Cold email checklist for agencies: 34 checks before you email local businesses

A cold email checklist for an agency selling to local businesses has five stages: set up the sending domain (separate domain, SPF, DKIM, DMARC, warm-up), build the list properly (a defined market, deduped, emails from each business's own website), verify it (verified addresses only, catch-all as its own segment, suppression applied), write a compliant message (honest subject, postal address, opt-out), and send small and watch the numbers (spam rate under 0.3%, bounces under 2%). The 34 checks below cover each stage, with the thresholds Google, Yahoo and the main sending tools publish.

It isn't legal advice. Where a rule matters, we link to the regulator's own guidance.

What thresholds should a cold email campaign stay under?#

Stay under a 0.1% spam complaint rate (never 0.3%) and under a 2% bounce rate. Those two numbers decide whether Gmail, Yahoo and your sending tool keep delivering your mail. The published figures, as of October 2026:

Two numbers from that table are worth turning into counts. At 0.3%, it takes 3 spam reports per 1,000 emails to cross Google's line. At 2%, a 500-email campaign can absorb only 10 bounces. Our cold email bounce rate guide explains where each figure comes from.

Stage 1: Is your sending setup ready?#

Set up a separate, authenticated, warmed-up domain before you send anything, so a reputation problem never reaches your agency's main email.

• 1. Use a separate sending domain that's clearly yours (getacmeagency.com), not your main domain or a client's.
• 2. Publish SPF for the services that send for that domain.
• 3. Turn on DKIM signing in your mail provider.
• 4. Publish a DMARC record. p=none meets Google's and Yahoo's bulk-sender rule; tighten it once reports look clean.
• 5. Align the From domain with the SPF or DKIM domain so DMARC passes.
• 6. Check the domain's MX and DNS with the email domain checker.
• 7. Warm up new mailboxes. Start with a low daily volume and raise it gradually over a few weeks. The Google Workspace cap of 2,000 a day is a ceiling, not a target.
• 8. Spread volume across mailboxes instead of pushing one mailbox hard.
• 9. Make replies reach a person. No "no-reply" addresses: a reply is the only thing you want from cold email.

Stage 2: Is the list built properly?#

Build the list from a defined market, cover the whole area, and clean it before you look for a single email.

• 10. Write the market down: trade, place and a qualification rule ("independent HVAC companies in Maricopa County with a website and fewer than 50 reviews").
• 11. Use every name for the trade. "Plumber", "plumbing contractor", "drain cleaning service". The keyword generator builds the list.
• 12. Cover the whole area, not one search's first page. One Google Maps search stops at about 120 results; see how to get past the 120-result limit.
• 13. Dedupe on the listing's place ID, not the business name.
• 14. Drop out-of-area and wrong-trade rows. Hardware stores don't buy plumber SEO.
• 15. Take emails from the business's own website, and keep the page each one came from.
• 16. Throw out junk addresses: the web designer's footer email, example@ placeholders, image filenames that look like emails.

The Google Maps lead generation playbook covers each of these steps in detail.

Stage 3: Is every address verified and cleared to send?#

Verify every address shortly before the send, keep catch-all addresses apart, and run the suppression list on every export.

• 17. Verify every address against the domain's mail server. Never send to invalid.
• 18. Re-verify anything checked more than 30 days ago.
• 19. Keep catch-all (accept-all) addresses as a separate segment, never mixed with verified. Our guide to catch-all emails has the decision rule.
• 20. Drop pattern-guessed addresses on catch-all domains. They can't be checked.
• 21. Re-check "unknown" results later instead of sending to them.
• 22. Apply one suppression list (every opt-out and hard bounce, across every client, campaign and tool) to every export and push.

Stage 4: Is the message honest and compliant?#

Write a short, specific email that says who you are, where you are and how to opt out. In the US, CAN-SPAM covers B2B email with no exception [9].

• 23. One business, one reason. Say something true about this business: its listing, site or market.
• 24. Honest subject line. No fake "Re:" or "Fwd:", nothing that misrepresents the content.
• 25. Accurate From name and headers. Your real name and company.
• 26. A valid physical postal address in every email. CAN-SPAM requires it.
• 27. A clear opt-out in every email: a working link, or a plain line like "Not interested? Reply 'no' and I won't email again."
• 28. Plain and short. A few sentences, one question, no attachments, few links. No fake first names: Google Maps data has no owner names.
• 29. Check the country. CASL (Canada), PECR (UK) and EU rules are stricter than CAN-SPAM. See cold email laws before emailing outside the US.

