Cold Emailing with AI: Research, Personalization and Deliverability That Holds Up

AI cold email can be very good or very bad, and the difference is rarely the writing. AI makes it easy to research prospects quickly and draft relevant first lines at scale. It also makes it easy to send thousands of generic messages that burn your domain, annoy buyers and get your mail filtered for everyone at your company.

We run cold outreach for our own businesses and for clients, on dedicated sending domains with ongoing warm-up and weekly health tracking per mailbox. This article covers the full setup: list building, personalization, the technical foundation, mailbox limits, the Gmail and Yahoo rules, CAN-SPAM, human review and handling replies.

Start with a narrow list

The best cold email campaigns are small and specific. Before any AI touches a message, define exactly who you are writing to: industry, company size, role, geography and the trigger that makes your offer relevant now (a new location, a hiring push, a funding event, a leadership change).

AI helps at two points here:

• Building the list. AI can pull candidates from business databases, industry directories and company websites, then classify each company against your criteria. It is faster and more consistent than a person reading websites one by one.
• Researching each account. For every company, AI can summarize what they sell, who they sell to, recent news and anything on their site that connects to your offer.

Verify email addresses before sending. Bounces are one of the fastest ways to damage a new domain's reputation, and an email verification step is cheap compared with rebuilding a domain.

Personalization that is accurate, not creepy

Good personalization shows you understand the recipient's business. Bad personalization shows you scraped their life.

Accurate and useful:

• A reference to something the company publicly announced or offers.
• A specific problem common to companies of their size and type.
• A relevant result from similar work, stated plainly.

Creepy or risky:

• References to personal social media, family, hobbies or location.
• Guesses dressed up as facts ("I saw you are struggling with...").
• Flattery generated from a profile ("Your impressive career journey...").

The bigger AI risk is inaccuracy. Models will confidently reference a product the company discontinued or a news item about a different company with a similar name. One wrong fact undoes the credibility the personalization was meant to build. Keep personalization to one or two sentences tied to a verifiable source, and have AI cite where each fact came from so a reviewer can check it.

Use separate sending domains

Do not send cold email from your main company domain. If a campaign generates complaints or bounces, the reputation damage lands on the domain your invoices, customer support and executive mail depend on.

The standard approach is to register one or more related domains (for example, a variation of your brand name), set up a small number of mailboxes on each, and point the website on those domains to your main site. This protects your primary domain's reputation. It does not exempt you from any rule: the same authentication, consent and opt-out standards apply, and mailbox providers judge each domain on its own behavior.

Authenticate every sending domain

Each sending domain needs SPF, DKIM and DMARC before it sends a single message. Our guide to SPF, DKIM and DMARC covers the details. In short:

• SPF lists the servers allowed to send for the domain.
• DKIM adds a cryptographic signature that proves the message was not altered and ties it to your domain.
• DMARC tells receivers what to do when SPF or DKIM fail to align with the visible From domain, and where to send reports.

Example records for a Google Workspace sending domain:

example-outreach.com.         TXT  "v=spf1 include:_spf.google.com ~all"
_dmarc.example-outreach.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

For Microsoft 365, the SPF include is include:spf.protection.outlook.com. DKIM keys are generated in each provider's admin console and published as the records they give you. Also set up a custom tracking domain if your sending tool tracks links, so clicks do not route through a shared domain used by other senders.

Warm up new mailboxes

A brand-new domain and mailbox have no sending history. Sending volume immediately looks like spam. Warm-up builds a reputation gradually by sending small, increasing volumes of mail that gets opened and replied to, usually through a warm-up network built into your sending tool.

Plan on several weeks before a new mailbox carries a real campaign, and keep warm-up running at a low level after launch. We track warm-up health scores weekly for each mailbox and pause any mailbox whose score drops. Our article on email warm-up explains what matters and what is marketing.

Keep volume per mailbox low

Mailbox providers set hard limits. Google Workspace, for example, allows up to 2,000 messages per user per day (500 on trial accounts). Those are ceilings for normal business mail, not targets for cold outreach.

In practice, cold email performs best when each mailbox sends a modest number of new messages per day, spread across business hours, with the total split across several mailboxes and domains. Scale by adding mailboxes, not by pushing one mailbox harder. Watch bounce rates, spam placement and reply rates per mailbox, and slow down at the first sign of trouble.

