Outreach Email Deliverability: How Link Builders Scale Without Burning Their Domain

To scale link building outreach without burning your domain, send from a separate, fully authenticated domain, warm it up slowly, keep volume per inbox modest, verify every address, and watch spam complaints in Google Postmaster Tools. The rules that matter most come from the mailbox providers themselves: Gmail and Yahoo's sender requirements (enforced from February 2024) and Microsoft's requirements for high-volume senders to Outlook.com (enforced from May 2025).

This guide is written for link builders, not newsletter marketers. Outreach is one-to-one cold email, which puts it in a riskier spot than a newsletter people signed up for. Here is how our team sets it up.

Why outreach from your main domain is risky

Mailbox providers build a reputation for your sending domain from how recipients react to your mail. Cold outreach draws more ignores, deletes and "report spam" clicks than mail people expect, however well written. If that reputation belongs to your main domain, the damage spreads to proposals, invoices, support replies and password resets.

That is why most outreach teams send from a dedicated domain, such as a close variant of the brand, used only for outreach. It should have a real website or redirect to the main site, a real person's name on every email, and a working reply inbox. It is a separate reputation, not a disguise.

A subdomain (for example outreach.yourbrand.com) is another option, but it is less isolated. Google's email sender guidelines FAQ notes that messages sent from subdomains count toward the primary domain's volume when determining bulk-sender status, and that bulk-sender status does not expire. We prefer a separate domain for cold outreach.

For the fundamentals that apply to all mail, not just outreach, see our overview of email deliverability basics.

Set up SPF, DKIM and DMARC before the first send

Authentication tells mailbox providers that you are allowed to send for the domain in your From address. Set up all three on every outreach domain:

1. SPF. A TXT record listing the services allowed to send for the domain, such as your Google Workspace or Microsoft 365 tenant and any outreach platform that sends through its own servers. Keep to a single SPF record per domain.
2. DKIM. Turn on signing in your email provider and publish the public key it gives you as a DNS record. Every sending service needs its own DKIM setup for your domain.
3. DMARC. Publish a record at _dmarc.yourdomain. Start with a monitoring policy and aggregate reports, then tighten once you are sure all legitimate mail passes.

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

DMARC passes only when SPF or DKIM passes and aligns with the domain in the visible From address. Outreach tools that send through their own infrastructure are a common cause of misalignment, so send a test to a mailbox you control and check the headers. Our guide to DMARC for deliverability walks through the records, reports and moving from p=none to enforcement.

What Gmail, Yahoo and Outlook require

All three major consumer providers now publish requirements. Most outreach inboxes send far below bulk thresholds, but the all-sender rules still apply, and an agency sending from shared domains can cross thresholds faster than it thinks.

Provider	Applies to	Key requirements
Gmail (from Feb 2024)	All senders	SPF or DKIM, valid forward and reverse DNS, TLS, RFC 5322 formatting, spam rate below 0.3% in Postmaster Tools
Gmail (from Feb 2024)	Bulk senders: close to 5,000+ messages a day to personal Gmail accounts	SPF and DKIM, DMARC (p=none allowed), From domain aligned with SPF or DKIM, one-click unsubscribe for marketing and subscribed messages, unsubscribes honored within 48 hours
Yahoo (from Feb 2024)	All senders	SPF or DKIM, valid forward and reverse DNS, RFC 5321/5322 compliance, spam rate below 0.3%
Yahoo (from Feb 2024)	Bulk senders	SPF and DKIM, DMARC with at least p=none that passes, one-click unsubscribe for marketing and subscribed messages, unsubscribes honored within 2 days
Outlook.com (from 5 May 2025)	Domains sending 5,000+ messages a day to Microsoft consumer mailboxes	SPF, DKIM and DMARC (at least p=none) passing with alignment; non-compliant mail rejected with error 550 5.7.515

Sources: Google's email sender guidelines, Yahoo's sender best practices, and Microsoft's support page on the 550 5.7.515 rejection. Google also says it has been increasing enforcement on non-compliant traffic, including temporary and permanent rejections, since November 2025.

What this means for outreach volume: a single outreach inbox sending tens of personal emails a day is nowhere near 5,000. The thresholds become relevant when an agency runs many inboxes on one domain or sends to large lists. Meet the bulk-sender authentication standard anyway. It costs nothing and removes a failure point.

