Cold outreach

Cold outreach only works if the message reads as though it was written to one person. A leaked merge tag — "Hi {{firstName}}" — proves the opposite in the first line, and nothing later in the email recovers it. This is the rare defect that makes a send worth less than not sending at all, which is why it blocks. Runs with no configuration; the default patterns cover `{{tokens}}`, `[COMPANY NAME]`, and placeholder filler.

An opt-out is legally required for cold outreach. CAN-SPAM applies to commercial email at any volume — there is no bulk threshold, and a one-to-one prospecting email is commercial however personal it looks (15 U.S.C. §7704(a)(3), §7704(a)(5)(A)(ii)). This check is deliberately stricter than the minimum. The statute accepts opt-out by reply — §7704(a)(3)(A)(i) names "a reply electronic mail message" as a valid mechanism — and Gmail only mandates the one-click `List-Unsubscribe` header above 5,000 messages a day, a threshold cold outreach rarely crosses. We still hold this line, because of how complaints are weighted: deliverability guidance consistently holds that a spam complaint costs far more than an unsubscribe — commonly put at 5–10× — though neither Google nor Microsoft publishes the ratio, and a recipient who cannot find an easy way out reaches for the spam button instead. A machine-readable opt-out is the cheapest insurance your sending reputation has. Worth knowing: some evidence suggests Gmail applies extra scrutiny when a one-to-one-shaped email carries bulk-sender headers. If you opt out by reply instead, you remain compliant — override this check, or build a custom set.

A valid physical postal address is mandatory in every commercial email, and cold outreach is commercial however personal it reads — CAN-SPAM sets no volume floor (15 U.S.C. §7704(a)(5)(A)(iii), 16 CFR §316.2(p)). It is also the requirement senders omit most often. Unlike a machine-readable unsubscribe, an address costs you nothing: there is no evidence it affects deliverability or reply rate, and it signals a real business behind the message. A street address, a PO box, or a registered private mailbox all satisfy the law. The check anchors on a postcode that agrees with its region, and recognises US, UK, Canadian and European formats. It fails an incomplete address on purpose — telling you that you comply when you might not is the one error here that carries legal consequences.

A cold email gets one link and one chance. This clicks every link by machine before your prospect does. It catches dead destinations, but more valuably it catches what a human proofreading the copy cannot see: a personalisation token that never resolved inside an href (`{{...}}`, `%%...%%`), or a scheme-less URL that Outlook.com silently strips. A broken link here does not just lose a click — it wastes the only touch you get with that person. Two kinds of link are never fetched, because fetching them would do something rather than read something: your unsubscribe and preference links, since following a one-click opt-out would actually opt someone out; and links whose path names an account action — verify, confirm, activate, reset, revoke and the like — since those endpoints complete on GET. Both are listed in the result with the reason they were skipped, so nothing disappears quietly. Failures are trustworthy by design. Bot-protection responses (401/403/429) are reported as *unverifiable* rather than failed, because Cloudflare-class protection serves those to automated checkers and never to a human with a browser; transient errors are retried once before any verdict. A FAIL means the link is provably broken for everyone. One caveat: fetching a tracked link registers a click, and ESP click-redirectors are still followed. Validate a test send, not a live campaign — and note Salesforce Marketing Cloud has no native bot-click filtering.

Checks that the domain in your `From:` header is one you actually own, using DMARC relaxed alignment — `reply.yourbrand.com` matches `yourbrand.com`, because only whoever controls your DNS can create that subdomain, while `notyourbrand.com` never matches. Cold outreach has no reputation buffer, so a mismatched or spoofed sender domain is expensive. Needs one piece of configuration: the domains you send from. Until you provide them the check is skipped rather than failed.

Mobile clients cut the subject line at 35–40 characters, and an analysis of roughly 12 million outreach emails found the 36–50 character band drew about a third more replies than very short ones. This flags subjects past 60 characters — a loose outer bound rather than the ideal, so read a pass as "not obviously too long" rather than "optimal". It cannot tell you a subject is too short or too vague; that judgement stays yours.

The text beside your subject line in the inbox is the second thing a prospect reads, and in a plain email it is simply your opening sentence. This checks that preview is not working against you: no leftover "view in browser" boilerplate, no merge token that failed to resolve, no bare URL, nothing cut off mid-thought. It does **not** ask you to add a hidden preheader block. That is a marketing-automation pattern a genuine one-to-one email would not have, and adding one earns you nothing here.

Cold outreach should carry at most one image — the working guidance is roughly 95% text — and Gmail already treats images as a security risk. If you do include one, alt text is what the recipient sees when images are blocked, which is the default in many corporate mail clients. Missing alt text is a documented deliverability negative, not only an accessibility gap. Placeholder values like "image" or "banner" are rejected as no better than nothing. An email with no images passes at no cost.

If you track clicks, this makes sure you will actually get the data. It grades only the tracking already on your links and never asks you to add any: unresolved merge tokens such as `utm_campaign={{campaign.name}}`, empty or duplicated parameters, misspelled UTM keys that analytics silently ignores, a raw email address sitting in a query string, and stray `gclid` or `fbclid` parameters that reveal a URL was pasted from a browser after an ad click. No links are fetched, so nothing here registers a click. Worth knowing: click tracking is **not** penalised by sending volume. The real risk is the reputation of the domain your links redirect through — a shared tracking domain pools reputation with every other sender on your platform. A custom tracking domain on your own subdomain isolates you from that.

Gmail stops rendering a message at roughly 102KB of HTML and hides the rest behind a "View entire message" link, taking the end of the email with it — including your opt-out. A cold email should never come close to this. If one does, something is wrong with how it was built rather than with what it says: a pasted image encoded into the HTML, or a template that was meant to be light and is not. That is worth catching before it sends, because a cold email that arrives with a "[Message clipped]" banner reads as a mass blast in the first second, which is the one impression this category cannot afford. It blocks for the same reason it will almost never fire.