B2B Cold Email Deliverability: The Complete Tech Stack Guide

The Extra Layer: Corporate Email Security Gateways

A large share of mid-market and enterprise organisations route inbound mail through a secure email gateway before it reaches Microsoft 365 or Google Workspace. Proofpoint, Mimecast, Barracuda, Cisco Secure Email, and Microsoft Defender for Office 365 are the names you will meet most often. These products are not spam filters in the consumer sense — they are security appliances tuned to stop phishing, business email compromise, and impersonation attacks. Cold outreach, unfortunately, shares several structural characteristics with exactly those threats: an unknown sender, a recently registered domain, a personalised message referencing the recipient's employer, and a link asking them to take an action.

You can see which gateway a prospect's company uses before you send a single email. Look up the MX records for their domain — an MX lookup takes seconds through MXToolbox or a `dig MX` query — and the hostname tells you who receives their mail first. Domains pointing at `mail.protection.outlook.com` land directly in Microsoft 365. Domains pointing at `aspmx.l.google.com` land in Google Workspace. Domains pointing at `pphosted.com`, `mimecast.com`, `barracudanetworks.com`, or `iphmx.com` are behind a gateway that inspects everything before the tenant ever sees it.

Knowing the gateway does not let you bypass it, but it does let you segment intelligently. Gateway-protected domains deserve your cleanest, oldest, best-warmed sending infrastructure and your plainest content. What trips these appliances is fairly consistent: a sending domain registered in the last few weeks; a lookalike domain that resembles the recipient's own domain or a well-known brand closely enough to score as impersonation; a display name matching an internal employee; link shorteners and redirect chains; tracking pixels; attachments of any kind; and HTML structure that pattern-matches to bulk marketing templates rather than person-to-person mail.

• Age your outreach domains before use. Domain registration age is a direct input to gateway reputation scoring. Register sending domains months before you need them and let them sit — this is the single cheapest deliverability upgrade available to a B2B sender, and it costs nothing but foresight.
• Avoid lookalike domains entirely. A domain that resembles your prospect's brand, or a near-miss of a large vendor's domain, will be scored for impersonation risk. Use recognisable variants of your own brand instead — `getacme.com` or `acmehq.com` rather than anything designed to be mistaken for someone else.
• Strip link shorteners and redirect chains. Gateways resolve and score every URL. A bit.ly link, a redirect through a marketing automation domain, or a chain of three hops all reduce trust. Link directly to a page on a domain you own with real content on it.
• Reconsider open tracking for gateway-protected domains. Tracking pixels are 1x1 remote images, and several gateways treat remote image beacons in a first-contact email as a suspicious signal. Many B2B teams now run tracking off entirely for enterprise segments and measure on replies instead, which is a more honest metric anyway.
• Never send attachments in first-contact cold email. Attachments trigger sandbox detonation, add latency, and materially raise the risk of quarantine. If you need to share a document, describe it and offer to send it after a reply.
• Use a custom tracking domain if you track at all. Shared tracking domains inherit the reputation of every other sender using them. A subdomain of your own sending domain, properly configured, keeps that reputation yours.

Microsoft 365 vs Google Workspace at Company Domains

Most B2B prospect lists are a mix of Microsoft 365 and Google Workspace recipients, and you cannot tell which is which from the email address alone — only from the MX record. This matters because the two ecosystems weight signals differently, and a campaign tuned entirely against Gmail will look healthy right up until you notice that your Microsoft-hosted segment has been quietly underperforming for a month.

Microsoft's Exchange Online Protection scores every inbound message with a Spam Confidence Level and, separately, a Bulk Complaint Level that estimates how bulk-like the sender looks. Tenant administrators set the threshold at which bulk mail gets diverted, and many enterprise tenants set it conservatively — meaning perfectly legitimate outreach that reads as bulk gets filed as bulk regardless of your authentication status. Microsoft also applies stricter treatment to unfamiliar sending infrastructure, and its filtering has been consistently the toughest of the major providers for cold senders; published benchmark data has repeatedly shown Outlook-family inbox placement lagging Gmail and Yahoo by a wide margin even for fully authenticated senders.