Know the Gmail, Yahoo and Microsoft rules

Since 2024, Gmail and Yahoo have enforced requirements for bulk senders, and Microsoft added similar rules for Outlook.com in 2025.

• Gmail applies extra requirements to senders of more than 5,000 messages a day to Gmail accounts. Those bulk senders must have SPF, DKIM and DMARC (at least p=none) with alignment, support one-click unsubscribe on marketing and subscribed messages, and honor unsubscribes within two days. All senders, bulk or not, need SPF or DKIM, valid forward and reverse DNS, TLS, and user-reported spam rates below 0.3% (Google recommends staying below 0.1%). Google's email sender guidelines have the full list.
• Yahoo requires SPF and DKIM, strongly urges DMARC, requires one-click unsubscribe for marketing mail from bulk senders, and requires unsubscribes to be honored within two days.
• Microsoft requires SPF, DKIM and DMARC (at least p=none, aligned) for domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com addresses, effective May 2025. Non-compliant mail may be rejected.

One-click unsubscribe uses two headers defined in RFC 8058:

List-Unsubscribe: <https://example-outreach.com/u?id=abc123>, <mailto:unsubscribe@example-outreach.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

A well-run cold campaign should stay far below the bulk thresholds per domain. Even so, treat these standards as the baseline: authenticate fully, offer a simple way to opt out, honor it fast, and keep complaints near zero. Many sending tools can add the unsubscribe headers for you.

Follow CAN-SPAM

In the United States, the CAN-SPAM Act applies to commercial email, including business-to-business messages. According to the FTC's compliance guide, you must:

• Use accurate From, To, Reply-To and routing information.
• Use subject lines that are not deceptive.
• Identify the message as an advertisement where required.
• Include a valid physical postal address.
• Tell recipients how to opt out, and honor opt-outs within 10 business days.
• Keep the opt-out mechanism working for at least 30 days after sending.
• Monitor anyone sending on your behalf; you remain responsible.

Penalties are assessed per email and adjusted for inflation, so check the FTC's current figure. Other countries are stricter. Canada, the UK and the EU have their own rules on consent for commercial email, so get advice before emailing prospects there.

Keep a human in the loop

AI should draft, not send. Every message should pass a human review before it goes out, at least until a campaign has proven itself, and spot checks should continue after that. The reviewer checks:

• Every personalized fact against its source.
• That the offer and claims are accurate.
• Tone: would you be comfortable if the recipient forwarded it to their CEO?
• That the opt-out line and postal address are present.

We also use a writing-style setup trained on the sender's own sent mail, so drafts read like the person whose name is on them instead of like generic AI copy.

Handle replies well

Replies are the point of the exercise, and they deserve speed and care.

• Positive replies should reach a person within hours. AI can draft a response, but a human sends it.
• Questions and objections get a real answer, not another template.
• Opt-out requests, including informal ones like "not interested" or "remove me," get suppressed across every mailbox and domain immediately.
• Out-of-office replies can be parsed automatically to reschedule follow-ups.

Keep a single suppression list shared across all sending tools and domains. Emailing someone again after they asked you to stop is the fastest way to collect spam complaints.

We set up and run AI cold outreach for clients end to end, from domains and authentication through list research, drafting and reply handling, with human approval on what goes out.

Frequently asked questions

Is cold email legal?

In the United States, commercial cold email is legal if it follows CAN-SPAM, including accurate headers, a postal address and a working opt-out. Other countries, including Canada and much of Europe, have stricter consent rules, so check before emailing prospects there.

Can AI write the whole cold email?

It can draft it, but a person should review it. AI is good at research and first drafts and prone to confident factual errors, which are especially damaging in a first message to a stranger.

How many cold emails can one mailbox send per day?

Provider limits are much higher than what works for cold outreach. Keep each mailbox to a modest daily volume spread across the day, and scale by adding mailboxes and domains rather than increasing volume per mailbox.

Do I need one-click unsubscribe for cold email?

Gmail and Yahoo require it for bulk senders of marketing mail. Lower-volume cold campaigns may not hit those thresholds, but offering an easy opt-out and honoring it quickly is required under CAN-SPAM and protects your domains either way.

Why use a separate domain for cold email?

To protect your primary domain. If a campaign draws complaints or bounces, the reputation damage stays on the outreach domain instead of affecting your everyday business mail.