> Enrich.chat gives AI agents verified work emails and mobiles. To use it from an agent, read https://enrich.chat/agents.md . This is the Markdown version of https://enrich.chat/blog/cold-email/

# Cold email in 2026: the data side, from list sourcing to sender rules

Your list sets your bounce rate, your spam complaints and your legal exposure before you write a word. Here is how to source it, check each address, follow Google, Yahoo and Microsoft rules, and keep the list clean.

By Enrich.chat Editorial. Updated October 15, 2026.

**Short answer:** Cold email data is the list behind every send: a named person, a work email with a status, and a record of its source and any opt-out. Verify each address, hold back catch-all and unknown results, and keep one suppression list that every tool reads. [Google](https://support.google.com/a/answer/81126) asks senders to keep user-reported spam below 0.10% and never reach 0.30%, and [Yahoo](https://senders.yahooinc.com/best-practices/) asks bulk senders to honor unsubscribes within 2 days.

## Key takeaways

- Keep seven fields per contact: name and title, work email, email status with its date, company website, country, source, and an opt-out flag.
- Send confirmed addresses first and cap catch-all ones. In Hunter's test, 100 accept-all addresses bounced at 27% against 1% for 100 valid ones, and Hunter suggests keeping them to 2% to 5% of a list.
- Google asks senders to keep user-reported spam below 0.10% and never reach 0.30%. Yahoo asks bulk senders to honor unsubscribes within 2 days, and CAN-SPAM and CASL allow up to 10 business days. The 2-day rule covers all of them.
- The law differs by country: CAN-SPAM has no B2B exception, CASL requires express or implied consent, and the UK email rule exempts companies but not sole traders.
- In Hunter's data, sequences of 21 to 50 recipients averaged a 6.2% reply rate against 2.4% for 500 or more. That is correlation from one vendor's users.

## What is cold email data, and why does the list matter most?

Cold email data is the set of records behind each cold send. A record holds a named person, a role, a company website, a work email with a status, a source, and a flag for anyone who has opted out. [Wikipedia](https://en.wikipedia.org/wiki/Cold_email) defines a cold email as an unsolicited email sent to a receiver without prior contact. The recipient never asked for it, so your record is where you show why you wrote.

List quality shows up first as bounces. [Hunter's 2026 report](https://hunter.io/the-state-of-cold-email) covers 31 million emails its users sent in 2025. It puts the average bounce rate at 3.6% and says bounces are typically caused by unverified contact information. Our guide to the [email bounce rate](https://enrich.chat/blog/email-bounce-rate/) explains the 2% target and how each platform counts bounces, so this page does not repeat it.

This guide covers the data layer only: sourcing, fields, status labels, sender rules, list hygiene and law. It leaves out copywriting. The figure shows the path from a raw list to a send list, and each section below covers one step.

**Figure 1: Six checks between a raw list and a send.** Six stacked steps. One, source: know where every row came from and use no bought lists. Two, match: one named person at one company website. Three, status: check the email status of each row and sort it into send, hold or drop. Four, suppress: remove opt-outs, bounces and complaints using one shared list. Five, send: use small batches, raise volume slowly and keep the spam rate under 0.3 percent. Six, learn: bounces and opt-outs flow back to step four.

*The six checks between a raw list and a send, with the rule that drives each one. The 0.3% spam limit comes from [Google](https://support.google.com/a/answer/81126) and [Yahoo](https://senders.yahooinc.com/best-practices/). Bounces and opt-outs loop back to the suppression step.*

## Where should a cold email list come from?

Build the list from your own records and from lookups you can name and date. Avoid bought and scraped lists, and treat guessed addresses as something to check, not to send. The table sets out five routes and the risk of each.

