Cold email prospecting: setup, sequence, and reply rates

What the law requires

Cold email in the US is governed by the CAN-SPAM Act, 15 U.S.C. 7701 and following, and the FTC's implementing rule at 16 CFR Part 316. The law is opt-out. You may send a first commercial message without consent if the message meets the rules below. The FTC states that "the law makes no exception for business-to-business email."

The FTC lists eight requirements. The ones that bind a cold sender day to day:

• Header information must be accurate. The From, To, and Reply-To fields must identify who sent the message.
• The subject line must reflect the content.
• The message must be identified as an advertisement.
• The message must include your valid physical postal address.
• The message must give a clear way to opt out, and you must not charge a fee or require more than an email address (16 CFR 316.5).
• You must honor an opt-out within 10 business days, and the opt-out method must keep working for at least 30 days after you send.
• If another company sends for you, you stay legally responsible.

The penalty is up to $53,088 per violating email, per the FTC guide. The full rule set, with the state laws that sit on top of it, is on the CAN-SPAM cold email rules page. Where your list came from also matters, see data broker laws.

Outside the US. The UK and EU differ. Under UK PECR you can email companies and other corporate bodies, but sole traders and some partnerships are treated as individuals, and the soft opt-in does not cover prospects or bought-in lists. The ICO says its guidance is under review because of the Data (Use and Access) Act. Under GDPR, Article 21 lets a person object to direct marketing at any time, and you must then stop. Check local rules before sending to either region.

How to set up sending infrastructure

Send cold email from separate domains, never from your main one. Complaints and bounces damage the reputation of the sending domain. A second domain keeps that damage away from your customer and billing mail. Point each sending domain's website at your main site so a recipient who checks it finds a real business.

Authentication is not optional at volume. Google's sender guidelines require SPF, DKIM, and DMARC for senders above 5,000 messages per day to Gmail accounts, in force since 02/01/2024. The DMARC policy may be set to none, and the From domain must align with the SPF or DKIM domain. Yahoo requires SPF and DKIM, a DMARC policy of at least p=none, and unsubscribes honored within 2 days. Both say to keep the spam complaint rate below 0.30%. Google adds a monitoring target of below 0.10%. Marketing mail needs one-click unsubscribe at both providers.

Even if you send far under 5,000 per day, set all three records. Do it before the first send.

Control	What to do	Source
SPF and DKIM	Publish both on every sending domain; DKIM key of at least 1024 bits	Yahoo sender page
DMARC	Publish at least p=none; a rua report address is recommended	Google and Yahoo pages
Unsubscribe	List-Unsubscribe header with one-click support, plus a visible link	Google and Yahoo pages
Spam rate	Below 0.30% required, below 0.10% as the target	Google sender guidelines
Daily ceiling	2,000 messages per user per day on Workspace; limits can change	Google Workspace limits page

Warmup and volume. Warmup means starting a new inbox at low volume and raising it as real replies and clean delivery build a sending history. No provider publishes a safe per-inbox number. The Workspace ceiling of 2,000 messages per day is a limit, not a recommendation. Set your own cap per inbox, add inboxes rather than pushing one, and cut volume the day bounces or complaints rise.

How to keep the list clean

List quality is the main lever you control. A sending-tool vendor's 2026 benchmark report says to keep the bounce rate below 2%, ideally much lower. That figure is vendor-reported; no mailbox provider publishes a bounce threshold.

Verify every address before the first send. Verification checks the syntax, the domain's mail records, and whether the mailbox responds. Then handle two special cases:

1. Catch-all domains. A catch-all server accepts mail to any address, so a verifier cannot confirm the mailbox. Send to these in a small separate batch and watch the bounce rate.
2. Role accounts and stale contacts. Addresses like info@ rarely reach a decision maker. Contacts who changed jobs bounce. Re-verify any address older than your last send.

Suppress anyone who opted out, across all your sending domains. Keep that list permanently. A B2B contact list with named people, titles, and a verified work address saves the research step, and the same named-contact discipline applies to the owner lists under homeowner counts.

The sequence: 4 touches in 14 days

A short sequence captures most of the replies. One vendor benchmark (data through 12/18/2025) reports that 58% of replies come from the first email and 42% from follow-ups, which is the case for following up. That report suggests 4 to 7 touches spaced 3 to 4 days apart. For prospecting from a purchased or built list, a tighter rail keeps complaint risk down.

• Day 0Email 1. Two or three sentences, one specific reason you chose them, one question.
• Day 3Email 2. Written as a short reply in the same thread. Add one fact they can use.
• Day 7Email 3. A different angle: a result for a similar business, or a smaller ask.
• Day 12Email 4. Close the loop. Say you will stop writing, and mean it.

Stop a contact the moment they reply, unsubscribe, or bounce. Do not add them to another sequence on a new domain. For a call, text, or mail step between emails, see the multi-channel prospecting sequence. If your lead has a deliverable mailing address, direct mail prospecting pairs well with email, and cold calling prospecting is the usual next step for replies.

What it costs

Cold email is cheap per message and costs mostly in setup and list work. The ranges below are published ranges from the vendors' own pages, fetched on 10/10/2026. Prices change, so check the page before buying.

Item	Published range	Note
Sending domain (.com)	$11.08 per year	One registrar's listed price, including ICANN fees
Inbox (Workspace Business Starter)	$7.00 per user per month	List price, USD; the page also shows a first-3-month promotion and 16% off with a 1-year commitment
Sending tool, entry plan	$32 to $47 per month	Two vendors' published entry plans, annual to monthly billing; 5,000 to 6,000 emails per month
List and verification	Varies	Priced per record by the list source; not included here

Worked example. Use 3 sending domains with 2 inboxes each, 6 inboxes. Assume 30 sends per inbox per day for 21 sending days. This is a planning assumption, not a provider guideline.

