A campaign can look fine at low volume while resting on weak foundations. Authentication may be shaky, DNS incomplete, complaint data patchy, or the unsubscribe process broken. There may also be nobody clearly responsible for stopping the send when warning signs appear. More volume exposes those weaknesses faster and to more recipients.
That makes pre-scale readiness a business decision as much as a technical one. The company has to show that its authentication, infrastructure, feedback, recipient controls and operating discipline can support a bigger campaign. Even then, meeting the technical rules is no promise of the inbox.
At low volume, uncertainty can hide in the gaps. Some messages still arrive even when DNS ownership is unclear, complaint data is sparse, or only one person understands how the sending stack is set up.
Scaling removes that margin. Major mailbox providers weigh authentication, infrastructure, reputation and recipient feedback together, and as volume rises, more messages meet those controls and more recipients have the chance to complain.
The technical difference between a receiving server accepting mail and that mail reaching the inbox is covered in Email Delivery Services That Ensure High Inbox Placement for Businesses. The question here is narrower: has the sending operation passed enough checks to justify the next increase in volume?
No single test certifies a cold-email program as ready. Gmail, Yahoo and Microsoft publish different requirements for different recipients, so the campaign has to be checked against the receivers it is likely to reach.
For B2B senders, there is a further wrinkle. Google's FAQ on its sender guidelines says they "don't apply to messages sent to Google Workspace accounts," and Microsoft's high-volume rule covers its consumer services. Many B2B recipients use business domains hosted on Google Workspace or Microsoft 365.
For those recipients, the published thresholds may not formally apply, and delivery depends on each platform's filtering and the recipient organization's settings. The published rules remain the clearest public statement of what the largest receivers expect, and they apply in full to any personal addresses on the list.
Start by proving that the domain authenticates correctly as receiving systems see it. A green indicator in a sending platform is only that platform's view.
Four terms come up repeatedly. SPF lets a domain publish which servers are allowed to send mail on its behalf. DKIM adds a digital signature that shows a message was not altered in transit. DMARC lets the domain owner decide what receivers should do with mail that fails SPF or DKIM, and can return reports on mail sent using the domain.
Alignment means the domain that passed SPF or DKIM matches the domain in the visible From address. Google's overview of authentication methods explains the first three in more detail.
Yahoo's sender requirements likewise ask for SPF or DKIM from all senders and SPF, DKIM and DMARC from bulk senders. Yahoo does not publish a fixed bulk-volume threshold.
Microsoft's current high-volume requirements apply to domains sending more than 5,000 emails a day to its consumer services, which include Outlook.com, Hotmail and Live.com. The daily threshold and the May 5, 2025 start date are set out in Microsoft's Outlook.com postmaster policies.
Those senders must pass SPF and DKIM, publish a DMARC record and pass DMARC validation, with SPF or DKIM aligned to the From domain. Mail that falls short can be sent to junk or rejected. The rule covers Microsoft's consumer services, so it says little about every Microsoft 365 business mailbox.
Before scaling, the company should know which systems send on behalf of the domain and whether SPF authorizes each of them. It should also know whether DKIM signatures validate, whether DMARC alignment passes where required, and who reviews authentication failures and DMARC reports. When a CRM, a sales-engagement platform and other tools all send for the same domain, every one of them has to be accounted for.
Passing this gate means the messages authenticate as intended. Whether recipients want them is a separate question.
The sending infrastructure also has to be coherent enough for the business to explain and support.
Google requires valid forward and reverse DNS for sending domains or IP addresses, and TLS for transmission. Yahoo requires valid forward and reverse DNS for sending IPs. Reverse DNS, also called a PTR record, lets a receiver look up the hostname behind a sending IP address, and TLS encrypts the connection between mail servers. These are basic operating requirements, whatever the campaign copy says.