Stage 5: Are you sending small and watching the numbers?#

Send a small first batch, read every reply, and let bounces and complaints, not the calendar, decide when to scale.

• 30. Send a first batch of a few dozen and read every reply before sending the rest.
• 31. Turn on your tool's bounce auto-pause (2% is the strictest common default) and watch bounces per segment, not the account average.
• 32. Watch the spam rate in Google Postmaster Tools. Stay below 0.1%.
• 33. Add opt-outs the day they arrive, including replies like "remove me", and remove hard bounces at once.
• 34. Follow up two or three times, then stop. Each follow-up adds something new; stop the moment someone replies or opts out.

After the campaign, re-run the market on a schedule for newly opened businesses. They're often the most receptive, and a list that only contains what's new is the cheapest one you'll build.

What changes outside the US?#

Mostly consent. CAN-SPAM lets you send B2B cold email without prior consent if you follow its rules; several other countries don't. In brief:

• UK: under PECR, you can email limited companies and LLPs without consent, but sole traders and some partnerships get the same protection as individuals [10]. UK GDPR applies when an address identifies a person.
• Canada: CASL generally requires consent. Implied consent can apply when an address is conspicuously published, without a "no unsolicited email" statement, and the message is relevant to the person's role [11].
• EU: GDPR applies to personal data in business emails, and national rules vary; Germany generally requires prior consent even for B2B email.
• Australia: the Spam Act requires consent, which can be inferred in limited cases, plus identification and a working unsubscribe [12].

Our cold email laws guide covers each country in more detail. When in doubt, get local advice.

FAQ#

What should be on a cold email checklist?#

Five stages: sending setup (separate domain, SPF, DKIM, DMARC, warm-up), the list (defined market, deduped, emails from the business's own site), verification (verified only, catch-all as a separate segment, suppression list applied), the message (honest subject, postal address, opt-out) and sending (small first batch, bounce and spam-rate limits, follow-ups that stop).

What spam complaint rate is too high for cold email?#

Google requires all senders to keep the spam rate reported in Postmaster Tools below 0.3% and recommends staying below 0.1%. Yahoo asks bulk senders to stay below 0.3%. At 0.3%, three complaints per 1,000 emails is enough to cross the line.

What bounce rate should pause a cold email campaign?#

Aim for under 2%. Woodpecker's default auto-pause is 2%, and Instantly pauses a campaign above 5% once it has sent 200 emails. Gmail and Yahoo do not publish a bounce limit, but they expect you to stop sending to addresses that bounce.

How many cold emails can I send per mailbox per day?#

Google Workspace caps a paid user at 2,000 messages a day, but that is a hard ceiling, not a cold email target. Start new mailboxes far lower, raise the volume gradually as the domain warms up, and spread larger campaigns across several mailboxes rather than pushing one.

Does CAN-SPAM apply to B2B cold email?#

Yes. The FTC says the law makes no exception for business-to-business email. You need accurate headers, a non-deceptive subject line, a valid physical postal address, a clear way to opt out, and opt-outs honored within 10 business days. Each violating email can cost up to $53,088.

Who is responsible when an agency sends cold email for a client?#

Both can be. Under CAN-SPAM, the company whose product is promoted and the company that sends the message may both be held legally responsible. Agree in writing who handles opt-outs and share one suppression list between agency and client.

Sources#

1. Google, Email sender guidelines (authentication, spam rate, one-click unsubscribe, bulk-sender rules).
2. Google, Email sender guidelines FAQ (0.1% recommendation, November 2025 enforcement).
3. Yahoo, Sender best practices (spam rate below 0.3%, unsubscribes honored within 2 days).
4. Microsoft, Outlook.com Postmaster: Policies, Practices, and Guidelines.
5. Woodpecker, Bounce shield help article, accessed October 2026.
6. Instantly, High bounce auto-pause feature, accessed October 2026.
7. Smartlead, What is high bounce rate auto protection, accessed October 2026.
8. Google Workspace Admin Help, Gmail sending limits in Google Workspace, seen November 3, 2026.
9. Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business.
10. Information Commissioner's Office (UK), Business-to-business marketing.
11. CRTC (Canada), Frequently asked questions about Canada's anti-spam legislation.
12. Australian Communications and Media Authority, Avoid sending spam.