| Route | Main risk | What the sources say |
| --- | --- | --- |
| Your own records | Records age as people change jobs, and opt-outs may be missing | Check them against your suppression list and re-check the emails. See [how fast B2B contact data goes bad](https://enrich.chat/blog/b2b-data-decay/). |
| A data provider or enrichment API | Quality differs by vendor, and the same status word can mean different things | In the UK, if you collect personal data from a third party, the [ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) says to give privacy information within a reasonable period and no later than one month. |
| Guessed addresses | Many do not exist and will bounce, and automated guessing adds legal risk | The [CAN-SPAM statute](https://www.law.cornell.edu/uscode/text/15/7704) adds an aggravated violation when a message that already breaks the law goes to an address the sender knew came from automated permutations of names, letters or numbers. |
| Scraped addresses | Seeded spam traps, and no record of consent | [Spamhaus](https://www.spamhaus.org/resource-hub/deliverability/spamtraps-fix-the-problem-not-the-symptom/) says a hit on a seeded trap suggests the sender scrapes addresses or buys lists. |
| Bought or rented lists | Spam traps, unknown consent, no source record | [Google](https://support.google.com/a/answer/81126) says not to purchase email addresses from other companies. [Yahoo](https://senders.yahooinc.com/best-practices/) says not to purchase mailing lists. [Amazon SES](https://docs.aws.amazon.com/ses/latest/dg/faqs-enforcement.html) says not to buy, rent or share addresses. |

Whatever the route, write down the source and the date for every row. You need them to answer a complaint, to send privacy notices and to trace a bad batch. Our guide to [business email formats](https://enrich.chat/blog/email-address-formats/) shows how guessed addresses are built. The [LinkedIn scraping guide](https://enrich.chat/blog/is-linkedin-scraping-legal/) covers the law on scraped profile data.

## Which data fields do you need before you send?

Keep seven fields for each contact. Together they tell you whether to send, which rules apply, and what to remove if the person opts out.

| Field | Why you need it |
| --- | --- |
| Name and title | Merge fields and fit checks. In the UK, a named person at work is personal data under UK GDPR, [says the ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/). |
| Work email | The address itself. Keep it exactly as returned. |
| Email status and date checked | Sets send, hold or leave out. A status is a snapshot, so date it. [Hunter's API](https://hunter.io/api-documentation/v2#email-verifier) returns a verification date that can be up to a month old. |
| Company website | Groups people by company. In [Hunter's data](https://hunter.io/the-state-of-cold-email), emailing one or two people per company got a 5.1% reply rate against 3.5% for three or more. |
| Country or state | Decides whether US, UK or Canadian rules apply. See the law section below. |
| Source and date added | Needed for privacy notices, complaints and tracing a bad batch. |
| Opt-out and bounce flag | Feeds your suppression list, so nobody is mailed twice after asking you to stop. |

Store the status next to each email and the date next to each status. Mailboxes change when people change jobs, as the [data decay guide](https://enrich.chat/blog/b2b-data-decay/) shows, so a status from last quarter is weaker than one from last week.

## What do email statuses mean, and which ones should you send to?

A status label tells you how sure a check was that the mailbox exists. Send to confirmed addresses first, cap the ones that cannot be confirmed, and leave out the rest. The table lines up the labels used by Hunter and ZeroBounce.

| Plain meaning | Hunter | ZeroBounce | Send rule |
| --- | --- | --- | --- |
| Mailbox confirmed | `valid` | `valid` | Send first, in small batches |
| Server accepts every address | `accept_all` | `catch-all` | Cap it or hold it back |
| Check could not finish | `unknown` | `unknown` | Leave out until it is re-checked |
| Mailbox does not exist | `invalid` | `invalid` | Drop it |
| Risky by type | `disposable` | `do_not_mail` | Leave out |

The labels differ in detail. [ZeroBounce](https://www.zerobounce.net/docs/email-validation-api-quickstart/v2-status-codes) says a catch-all address is impossible to validate without sending a real email and waiting for a bounce. It suggests you put catch-all addresses in their own group and expect some bounces. It says an unknown result means the check could not finish, for example because a server was offline or an anti-spam system blocked it, and that about 80% of its unknowns turn out to be invalid. That figure is the vendor's own claim.

The catch-all rule matters most. [Hunter](https://hunter.io/email-verification-guide/accept-all-catch-all/) sent one campaign to 100 accept-all addresses and 100 valid ones. The accept-all group bounced at 27% and the valid group at 1%. It is one small test by a verifier vendor, but the gap is wide. Hunter suggests keeping accept-all addresses to 2% to 5% of a list when you must include them. You can test any domain with the free [catch-all checker](https://enrich.chat/tools/catch-all-checker/).