• Domains: 3 x $11.08 = $33.24 per year, or $2.77 per month.
• Inboxes: 6 x $7.00 = $42.00 per month.
• Tool: $47 per month (monthly billing, entry outreach plan).
• Total: $2.77 + $42.00 + $47.00 = $91.77 per month.
• Volume: 6 x 30 x 21 = 3,780 emails per month, inside the 5,000 plan limit.
• Cost per 1,000 emails: $91.77 / 3.78 = $24.28.

This excludes list cost and your time.

Reply rates and what good looks like

Published reply rates conflict because the studies count different things. The 0.45% figure is replies divided by all emails sent. Other figures use workspace averages or survey answers. All figures below are vendor-reported. None is a government or academic study.

Source	Figure	Sample	What it measures
B2B appointment-setting agency study	0.45%	7,530,489 emails sent in 2025, 34,393 tracked replies	Replies per email sent, client campaigns
Sending-tool vendor benchmark	3.43% average, 5.5% top quarter, 10.7% top 10%	Billions of interactions, thousands of workspaces, 01/01/2025 to 12/18/2025	Platform averages; the report does not give a denominator in the text we read
Outreach-tool vendor survey	1% to 4% typical	508 outbound professionals, report dated 01/01/2026	Self-reported

Use the table to set a floor and a target for your own sends:

Metric	Weak	Workable	Strong
Reply rate	Under 1%	1% to 4%	Above 5.5% (top quarter of one vendor's data)
Bounce rate	2% or more	Under 2%	Well under 2%
Spam complaints	0.30% or more	Below 0.30%	Below 0.10%

Apply the worked example. At 3,780 emails per month, the 0.45% study rate gives about 17 replies, or about $5.40 per reply. The 3.43% vendor average gives about 130 replies, or about $0.71 per reply. A reply is not a meeting, and many replies are "not interested," so track positive replies separately.

Next step

Pull counts for the markets and titles you plan to email before you buy domains. Ask for a count for your own geography or list definition. Compare channels in the how-to library, and see SMS text prospecting and retargeting from lists for the other steps in a sequence.

Questions people ask

Q01What reply rate should a cold email campaign expect?

Published figures run from 0.45% of all emails sent in one agency study of 7,530,489 emails to a 3.43% platform average in one sending-tool benchmark. A 508-person vendor survey put typical replies at 1% to 4%. All are vendor-reported, so measure your own.

Q02How many cold emails can one inbox send per day?

Google caps a Workspace account at 2,000 messages per day, and says limits can change without notice. That is a ceiling, not a target. Start low on a new inbox, raise volume slowly, and watch bounces and complaints.

Q03Why use a separate domain for cold email?

Complaints and bounces damage the reputation of the domain you send from. A separate sending domain keeps that damage away from your main domain, where your customer mail and your invoices live.

Q04What is a catch-all address and why does it matter?

A catch-all domain accepts mail to any address, so a verifier cannot confirm the mailbox exists. Those addresses can still bounce later. Send to them in a small, separate batch and watch the bounce rate.

Q05How many follow-up emails should a cold sequence have?

One sending-tool benchmark found 58% of replies come from the first email and 42% from follow-ups, and suggests 4 to 7 touches spaced 3 to 4 days apart. Four touches over about two weeks captures the follow-up replies without piling up complaints.

Sources

1. FTC, CAN-SPAM Act: A Compliance Guide for Business (eight requirements, 10 business days, $53,088 per email, no B2B exception)ftc.gov
2. 16 CFR Part 316, CAN-SPAM Rule (FTC rule text; section 316.5 bars fees or extra requirements for opting out)law.cornell.edu
3. 15 U.S.C. 7701, Congressional findings and policy (CAN-SPAM Act of 2003)law.cornell.edu
4. Google, Email sender guidelines (5,000 per day threshold, SPF, DKIM, DMARC, one-click unsubscribe, 0.30% and 0.10% spam rate)support.google.com
5. Yahoo, Sender requirements and best practices (SPF, DKIM, DMARC p=none minimum, 2 day unsubscribe, spam rate below 0.3%)senders.yahooinc.com
6. Google Workspace, Gmail sending limits (2,000 messages per day per user)knowledge.workspace.google.com
7. Cold email benchmark report 2026 (sending-tool vendor, data 01/01/2025 to 12/18/2025) (vendor-reported: 3.43% average, 5.5% top quarter, 10.7% top decile, 58% of replies from step one, bounce under 2%)instantly.ai
8. 2026 cold email response study (B2B appointment-setting agency, 7,530,489 emails sent in 2025) (vendor-reported: 0.45% replies per email sent)belkins.io
9. State of Cold Email 2026 (outreach-tool vendor survey, 508 respondents, 01/01/2026) (vendor-reported survey: typical reply rate 1% to 4%; article dated 01/01/2026, survey date not stated)mailshake.com
10. Google Workspace pricing (Business Starter $7.00 per user per month list price, USD; introductory discounts shown on 10/10/2026; annual commitment saves 16%)workspace.google.com
11. Sending-tool pricing page, published ranges (outreach plans $47 monthly, $37.60 annual per month, 5,000 emails per month)instantly.ai
12. Second sending-tool pricing page, published ranges (Base $39 monthly, $32 annual per month, 6,000 emails per month)smartlead.ai
13. Porkbun domain pricing (.com $11.08 per year including ICANN fees)porkbun.com
14. ICO, Electronic mail marketing (PECR)ico.org.uk
15. Regulation (EU) 2016/679 (GDPR), Article 21 right to object (Art. 21(2) and (3): objection to direct marketing, processing must stop)eur-lex.europa.eu