A sales team need not become a mail-server team, but someone has to answer a few ownership questions before volume rises. Which domain is being used? Which IPs or providers actually send the mail? Do sales, transactional and support messages share infrastructure? Who can change DNS? Who diagnoses an authentication failure or rejection?
If the answers are scattered across sales operations, an outside platform and IT, make ownership explicit before launch. A sending system that nobody fully owns turns a delivery problem into a coordination problem.
Next, the business needs enough feedback to see how recipients and mailbox providers are reacting, and it has to avoid reading missing data as good data.
Google requires the spam rate reported in Postmaster Tools to stay below 0.30% and recommends keeping it below 0.10%. Yahoo also sets its ceiling at 0.3%, and its best-practice guidance recommends an active Complaint Feedback Loop for every DKIM-signed domain; the program only supports DKIM-signed mail.
Those figures need context. Google's Postmaster Tools help says dashboard data covers only mail sent to personal Gmail accounts and is not real-time. To protect user privacy, it may also be incomplete on days when sending volume is low. A thin dashboard before scaling proves very little.
Each major provider offers a free way to watch these signals. Google Postmaster Tools reports spam rate and other data for mail to personal Gmail accounts. Microsoft's Smart Network Data Services gives data on sending reputation at Outlook.com for the IPs a sender is responsible for.
That makes it most useful to teams that control their own sending IPs. Yahoo's Complaint Feedback Loop sends DKIM-signed senders a report when Yahoo users complain, so those addresses can be suppressed.
Reply rates measure sales engagement and say nothing about whether the sending identity is building up delivery risk. A team that cannot see complaints, bounces, deferrals and available reputation signals should hold volume where it is.
List quality belongs in this gate too. Bounces are one of the signals to watch, and a bigger send to a stale or unverified list multiplies them. Before the increase, check where each new list came from, verify the addresses and remove anything that has already bounced or opted out.
Agree in advance which signals will be watched and what triggers a closer look. Repeated authentication failures, rising deferrals, a complaint spike, a provider warning or a visible reputation decline should halt the next increase until the cause is understood.
A cold-email program has three separate questions to answer. Is the message lawful? Does the mailbox provider accept the sending practice? And do recipients actually want it?
In the United States, the FTC's CAN-SPAM compliance guide applies to commercial email and makes no exception for business-to-business messages. It requires accurate header information, honest subject lines and identification of commercial email as an advertisement. Messages must also include a valid physical postal address and a clear way to opt out. Opt-out requests must be honored within 10 business days.
CAN-SPAM works on an opt-out basis rather than a blanket prior-consent rule. Mailbox providers set a higher bar. Google's guidelines say not to buy email addresses and not to send to people who did not sign up to hear from you. Yahoo tells senders to verify that they are mailing only users who specifically requested it, and warns that unsolicited commercial email can damage reputation.
Industry bodies go further. The Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) sets out its view in its Sender Best Common Practices. It defines cold email as unsolicited email seeking a business relationship with someone who has no prior relationship with the sender. M3AAWG "views such email as abusive."
Its November 2025 position on cold email singles out bulk mail disguised as one-to-one outreach, including "lookalike domains," "multiple sending accounts" and attempts to "artificially simulate subscriber engagement." The blocklist operator Spamhaus says in its June 2025 position that it "will assess Cold Outreach Email sent in bulk and hitting our spamtraps as candidates for listing." A listing can reach well beyond the campaign that caused it.
For a genuinely cold campaign, that tension matters. Meeting the authentication rules and the U.S. legal floor still leaves the outreach outside provider and industry best practice. A team that scales should do so knowing where it stands.
Unsubscribe handling is stricter in practice than CAN-SPAM requires. Gmail requires one-click unsubscribe for marketing and promotional messages from bulk senders, and its sender guidelines FAQ recommends fulfilling unsubscribe requests within 48 hours. Yahoo requires one-click unsubscribe from bulk senders and asks them to honor unsubscribes within two days.