Google Workspace at a company domain is not the same as consumer Gmail either. The underlying filter is similar, but the admin console lets IT tighten spam thresholds, enforce stricter authentication requirements on inbound mail, disable the Promotions tab entirely, and add domain-level blocklists. Corporate Google Workspace tenants also tend to have far less individual training data per mailbox than a consumer Gmail account that has been in use for a decade, so engagement signals build more slowly.

• Match your infrastructure to your list mix. If a meaningful share of your prospects sit on Microsoft 365, run some of your sending mailboxes on Microsoft 365 too. Provider-to-provider mail benefits from familiar routing, and it gives you a control group when placement diverges.
• Warm against both ecosystems. A warmup network composed mostly of Gmail seed accounts builds Gmail reputation and tells you nothing about Outlook. Confirm your warmup provider maintains genuine Microsoft 365 and business-domain inboxes in its seed pool, not just consumer Gmail.
• Register for both monitoring tools on day one. Google Postmaster Tools and Microsoft SNDS are free and only report data from the date you verify, so setting them up before your first send gives you a baseline you cannot retroactively create.
• Track placement per provider, not in aggregate. A blended 88% inbox rate can easily be 95% at Gmail and 70% at Microsoft. The aggregate number hides the problem you actually need to fix.

B2B List Hygiene Problems That Do Not Exist in B2C

Consumer lists decay slowly and predictably. B2B lists decay because people change jobs, and when someone changes jobs their work address is deactivated, repurposed, or — worst case for you — converted into a spam trap by a security team that knows recycled addresses are an excellent way to catch senders using stale purchased data. Industry estimates commonly put B2B address decay at roughly a fifth to a quarter of a list per year, and it clusters: a company that runs a layoff invalidates dozens of your contacts in a single week.

• Catch-all domains. Many company domains accept mail to any address, so a verification service can only return unknown rather than valid. Sending blind to catch-all domains inflates your apparent delivery rate while generating no engagement, which drags reputation down without ever producing a bounce to warn you. Cap catch-all addresses at a small share of any campaign and prioritise verified-valid contacts.
• Recycled and repurposed addresses. An address that belonged to a departed employee may be forwarded to a manager, converted to a shared alias, or turned into a trap. Any B2B list older than a few months needs re-verification before it is sent to — not because the domain changed, but because the humans did.
• Distribution lists and aliases. Addresses like `team@`, `everyone@`, or `engineering@` fan out to many people at once. One cold email to a distribution list can generate multiple simultaneous spam complaints from a single send, which is a fast way to damage a domain.
• Auto-responders and shared mailbox tooling. Corporate helpdesk and ticketing systems auto-reply to everything, which pollutes your reply metrics with meaningless positive signals and can create loops if your sequence logic treats any reply as engagement.
• Departed-employee forwarding. Some organisations forward a leaver's mail to a colleague for months. Your carefully personalised email arrives addressed to someone who no longer works there, read by someone who now considers you sloppy — a reply-rate problem that also increases complaint risk.
• Scraped data poisoning. Publicly scraped B2B datasets are seeded with trap addresses precisely because they are scraped. If you cannot explain where a contact came from, treat it as higher risk and verify it independently before it enters a campaign.

The operational response is the same in every case: verify at import, verify again if a list has been idle for more than about 30 days, remove hard bounces the same day they occur, and treat verification as a recurring cost of doing B2B outreach rather than a one-time cleanup. Our guide to building a cold email prospect list that converts covers sourcing and enrichment in more depth; the point here is narrower — in B2B, list quality is a deliverability control, not just a targeting one.

Role-Based Addresses: The Quiet Reputation Killer

Role-based addresses are mailboxes tied to a function rather than a person: `info@`, `sales@`, `support@`, `contact@`, `admin@`, `hr@`, `careers@`, `billing@`, `webmaster@`, `no-reply@`. They are trivially easy to guess, which is exactly why they end up in cheap lists — and exactly why sending to them damages you.

• They are monitored by people paid to filter. A `support@` inbox is triaged by someone whose job is to dispose of non-customer mail quickly. Marking it as spam is the fastest disposal method available.
• They are common spam trap conversions. Abandoned role addresses are among the most frequently repurposed trap addresses because senders using purchased data hit them reliably.
• They fan out. Role addresses often route to a shared inbox or ticketing system with several watchers, so one complaint button press can represent several recipients.
• They generate junk engagement. Ticketing auto-replies register as replies in your reporting, making a failing campaign look like a working one and delaying the moment you notice the problem.
• They almost never convert. Even setting deliverability aside, a message to `info@` reaching a decision maker is a rare event. The expected value is close to zero while the reputation cost is real.
• Verification services flag them, and you should act on the flag. Most verification APIs return a role-based indicator alongside validity. Suppress on that field automatically rather than reviewing it manually.

