Cold email deliverability in 2026: the rules that matter for B2B

Most cold email deliverability advice is written around Gmail’s consumer rules. If you sell to businesses, the rules that decide whether you land are set elsewhere: in the security gateways in front of corporate mailboxes, in Microsoft’s new limits for fresh tenants, and in the suspicion every new domain starts with. Meanwhile, the numbers you used to steer by are going dark.

The famous rules are about consumer inboxes

Google defines a bulk sender as anyone who sends “close to 5,000 messages or more to personal Gmail accounts within a 24-hour period,” and its FAQ is explicit about scope: “Sender requirements and Google enforcement apply only when sending email to personal Gmail accounts,” not Google Workspace accounts. Microsoft’s equivalent, enforced since May 2025, covers senders of 5,000 or more emails a day to its consumer addresses at outlook.com, hotmail.com and live.com.

That does not make business inboxes easier. It means the gatekeepers are different, and less forgiving.

Set up SPF, DKIM and DMARC anyway. SPF lists who may send for your domain, DKIM signs each message, and DMARC ties both to your From domain and tells receivers what to do when they fail. Every gatekeeper below checks them; they are the price of entry, not an advantage.

B2B mail meets a gateway first

Many companies route incoming mail through a secure email gateway before it reaches Microsoft 365 or Google Workspace, and Proofpoint and Mimecast are the names you will see most in B2B bounce messages. Think of a corporate mailroom with a security scanner: every envelope is opened and checked before it reaches anyone. The gateway checks the sender’s reputation, scans every link, opens attachments in a sandbox and looks for impersonation.

Two of its habits matter most for cold email:

• It quarantines quietly. The default for suspicious mail is quarantine, not rejection. Your sending tool logs a successful delivery, and the recipient never sees the email unless someone in IT releases it.
• It clicks your links. Gateways rewrite and scan links, and those automated fetches register as opens and clicks. Your most engaged account may be a sandbox.

Few teams check which gateway their targets use, though an MX lookup shows it in seconds. And because a quarantine looks like a delivery, the warning signs are indirect: a company that used to answer goes silent, or a contact says they never got your email.

New domains and new tenants start on probation

Spamhaus notes that for roughly the first 30 days after registration, most threat-intelligence companies flag a new domain and watch it for mass sending. Criminals buy domains in bulk and burn them, so a domain with no history looks like one of theirs.

Spamhaus’s advice: “Don’t send a bulk email run with your newly acquired domain name.” Show who owns the domain instead of hiding it behind privacy masking, connect it visibly to your brand, and build volume slowly with recipients who engage.

Microsoft has added a probation of its own. From mid-September 2026, new Exchange Online tenants get 10% of their normal external-recipient quota in their first 30 days and 25% until day 60, and trial tenants drop from 5,000 external recipients a day to 500.

The detail most teams miss is that this limit covers the whole tenant, not one mailbox. As emailexpert puts it, “a sales team using Exchange Online for outreach could therefore prevent the rest of the business from sending ordinary external email.” An aggressive campaign from your main tenant can stop your finance team sending invoices.

The telemetry is disappearing

Four numbers outbound teams relied on are fading:

• Opens. Belkins disabled open tracking for its whole 2025 study because the tracking pixel “was hurting deliverability throughout the industry in 2024.”
• Clicks. Gateway scanners click links automatically, so click data from corporate domains is polluted.
• Reputation. Google says the domain and IP reputation dashboards in Postmaster Tools will be retired, because “reputation data is not easily actionable for most senders.”
• “Delivered.” A quarantined email counts as delivered.

What is left is what a person does: replies and meetings. Belkins now measures reply rate against every email sent rather than against opens, a stricter number and the only honest denominator left.

Eight cold email deliverability rules for 2026

1. Keep cold email off your main domain and your main Microsoft tenant.
2. Authenticate with SPF, DKIM and DMARC, aligned with your From domain.
3. Give new domains time before volume; the first month is when they are watched hardest.
4. Write plain emails: no attachments, few links, no tracking pixels.
5. Cap how much any one company receives per day, and spread volume across mailboxes.
6. Send in the recipient’s morning. In Belkins’ data, emails sent between 8 AM and noon had the best reply rate, 0.54%.
7. Stop on the first reply, and honor every opt-out.
8. When one company goes quiet, pause there instead of retrying harder. In WillItInbox’s words, “volume against a suspicious gateway confirms its judgment.”

Rule 5 matters twice in enterprise markets, where an account you annoy may not come back: your market is a pond, not an ocean.

How Dylan sends

Dylan writes from his own warm domains and mailboxes, with a separate slice for each client. Your domain never sends a cold email, so your tenant, your brand domain and your invoices stay out of it.

He caps sends per company, sends within set windows in the recipient’s time zone, and stops writing to a person the moment their reply is read, by rule, before any AI sees it. Deliverability comes from the team behind Folderly. The full set of protections is in how Dylan is built.

What to do next

Run an MX lookup on your top 50 accounts this week. If your team sends cold email from your main domain or tenant, move it before your next campaign. And take open rate off your dashboard: put replies per email sent in its place.