**Figure 2: Send, hold or leave out, by email status.** Three cards sort email statuses into actions. A valid status means the check found the mailbox is valid, so send first and read bounces before the next batch. An accept_all status means the server accepts every address, so it cannot be confirmed: cap it at 2 to 5 percent of a list. An unknown or invalid status means leave the address out, drop invalid ones and re-check unknown ones. Below, Hunter tested 100 accept-all addresses and 100 valid addresses with the same campaign: 27 percent of the accept-all addresses bounced against 1 percent of the valid ones.

*Send, hold or leave out, by status, using Hunter's labels. The caps follow [Hunter's guidance and test](https://hunter.io/email-verification-guide/accept-all-catch-all/) of 100 addresses in each group. The three actions are our suggested rules, not an industry standard.*

### How does a verifier reach a status?

A verifier runs a series of checks and reports the result as one label. [Hunter's API](https://hunter.io/api-documentation/v2#email-verifier) shows the steps as separate fields: a format check, whether the domain has MX records, whether it could connect to the SMTP server, whether the address bounced in the SMTP check, and whether the domain accepts all addresses. It also flags addresses that look generated, disposable or webmail. Hunter warns that SMTP checks on an accept-all domain can give false positives, and a server can block the check. That is why catch-all and unknown exist as labels.

### What about role and disposable addresses?

Leave them out. [ZeroBounce](https://www.zerobounce.net/docs/email-validation-api-quickstart/v2-status-codes) calls role addresses such as sales@ and info@ valid but strongly linked to spam reports, and it flags disposable addresses as ones that will bounce later. [Spamhaus](https://www.spamhaus.org/resource-hub/deliverability/spamtraps-fix-the-problem-not-the-symptom/) says role addresses published in domain records, such as postmaster@, should almost never be on a marketing list.

### How long does a status stay good?

Not long. A status describes the mailbox on the day it was checked. [Smartlead](https://www.smartlead.ai/blog/cold-email-bounce-rate) says to re-verify any address not checked in the last 90 days. Re-check before each send, and see the [decay guide](https://enrich.chat/blog/b2b-data-decay/) for a refresh schedule.

## What do Google, Yahoo and Microsoft require from cold email senders?

All three require authentication. Google and Yahoo also cap spam complaints and ask bulk senders to make unsubscribing easy. None of their pages mentions cold email, so the rules reach you by volume and by how recipients treat your mail.

| Rule | What the providers say | What it means for your list |
| --- | --- | --- |
| Authenticate the domain | [Google](https://support.google.com/a/answer/81126): all senders need SPF or DKIM, and senders of about 5,000 or more messages a day to personal Gmail need SPF, DKIM and DMARC. [Yahoo](https://senders.yahooinc.com/best-practices/): bulk senders need SPF, DKIM and a DMARC policy of at least p=none. [Outlook.com](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730): domains sending over 5,000 emails a day need all three. | Fix this before the first send. A clean list cannot rescue a domain that fails authentication. |
| Keep spam complaints low | Google: keep the user-reported spam rate below 0.10% and never reach 0.30%. Yahoo: stay below 0.3%, calculated on mail delivered to the inbox. | Every unwanted recipient adds to the rate. Tight targeting is the main control. See the [ICP guide](https://enrich.chat/blog/ideal-customer-profile/). |
| Make unsubscribing easy | [Google](https://support.google.com/a/answer/14229414): bulk senders need one-click unsubscribe on marketing mail, and it recommends acting within 48 hours. Yahoo: bulk senders need a List-Unsubscribe header and must honor unsubscribes within 2 days. | Opt-outs must reach your suppression list within days, in every tool that sends. |
| Keep the list clean | Google: do not purchase email addresses. Yahoo: do not purchase mailing lists, and remove invalid recipients promptly. Microsoft: remove invalid addresses regularly. | Know the source of every row. Move hard bounces to suppression the same day. |

Three details change how you read these rules. First, Google's [sender FAQ](https://support.google.com/a/answer/14229414) says its guidelines do not apply to messages sent to Google Workspace accounts, only to personal Gmail accounts. Second, the same FAQ says Gmail began ramping up enforcement in November 2025, with temporary and permanent rejections for mail that fails the requirements. Third, [Microsoft's announcement](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730), updated April 29, 2025, says non-compliant mail from high-volume domains goes to Junk after May 5, 2025, with rejection to follow on a date to be announced. It also says Outlook may filter or block non-compliant senders. Check Microsoft's page for the current status, and treat all three sets of limits as a floor.

