Your cold email shares a domain with your invoices

A rep connects a new sequencing tool to their mailbox on Monday. By Friday it has sent a few hundred cold emails as yourcompany.com, and nobody touched DNS. Two weeks later a customer asks why your invoice went to spam. Nothing broke loudly. The domain that carries your invoices, password resets, and contracts just absorbed the complaints from your outbound.

Cold email deliverability gets treated as a copywriting problem. It's an infrastructure problem first, and the infrastructure is shared.

Do Gmail's and Outlook's bulk-sender rules apply to cold B2B email?

Mostly not directly, and that's the trap. The published rules are written for consumer inboxes.

Google (Email sender guidelines, in force since February 1, 2024): every sender needs SPF or DKIM, valid forward and reverse DNS, TLS, and a Postmaster Tools spam rate below 0.3%. Above 5,000 messages a day to personal Gmail accounts, you also need both SPF and DKIM, a DMARC record (p=none is enough), a From: domain aligned with SPF or DKIM, and one-click unsubscribe on marketing and subscribed messages. Google's FAQ adds that since November 2025, Gmail has been ramping up enforcement, including temporary and permanent rejections.
Microsoft (Outlook.com Postmaster policies, effective May 5, 2025): domains sending more than 5,000 emails a day to Outlook.com accounts must comply with SPF, DKIM, and DMARC, with DMARC at least p=none (p=reject recommended) and aligned. Mail that doesn't comply goes to junk and, if issues remain unresolved, may be rejected.
Yahoo (Sender Hub): the same floor for bulk senders, a spam rate below 0.3%, and unsubscribes honored within two days.

Now the fine print. Google's FAQ says it plainly: "The Email sender guidelines don't apply to messages sent to Google Workspace accounts." Microsoft's page covers Outlook.com, its consumer service. Your prospects' work addresses don't end in @gmail.com or @outlook.com.

So B2B inboxes don't have rules?

They have filters, just no published thresholds. Google's Workspace admin documentation says Gmail scans every message for spam, the scanning can't be turned off, and admins can have bulk senders scanned more closely. Microsoft's documentation says every Microsoft 365 organization with cloud mailboxes is automatically protected against spam, and that its filtering learns in part from Outlook.com user feedback.

Our read: much of what those filters weigh is your domain's reputation. Google's guidelines say spam reports can lower a domain's reputation over time, and that Gmail tracks volume, feedback, and limits per domain and IP address. Its FAQ goes further: "High spam rates negatively affect message delivery for any message type that you send."

Any message type. That's the sentence to read twice.

Why does cold email put your invoices at risk?

Because of everything else that domain sends: invoices, password resets, contract links, the newsletter, your CEO's replies. Cold email is the stream most likely to draw spam reports. Google's own guidelines tell senders not to email people who didn't sign up, and a cold email fails that test by definition.

Two details make it stickier. Google counts everything your primary domain sends to personal Gmail accounts toward the 5,000-a-day line, subdomains included. And bulk sender status doesn't expire: cross the line once and you're classified for good. Transactional mail like password resets is exempt from the one-click unsubscribe rule, but it rides on the same reputation.

Should cold email go out from a separate domain?

The providers point that way themselves. Yahoo's guidance says to segregate email types by IP or DKIM domain, because "each IP and DKIM domain has a reputation," and not to send bulk or marketing mail from the IPs that carry user and transactional mail. Google recommends one From: address per message category, and a different IP per message type if you use more than one.

Two practical options:

A subdomain such as outreach.yourcompany.com. It gets its own DKIM signing and From: addresses, and the link to you stays obvious. It still rolls up to your primary domain in Google's bulk count.
A second domain you own. More separation, but no sending history, so it needs a slow warm-up like the one in our domain migration playbook.

Either way, separation isn't disguise. You're isolating reputation, not hiding who's sending, so the second domain should carry your company name, resolve to a page that says who you are, and send from people who answer.

The checklist before the next sequence goes out

Inventory every sender. Google says your SPF record should include all senders for your domain. Turn on DMARC aggregate reports and you'll see mail sent as your domain from tools nobody told IT about. In a consolidated sales stack, that list is short.
Authenticate the outbound domain fully. SPF, DKIM (Google recommends 2048-bit keys where your provider supports them), and DMARC aligned with the From: domain, even below 5,000 a day.
Cap and ramp. Google advises starting with low volume to engaged recipients and avoiding sudden spikes. Set a daily cap per mailbox and raise it slowly.
Make opting out easy, and honor it everywhere. A plain opt-out in every message, suppressed in the CRM and not just in the tool, so the next rep doesn't re-add the contact. Google recommends processing unsubscribes within 48 hours.
Watch the numbers weekly. Google says to keep the Postmaster Tools spam rate below 0.1% and never let it reach 0.3%. Postmaster Tools covers mail to Gmail users, so read DMARC reports and bounce rates next to it.
Fix alignment before you enforce. Google's FAQ says mail failing DMARC is generally handled by the sending domain's policy. Move your main domain to quarantine or reject while a rep's tool sends unaligned mail, and that tool's mail is the first casualty.

None of this replaces good targeting. Who you email and what you say still decides replies. This is the floor it stands on.

What does the law say about cold B2B email?

In the US, the FTC's CAN-SPAM compliance guide says "the law makes no exception for business-to-business email." Its requirements include accurate headers that identify the sender, originating domain included, a valid physical postal address, and an opt-out honored within 10 business days. The guide lists penalties of up to $53,088 per separate email, and says you can't contract away responsibility to whoever sends on your behalf.

That's US law only. The EU, the UK, Canada, and Latin American countries have their own rules for commercial email. This isn't legal advice: check with counsel before a sequence crosses a border, and see our GDPR guide for the EU basics.

Who owns cold email deliverability?

Usually nobody, which is the problem. Sales picks the tools. Secure owns SPF, DKIM, and DMARC. Marketing's newsletter shares the reputation. Build's transactional mail is what customers notice first, and Data watches the spam-rate trend. Outbound is the capture side of demand, and Sales can't keep it healthy alone. That's the case for one team owning all of it.

The Sales dimension of the DGTL Readiness Index covers outbound cadence, conversion measurement, revenue operations, and forecast accuracy. See the framework.