Cold Outreach skill

Cold Outreach

Workflow

1. Deliverability Setup

Do this BEFORE sending a single email. Skipping this = spam folder.

DNS records (required) — publish only the ESP you actually send through. Do not copy a multi-include SPF "starter" record; each include: costs DNS lookups (SPF hard-fails at 10 lookups per RFC 7208) and an unused include both wastes a lookup and authorizes a sender you don't use.

# SPF — pick ONE example matching your ESP. Use ~all (softfail) while warming, -all once stable.
# Google Workspace:   v=spf1 include:_spf.google.com ~all
# SendGrid:           v=spf1 include:sendgrid.net ~all
# Microsoft 365:      v=spf1 include:spf.protection.outlook.com ~all
# Amazon SES:         v=spf1 include:amazonses.com ~all
# Most cold-email senders (Instantly/Smartlead) ship a dedicated domain — use the
# exact SPF/DKIM strings from THEIR setup wizard, not the strings above.

# DKIM — your ESP generates the keypair and gives you the exact TXT record + selector.
# Publish it verbatim. Prefer a 2048-bit key. Example selector:
sg._domainkey.example.com  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."   # value from ESP

# DMARC — start at p=none with reporting; tighten only after SPF+DKIM align cleanly for ~2 weeks.
_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1"

Alignment, not strictness. DMARC passes on relaxed alignment by default (org-domain match), which is all Gmail/Yahoo require. Do not reflexively set aspf=s; adkim=s — strict mode breaks legitimate setups where the ESP signs with a subdomain or rewrites the envelope (common with shared sending domains). Leave alignment relaxed (the default) unless you control every signing surface and have a specific spoofing reason.

Verify before you send (run these; don't trust the dashboard alone):

dig +short TXT example.com                         # SPF: exactly one v=spf1 record, <10 includes
dig +short TXT sg._domainkey.example.com           # DKIM: your selector resolves to v=DKIM1 ...
dig +short TXT _dmarc.example.com                   # DMARC: v=DMARC1; p=...; rua=...
# Count SPF lookups (must stay <=10):
dig +short TXT example.com | grep -o 'include:' | wc -l
# End-to-end: send one message to a Gmail account, open "Show original" → expect
#   SPF: PASS,  DKIM: PASS,  DMARC: PASS

If you use a click/open tracking domain, host it as a CNAME on a subdomain you control (e.g. track.example.com) and confirm it isn't on a blocklist — a shared/blacklisted tracking domain tanks deliverability even when auth passes.

Domain warmup schedule (new domain):

Domain strategy — tradeoff, not a rule. "Never send cold from your primary domain" is a heuristic, not a law: a sending subdomain (mail.example.com) shares the organizational domain's reputation, so it isolates DKIM/IP reputation but does not fully wall off the brand. Common patterns:

Whatever you choose, authenticate it fully and never run cold volume through the domain that carries your password-reset / billing / transactional mail.

2. Copy Frameworks

PAS (Problem-Agitate-Solve):

Subject: [Problem they have]

Hi [Name],

[Problem]: Most [their role] at [their company type] struggle with [specific problem].

[Agitate]: This usually means [consequence] — which costs [quantified impact].

[Solve]: We help [similar companies] [specific outcome] by [method].

[CTA]: Worth a 15-min call this week?

QVC (Question-Value-CTA):

Subject: Quick question about [their specific situation]

Hi [Name],

[Question]: How are you handling [specific challenge] at [Company]?

[Value]: We helped [similar company] [specific result with numbers]
by [brief method].

[CTA]: Open to hearing how?

BAB (Before-After-Bridge):

Subject: [Desired outcome] for [Company]

Hi [Name],

[Before]: Right now [their situation/pain].

[After]: Imagine [desired state with specific metrics].

[Bridge]: That's what we did for [reference customer].
15 minutes to show you how?

3. Follow-Up Sequence

Timing (7-touch, 21 days):

Follow-up rules:

• Each touch adds NEW value — never "just bumping this up"
• Vary the angle: problem, social proof, insight, resource, direct ask
• Keep emails under 100 words (mobile-first)
• One CTA per email, always a question

3b. LinkedIn outreach — ToS risk policy (read before automating)

LinkedIn's User Agreement explicitly prohibits third-party software that scrapes, copies, or automates activity (connections, messages, profile views, data export). Enforcement is active and escalating: detection → temporary restriction → permanent account ban, and a banned account loses your network permanently. There is no "safe" automation tier — only a risk gradient. Choose deliberately.