Google counts messages from the same primary domain together toward its bulk sender limit, so sending from subdomains does not lower the count. Bulk sender status is permanent once reached, says the same FAQ. The unsubscribe header is a standard: [RFC 8058](https://www.rfc-editor.org/rfc/rfc8058.html) defines a List-Unsubscribe header with an HTTPS address and a List-Unsubscribe-Post header, so a mailbox provider can send the opt-out for the person. Check that your sending tool adds both, and that each opt-out lands in your suppression list.

Google also tells senders to make sure recipients opt in to messages. A cold recipient has not. That makes your complaint rate the number to watch, and a small, well-matched list is the best control you have. Our [AI lead generation guide](https://enrich.chat/blog/ai-lead-generation/) compares the provider limits side by side, and the [bounce rate guide](https://enrich.chat/blog/email-bounce-rate/) lists what each sending platform enforces.

## How do you keep a cold email list clean after you send?

Keep one suppression list that every sending tool and your CRM read, and add to it the same day. It should hold hard bounces, unsubscribes, spam complaints and anyone who replies asking you to stop.

- **Hard bounces.** [Amazon SES](https://docs.aws.amazon.com/ses/latest/dg/faqs-enforcement.html) says to remove bounced addresses and stop sending to them immediately. It adds that early removal keeps them from being turned into spam traps. [Spamhaus](https://www.spamhaus.org/resource-hub/deliverability/spamtraps-fix-the-problem-not-the-symptom/) says dead addresses often bounce for 12 months or more before they return as traps.
- **Spam complaints.** Amazon SES says to stop sending to anyone who complains, without even a confirmation message. It adds that for every person who complains, dozens more may not have liked the mail, so fix the cause too.
- **Unsubscribes and replies asking to stop.** Treat a reply that asks you to stop as an opt-out. The clock for acting on it depends on the rule, as the chart shows.

Suppress an address, do not delete it. The [ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) tells senders to add an objecting contact to a suppression list instead of deleting every record, so you can screen new lists against it. The [FTC's CAN-SPAM guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) adds that you cannot sell or transfer the address of someone who opted out, even as part of a mailing list, unless it goes to a company you hired to help you comply.

One suggestion of ours: store the person's name and company website next to each suppressed address. A person who opted out can return on the next list under a new address, and a match on the email alone will miss them.

**Figure 3: How fast you must stop mailing after an opt-out.** A bar chart of the time allowed to stop emailing someone who opts out. Yahoo asks bulk senders to honor unsubscribes within 2 days. Google recommends acting within 48 hours, which is also 2 days. The US CAN-SPAM Act and Canada's CASL both allow no more than 10 business days, drawn here as about 14 calendar days.

*Time allowed to stop mailing after an opt-out. Sources: [Yahoo](https://senders.yahooinc.com/best-practices/), [Google's FAQ](https://support.google.com/a/answer/14229414), the [FTC](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) and [CASL, section 11](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html). Ten business days is drawn as 14 calendar days, two weeks with no holidays. The UK has no day count; the ICO calls the right to object to direct marketing absolute.*

The sender rules set the shortest clock. Yahoo asks bulk senders to honor unsubscribes within 2 days and Google recommends 48 hours, while the US and Canadian laws allow up to 10 business days. Use the 2-day rule for every list, in every country, and your suppression list stays ahead of all four.

Expect the list to shrink after each send. Hunter's users saw an average unsubscribe rate of 1.6%, which is about 16 opt-outs for every 1,000 emails. Before the next send, add those opt-outs, re-check the emails you plan to use and review the [bounce numbers](https://enrich.chat/blog/email-bounce-rate/) from the last batch.

