In this article
A spreadsheet arrives. Two hundred and sixty nine rows, names, titles, companies, a segment column somebody filled in by hand. It is a good list, built rather than scraped, and the obvious next step is to load it into the same place the newsletter goes out from. That step is the one worth slowing down for, because it quietly converts a marketing experiment into a risk against the domain your invoices leave on.
Sourcing a list is normal. Merging it is not#
There is nothing disreputable about building a list. Researching the two hundred people who plausibly need what you sell, finding out who they are and writing to them is what a founder does before there is a funnel. Plenty of good companies were started on exactly that.
The mistake is not sourcing the contacts. It is putting them in the same bucket as the people who typed their address into a form on your site, because from that point on the two groups are indistinguishable to you and identical to a mailbox provider. One group opted in. The other has never heard of you. They will behave completely differently, and you will only be able to see the blended result.
The practical loss is not a worse open rate. It is that you can no longer answer the only question that matters afterwards, which is whether the people who asked to hear from you are still receiving anything.
The asset at risk is the domain#
Most people think of a bad campaign as a wasted campaign. Some addresses bounce, a few people unsubscribe, the numbers are poor and you write a better one next month. That model is roughly correct for advertising and it is wrong for email.
Mailbox providers do not score campaigns. They score the identity sending them, which is your domain, and they keep scoring it after the campaign is over. Complaints, bounces and mail deleted without being read all attach to the domain. So do replies and opens, which is why a well-behaved list is an asset rather than just a number.
The campaign is not what you can lose. The domain is, and it is the same domain your quotes, contracts and password resets go out on.
That is the whole problem in one line. A practice sending a cold campaign from the domain it also uses for appointment reminders is putting the reminders behind the campaign. The failure is delayed, silent, and shows up as customers saying they never got the email.
What the mailbox providers actually published#
This used to be folklore. It is not any more. In February 2024, Google and Yahoo both introduced published requirements for bulk senders, broadly those sending more than five thousand messages a day to their users, and the bar is concrete.
Authenticate properly
SPF and DKIM on the sending domain, and a published DMARC record. This does not make you trusted. It makes you identifiable, which is the precondition for having a reputation instead of being filtered on sight.
One-click unsubscribe
A working list-unsubscribe header, so a recipient can leave without hunting for a link. Making it hard to unsubscribe does not keep subscribers, it converts them into complainants.
Stay under the complaint rate
Google publishes 0.3 percent as the threshold and advises aiming below 0.1 percent. That is three complaints per thousand delivered, and a sourced list can pass it in a single send.
Keep the data clean
Repeatedly sending to addresses that no longer exist is itself a signal. Providers read a high hard-bounce rate as a sender who does not know who is on their list.
Microsoft has since introduced its own version of these requirements for Outlook.com. The direction is one way and it is not going to reverse: the era where you could send to anything and let the filters sort it out closed some years ago, and it closed hardest on small senders who have no relationship with a provider to fall back on.
Bounces, traps and the complaint rate#
Three things go wrong with a sourced list, and they go wrong in a specific order.
Hard bounces come first. A sourced list is a snapshot of who worked somewhere on the day it was built. People change jobs. The address that was real in March is gone by September, and a batch of permanent failures in one send is one of the loudest signals you can produce.
Complaints come next. Someone who never asked to hear from you does not unsubscribe, they press the button that says this is spam, because from where they are sitting that is a fair description. A handful of those per thousand is all it takes.
Spam traps are the one you cannot see coming. Recycled traps are real addresses, abandoned long ago, that a provider has reactivated specifically to catch senders mailing stale data. Pristine traps were never a person at all, and were seeded in places only a scraper would find. You cannot pick either out by looking at the address. That is the entire point of them, and it is why verification reduces the risk rather than removing it.
Separate the sending, not just the list#
Tagging the imported contacts with a source field is necessary and it is not sufficient. Segmenting inside one account still sends both groups from one domain, which means both groups share one reputation. Separation has to happen at the sending identity.
In practice that means outbound mail leaves from its own subdomain, something like outbound.yourcompany.com, while the main domain keeps carrying the mail that has to arrive. If the cold programme goes badly, the damage is contained to the subdomain you can abandon. Some teams go further and register a separate domain for outbound entirely.
The cost is real and worth stating. A new subdomain has no reputation at all, and a stranger sending at volume on day one looks exactly like a throwaway, because that is what throwaways do. It has to be warmed: a low daily volume that climbs over a few weeks, ideally to people who reply. That is the price of separation, and it is much lower than the price of finding out your invoices stopped arriving.
This is one reason we run our own mail infrastructure in PostWyse rather than renting a sending API, with hosted mail, domains and warmup in the same place as the sequences. Not because it is glamorous, but because the alternative is discovering where the reputation lives after it has moved.
One week, in order#
If a list is already sitting in front of you, this is the sequence that keeps the options open.
Import it, but tag it
Load the contacts with a source value that says exactly where they came from, and never let that field go empty. Everything downstream depends on being able to filter cold from opted in.