Practical limits even when manual: keep connection requests to roughly 15-25/day on an established account (lower for new accounts), personalize the note, and warm with a comment/like before connecting. Lead with the relationship — pitch after a connection is accepted and there's a reason to talk, not in the connection request. For volume programs, email is the lower-legal-risk channel; use LinkedIn for research, social proof, and a human touch within the multi-channel sequence (touch 3 in §3), not as the automation backbone.

4. Targeting & list quality (do this before personalization)

The biggest reply-rate lever is who you contact and where the list came from — not the copy. Garbage list + perfect copy still loses.

ICP qualification checklist (a lead should clear most of these before it enters a sequence):

• Firmographic fit: industry, company size/headcount, revenue, geography, funding stage.
• Role fit: the contact can buy or champion — title maps to budget/authority over the problem, not just a keyword match.
• Trigger/timing signal: a reason to reach out now (new funding, new hire in the role, job postings for the pain you solve, tech-stack change, expansion, leadership change).
• Reachability: a verified email (and ideally a LinkedIn profile) — see verification in §7.
• Exclusions: existing customer, open opportunity, competitor, or on the suppression list (§9) → drop.

Source-quality scoring — not all "leads" are equal; score the source and set expectations accordingly:

Offer–message fit: match the offer to where the segment sits. Cold prospects rarely book a "demo" — lead with a low-friction, high-value ask (a relevant insight, a teardown, a benchmark, a 15-min problem conversation) sized to the relationship temperature. The CTA in §2 should escalate as the prospect warms, not open with the biggest ask.

Personalization

Tiers by effort (reply-rate ranges are directional — they depend on ICP fit and list temperature from above, not just minutes spent):

Personalization signals (research checklist):

• Recent LinkedIn posts or articles they wrote
• Company news (funding, hiring, product launch)
• Tech stack (BuiltWith, Wappalyzer)
• Job postings (reveal priorities and pain points)
• Mutual connections
• Conference appearances or podcast episodes

5. Benchmarks

These bands are directional, not universal. Reply/positive-reply rates swing 5-10x with ICP, list source (opted-in vs scraped vs referral), offer strength, market, seniority, and channel. Treat the table as "is my campaign roughly in range," not as a target — and always compare a campaign to your own baseline, not to a blog number.

Optimize for revenue, not opens. The metric that pays is opportunity rate and revenue per 1,000 sends (= positive replies × meeting rate × win rate × ACV ÷ sends). Rank campaigns by that, not by opens.

Bands shift with list temperature — calibrate before judging:

Open rate is now a vanity/noise metric, not a diagnostic. Two effects break it: (1) Apple Mail Privacy Protection (iOS 15+) pre-fetches every tracking pixel through Apple proxies, so Apple Mail clients log an "open" regardless of whether anyone read it; (2) Gmail/Google image proxying caches images server-side, inflating and de-timing opens. Reported open rates above ~50% are dominated by this noise. Use open rate only as a coarse "is my domain getting delivered at all" smoke signal — make decisions on reply, meeting, and opportunity rates.

Diagnostics:

• Replies near zero, but it's a fresh domain/inbox: likely a deliverability (placement) problem, not copy — seed-test inbox placement (GlockApps/mail-tester) before blaming the message.
• Opens look fine but replies are low: copy/offer/targeting problem. Test framework, then offer, then ICP — in that order.
• Bounce rate high: list-quality problem. Re-verify (§7) and pause the domain — high bounces trigger filtering for the whole sending domain.
• Complaint rate climbing toward 0.3%: stop. Re-segment, tighten ICP, and check you're honoring opt-outs (§8).

5b. Google, Yahoo + Microsoft sender requirements (in force 2024-2025)

Effective Feb 1, 2024 (with one-click unsubscribe enforced from June 1, 2024), Gmail and Yahoo split their rules into two tiers. Know which tier you're in:

• All senders (any volume): valid SPF or DKIM, valid forward+reverse DNS (PTR) on sending IPs, a real From, and spam rates kept low. Don't send from a domain with no auth at all.
• Bulk senders (~5,000+ messages/day to Gmail/Yahoo, counted per From-domain): the full table below — SPF and DKIM, DMARC, DMARC-aligned From, one-click unsubscribe, and complaint rate held under 0.3%.
• Microsoft Outlook (outlook.com/hotmail/live): since May 5, 2025, domains sending 5,000+ emails/day to Outlook consumer addresses must also pass SPF, DKIM, and DMARC (min p=none, aligned); non-compliant mail is junked, then rejected outright. The table below covers it: same auth, same unsubscribe hygiene.