## What do the laws say about B2B cold email lists?

Cold email is not illegal by itself, but the rules differ by country. The US allows it with an opt-out, Canada requires consent that can be implied, and the UK exempts companies from its email consent rule but not people from data protection law. This is general information, not legal advice.

| Where | Main rule for B2B cold email | What it means for your list |
| --- | --- | --- |
| United States: [CAN-SPAM](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) | The law makes no exception for business-to-business email. Messages need accurate headers and subject lines, a clear notice that they are ads, a valid postal address and an opt-out you honor within 10 business days. Each email in violation can cost up to $53,088. | Keep an opt-out flag. Never sell or transfer an opted-out address. Know where each address came from. |
| United Kingdom: [PECR and UK GDPR](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) | The PECR email rule does not apply to corporate subscribers such as companies. Sole traders and some partnerships count as individuals and need consent or the soft opt-in. UK GDPR still covers named people, and their right to object to direct marketing is absolute. | Record the company type if you can. If you are unsure, treat the contact as an individual. Suppress objectors. |
| Canada: [CASL](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html) | A commercial electronic message needs consent, express or implied. A published address gives implied consent only if it was conspicuously published, carried no refusal statement, and the message relates to the person's role. Opt-outs must be honored within 10 business days. The maximum penalty is $10,000,000 for a violation by anyone other than an individual. | Record how you got each address and when. Split Canadian contacts into their own segment. |

The country field decides which row applies. A list that mixes the three should follow each contact's own rule, not an average of them. Other countries have their own rules, so check them before you add a country to a send.

Phone and text follow other laws. Our guide to [TCPA and B2B cold calling](https://enrich.chat/blog/tcpa-b2b-cold-calling/) covers them. Using any data tool, including Enrich.chat, does not make a send compliant. You stay responsible for CAN-SPAM, GDPR and the other rules that apply to you.

## How many people should you email at once?

Start small, send verified addresses first, and raise volume only while bounces and complaints stay low. Published figures favor tight segments and a modest number of emails per mailbox per day.

[Hunter's 2026 report](https://hunter.io/the-state-of-cold-email) compares reply rates for three list choices.

| List choice | Higher reply rate | Lower reply rate |
| --- | --- | --- |
| Recipients per sequence | 21 to 50 recipients: 6.2% | 500 or more: 2.4% |
| People contacted per company | One or two: 5.1% | Three or more: 3.5% |
| Emails per account per day | 20 to 49: 5.7% | All accounts: 4.5% average |

These are correlations from one vendor's users, not proof of cause. Hunter says the result does not mean you cannot scale. It means you need to split a large list into segments and tailor the offer to each. For the list, that means one clear ICP per segment, as the [ICP guide](https://enrich.chat/blog/ideal-customer-profile/) shows.

Sending tools set their own caps. [Instantly](https://instantly.ai/blog/cold-email/) advises warming each new inbox for two to four weeks, starting at 5 to 10 emails a day, and capping campaign sends at 30 per inbox per day. [Google](https://support.google.com/a/answer/81126) says to ramp volume up gradually, and to reduce it when messages bounce or are deferred until the error rate falls. These are vendor figures, not inbox provider rules.

As an illustration, 600 verified contacts at 30 emails per inbox per day across 3 inboxes is 90 emails a day, so the first step of the sequence takes 7 sending days. Send the verified group first. Read the bounce rate and complaints, then add the next group, and keep catch-all addresses to the small share described above.

## How can an AI agent build and check a cold email list with Enrich.chat?

An agent can build the list from one prompt: search by role and company traits, look up each work email, and sort the results by status. Enrich.chat supplies the contacts and the statuses. It does not send email, warm up inboxes or manage your suppression list.

