Cold Email Deliverability for Investor Outreach: Setup Guide

Good cold email deliverability for investor outreach comes down to four things: send from a real mailbox on your own company domain, set up SPF, DKIM and DMARC, spend about two weeks sending normal low-volume email first, then send your investor emails in small personalized batches. Google defines a bulk sender as one sending close to 5,000 messages in 24 hours to personal Gmail accounts, so 100 emails are far below that line. Volume limits are not your problem. Relevance and list quality are.

Should I email investors from my main domain or buy a new one?

For about 100 hand-picked investors, use a mailbox on your main company domain. A second domain solves a problem you don't have yet, and it adds trust and setup costs.

Option	Advantages	Risks	Verdict
Mailbox on your main company domain	Consistent identity. Investors can check your site. Existing domain history may help.	Bad sending behavior can hurt the company domain's reputation.	Best choice for about 100 targeted investors.
New lookalike domain (e.g. getcompany.com)	Separates outreach reputation from your main domain. Useful for ongoing, legitimate volume.	No sending history. Needs setup and gradual sending. Can look deceptive.	Only for recurring or much larger outreach.
Free Gmail address	Fast and cheap.	Less professional. Weaker brand consistency. Less control over authentication.	Fine for a very small personal introduction, not the preferred setup.

A new domain is not a shortcut around filtering. It has no sending history, and Google advises increasing volume slowly to avoid delivery problems.

If you do use a new domain for outreach:

• Register it well before the campaign.
• Publish a simple website that clearly identifies your company.
• Redirect it to your main site only if the relationship is obvious.
• Make the company name, signature and contact details match your main brand. It should never look like an unrelated identity.

Google Workspace and Microsoft 365 are both fine for ordinary one-to-one outreach. Microsoft states that Exchange Online bulk email is not a supported use and is allowed only on a best-effort basis. Bulk-mail and cold-email tools can add shared infrastructure, tracking links, automated follow-ups and extra compliance obligations, so don't adopt one just to send 100 messages.

What are SPF, DKIM and DMARC in plain words?

These are three DNS records that prove an email really comes from you. Here is SPF, DKIM and DMARC for founders, without the jargon:

• SPF is a public list of which email systems may send for your domain. Think of the guest list at the building entrance.
• DKIM is a cryptographic signature on each message. It shows your domain authorized the email and nobody changed it in transit. Think of a tamper-evident seal.
• DMARC tells receiving servers what to do when SPF or DKIM fails, and where to send you reports. It also checks that the authenticated domain matches the domain in the visible From address. Think of a standing instruction to the doorman, with a report back to you.

Google requires everyone sending to Gmail accounts to use SPF or DKIM, and bulk senders must use SPF, DKIM and DMARC. Set up all three anyway, even though you are nowhere near bulk volume. It costs an hour and removes an obvious reason for filtering.

Authentication does not guarantee inbox placement. It proves who you are. Engagement, complaints, bounces, content and sending behavior still decide whether you land in the inbox.

How do I set up SPF, DKIM and DMARC step by step?

1. Create a named mailbox, such as founder@yourdomain.com, not a generic anonymous address.
2. Open DNS management at your registrar or DNS host (Cloudflare, for example).
3. Publish SPF. Copy the value Google Workspace or Microsoft 365 gives you. Add any legitimate third-party senders, but keep only one SPF record.
4. Turn on DKIM. In Google Workspace, generate the key in the Admin console. In Microsoft 365, use the Defender or Exchange authentication settings. Publish the public key as a TXT or CNAME record, then go back to the admin console and switch signing on.
5. Publish DMARC in monitoring mode. Start with p=none and a reporting address. Tighten the policy only after your legitimate senders pass authentication and alignment.
6. Test. Send messages to Gmail, Outlook and one other provider. Open the full headers and look for SPF, DKIM and DMARC all showing pass.
7. Read the DMARC aggregate reports to see which systems send for your domain and whether they align.