Cold outreach almost always should meet the bulk-sender bar even under 5,000/day — filters apply the same signals to everyone and tighten over time.

Sequence-tool vendors (Instantly, Smartlead, Lemlist) usually inject the unsubscribe headers automatically when you publish a custom sending domain, but always test once with a real Gmail/Yahoo inbox before scaling. Requirements evolve; confirm current thresholds at the official pages (Google: support.google.com/a/answer/81126, Yahoo Sender Hub, Outlook postmaster/SNDS portal); as of Jun 2026 the above reflects the 2024-2025 rollout.

6. A/B Testing

Test one variable at a time:

Sample size: be realistic about power. For reply/positive-reply rates in the 1-5% range, 100 emails per variant is directional only, not statistically significant (you'd see ~1-5 replies per arm, so noise swamps the signal). Rough guide to detect a change at ~5% base reply rate:

Rules of thumb: the lower the base rate and the smaller the lift, the more volume you need; if you can't reach the volume, treat results as a lean, not a verdict, and don't over-rotate on a winner from a few hundred sends. Use a 2-proportion z-test (or any A/B calculator) before declaring a winner. Subject-line/open tests need more volume now because open data is MPP-polluted (§5) — prefer testing on reply, not opens.

Run time: 7-14 days to account for follow-up replies (replies trickle in across the sequence; calling it on day 2 biases toward fast responders).

7. Tools Stack

8. Legal & compliance (this is not optional)

Not legal advice. Cold outreach is regulated and the rules differ sharply by recipient jurisdiction and B2B-vs-B2C. The cost of getting it wrong is fines, blocklisting, and brand damage. Confirm specifics with counsel for your markets, and suppress jurisdictions you can't comply with rather than guessing.

The non-negotiables for any commercial email (all jurisdictions): truthful From/sender identity, non-deceptive subject line, accurate routing headers, a working opt-out, prompt honoring of opt-outs, and no scraped/harvested/purchased lists. Build the suppression list before the first send (§9).

US — CAN-SPAM (federal, applies to commercial email to US recipients)

B2B and B2C are treated the same; there is no opt-in requirement, but every message must:

• Use truthful header info and a non-deceptive subject line.
• Identify the message as an ad (context usually suffices for 1:1 sales; be safe if borderline).
• Include a valid physical postal address (street address, PO box, or registered-agent address).
• Provide a clear opt-out mechanism and honor it within 10 business days; keep honoring it (no re-adding, no selling the address).
• Penalties accrue per email, and you're liable for what a vendor sends on your behalf.

US states — privacy laws (CCPA/CPRA and the 2023-2025 wave: VA, CO, CT, UT, TX, OR, etc.)

Email prospecting is governed by CAN-SPAM, but the data you process (enriched B2B contact records) can fall under state privacy laws. Practically: honor deletion/opt-out-of-sale requests, don't buy/sell personal data sketchily, and keep a record of your data sources. Treat this as data-handling hygiene layered on top of CAN-SPAM.

EU/UK — GDPR + ePrivacy (and UK PECR)

This is the strict regime. Email + names + company info = personal data under GDPR.

• Lawful basis: for B2B cold email the usual basis is legitimate interest — and you must actually run and document a Legitimate Interest Assessment (LIA): a clear B2B purpose, relevance of the offer to the person's professional role, and a balancing test showing your interest doesn't override their rights. B2C cold email generally requires prior consent (opt-in).
• ePrivacy/PECR overlay: electronic marketing rules sit on top of GDPR. Some EU states and the UK treat individual/sole-trader/partnership contacts more like consumers (consent-leaning) even in B2B; corporate role addresses (name@company.com) are the safer LI ground. UK PECR + GDPR: corporate B2B email can rely on LI; sole traders/individuals lean to consent.
• Required at/after first contact: identify who you are, how you got their data, the purpose, and an easy way to object/opt out — plus a privacy-notice link. Honor objection and erasure requests promptly.
• Data minimization & retention: collect only what you need, document the source per record, and set a retention/deletion policy (don't sit on stale prospect data indefinitely).

Canada — CASL (one of the strictest; opt-in by default)

• Commercial electronic messages generally require express or implied consent before sending — cold-emailing a Canadian recipient with no prior relationship is high-risk.
• Every message must include clear sender identification, valid contact info, and a working unsubscribe honored within 10 business days.
• Penalties are severe (up to CAD $10M per violation for organizations). When in doubt, suppress .ca / Canadian recipients unless you have a defensible consent basis.