The agent reads [enrich.chat/agents.md](https://enrich.chat/agents.md) once, or you add the MCP server at `https://enrich.chat/mcp`. The [agents page](https://enrich.chat/agents/) has setup steps for ChatGPT, Claude, Cursor and more. No key is needed to start. Here is how the seven fields from earlier map to requests:

| Field | How the agent gets it |
| --- | --- |
| Name and title | `/v1/search` with role, industry, country and headcount filters, or `/v1/company/people?domain=` |
| Work email and status | `/v1/person?linkedin_url=` with `fields=email` returns the address and its status |
| Company website | Your own list, or the `company_domain` filter on `/v1/search` |
| Country or state | `/v1/company?domain=` returns industry, headcount, state and country |
| Source, date and opt-out flag | Kept by you, in your sheet or CRM |

Enrich.chat labels each work email `verified`, `catch_all` or `unknown`, from our records. They line up with the confirmed, accept-all and unchecked groups in the status section above. When nothing matches, `found` is false and there is no address to send to. Search results that include an email carry the status `unknown`, so the agent runs each LinkedIn URL through `/v1/person` to get the status. A LinkedIn URL is only a lookup key, and Enrich.chat never logs in to LinkedIn.

```
GET https://enrich.chat/v1/person
  ?linkedin_url=linkedin.com/in/jane-doe-ops
  &fields=email

{
  "found": true,
  "work_email": {
    "value": "jane.doe@acmelogistics.com",
    "status": "catch_all"
  },
  "credits_used": 10,
  "free_lookups_remaining": 9
}
```

The agent then applies the send rules from this guide: `verified` first, `catch_all` held back, and `unknown` or not found left out. Treat every contact as a strong lead, not a guarantee. This prompt does the whole sort:

```text
Use www.enrich.chat to find 25 heads of marketing at US software companies with 50 to 200 employees. Look up each work email and show its status. Put verified emails in one list, catch_all emails in a second list to hold back, and unknown or not found in a third. For each person include name, title, company website and LinkedIn URL, and report the total credits used.
```

You get 10 free API lookups a day with no signup, and one search counts as one lookup however many people it returns. Beyond that, plans start at $29 a month for 100,000 credits, billed monthly with unlimited seats. A person returned by search uses 5 credits, a work email found uses 10, and a lookup that finds nothing uses 0. If every person on a 1,000-person list comes back with an email, the list uses 15,000 credits. That fits the Growth plan at $29 a month. See [Enrich.chat pricing](https://enrich.chat/pricing/) for every plan.

### What does Enrich.chat leave to you?

- **Sending and warm-up.** Enrich.chat does not send email or warm up inboxes. Use your own sending tool.
- **Suppression.** It does not hold your opt-out list. Keep it in your CRM or sheet and check every list against it. People can also remove their own data at [enrich.chat/opt-out/](https://enrich.chat/opt-out/).
- **Compliance.** A status is a label from our records, not a guarantee, and it does not decide whether you may email someone.

For the lookups behind this workflow, see the [person enrichment API](https://enrich.chat/api/person-enrichment/), the [people search API](https://enrich.chat/api/people-search/) and the free [email finder](https://enrich.chat/tools/email-finder/). The [waterfall enrichment guide](https://enrich.chat/blog/waterfall-enrichment/) shows how to combine more than one source when one returns nothing.

## Frequently asked questions

### Is cold emailing illegal?

Not by itself, but the rules depend on where you send. The FTC says [CAN-SPAM](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) makes no exception for business email: you need honest headers, a postal address and an opt-out you honor within 10 business days. [Canada's CASL](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html) requires express or implied consent. The [ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) says the UK email rule exempts companies, but data protection law still covers named people. This is not legal advice.

### Do Google and Yahoo sender rules apply to cold email?

Yes, by volume and behavior, not by label. Neither [Google's](https://support.google.com/a/answer/14229414) nor [Yahoo's](https://senders.yahooinc.com/best-practices/) pages mention cold email. Every sender needs SPF or DKIM and a spam rate below 0.3%. Google's bulk rules start near 5,000 messages a day to personal Gmail accounts, and its guidelines do not cover Google Workspace recipients. Bulk senders also need DMARC and easy unsubscribe. Our [AI lead generation guide](https://enrich.chat/blog/ai-lead-generation/) compares the limits.

### Should you send cold email to catch-all addresses?

Only a few, and last. A catch-all server accepts every address, so a check cannot confirm the mailbox. In [Hunter's test](https://hunter.io/email-verification-guide/accept-all-catch-all/), 100 accept-all addresses bounced at 27% against 1% for 100 valid ones, and Hunter suggests keeping them to 2% to 5% of a list. Test a domain with the free [catch-all checker](https://enrich.chat/tools/catch-all-checker/), and read our [email bounce rate guide](https://enrich.chat/blog/email-bounce-rate/).

