spread across mailboxes
• Every address verified before sending; role addresses removed
• First touches are short, plain text, with minimal links and no attachments
• Every message gives a specific, relevant reason to reply
• Spam rate kept well below 0.3% — aim for under 0.1%
• Postmaster Tools, DMARC reports and bounce rates reviewed weekly
• Email runs alongside phone and LinkedIn, not alone

Get the authentication right once, protect your primary domain permanently, and let relevance — not volume — do the work.