The fix is to find the named human instead. Enrichment providers, LinkedIn-based sourcing, and pattern-plus-verification approaches all produce individual addresses at a cost far below what a damaged domain costs to replace — our guide on how to find email addresses for B2B prospects walks through seven methods. If a specific account genuinely has no discoverable individual contact, that account belongs in a LinkedIn or phone motion, not in your email sequence.

“In B2B outreach, list quality is not a targeting decision that affects reply rates. It is an infrastructure decision that affects whether your domain can send at all next month.”

The B2B Cold Email Tech Stack

Teams searching for help with a B2B cold email tech stack are usually looking at nine or ten vendor categories and trying to work out which are genuinely necessary and which are the same product sold twice. Here is the honest layer map — what each layer does, and what actually matters when you evaluate it.

The trap in this table is that you can buy all ten layers separately and end up with a stack that costs more than the pipeline it produces while giving you no single view of health. Warmup billed per mailbox is the clearest example: at typical market rates of roughly $15 to $50 per inbox per month, a 40-mailbox fleet can cost more in warmup alone than the entire sending platform. Layers that belong together — sending, rotation, warmup, monitoring, and reply handling — are worth consolidating, because the value of each depends on data from the others.

1. Buy and park the domains first. Register secondary sending domains and let them age while you build everything else. Put a simple one-page site on each so the domain has a footprint.
2. Publish SPF, DKIM, and DMARC before creating a single mailbox. Warming an account with broken authentication wastes the entire warmup window. Our SPF, DKIM, and DMARC setup guide covers the exact record syntax and rollout sequence.
3. Create mailboxes across both Google Workspace and Microsoft 365, using real human names rather than generic aliases, at two to three mailboxes per domain.
4. Start warmup immediately and never stop it. Warmup should be running weeks before your first campaign and should continue in parallel at a meaningful share of volume permanently.
5. Stand up verification before data. Wire your verification API into the import path so no unverified address can enter a campaign, rather than cleaning up afterwards.
6. Source and enrich the list, capturing MX and gateway data alongside firmographics so you can segment by filtering environment later.
7. Configure sending limits and rotation so campaign volume distributes across the fleet within per-mailbox caps, with follow-ups pinned to the mailbox that started each thread.
8. Turn on placement testing and per-mailbox monitoring before launch, not after the first campaign underperforms.
9. Connect the unified inbox and CRM last, so that the moment replies start arriving there is exactly one place they land and one path into pipeline.

Sending to Enterprise Recipients

The larger the target company, the more of the stack above is working against you — and the more your content choices matter. Enterprise security teams run phishing simulation programmes that train staff to report unexpected external mail, and a reported message feeds directly back into the tenant's filtering. At that scale, a single campaign that reads as suspicious can get your entire domain added to a tenant block list, at which point every future email to that company is dead regardless of which mailbox sends it.

• Plain text, short, one ask. Enterprise-targeted cold email should look like internal correspondence: no HTML wrapper, no images, no signature block full of social icons, and a single clear call to action. Fifty to 125 words remains the reliable range.
• One link at most, on a domain you own. Two or more links in a first-contact email to a gateway-protected domain is a meaningful risk increase for very little gain.
• Do not spoof familiarity. Subject lines like `Re:` or `Fwd:` on a first contact, or display names matching an internal employee, are exactly the patterns impersonation detection is built to catch.
• Respect external-sender banners. Most enterprises stamp external mail with a warning banner. Copy that pretends to be an internal colleague reads as a phishing attempt the moment the banner appears above it.
• Keep sequences short and well spaced. Three to five touches over two to three weeks with at least three business days between steps. Aggressive cadences to unengaged enterprise recipients are the fastest route to a complaint.
• Apply global suppression across campaigns. If a prospect is in two sequences at once, they receive double the volume from your domain and the recipient organisation sees a pattern that looks like a campaign, not a conversation.