### How many cold emails can you send per day?

The Google, Yahoo and Microsoft rules in this guide set no per-mailbox cap. Vendors do. [Instantly](https://instantly.ai/blog/cold-email/) advises 30 per inbox per day after a two to four week warm-up that starts at 5 to 10 a day. [Hunter](https://hunter.io/the-state-of-cold-email) found its highest reply rates at 20 to 49 emails per account per day. [Google](https://support.google.com/a/answer/81126) says to raise volume slowly and cut it when messages bounce. Start low and watch your bounce rate.

### Is it OK to buy an email list for cold email?

It is a poor choice for deliverability. [Google](https://support.google.com/a/answer/81126) says not to purchase email addresses, [Yahoo](https://senders.yahooinc.com/best-practices/) says not to purchase mailing lists, and [Amazon SES](https://docs.aws.amazon.com/ses/latest/dg/reputationdashboardmessages.html) says purchased lists can contain spamtrap addresses. The [ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) adds that using a bought list of business contacts must still comply with UK GDPR. Build the list from sources you can name.

### How do you get verified emails for cold email?

Use your own records and a provider that returns a status for each address. With Enrich.chat, an agent looks up each work email by LinkedIn URL, or by name and company website, and it comes back as `verified`, `catch_all` or `unknown`. A lookup that finds nothing uses 0 credits, and the free tier gives 10 lookups a day with no signup. See the [email finder API](https://enrich.chat/api/email-finder/).

## Sources

1. [Cold email](https://en.wikipedia.org/wiki/Cold_email)
2. [Email sender guidelines](https://support.google.com/a/answer/81126)
3. [Email sender guidelines FAQ](https://support.google.com/a/answer/14229414)
4. [Sender best practices](https://senders.yahooinc.com/best-practices/)
5. [Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730)
6. [RFC 8058: Signaling One-Click Functionality for List Email Headers](https://www.rfc-editor.org/rfc/rfc8058.html)
7. [CAN-SPAM Act: A compliance guide for business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business)
8. [15 U.S. Code 7704: Other protections for users of commercial electronic mail](https://www.law.cornell.edu/uscode/text/15/7704)
9. [Business-to-business marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/)
10. [Canada's Anti-Spam Legislation (S.C. 2010, c. 23)](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html)
11. [The State of Email Outreach 2026](https://hunter.io/the-state-of-cold-email)
12. [What Are Accept-all Email Addresses, and How to Use Them](https://hunter.io/email-verification-guide/accept-all-catch-all/)
13. [Email Verifier, API documentation](https://hunter.io/api-documentation/v2#email-verifier)
14. [API Status Codes (v2)](https://www.zerobounce.net/docs/email-validation-api-quickstart/v2-status-codes)
15. [Spamtraps: fix the problem, not the symptom](https://www.spamhaus.org/resource-hub/deliverability/spamtraps-fix-the-problem-not-the-symptom/)
16. [Amazon SES sending review process FAQs](https://docs.aws.amazon.com/ses/latest/dg/faqs-enforcement.html)
17. [Reputation metrics messages](https://docs.aws.amazon.com/ses/latest/dg/reputationdashboardmessages.html)
18. [Cold Email: The Ultimate Outreach Guide for 2026](https://instantly.ai/blog/cold-email/)
19. [Cold email bounce rate: what's good and how to fix it](https://www.smartlead.ai/blog/cold-email-bounce-rate)

## Try this prompt

Build a send-ready list from your ICP

```text
Use www.enrich.chat to find 25 heads of marketing at US software companies with 50 to 200 employees. Look up each work email and show its status. Put verified emails in one list, catch_all emails in a second list to hold back, and unknown or not found in a third. For each person include name, title, company website and LinkedIn URL, and report the total credits used.
```

## Related

- [Email bounce rate: what is good](https://enrich.chat/blog/email-bounce-rate/)
- [How fast B2B contact data goes bad](https://enrich.chat/blog/b2b-data-decay/)
- [AI lead generation: what actually works](https://enrich.chat/blog/ai-lead-generation/)