Cold Email That Gets Replies (and Stays Compliant)

By MercConsulting · Published 2026-08-16 · Updated 2026-08-30

Cold email works when you build it in the right order: deliverability, list quality, then copy. The four-sentence email, the follow-up cadence, and the mistakes that kill sending domains.

Cold email still works for B2B in 2026, but only when it is built in a specific order: deliverability first, list quality second, copy third. That means sending from a separate domain that has been warmed for several weeks with SPF, DKIM, and DMARC in place; verifying every address before you send; keeping volume low and steady per inbox; and writing four-sentence emails that lead with relevance, name a specific problem, offer one piece of proof, and end with a soft ask. Most failed campaigns did not have a copy problem — they had a deliverability problem, and the best email ever written does nothing from a spam folder.

Done right, cold email is one of the cheapest ways for a B2B service firm to open conversations with exactly the companies it wants: a few hundred dollars a month in tooling against a sales channel you control end to end. Done wrong, it burns a domain in weeks and teaches you the false lesson that the channel is dead.

Here is the full build: the deliverability foundation in plain English, list quality, the email itself, follow-up without nagging, the CAN-SPAM basics, what kills sending domains, and the situations where cold email is honestly the wrong channel.

Deliverability first: the part everyone skips

Inbox providers decide whether your message is ever seen, and they judge the sender before they read a word of copy. Four moves make up the foundation:

• Use a separate sending domain. Never run cold outreach from your main company domain. Buy a close variant — if you own acmeops.com, something like acmeops.co or tryacmeops.com — and send from that. If outreach ever damages its reputation, your invoices, proposals, and support emails keep landing while you rotate the outreach domain. Set the variant to redirect to your real site so a curious recipient who types it in lands somewhere legitimate.
• Authenticate: SPF, DKIM, DMARC. Three DNS records that answer one question for the receiving server — is this sender who it claims to be? SPF lists which servers may send mail for your domain. DKIM puts a cryptographic signature on each message proving it was not altered. DMARC tells receivers what to do when a message fails those checks and sends you reports about it. Google and Microsoft now effectively require all three from bulk senders; without them you are filtered before content is even considered. Your email platform will give you the exact records; it is typically an afternoon of DNS work.
• Warm up before you campaign. A brand-new domain sending 200 emails on day one looks exactly like a spammer, because that is what spammers do. Warm the domain for three to six weeks — most sending platforms include automated warmup that exchanges real, opened, replied-to messages in growing volume — before the first real prospect sees anything.
• Volume discipline, forever. Even warmed, keep each inbox at roughly 20 to 50 cold sends a day and grow gradually. Need more reach? Add inboxes and domains, not volume per inbox. Spikes are the classic trigger for filtering — steady beats big everywhere in this channel.

List quality: where campaigns are won or lost

The fastest way to ruin a warmed domain is a bad list. Two failure modes matter: dead addresses, which bounce and mark you careless, and irrelevant recipients, who ignore or report you. The fixes are unglamorous and non-negotiable.

First, verify every address through a verification service before it enters a campaign, and drop anything that is invalid or questionable. Getting the raw bounce rate under 2 to 3 percent is the target; a purchased list run unverified will commonly bounce 10 to 20 percent, which is enough to damage a domain in one send.

Second, narrow the targeting until relevance is obvious. A list of 300 Houston-area commercial contractors between 10 and 50 employees, with the owner's name and something observable about each company, will outperform 5,000 generic "decision makers" every time — in replies and in domain safety, because relevant recipients do not hit the spam button. If you cannot say in one sentence why this specific company should hear from you, it does not belong on the list.

The four-sentence email

Cold email copy fails from length and self-absorption more than anything else. Nobody reads a stranger's five paragraphs. The structure that works is four sentences, roughly 60 to 100 words, plain text:

Keep subject lines short, lowercase-casual, and honest — three to five words tied to the actual content. Skip images, attachments, and heavy links: they hurt deliverability, and a wall of formatting signals mass mail. One plain link at most, ideally only after someone replies.

"Our first campaign got zero replies and I blamed the copy. The real problem was that every message went to spam. Same list, same offer, warmed domain — the rerun booked eleven calls."

Follow-up without nagging

Most replies come from follow-ups, not the first touch — busy people miss good emails constantly. But there is a line between persistent and annoying, and it is drawn by whether each touch adds something. A workable cadence: first email day one; a short bump three or four days later ("any thoughts on this?" is fine once); a third touch a week after that carrying something new — a different angle on the problem, a one-line case result, a useful observation; and a courteous close-out around day 21 that explicitly says you will stop. Three to five touches over about three weeks, then done.

Never fake a forward, never write "re:" on a thread that does not exist, and never guilt the reader ("I guess this isn't a priority for you"). Honor every no immediately, including the silent no of four ignored messages. When a reply does come in, speed decides everything — answer within minutes and the meeting usually books; the mechanics are covered in the five-minute window that decides the deal. Sequencing this without sounding mechanical is its own craft, laid out in automating lead follow-up without sounding like a robot.

