Does cold email still work in 2026, and what do the Google, Yahoo and Microsoft sender rules mean?

Every few months someone declares cold email dead. The evidence says otherwise, with a catch. Hunter's State of Email Outreach 2026 report, based on 31 million cold emails sent by its users in 2025, found an average reply rate of 4.5% across sequences. Sequences sent to 21 to 50 recipients drew 6.2%, against 2.4% for those sent to 500 or more. Hunter sells email tools and its data is global, not UK only, but the pattern matches what we see: small, researched sends work, and big ones struggle.

At the same time, the mailbox providers have tightened their rules. Since February 2024, Google and Yahoo have required senders to authenticate their mail and keep spam complaints below 0.3%, with extra rules for bulk senders. Microsoft followed for Outlook in May 2025. Those rules punish volume and carelessness. A founder-led firm sending a few dozen well-researched emails a day has little to fear from them, as long as the basics are in place.

This guide explains what the rules require, who they apply to and how to set up sending so your emails arrive: separate domains, warm-up, daily volumes, list hygiene and personalisation a person writes. For the legal side, see whether cold emailing businesses is legal in the UK.

#Does cold email still work in 2026?

Yes, when it is researched, relevant and low volume. It struggles when it is none of those.

Hunter's data points the same way on almost every measure. Emails with two custom details drew a 5.6% reply rate against 3.6% for emails with none. Manually edited emails drew 5.2% against 4.4% for fully automated ones. Contacting one or two people per company drew 5.1% against 3.5% for three or more. Hunter's survey also found that 69% of decision makers say it bothers them if AI was used to write an email, unless the result feels human.

Outbound matters for a reason beyond reply rates, too. It reaches buyers before any AI assistant is asked who to hire, and puts your name in front of them while the shortlist is still forming.

#What do the Google, Yahoo and Microsoft sender rules require?

Authentication, low complaint rates, an easy way out and honest formatting. Here is what each provider has published.

Microsoft's announcement for high-volume senders first said non-compliant mail would go to junk. Its update of 29 April 2025 said messages failing the authentication checks would instead be rejected, with the error "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level."

#Who counts as a bulk sender, and do the rules apply to cold email?

Google defines a bulk sender as anyone sending "close to 5,000 messages or more to personal Gmail accounts within a 24-hour period", and counts all mail from the same primary domain together. Once you cross that line, the status is permanent (Google, sender guidelines FAQ). Microsoft's threshold is domains sending over 5,000 emails a day. Yahoo sets out bulk sender requirements without publishing a number.

Most founder-led firms sending cold email are nowhere near those volumes. Google also says its guidelines "don't apply to messages sent to Google Workspace accounts": its enforcement covers personal Gmail addresses, and many business prospects use Workspace or Microsoft 365, which run their own filtering.

So why bother? Because the rules are the clearest public statement of what mailbox providers expect, and in our view the same checks, authentication and complaint rates, decide whether any sender is trusted. Microsoft says as much: "While enforcement first targets large senders, all senders benefit from these best practices." Google is tightening too: from November 2025 it began "ramping up its enforcement on non-compliant traffic", including temporary and permanent rejections.

One line in Google's guidance deserves a direct answer. It tells senders: "Don't send messages to people who didn't sign up to get messages from you." Cold email, by definition, goes to people who did not sign up, so it is judged on how recipients react. A message someone would reasonably expect in their role, sent to a small number of well-chosen people, rarely gets reported as spam. A template sent to thousands does.

#Why do outbound teams use separate sending domains?

To protect the domain your business runs on. If cold email damages your main domain's reputation, your invoices, proposals and client replies can start landing in junk too. A separate domain keeps that risk apart.

Two details matter. First, a subdomain does not help with Google's bulk sender count, because Google counts everything from the same primary domain together. Second, the separate domain must still be plainly yours: your firm's name, a link to your real website and a real person behind the address. Microsoft asks senders to make sure the From or Reply-To address "is valid, reflects the true sending domain, and can receive replies", and Google warns against misleading display names. Yahoo recommends separating types of mail by IP address or DKIM domain, noting that "Sending unsolicited commercial email can negatively affect your reputation."

If an agency sends for you, ask which domains it will use and who owns them; our guide to whether appointment-setting agencies are worth it lists the other questions to ask.

#How do you warm up a new sending domain?

Slowly, and with authentication in place before the first message. Google's guidance on sending volume is the best public account of how mailbox providers think about it.

#Step 1: Authenticate before you send anything

Publish SPF, DKIM and DMARC for the new domain, with a DMARC reporting address. Send test messages to a few accounts you control and check the headers show all three passing.

#Step 2: Start small and increase gradually

Google advises senders to "Start with a low sending volume to engaged users, and slowly increase the volume over time", and warns that "immediately doubling previously sent volumes suddenly could result in rate limiting or reputation drops." In practice, begin with people who know you, such as clients and partners, before any cold sends. We treat the first month of a new programme as warm-up.