Placeholder record shapes (your provider supplies the real values):

SPF   (TXT on yourdomain.com)
v=spf1 include:provider.example ~all

DKIM  (TXT or CNAME)
Host:  selector1._domainkey.yourdomain.com
Value: v=DKIM1; k=rsa; p=PUBLIC_KEY_HERE

DMARC (TXT)
Host:  _dmarc.yourdomain.com
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

The common mistakes:

• Publishing two SPF records.
• Leaving out a legitimate sender.
• Publishing a DKIM key but never switching signing on.
• Sending through one domain while showing another in From, which breaks alignment.

How do I warm up a new mailbox in two weeks?

Email warm-up means building a pattern of normal, wanted email before any outreach: real conversations, replies, modest volume and few bounces. Google advises increasing sending volume slowly, but it does not prescribe a two-week schedule or a daily ramp number, and I found no warm-up guidance from Microsoft either. Treat the schedule below as cautious practice, not an official requirement.

Here is the plan. The volume column is deliberately qualitative, because neither Google nor Microsoft publishes a safe daily number for a new mailbox.

Day	Action	Who you email	Volume	What to check
1	Create the mailbox, publish SPF, start DKIM	Your own test accounts	Test messages only	Mailbox identity, SPF
2	Finish DKIM, publish DMARC p=none, send tests	Your Gmail, Outlook and one other account	Test messages only	Headers show SPF, DKIM, DMARC pass
3-5	Normal two-way conversations, ask for replies	Colleagues, advisers, mentors	A few per day	Real replies, bounces, spam placement
6-7	Moderate, steady increase	Known contacts	Low and steady	No sudden spike, bounces
8-9	Widen cautiously	Lower-stakes professional contacts	Slightly higher, still modest	Gmail and Outlook seed tests
10	Prepare the campaign: verify addresses, finish copy	No investor send yet	Minimal	Remove invalid and role-based addresses
11	First small investor batch	Warmest, best-fit investors	Small batch	Pause if bounces or spam placement rise
12	Review the first batch	Nobody new	None or minimal	Replies, bounces, headers
13-14	Second and third small batches	Best-fit, high-priority investors	Small batches	Keep copy individualized
After 14	Remaining investors in batches	Remaining qualified investors	Small batches over several days	Adjust to bounces, replies, placement

The real work in days 3 to 9 is genuine conversation. Ask people to reply, and reply back. Pause if bounces rise, messages start landing in spam, or anyone complains.

Automated warm-up services generate artificial messages, replies and opens. You don't need them, and artificial engagement can create misleading signals or conflict with what providers expect. Treat them as a risk decision, not a prerequisite.

How many emails can I send per day without getting flagged?

For 100 investors, hard sending limits are unlikely to be your constraint. Relevance, bounces, complaints and recipient behavior are the real risks.

It helps to separate two things. A hard limit makes the platform reject or stop your mail. A reputation threshold affects inbox versus junk placement. Staying under a hard limit does not make a campaign safe.

Google

• The bulk-sender threshold from the top of this article is far above your volume, but the SPF, DKIM and DMARC requirements are a good baseline for everyone.
• When a Workspace sending limit is exceeded, Gmail can return a daily-user-limit error instead of sending.
• Workspace also has per-user recipient limits, and limits for new or trial accounts. Check the current figures on Google's official Workspace limits page before you plan a send.

Microsoft

• Exchange Online lists a 10,000-recipient-per-day limit for the standard plans in its limits table.
• SMTP client submission lists a throttle of 30 messages per minute and 10,000 recipients per day.
• For Outlook.com, Microsoft 365 subscribers get 5,000 daily recipients, 500 recipients per message and 1,000 daily non-relationship recipients. These can vary with account history and can be lower for non-subscribers.
• Exchange Online bulk email remains unsupported and best-effort only.

Providers change these figures, so confirm them on the linked pages before you rely on them.