CAN-SPAM in plain English

Cold B2B email is legal in the United States under CAN-SPAM — it is an opt-out regime, not an opt-in one like some other countries. Staying compliant is mostly staying honest:

• Truthful headers and subject lines. The from-name, domain, and subject must not misrepresent who you are or what the message is. The fake "re:" trick is not just tacky; it runs against the rule.
• A working opt-out. Every message needs a clear way to decline further email — an unsubscribe link or a plain "reply 'no thanks' and I won't follow up" — and opt-outs must be honored promptly; the statute allows ten business days, but immediately is the right answer.
• A physical address. Include your real street address or a registered alternative in the footer.
• Own your vendors' behavior. If an agency or tool sends on your behalf, the obligations are still yours. Penalties are assessed per email, so sloppy vendors are your risk.

Note that this covers U.S. recipients. Emailing into Canada, the U.K., or the EU brings materially stricter consent rules — check before pointing a campaign abroad.

What kills sending domains

Domains rarely die from one mistake; they die from a pattern. The recurring killers:

• Unverified purchased lists — the bounce spike does more damage in one send than a month of warmup repairs.
• Volume spikes — jumping from 30 to 300 a day because a campaign "was going well."
• Image-heavy templates and attachments — mass-mail signals on what should read like a personal note.
• Ignoring the metrics — a climbing bounce or complaint rate is the domain telling you to stop; senders who push through the warning finish the job.
• Sending from the main company domain — the one mistake with no cheap recovery, because the reputation damage lands on your operational email.

If a domain does get burned — replies stop, test sends land in spam — pause it, fix the practice that burned it, and start a fresh domain with a full warmup. Recovery of a damaged domain is slow and unreliable; rotation is the practical answer, which is exactly why outreach never runs on your primary domain.

When cold email is the wrong channel

Cold email earns its keep in B2B, higher-ticket, definable-audience situations. It is the wrong first channel when your buyers are local consumers — homeowners do not respond to cold B2B-style email, and for local trades the same effort put into your Google profile and reviews returns far more; when your total addressable market is tiny, where a hundred hand-written notes or calls beat automation; when you cannot staff the replies — a 12-hour response time wastes every reply the campaign generates; or when compliance-heavy audiences like healthcare or finance make list-based outreach riskier than it is worth. Weighing cold email against the alternatives on limited money is covered in how to choose marketing channels on a small business budget.

One more honest caveat: cold email is a volume-and-iteration game with a real setup tax. If your close rate math cannot absorb 60 to 90 days of building — domain, warmup, list, testing — before the first closed deal, spend the budget on a faster channel first and come back to this one later. This channel also pairs naturally with automation done carefully — reply detection, enrichment, sequenced follow-up with a human on every actual conversation — the kind of pipeline we design as part of growth strategy engagements.

Frequently Asked Questions

Is cold email still effective for B2B in 2026?

Yes, when built correctly. Deliverability standards have tightened — authentication is now effectively mandatory, and inbox filtering is more aggressive — which cleared out lazy senders and left more room for disciplined ones. Well-run campaigns to narrow, verified B2B lists typically see reply rates in the low single digits, which is enough to fill a pipeline at cold email's cost.

Is cold email legal?

Cold B2B email to U.S. recipients is legal under CAN-SPAM as long as your headers and subject lines are truthful, every message includes a working opt-out that you honor promptly, and you include a physical mailing address. Rules for Canada, the U.K., and the EU are materially stricter and generally require consent — check the destination country's rules before emailing abroad.

How many cold emails should I send per day?

Roughly 20 to 50 per sending inbox per day, after a three-to-six-week warmup, growing gradually. To scale, add sending inboxes and domains rather than pushing one inbox harder. Volume spikes are one of the most common triggers for spam filtering, and steady low volume from several inboxes dramatically outperforms bursts from one.

What are SPF, DKIM, and DMARC?

Three DNS records that prove your email is legitimate. SPF lists the servers allowed to send for your domain, DKIM adds a tamper-evident signature to each message, and DMARC tells receiving servers how to treat failures and reports back to you. Major inbox providers now expect all three from bulk senders; your sending platform provides the exact records to paste into DNS.

Why are my cold emails going to spam?

Usually one of four causes: missing or broken authentication (SPF, DKIM, DMARC), a domain that was never warmed up or sent too much too fast, a low-quality list generating bounces and complaints, or mass-mail signals in the message itself — images, attachments, link trackers, spammy phrasing. Fix them in that order; copy is almost never the first problem.

This article is general education, not legal advice. MercConsulting coordinates compliance-sensitive implementation with licensed attorneys and qualified professionals where the work requires it.