Your cold email lands in spam. Here's the diagnosis.

Cold email lands in spam for one of four reasons: authentication that fails or half-passes, a sending domain with thin or damaged reputation, a list that hands filters evidence of carelessness, or sending behaviour that looks automated rather than human. Rewriting your subject line will not rescue a domain the filters have already scored down. The fix is a diagnosis run in a fixed order — authentication, reputation, list, behaviour — because each layer can mask the one beneath it.

Is your authentication actually passing?

Start here because it is binary and takes ten minutes. Send a test email to a Gmail address you control, open the message menu and choose "Show original". Gmail displays three verdicts at the top: SPF, DKIM and DMARC. All three should read PASS. Google and Microsoft have both tightened their requirements for senders in recent years, and unauthenticated mail from an unfamiliar domain starts at a disadvantage before anyone reads a word of it.

The common half-failure is alignment. Your sending tool signs the message with its own DKIM key, SPF passes against the tool's servers, and both look green in isolation — but neither matches the domain in your From address. When the From domain and the authenticated domain do not align, then DMARC fails regardless of the individual passes. Fix the records before touching anything else; every other signal is read through this lens. The full record setup, warm-up schedule and monitoring routine are laid out in Cold Email Deliverability: The Practical Guide.

What has your domain done to earn this?

Filters score domains on history, and two histories cause most spam placement. The first is no history at all: a domain registered last week, pushing 200 emails on day three. Sudden volume from a new domain is the signature of a spammer, and filters treat it accordingly. The second is bad history: a primary company domain that once blasted a purchased list, collected complaints, and still carries the record.

Both problems have the same structural answer — cold email should not run on your primary domain at all. Secondary domains exist precisely to hold this risk: warmed slowly, monitored, and replaceable if damaged. Warm-up means weeks of low, gradually rising volume with genuine engagement before campaign one. We want to see a mailbox reputation score in the low nineties — 91/100 is the sort of warmed-mailbox figure we work from — before loading commercial volume.

Is your list feeding the filters evidence?

Every invalid address you email is a signal against you. When you send to mailboxes that no longer exist, then the receiving provider reads it as proof the list was never verified — and legitimate senders verify. Bounce rate is the loudest of these signals, and a bounce rate in the mid single digits is commonly enough to sink placement on its own. Spam-trap addresses — dormant mailboxes recycled by providers as tripwires — do quieter, deeper damage, because only harvested or stale lists contain them.

The remedy is unglamorous: verify every address immediately before every campaign, remove anything invalid, and treat catch-all domains with caution.

Does your sending pattern look human?

A human sends a few dozen emails a day at irregular intervals. A machine sends 500 at 09:00 exactly. Filters can tell the difference. Hold each mailbox to 25–40 cold emails per day, spaced through working hours, and scale by adding mailboxes and campaigns rather than pushing one inbox harder. Sequences of 4 emails over 14 days keep per-recipient pressure low. Firms that run one campaign per sub-vertical — the approach mapped in Growth Systems by Industry — spread volume across several smaller campaigns by design, which is far easier on reputation than one large blast at a single list.

What is the diagnostic sequence?

Run it in this order.

1. Check authentication. Three PASS verdicts in "Show original". If any fail, fix the records and re-test before doing anything else.
2. Check reputation. Google Postmaster Tools for domain reputation; a blacklist checker for public listings.
3. Check the list. Pull the bounce log from the last campaign. Above the low single digits, stop sending and re-verify everything.
4. Check behaviour. Daily volume per mailbox, sending windows, and how fast you ramped after warm-up.
5. Then act. When the records are fixed and the list is clean, cut volume back to warm-up levels and rebuild engagement. Reputation recovers on good behaviour over weeks, not days.

When do you stop repairing and rebuild?

If a secondary domain is deeply scored down, or blacklisted with no response to delisting requests, replacement is usually cheaper than rehabilitation: new secondary domain, fresh warm-up, verified list, disciplined volume. That is a reset measured in weeks, and it only holds if the practices that burned the first domain change with it. If the damaged domain is your primary, the priorities invert — stop all cold sending from it immediately and protect the asset your invoices and client correspondence depend on.

---

Next step: the Growth System Audit — £450, seven days, credited against any build — maps where your growth system leaks and what to build first.