Watch spam complaints in Postmaster Tools

Gmail's guidance is to keep your spam rate below 0.1% and to avoid ever reaching 0.3%, measured daily. Google Postmaster Tools shows the spam rate and authentication results for your domain once you verify it and send enough daily volume to Gmail for data to appear. Low-volume outreach domains may show little or nothing, which is one more reason to track your own signals: bounces, replies asking to be removed, and sudden drops in replies.

Complaints are the metric that hurts most, and in outreach they come from three places: poorly targeted prospects, too many follow-ups and no clear way to opt out. Fixing the list fixes most of it. Our link prospecting workflow covers how to qualify sites so the people you email have a real reason to care.

Warm up new domains and cap daily volume

A brand-new domain has no sending history, so a sudden burst of cold email looks like spam. Warm up gradually:

1. Let the domain and its authentication settle, and use the inbox for normal correspondence first.
2. Start with a small number of hand-written emails a day to real contacts likely to reply.
3. Increase volume in small steps over several weeks while watching bounces, complaints and replies.
4. Pause and investigate at the first sign of trouble, such as rising bounces or replies landing in spam.

As an internal rule of thumb, not a provider requirement, we keep each outreach inbox at a volume a person could plausibly write by hand, and spread larger campaigns across several warmed inboxes rather than pushing one harder. Automated "warm-up networks" that exchange artificial emails are a gray area. We rely on real, gradual sending instead.

Keep your list clean

Bounces tell providers you are guessing addresses. Before any send:

• Verify every address with an email verification tool and drop invalid results.
• Treat "catch-all" and "unknown" results with caution, and send to them in small batches, if at all.
• Avoid role addresses such as info@ and admin@ unless the site asks for pitches there.
• Dedupe across campaigns and team members so one editor never hears from you twice about the same thing.
• Suppress anyone who has asked not to be contacted, across every domain and inbox you use.

Plain text, tracking pixels and links

Outreach should look like a person wrote it, because a person should have. Simple plain-text or lightly formatted email tends to fare better than templated HTML with images, and it reads better on a phone.

• Open tracking works by loading a hidden image. It adds weight to the message, and privacy features such as Apple Mail Privacy Protection preload images, so open rates are unreliable anyway. We turn it off for outreach and measure replies.
• Click tracking rewrites your links through a redirect domain. If you use it, use a custom tracking domain on your own sending domain, not a shared one. Often it is better to leave links untracked.
• Links per email: one link to the page you are pitching is usually enough.

Handle opt-outs properly

Give every recipient a simple way to say no, such as "Reply 'no thanks' and I won't email you again," and honor it immediately across all your inboxes. For bulk senders of marketing or subscribed messages, Gmail and Yahoo require one-click unsubscribe (the List-Unsubscribe and List-Unsubscribe-Post headers defined in RFC 8058). Most outreach platforms can add these headers, and it is worth turning on if you run volume.

Legal basics: CAN-SPAM, GDPR and PECR

In the US, the FTC's CAN-SPAM compliance guide covers commercial email, and the FTC says the law makes no exception for business-to-business email. Its main requirements:

• Accurate From, To, Reply-To and routing information.
• Subject lines that reflect the content of the message.
• Clear disclosure that the message is an advertisement, where it is one.
• A valid physical postal address.
• A clear way to opt out, honored within 10 business days.
• Responsibility for compliance even when you hire someone else to send for you.

Whether a particular outreach email counts as commercial depends on its primary purpose, so we treat every outreach email as if the rules apply. The FTC states penalties can reach tens of thousands of dollars per violating email.

For recipients in the UK and EU, data protection and electronic marketing rules (GDPR, the UK GDPR and PECR in the UK, and national ePrivacy laws in the EU) govern how you collect, store and use personal data such as a named editor's email address. The rules differ by country and by whether the recipient is an individual or a corporate address. At minimum, have a documented lawful basis, tell people where you got their details, and honor objections. Get legal advice for your specific setup.

Build it into your process

Deliverability is not a one-time setup. Check authentication, bounce rates and complaint signals on a schedule and write the checks into your team's process. Our link building SOP for agencies shows where these QA checks fit alongside roles and turnaround times, and our outreach email templates are written to stay short, honest and low-complaint.

Less email is also an option. Assets that attract links on their own reduce how much outreach you need, as covered in our guide to earning links without outreach. When you evaluate link building agencies, ask which domains they send from and how they protect them. An agency that pitches from your main domain without asking is putting your business email at risk.

If you want outreach run on properly authenticated, warmed domains with every link reported, talk to our link building team.

Frequently Asked Questions