Cold email deliverability for B2B: what the sender rules actually cover

Most advice about cold email deliverability is folklore: magic warm-up schedules, secret sending limits, subject-line tricks. The mailbox providers, by contrast, publish their requirements. This post lays out what Google, Yahoo and Microsoft actually say, what those rules do and do not cover for B2B outreach, and where we are relying on judgment rather than a published rule.

The published rules, side by side

Google and Yahoo publish nearly the same requirements. The parts that matter for outbound:

Google defines a bulk sender as one sending more than 5,000 messages a day to Gmail accounts. It counts every message from the same primary domain, so mail from a subdomain adds to the total instead of resetting it. According to Google, enforcement ramped up from November 2025, moving non-compliant traffic from temporary errors toward permanent rejections.

Microsoft applies a similar 5,000-a-day line to consumer Outlook.com addresses. Its announcement requires SPF, DKIM and DMARC (at least p=none, aligned), and says non-compliant mail from high-volume domains is routed to Junk from May 5, 2025 and can be rejected with error 550 5.7.515.

What these rules do not cover

Google states that its sender guidelines "don't apply to messages sent to Google Workspace accounts". B2B outreach mostly targets work addresses, and work addresses sit on business mail systems such as Google Workspace and Microsoft 365, not on personal accounts. The thresholds above are not the rule that decides whether that mail arrives.

That does not make the numbers irrelevant. Business mail systems run their own filtering and do not publish thresholds, so there is no equivalent 0.3% line to aim at. We treat the Google and Yahoo figures as the best public benchmark of what a mailbox provider tolerates, and design campaigns to stay well inside them. That is a working assumption on our part, not something the providers state.

Below 5,000 messages a day you are formally required to have SPF or DKIM, nothing more. We set up SPF, DKIM and a DMARC policy on every sending domain anyway. It costs little at setup, and a domain that later crosses the 5,000 line already complies.

There is also a tension worth naming. Google tells senders to email only people who want the message, and Yahoo says not to buy mailing lists. Cold outreach is, by definition, to people who have not asked. The providers measure that gap with complaints: every recipient who reports a message as spam counts against your rate. That is why targeting and relevance are deliverability levers, not only conversion levers.

The spam-rate arithmetic

Google reports spam rate in Postmaster Tools and calculates it daily. Read as a percentage of messages, 0.10% is one report per 1,000 messages and 0.30% is three. On 1,000 messages delivered to Gmail users, three spam reports is the ceiling and one is the target. Yahoo offers a complaint feedback loop that lets senders see the same signal for their Yahoo traffic.

What we build to stay inside the limits

This is our practice, not a provider requirement:

• Authenticated sending domains. SPF, DKIM and DMARC on every domain, with the From domain aligned.
• Separate sending domains. Outreach runs from lookalike domains, not the primary one, so a reputation problem never reaches the mail your team and customers use.
• Warm-up before volume. Inboxes are warmed and rotated before campaigns scale.
• Verified lists. Lists are scrubbed before a single message goes out, and bounces are handled.
• An opt-out in every message, processed promptly.
• Tight targeting. Fewer, more relevant messages draw fewer spam reports.
• Monitoring. Spam rate in Postmaster Tools for Gmail recipients, and Yahoo's complaint feedback loop for Yahoo recipients.

The legal floor: CAN-SPAM

The FTC's compliance guide says the law "makes no exception for business-to-business email", so cold B2B email must comply. It also says you do not need consent to send marketing email. What you must do: no false or misleading header information, no deceptive subject lines, identify the message as an ad, tell recipients where you are located, tell them how to opt out, and honor opt-outs within 10 business days. The FTC lists penalties of up to $53,088 per violating email.

CAN-SPAM is US law. Rules in other countries, including the UK and EU, differ and can be stricter. Take legal advice for any market you sell into. This post is not legal advice.

Questions to ask an outbound agency

• Which domains will the email be sent from, and who owns them if we part ways?
• Are SPF, DKIM and DMARC set up and aligned on every sending domain?
• Which complaint rate do you monitor, and what do you change when it climbs?
• Where do the lists come from? Yahoo specifically warns against purchased lists.
• Will I see the raw campaign data every week?

These are the questions our own done-for-you B2B lead generation and B2B SaaS lead generation engagements are built to answer, with every domain and inbox registered in your accounts. If you want the setup reviewed on your own domains, start with a free audit.