Do not send to it yet
Nothing about the list expires this week. The order matters more than the speed, and every irreversible step here is a sending step.
Set up the subdomain
Stand up the outbound subdomain with its own SPF, DKIM and DMARC. Confirm authentication passes before a single real recipient sees anything.
Warm it, then start small
Low volume, rising over weeks. Begin with the segment most likely to reply, because replies are the strongest positive signal you can generate.
Watch bounces and complaints, not opens
Open rate has been unreliable since privacy features started pre-fetching images. Hard bounce rate and complaint rate are the numbers that predict whether you still have a domain next quarter.
Keep the opted-in list where it is
People who filled in your form stay on the main domain, in their own list, receiving what they signed up for. They are the asset. Do not spend them on the experiment.
When it is not worth sending at all#
There is an honest version of this where the answer is not to send. If the list is small enough that you could write to each person individually, then a sequence is the worse tool. Two hundred people is well inside the range where a real message from a real person, sent from your normal mailbox, outperforms anything automated and carries almost none of this risk.
The machinery in this article exists for volume. Below a few hundred contacts you are usually better off with a short list, a personal note and the patience to send them over a fortnight. That is not a moral position, it is that response rates on genuinely personal mail are high enough to make the infrastructure question moot.
If you would be uncomfortable with the recipient knowing exactly how you got their address, the deliverability question is not the first problem.
And if the list is large, sourced, and the plan is a real programme, then treat it as one: its own subdomain, its own warmup, its own measurement, and a firm wall between it and the people who actually asked to hear from you. There is more on the follow-up side in responding to leads faster and on writing something worth opening in emails that do not sound like AI.
Frequently asked
Can I add a purchased or sourced list to my newsletter list?
You can, and it is usually the wrong move. The people on a sourced list never asked to hear from you, so they complain and bounce at a far higher rate than people who filled in a form. Mixed into one list, those complaints are attributed to your sending domain, which is the same domain your invoices, quotes and password resets use. Keep sourced contacts in their own segment, sent from their own subdomain.
What is a sending domain reputation?
A running judgement each mailbox provider keeps about mail carrying your domain. It is built from how recipients react: opens and replies help, complaints, bounces and deletions without reading hurt. It follows the domain rather than the campaign, so a bad week on a cold campaign shows up later in whether a customer sees your invoice, and no amount of rewriting the next email undoes it quickly.
What spam complaint rate is too high?
Google publishes 0.3 percent as the rate bulk senders must stay under, and advises aiming below 0.1 percent. That is three complaints per thousand delivered. A list of people who asked to hear from you rarely gets near it. A sourced list can pass it in a single send, and because the threshold is measured over time rather than per campaign, one bad send keeps affecting you after you stop.
Do I need SPF, DKIM and DMARC?
Yes, and since February 2024 it is not optional for volume. Google and Yahoo both require bulk senders to authenticate with SPF and DKIM, publish a DMARC record, and offer one-click unsubscribe. Microsoft has since introduced its own version for Outlook.com. Authentication does not make you trusted, it makes you identifiable, which is the precondition for having a reputation at all rather than being filtered by default.
What is a spam trap?
An address that exists only to catch senders who did not earn their list. Recycled traps are real addresses, long abandoned, that a provider reactivated; hitting one says your data is old. Pristine traps were never a person and were seeded where only a scraper would find them; hitting one says your data was scraped. You cannot detect either by looking at the address, which is the point of them.
Should cold email go from a separate domain?
From a separate subdomain at minimum, and many teams use a separate domain entirely. Reputation is tracked per sending domain, so outbound.yourcompany.com absorbing the complaints keeps yourcompany.com clean for the mail that has to arrive. The cost is that the subdomain starts with no reputation and has to be warmed, which is a few weeks of low volume before it carries a real campaign.
What is email warmup and do I need it?
Sending a small and slowly increasing volume from a new domain so providers see a normal pattern rather than a stranger sending thousands on day one. A new subdomain with no history that starts at volume looks exactly like a throwaway, because that is what throwaways do. Warmup is the difference between a sending identity that is unknown and one that is suspicious.
Is cold outreach legal?
This is not legal advice and the answer depends where your recipients live. In the United States CAN-SPAM permits unsolicited commercial email provided you identify yourself, give a real postal address, honour opt-outs promptly and do not mislead in headers or subject lines. In the United Kingdom and the European Union, consent rules are considerably stricter and the business-to-business position is narrower than people assume. Check the rules for the list you actually have.
What is the first thing to do with a list I already imported?
Find out whether the sourced contacts and the opted-in contacts are distinguishable. If they carry a source field you can filter on, you have lost nothing yet: segment them, move the cold send to a subdomain, and leave your main domain for people who asked. If they were merged with no way to tell them apart, treat that as the actual incident, because every future send now carries risk you cannot measure.
Try it on autopilot
Cold outreach on its own domain, customers on yours.
PostWyse runs hosted mail, domains, warmup and sequences in one place, so outbound can leave from its own subdomain while the mail that has to arrive keeps the reputation you already built.
Weighing up the whole stack instead? See pricing.