Practical decision rules

• B2B, US, role-based corporate address, relevant offer: CAN-SPAM compliant footer + opt-out → generally OK.
• B2B, EU/UK, role-based corporate address: document an LIA, disclose data source, easy opt-out/object → defensible; individuals/sole traders → lean consent.
• Canada / any B2C / any consumer address: assume consent required or suppress.
• List was scraped/purchased: do not send. It's both a deliverability disaster and unlawful in most regimes.
• Can't determine recipient jurisdiction: enrich it, or suppress by country, before sending.

9. Operational artifacts

Compliant email footer (every cold message)

—
[Your Name] · [Company]
[Company Legal Name], [Street Address or PO Box], [City, Region, Postal, Country]   ← required by CAN-SPAM
We got your work email because [how you sourced it, e.g. "your role at <Company>"].   ← required under GDPR
Don't want these? Unsubscribe: https://example.com/unsub?t=<token>   (we'll stop within 2 days)

Keep it short and human for 1:1 sales, but the postal address, source disclosure, and working opt-out must be present.

One-click unsubscribe headers (bulk; see §5b)

List-Unsubscribe: <mailto:unsub@example.com?subject=unsubscribe>, <https://example.com/unsub?t=OPAQUE_TOKEN>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The HTTPS endpoint must accept a POST with body List-Unsubscribe=One-Click and suppress without requiring a login or extra click. Use an opaque per-recipient token, not the raw email in the URL.

Suppression list — the single most important table you own

Check every address against this before every send, across all campaigns and sending domains. One global suppression list, not per-campaign.

CREATE TABLE suppression (
  email_hash    TEXT PRIMARY KEY,   -- sha256(lower(trim(email))); store hash, not raw, where possible
  email         TEXT,               -- raw kept only if you have a lawful basis
  domain        TEXT,               -- suppress whole domain on a single complaint if needed
  reason        TEXT NOT NULL,      -- unsubscribe | complaint | hard_bounce | manual | gdpr_erasure | do_not_contact
  source        TEXT,               -- where the suppression came from
  campaign_id   TEXT,               -- which campaign triggered it (nullable)
  created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
  permanent     BOOLEAN NOT NULL DEFAULT true   -- complaints/unsubs/erasure = permanent; never re-add
);
-- Suppression is permanent and global. Never "clean" it to re-mail people. Never sell or share it.

Bounce & reply taxonomy (drives suppression and triage)

Deliverability incident triage (replies/placement suddenly drop)

1. Confirm it's placement, not copy: seed-test inbox placement (GlockApps / mail-tester); send yourself a message and check Gmail "Show original" → SPF/DKIM/DMARC all PASS?
2. Check authentication didn't break: re-run the §1 dig checks (someone edited DNS? SPF over 10 lookups? DKIM selector rotated by the ESP?).
3. Check reputation: Google Postmaster Tools domain/IP reputation + spam-complaint panel. Climbing complaints or "Bad/Low" reputation → pause volume immediately.
4. Check volume/ramp: did you spike sends or add a cold inbox without warmup? Drop back to the §1 warmup curve.
5. Check list quality: bounce rate up? You burned a bad list — pause, re-verify, tighten ICP (§4).
6. Check content: spammy phrasing, too many links/images, link-shortener/blacklisted tracking domain, big image-to-text ratio.
7. If reputation is damaged: stop sending on that domain, let it cool, re-warm slowly; don't just spin up a new domain and repeat the same behavior.

When to stop a campaign (hard thresholds)

• Bounce rate > 3% mid-campaign → pause, re-verify the remaining list.
• Spam-complaint rate ≥ 0.1% and rising → pause, re-segment, audit opt-out handling (target stays < 0.3%, see §5b).
• Unsubscribe rate > 2% → message/offer/targeting mismatch — fix before resuming.
• Reply rate far below your own baseline after adequate volume (§6) → kill or rebuild; don't keep burning domain reputation on a dead campaign.

Daily Operations Checklist

• Check reply inbox — respond within 2 hours during business hours
• Process opt-outs / "remove me" replies into the suppression list within 2 days (§9), including free-text ones
• Review bounce notifications — suppress hard bounces; investigate any block/policy bounces as a reputation issue (§9 taxonomy)
• Monitor sending reputation + spam-complaint rate (Google Postmaster Tools); pause if complaints near 0.1% and rising
• Review sequence analytics on reply/meeting rate, not opens — pause underperforming or stop campaigns past the §9 thresholds
• Move positive replies to CRM — tag source campaign, and pull them out of the sequence