Send 20 to 40 cold emails per day per inbox, and plan around 30. That is the honest answer to how many cold emails per day per inbox is safe in 2026. The number does not come from a platform cap: Google Workspace technically lets one account send 2,000 messages a day. It comes from the spam complaint math. Since February 2024, Google and Yahoo cut off senders whose complaint rate reaches 0.3 percent, which is one angry recipient per 333 delivered emails. Cold email lives or dies on staying under that line, and small per-inbox volume is how you keep one bad day from becoming a burned domain.
If you search this question you will find answers of 25, 30 to 50, and 100 to 150 a day, often published weeks apart, and almost never with reasoning attached. The pattern behind the spread is simple: the vendors selling you inboxes and warmup seats quote the high numbers, and the people who fix burned domains quote the low ones. This guide referees. It walks through what the Google and Yahoo bulk sender rules actually say, what Microsoft's 2025 mirror of those rules did to Outlook delivery, the arithmetic for how many domains and inboxes you need to send 500 cold emails a day, and whether warmup tools still earn their subscription. Every number below is sourced from the platform rules or from named practitioner guides, so when the advice changes again, you will be able to re-derive the answer yourself.
Is cold email still effective in 2026?
Yes, and the 2024 and 2025 rule changes are a large part of why. The requirements did not ban cold email; they banned lazy cold email. Authentication, working unsubscribes and complaint monitoring raised the cost of spraying 10,000 templated messages from a burner domain, which thins out the noise your prospect wakes up to. A relevant, individually written email from a properly configured domain now competes against less garbage than it did in 2023.
The trade is that the technical floor is higher. You cannot skip SPF, DKIM and DMARC. You cannot buy one domain and blast from it. And you cannot outrun a bad list with volume, because complaints are now measured and enforced rather than quietly tolerated. Cold email in 2026 is an infrastructure discipline plus a relevance discipline. The rest of this guide is the infrastructure half; for the relevance half, your list and your first sentence matter more than any tool.
Do this now: before buying a single domain, write down your target segment and how many of them exist. If the honest answer is 2,000 companies, you do not need 500 sends a day, and smaller volume with better research will beat the spreadsheet-blaster approach on replies per hour of work.
What are the Google and Yahoo bulk sender requirements?
Both took effect in February 2024 and are nearly identical. Google's email sender guidelines require anyone sending 5,000 or more messages a day to Gmail accounts to have:
- SPF and DKIM authentication on the sending domain.
- A DMARC record, which can be as permissive as p=none, with the From domain aligned to SPF or DKIM.
- One-click unsubscribe using the RFC 8058 headers (List-Unsubscribe and List-Unsubscribe-Post) plus a visible unsubscribe link, for marketing and subscribed mail.
- A spam complaint rate in Postmaster Tools kept below 0.1 percent, and never reaching 0.3 percent.
Yahoo's sender requirements mirror all of it: SPF and DKIM, DMARC at p=none minimum, one-click unsubscribe honored within two days, and spam rate under 0.3 percent.
Three details from Google's own FAQ matter more than the headline threshold. First, the 5,000 counts all mail from the same primary domain, subdomains included, so you cannot dodge it by splitting to sub.yourdomain.com. Second, bulk sender status is permanent once triggered: there is no cooling-off period. Third, enforcement stopped being polite. As of November 2025 Google is ramping up rejections of non-compliant traffic, temporary and permanent, with new domains held to an accelerated compliance timetable.
Here is the math that sets your daily number. The 0.3 percent ceiling is one complaint per 333 delivered emails. The 0.1 percent target is one per 1,000. Cold recipients did not opt in, so some fraction will always hit report spam, and you do not control which day they do it. An inbox sending 30 a day gives a single complaint limited blast radius and keeps each domain so far under 5,000 a day that you never trip the bulk sender machinery at all. An inbox sending 150 a day into a mediocre list can hit the ceiling in an afternoon. The per-inbox limit is not a rule anyone wrote down; it is the complaint math expressed as a habit.
Do this now: set up Google Postmaster Tools for every sending domain, then send a test to your own Gmail and check the original message shows SPF, DKIM and DMARC all passing. Ten minutes, and it is the difference between measuring your reputation and guessing at it.
Did Microsoft's rules kill cold email to Outlook?
No, but they ended unauthenticated sending to it. On May 5, 2025, Microsoft applied its own version of the Google and Yahoo rules to Outlook.com, Hotmail and Live addresses: senders of 5,000 or more messages a day must have SPF, DKIM and DMARC (p=none minimum, aligned), as documented in Mailgun's breakdown of the requirements. Microsoft originally planned to route failing mail to junk first, then changed course: from May 5 non-compliant mail is rejected outright with the SMTP error "550; 5.7.515 Access denied, sending domain does not meet the required authentication level."
If you see 5.7.515 bounces, that is not a reputation problem, it is a configuration problem, and it is fixable in an hour with correct DNS records. The harder truth is that Microsoft's filtering was already stricter than Google's before these rules, particularly for corporate Microsoft 365 tenants, which is why practitioner guides such as lemlist's 2026 infrastructure walkthrough recommend splitting your mailboxes across both Google Workspace and Microsoft 365, so mail to Outlook recipients travels inside Microsoft's own ecosystem where possible.
Do this now: run your sending domain through a free DMARC checker, and grep your bounce logs for 5.7.515. If it appears, fix SPF, DKIM and DMARC alignment before sending another campaign; every send that bounces on authentication is pure reputation damage.