There is a strategic point hiding in all of this. Every constraint above pushes B2B cold email toward looking like genuine person-to-person correspondence — because that is precisely what corporate filters are tuned to let through. The technical work buys you the right to be evaluated on your message; the message still has to earn the reply.

B2B Deliverability Metrics Worth Separating

Aggregate metrics hide B2B problems because your list is a mixture of filtering environments. Break every number below down by recipient provider — Microsoft, Google Workspace, gateway-protected — and the diagnosis usually becomes obvious within one reporting cycle.

One more B2B-specific instrument worth running: seed accounts on real business domains, not just consumer Gmail and Outlook.com addresses. A consumer seed set tells you nothing about whether Proofpoint quarantined you. Placement testing that includes Microsoft 365 and Google Workspace seeds on custom domains is the only way to see the failure mode that costs B2B senders the most.

The B2B Cold Email Deliverability Playbook

If you want the whole thing as a sequence you can execute against, this is it — ordered so that each step protects the one after it.

1. Never send cold outreach from your primary corporate domain. Register dedicated secondary domains and keep the corporate domain for customers, partners, and transactional mail.
2. Register those domains well ahead of need and let them age. Add a real one-page site to each.
3. Publish SPF, DKIM at 2048 bits, and DMARC on every sending domain. Start DMARC at `p=none` with reporting, then tighten once alignment is clean.
4. Create two to three mailboxes per domain, using real human names, split across Google Workspace and Microsoft 365 to match your prospect mix.
5. Warm every mailbox before it sends and keep warmup running permanently alongside campaigns.
6. Verify every address at import. Suppress role-based addresses automatically and cap catch-all domains.
7. Enrich with MX data and segment your list by filtering environment — direct Microsoft 365, direct Google Workspace, gateway-protected.
8. Cap each mailbox at 30 to 50 campaign sends per day and distribute volume across the fleet through rotation rather than raising per-mailbox limits.
9. Send plain text, 50 to 125 words, one call to action, at most one link on a domain you own, and no attachments.
10. Space sequences to three to five touches over two to three weeks, with global suppression preventing overlap between campaigns.
11. Run placement tests weekly against seeds that include real business domains, and check blocklists on every sending domain.
12. Monitor per provider and per mailbox. Pull any mailbox showing degradation out of rotation immediately and re-warm it rather than letting it drag the fleet down.
13. Answer replies fast and from the mailbox that sent the original message — sustained two-way conversation is the strongest positive signal available to a B2B sender.

Where ColdBox Fits in the B2B Stack

ColdBox consolidates the layers that only work well when they share data. Connect unlimited Google Workspace, Microsoft 365, or SMTP mailboxes and warmup starts immediately and free on every one of them — real conversations with an engaged network, with messages opened, replied to, and rescued from spam automatically, then held at a maintenance level permanently so reputation never decays between campaigns. Because warmup is built in rather than billed per inbox by a separate vendor, adding mailboxes to improve deliverability stops being a budget decision.

Sending and rotation sit on the same data. ColdBox distributes campaign volume across your entire fleet inside safe per-mailbox limits, keeps follow-ups on the mailbox that started the thread, and applies global suppression so a prospect never receives overlapping sequences from your domains. Deliverability monitoring reports placement and per-inbox health continuously, so a mailbox drifting toward spam gets flagged before it damages a campaign rather than after. When replies arrive, the unified inbox pulls them from every mailbox into one view with AI classification by intent, and AI reply agents can draft or send responses and book meetings directly — which matters for deliverability as much as for pipeline, because sustained two-way conversation is exactly the pattern corporate filters reward.

The Bottom Line

B2B cold email deliverability is not generic deliverability with business recipients attached. It is a harder problem with more filtering layers, faster list decay, and failure modes that produce no bounce and no signal. The teams that solve it treat the recipient's filtering environment as data — looking up MX records, segmenting by gateway, splitting metrics by provider — and treat their own infrastructure as a fleet to be maintained rather than a set-and-forget configuration.

Get the fundamentals right, then go further: age your domains, suppress role-based addresses ruthlessly, warm continuously, send plain text that looks like correspondence, and rotate volume across many mailboxes instead of pushing any single account harder. ColdBox provides the sending, rotation, free built-in warmup, deliverability monitoring, unified inbox, and AI reply agents in one platform, so the stack you have to assemble is a great deal shorter than the one above. Start free and have your first B2B sending infrastructure warming today.