What protects cold email deliverability for investor outreach once I start sending?

Authentication gets you through the door. After that, what you write and who you write to decide placement. Before you send, check these:

• Give each investor a genuine reason for contacting them.
• Keep it plain-text-leaning, with one clear, low-friction ask.
• Attach nothing to the first message.
• Use few links and no link shorteners.
• Leave tracking pixels off at first.
• Sign with your real name, company, role and contact details.
• Offer a simple opt-out.
• Verify addresses and drop stale or risky ones.
• Don't blindly email role addresses like info@ or investments@.

Spread sends over several days and stagger the times. Follow up only with non-repliers, after a reasonable gap. If someone says "not interested" or asks you to stop, suppress them permanently.

Example email (placeholders in brackets, write your own for every investor):

Subject: [Investor first name], question on [their stated focus]

Hi [First name],

I read your post on [specific topic] and thought of what we're building: [one sentence on the company and who it serves].

[One concrete proof point.]

Would it be useful if I sent a short summary?

If you'd rather not receive messages from me, say so and I won't follow up.

[Name], [Role], [Company], [website]

Building a targeted list and writing individual emails is the slow part. I run HeyEveryone (heyeveryone.io), which matches you with investors and drafts one personalized email per investor, then sends from your own Gmail or Outlook mailbox. Everything in this guide applies to that setup too.

A short compliance note. In the US, CAN-SPAM covers sender identification, non-deceptive subject and routing information, a working opt-out, and honoring opt-outs. Whether investor outreach counts as commercial email is fact-specific. In the EU and UK, GDPR and PECR can apply, including lawful basis, transparency and an objection route. Keep a record of where each address came from, and get legal advice before a large campaign.

How do I check if my emails are landing in spam, and what do I do if they are?

Check before you send the whole list, not after.

• Seed tests. Send to accounts you control at Gmail, Outlook and one other provider. See whether each message lands in the inbox, promotions or spam.
• Headers. Confirm SPF, DKIM and DMARC pass, and that the visible From domain matches the authenticated domain.
• Bounce codes. Read the rejection explanations.
• DMARC aggregate reports. They show who is sending as your domain and whether it aligns.
• Google Postmaster Tools. It reports spam rate and reputation for eligible traffic. Google's guidance is to keep the spam rate below 0.1% and never reach 0.3% or higher. A 100-email campaign may produce little or no useful data there.

A high reply rate does not prove inbox placement, but rising bounces or spam placement is a reason to stop and investigate.

If messages land in spam:

1. Stop sending the rest of the campaign.
2. Confirm SPF, DKIM and DMARC pass and align.
3. Remove invalid, stale or weakly relevant addresses.
4. Rewrite promotional copy and cut unnecessary links and tracking.
5. Review bounces and complaints.
6. Resume with a smaller, more relevant batch.
7. Don't jump to a lookalike domain as a workaround.

FAQ

Do I really need a new domain to email investors?

Usually not. For about 100 carefully selected investors, use your authenticated main domain and send in restrained batches.

Is it OK to send investor outreach from a Gmail address?

It can work for a small personal introduction. A company-domain mailbox is more credible and gives you better control over SPF, DKIM and DMARC.

How long should I warm up a new mailbox before emailing investors?

Two weeks is a cautious practice, not an official rule. Google says to increase volume slowly and publishes no universal schedule.

Do SPF, DKIM and DMARC guarantee inbox placement?

No. They authenticate you, but targeting, complaints, bounces and content still affect placement.

Can I use a mass-mailing or cold-email tool for 100 investors?

You can, but weigh the trade-offs. Microsoft says Exchange Online bulk email is unsupported and best-effort only. Tools can add tracking, shared infrastructure, automated follow-ups and compliance obligations.

What should I do if an investor says my email went to spam?

Pause the campaign, check authentication and headers, remove weak addresses, simplify the message, and resume with a smaller batch. Don't keep retrying the same recipient without fixing the cause.