Outside the United States, the rules differ in ways that matter for B2B outreach. In the UK, the ICO's guidance on business-to-business marketing says PECR does not require consent to send marketing email to companies and other corporate bodies. Sole traders and some partnerships, however, count as individuals. They must have consented, or the soft opt-in must apply.
Senders must identify themselves and give a valid address for opting out. An email address that identifies a person is also personal data under the UK GDPR, which brings in the right to object to direct marketing. The ICO notes that this guidance is under review following the Data (Use and Access) Act.
In the EU, the ePrivacy Directive requires prior consent for email marketing to individuals. It leaves member states to protect the interests of business subscribers, so the rules for company addresses vary by country. Canada's anti-spam law requires consent, identification and an unsubscribe mechanism.
The CRTC's guidance allows implied consent where an address has been conspicuously published without a statement refusing unsolicited messages. The message must also be relevant to the recipient's business role.
So test opt-out and suppression across every sending tool, stop earlier opt-outs being re-imported, make the sender's identity clear and confirm the rules in every jurisdiction the campaign targets. A program that cannot keep a suppression decision in sync across its tools is not ready for more volume.
Relevance is a separate sales problem. Warm Outreach Done Right: Personalize Your Approach for Better Results looks at how context and personalization improve the approach, and no amount of infrastructure makes unwanted outreach welcome.
Finally, ask what happens when the team moves from today's volume to the next level.
Google advises senders to start with low volume to engaged users, increase it slowly, send at a consistent rate and avoid bursts. It also recommends monitoring server responses, spam rate and domain reputation. Its guidelines warn that "immediately doubling previously sent volumes suddenly could result in rate limiting or reputation drops," which is exactly the move many sales teams are planning.
If the team relies on automated warm-up tools, one caution applies. M3AAWG's best practices say "artificial warming practices are not recommended and may be illegal," so check exactly what those tools do before using them.
The threshold effect matters as well. The same FAQ says messages from the same primary domain count toward the 5,000 limit. Senders who meet the bulk criteria at least once are permanently considered bulk senders.
So the scale plan needs more than a target number of emails per rep. It needs an owner, a ramp sequence and a rollback rule.
For each increase, record the previous baseline, the new volume, the domains or streams affected, the signals being watched, and the person authorized to pause the campaign. If a sales platform can multiply sends with one setting, the safeguard has to be a written rule with a named owner.
The five gates matter only if they change the decision. The point is to separate a controlled increase from one made with unresolved risks.
| Status | What it means | Decision |
|---|---|---|
| Ready | Authentication works, infrastructure ownership is clear, recipient controls function and relevant feedback signals can be monitored. | Increase volume in controlled steps and keep checking the agreed indicators. |
| Fix before scaling | Mail can be sent, but one or more controls cannot yet be demonstrated, monitored or owned. | Hold the current level while the gap is corrected and retested. |
| Stop | Authentication is failing, complaints or provider warnings are serious, unsubscribe or suppression is broken, or ownership is unclear. | Pause the increase and resolve the underlying problem before further outreach. |
The scenario below is hypothetical and simplified. A sales team sends about 500 cold emails a day from a sales-engagement platform on a sending subdomain, while the CRM sends newsletters from the main domain. Leadership wants 2,000 a day by next week, using the existing list plus 8,000 newly purchased contacts.
| Gate | What the review finds | Status |
|---|---|---|
| Authentication | SPF and DKIM pass for the engagement platform. The CRM signs with its vendor's DKIM domain and uses the vendor's domain for SPF, so its newsletters fail DMARC alignment | Fix before scaling |
| Infrastructure | The platform's sending IPs have valid forward and reverse DNS, and IT agrees to be the named owner for DNS changes | Ready |
| Reputation and feedback | Postmaster Tools shows little data because most recipients are business addresses, and the purchased list has not been verified | Fix before scaling, and drop the purchased list |
| Recipient controls | Unsubscribes in the engagement platform do not sync to the CRM, and two earlier opt-outs appear in the purchased list | Stop |
| Scale control | The plan quadruples volume in a week, and the team assumed the sending subdomain kept that volume separate from the main domain | Fix before scaling |
The review changes the plan. The purchased list goes, because Google's guidelines say not to buy addresses, and two of its entries had already opted out. Suppression has to sync across both tools before any increase. The CRM needs an aligned authentication path, such as DKIM signing under the company's own domain. The ramp is spread over several weeks, with a named owner and a pause rule.
