B2B cold email: how to run cold outreach without landing in spam

Transparency note. This guide is written by the GTM Flow team, and we sell a prospecting tool. We have tried to make it just as useful if you use something else: every requirement quoted here is public as of 17 September 2026 and every source is linked at the end.

It is written for founders who sell themselves and for sales teams of one to ten people in the US, the UK and Europe who are starting to prospect by email. It is not legal advice: the section on the rules only links to official texts.

Cold outreach is the whole job of opening conversations with companies that do not know you: picking who, finding a contact detail you can trust, and writing, calling or reaching out on LinkedIn. Email is the cheapest channel to scale and the easiest to ruin, because mailbox providers watch authentication, volume and complaints.

Email rarely works on its own. For which tool covers which channel, from contact databases to calls, see B2B prospecting tools.

• SPF (RFC 7208): a DNS record listing which servers may send email on behalf of your domain. Google notes it must include every sender for the domain, third-party services included. How to set up SPF.
• DKIM (RFC 6376): a cryptographic signature that lets the receiving server check the message really came from your domain and was not altered. For personal Gmail accounts, Google asks for a 1024-bit key as a minimum and recommends 2048. How to turn on DKIM.
• DMARC (RFC 9989, which replaced RFC 7489 in May 2026): a record telling receivers what to do with messages that fail SPF or DKIM. To pass it, the authenticated domain has to match the one in the From header. How to add a DMARC record.

One nuance that matters in B2B: Google states its guidelines apply to messages sent to personal Gmail accounts, not to Google Workspace accounts, and Microsoft's announcement covers Outlook.com, Hotmail and Live. Even so, Google recommends always setting up SPF, DKIM and DMARC to improve delivery, so treat them as the floor even when you write to company domains.

On mailboxes: send from real Google Workspace or Microsoft 365 mailboxes with a person's name on them. Microsoft recommends that the From or Reply-To address be valid, reflect the real sending domain and be able to receive replies. Whether to split prospecting from day-to-day email with a secondary domain is covered in the questions below.

• Start with the best-fit accounts. Google advises starting at low volume with engaged recipients: in prospecting, that means the accounts where you have a clear reason to write.
• Spread the sends out. Google's guidelines say to send at a consistent rate and avoid sending many messages at once. A few every working day beats a pile on Monday.
• Only scale on good signals. Before you increase, check bounces, replies and the spam rate in Postmaster Tools.
• If you see bounces or deferrals, slow down. Google recommends reducing volume until the errors drop, then building back up gradually.
• Split across several mailboxes instead of loading one, and give each mailbox its own daily cap.

Plenty of tools offer automatic mailbox warm-up, and it helps you get going. But Gmail monitors volume, recipient feedback and per-domain and per-IP limits: what weighs most over time is how the real people you write to react.

1. Ideal customer profile. Industry, size, country, the job title that decides, and the problem your product solves. If it does not fit in two lines, it is still too broad.
2. One reason per account. A hire, a funding round, an expansion, the tool they already use. With no reason, the email reads generic, and it shows.
3. A short, reviewed list. A handful of good accounts a week beats thousands nobody looked at. Exclude customers, open opportunities and anyone who asked you to stop.
4. Verify before you send. Run the addresses through a verifier and park the risky ones.
5. Bounces out. Google recommends automatically unsubscribing recipients whose messages keep bouncing back, and Yahoo asks senders to watch bounces and remove invalid recipients quickly.

There are dedicated tools for finding and verifying addresses, several with a free plan; we compare them in the B2B prospecting tools guide. If you are the founder doing the selling, the founder-led sales guide helps you decide who to write to first.

• Subject: short and descriptive, the way a colleague would write it. No capitals, no urgency, no fake “Re:” or “Fwd:” — Google's guidelines ask that the subject accurately reflect the content.
• First line: about their company, not yours. Name the reason you are writing to that account.
• Offer: the problem and the outcome in one or two sentences. No feature list.
• Call to action: one ask, easy to answer, such as two slots for a short call.
• Format: plain text, no images or attachments on the first touch. If you include a link, make it visible and make it obvious where it goes, as Google asks.
• An easy way out: one line letting them say no. Google explains that making it easy to opt out helps keep the spam rate low.

Here is an example for Verso, a fictional B2B startup that checks supplier invoices automatically (brackets mark the fields you personalise):

Subject: supplier invoices at [company]. Email: Hi [first name] — I saw [company] opened two new sites this quarter. More sites usually means a bigger pile of supplier invoices someone matches to purchase orders by hand. Verso reads them, checks them against the order and only flags the ones that do not line up. Is that happening at your end? If so, would 15 minutes on Tuesday or Thursday work? If it is not your area, tell me and I will not write again. Marta, co-founder, Verso.

• Every follow-up brings a new angle: a data point, a similar case, a different question. “Did you see my email?” brings nothing.
• Leave several days between sends and respect the recipient's working hours and public holidays.
• Stop the moment you get a reply, whether it is a yes, a no or a not now. An out-of-office auto-reply is not a no: reschedule.
• Unsubscribe immediately from every sequence if someone asks you to stop. Yahoo asks for unsubscribes to be honoured within 2 days, Google within 48 hours.
• Close politely. The last email can leave the door open without pressure.

The sequence does not have to be email only. A LinkedIn invitation sent by hand or a phone call can replace a follow-up; the B2B prospecting tools guide goes through the options for each channel.

It is worth being honest about the risk. Google's guidelines say not to send messages to people who have not signed up to receive them, and warn that they may mark your messages as spam. A cold email always reaches someone who did not ask for it, so the only real protection is that it is relevant to that person and that the volume stays low.

Measure by segment and by message variant, not just in total. And do not steer by opens: Google writes that a low message open rate is not necessarily an accurate indicator of delivery or spam classification problems.

Which rules apply depends on where you are established and where the people you write to are. These are the primary texts, all checked on 17 September 2026. We link them so you can read them; we do not tell you what any of them means for your campaign.

• European Union: the General Data Protection Regulation governs the processing of personal data, and the ePrivacy Directive 2002/58/EC, whose Article 13 is titled “Unsolicited communications”, covers direct marketing by electronic mail. Member States implement the directive in their own national law, so the detail differs from country to country.
• United States: the FTC publishes CAN-SPAM Act: A Compliance Guide for Business, which sets out the requirements for commercial email messages.
• United Kingdom: the ICO's guidance on electronic mail marketing explains how PECR applies to marketing by email, alongside UK data protection law.

Read them with a lawyer before the first send, and check what the country you are writing into requires. This guide explains how to do cold email well; it does not say whether your particular campaign complies with anything.

• Your mailboxes: send from Gmail, Google Workspace or any IMAP/SMTP account, with rotation across mailboxes and a cap per mailbox. Nothing goes out from shared domains.
• A clean list: addresses checked at enrolment (syntax, MX records and disposable domains), and bounces and unsubscribes handled for you.
• Replies with context: AI agents read every reply: it lands on the contact and stops the sequence, and if it shows interest the agent creates a task and flags the account as hot. See how the agents work.
• A/B variants with a per-variant report to compare messages by segment.
• Other channels in the [same sequence](/product/prospect): LinkedIn steps with per-profile limits, WhatsApp with its own daily cap, and calls from the browser with recording and a written summary.

Where things stand on 14 October 2026: our own sales team uses it in production and early access opens in waitlist order. The planned pricing is Solo at €39, Team at €69 and Scale at €149 per seat a month billed annually. If you need to send today, a dedicated cold email tool covers the sending; if what you are missing is prospecting and pipeline in the same place, see GTM Flow, the AI go-to-market platform with the CRM inside.