#Step 3: Keep a steady daily rhythm

Google's advice is to "Send email at a consistent rate. Avoid sending email in bursts." Spread sends across the working week at similar volumes, not hundreds on a Monday and nothing after.

#Step 4: Watch the signals and slow down when they turn

Check bounces, deferrals, spam complaints and your DMARC reports every week. Google's rule of thumb: "If messages start bouncing or start being deferred, reduce the sending volume until the SMTP error rate decreases. Then, increase slowly again."

#How many cold emails can you send a day?

No mailbox provider publishes a safe number for cold email, so treat any figure quoted as a rule with suspicion. The useful evidence is about what works. Hunter found reply rates peaked at 5.7% for accounts sending 20 to 49 emails a day, were similar at 50 to 99, and that open rates were highest below 100 a day per account. Its conclusion: "Human-like sending volumes protect deliverability."

For a founder-led firm, the limit is usually research, not sending capacity. If each message is written from a real look at the firm and the person, a few dozen a day is plenty of work.

#What keeps a list clean?

A clean list is short, current and checked. Five habits do most of the work:

• Verify addresses before sending and remove hard bounces at once. Microsoft suggests removing inactive or invalid addresses "monthly or quarterly".
• Do not buy lists. Google says "Don't purchase email addresses from other companies", and Yahoo says the same.
• Contact one or two people per company, not the whole team, which also matched Hunter's higher reply rates.
• Keep one suppression list across every sender, domain and agency, and check every new list against it.
• Stop tracking opens. Google says it does not track open rates and that low open rates are not necessarily a sign of deliverability problems. Hunter found campaigns without open tracking drew 7.4% replies against 4.4% with it.

#What does personalisation written by a person look like?

It is one specific, true observation about the firm or the person, and a reason to talk that follows from it. It is not a first name and a company name dropped into a template.

That is how we run Pipeline That Fills: every message written and approved by a person, sent from warmed domains, with nothing sent on a timer regardless of what the prospect replied. If the phrase "cold outreach" makes you wince, you are not alone.

#What about the law?

The sender rules are about deliverability; the law is separate. Under PECR, the ICO's guidance says you may email companies and LLPs without consent if you identify yourself and give a valid address to opt out, while sole traders and some partnerships need consent. UK GDPR also applies to named contacts. Our guide to whether cold emailing businesses is legal in the UK covers it in full.

#What to do this month

1. Check SPF, DKIM and DMARC on every domain you send from, and add a DMARC reporting address.
2. Set up Google Postmaster Tools for your sending domain and look at your spam rate every week.
3. If you send cold email from your main domain, register a separate one, authenticate it and warm it up before moving outbound across.
4. Turn off open tracking and judge campaigns on replies and meetings.
5. Clean your list: remove bounces, keep to one or two contacts per company and check it against your suppression list.
6. Rewrite your first message so it opens with something specific and true about the recipient.

#Frequently asked questions

#Is cold email dead in 2026?

No. Hunter's analysis of 31 million emails sent in 2025 found that small, personalised sequences drew well above the average reply rate. What has stopped working is high-volume, templated sending, which the mailbox providers' rules are built to filter out.

#Do the Gmail rules apply if we only email business addresses?

Strictly, Google says its sender guidelines apply to personal Gmail accounts, not Google Workspace accounts. Business inboxes run their own filters, and in our experience they reward the same things: authenticated mail, low complaint rates and steady volumes. Set up the basics whoever you email.

#What spam rate is too high?

Google tells senders to keep the rate reported in Postmaster Tools below 0.1% and never to reach 0.3%, and Yahoo's requirement is below 0.3%. On a small cold send, a handful of spam reports can push you over, which is another reason to keep lists small and relevant.

#Do we need DMARC if we send only a few emails a day?

Google and Yahoo require it only from bulk senders, and Microsoft from domains sending over 5,000 a day. But Google recommends that every sender set up SPF, DKIM and DMARC, and a DMARC record costs nothing but a line in your DNS, so publish one.

#Should we use a subdomain or a separate domain for cold email?

A separate domain keeps outbound risk further from your main domain. Google counts mail from subdomains together with the primary domain for its bulk sender threshold. Whichever you choose, make it clearly yours, with a working website link and a real person who can receive replies.

#Can we send cold email from a free Gmail or Outlook account?

It is a poor idea. Hunter found emails from a custom domain drew a 5.2% reply rate against 2.5% from free email accounts, and a free account gives you no control over your own authentication.

#Does one-click unsubscribe apply to cold email?

Google and Yahoo require one-click unsubscribe headers for marketing and subscribed messages from bulk senders. Whatever your volume, UK law requires a valid way to opt out of marketing email, so include a clear one in every message and honour it straight away.

If you want outbound that reaches the inbox because it deserves to, see Pipeline That Fills, or book a free Growth Review for three fixes in writing across your website, reputation and pipeline.

#Sources