The team also learns that Gmail counts the subdomain and the main domain together, so the newsletters and the outreach count toward the same bulk-sender threshold. None of that stops the team from growing its outreach. It means the increase happens once the controls can carry it.
Some failed gates belong to other teams. DNS, identity, security and infrastructure may be owned elsewhere in the business.
If management needs outside technical help, Complete Technology's technical expertise covers 24/7 monitoring, server administration, threat protection and co-managed IT support, according to its managed-IT page. The Computer Connection's team lists network design, cybersecurity, data backup and IT consulting among its services.
Whichever route a company takes, define the actual readiness gap first, such as DNS ownership, authentication configuration or infrastructure troubleshooting, and give the provider a technical brief.
Keep decision rights clear. A provider may configure records or troubleshoot infrastructure, but sales leadership still decides who is contacted, how volume changes, which warning signals matter and when the campaign pauses.
Before approving the next increase, management should be able to confirm:
If any answer is "we think so," treat it as unresolved. The review exists to replace assumptions with proof before the company adds volume.
A bigger pipeline target makes cold email no safer. Higher volume magnifies whatever is already true about the sending system and gives recipient feedback more chances to shape future delivery.
There is also a strategic question to ask before adding volume. The industry's anti-abuse body regards cold email as abusive, and the largest mailbox providers ask senders to mail only people who want to hear from them. So does the business need more cold email, or a better reason to contact fewer people?
Signal-led outreach to people the team already knows is one answer. Fundz Engage takes that route. It works from a user's first-degree LinkedIn connections and ranks them against an ideal customer profile and live signals at their companies. It then prepares a message for each, which the user approves and sends individually. It is a different channel, and it shows that more volume is only one route to more opportunities.
Cold email may still be the right channel. If so, sound authentication, owned infrastructure, visible feedback, working opt-outs, and clear authority to slow down give the business a defensible basis for a controlled increase. The company will then understand the risks it is choosing to take on.
No. They help receiving systems verify the sender, but reputation, recipient feedback, infrastructure and each provider's own filtering also decide where mail lands.
Google and Yahoo require it only for bulk senders, and Microsoft only for domains sending more than 5,000 emails a day to its consumer services. It is still worth setting up before scaling.
Google and Yahoo accept a DMARC policy of p=none, which monitors mail without blocking any of it, and Microsoft asks for at least p=none while recommending p=reject. A practical sequence is to publish a monitoring-only policy first and use the reports to find every system sending as the domain. Once all of them pass SPF or DKIM with alignment, move toward quarantine or reject.
Google and Yahoo both treat 0.3% as the ceiling, and Google recommends staying below 0.10%. At low volume, Postmaster Tools may not show complete data, so a clean-looking dashboard is weak evidence.
CAN-SPAM does not require prior consent for commercial email, including B2B messages, but it does set rules on sender information, subject lines, postal address and opt-out.
Other jurisdictions differ. In the UK, PECR does not require consent to email companies but does for sole traders and some partnerships. In the EU, rules for business addresses vary by member state. Canada's CASL requires express or implied consent. Mailbox-provider and industry practices are stricter than any of these legal floors.
There is no universal safe percentage. Google advises gradual increases at a consistent rate and warns that suddenly doubling volume can cause problems. A sensible step is one the team can observe and reverse before a warning signal becomes a larger problem.