← Blog

Sell ·

How to Get Customers With Cold Email Without Landing in Spam

Cold email is legal in the US without opt-in. Stay out of spam with truthful headers, SPF, DKIM and DMARC, a warm domain and a small researched list.

By , Founder, Baljia AI

The short answer

You get customers with cold email by making every part of it smaller and truer than feels natural: a list of twenty researched people instead of two thousand bought addresses, a message under 120 words about their problem instead of your product, three touches at most that stop the moment anyone replies, and a sending setup that shows mailbox providers you are a real business writing real mail.

The legal part is simpler than most founders fear. In the US, the CAN-SPAM Act does not require prior consent before you email a prospect. It requires honesty and an exit: truthful sender information, a subject line that matches the message, a physical address, and an unsubscribe that keeps working and gets honored fast.

The spam-folder part is mostly setup and restraint: SPF, DKIM and DMARC configured once, a warmed-up domain, a daily volume a person could have typed, plain text, and one link at most.

We make Baljia, which drafts this kind of outreach, and it appears briefly near the end. Everything in this guide runs with a mailbox, a spreadsheet and patience.

What CAN-SPAM actually requires

CAN-SPAM is an opt-out law, not an opt-in law. The FTC's compliance guide describes no consent requirement before the first email; what it regulates is how you send and what happens when someone wants out. This section is US law only; if you email people in other countries, check the rules that apply there before you send.

Here is what the FTC's guide requires, in plain words:

  • Tell the truth in the header. The From, To and Reply-To fields and the routing information must accurately identify the person or business that sent the message, including the originating domain and email address. No borrowed names, no lookalike domains pretending to be someone else.
  • Tell the truth in the subject line. The subject must reflect what the message actually says. "Quick question about your scheduling" is fine if the message asks one. "Re: our call" when there was no call is a violation and, separately, the fastest way to make a stranger distrust you.
  • Identify the message as an ad. The law gives you latitude in how, but a commercial message must disclose clearly and conspicuously that it is an advertisement. Honest wording alone is not that disclosure: the message needs a clear line identifying it as a commercial message, and you should not dress it up as something it is not.
  • Include a valid physical postal address. A current street address, a post office box registered with the USPS, or a private mailbox registered with a commercial mail receiving agency all qualify. One line in the footer.
  • Give a working way to opt out, and honor it fast. The opt-out must be clear, must not cost anything, must not demand more than an email address or a visit to a single web page, and must keep working for at least 30 days after you send. Once someone opts out, you have 10 business days to stop emailing them, and you may not sell or transfer their address except to a company helping you comply.
  • You stay responsible when software or an agency sends for you. The FTC is explicit that hiring another company to handle your email does not shift legal responsibility. Both the business whose product is promoted and the business that pushed send can be held liable.

The stakes are not decorative: the guide states that each separate email in violation is subject to penalties of up to $53,088.

None of this is hard. A truthful subject, a real signature, an address line, a clear line identifying it as a commercial message, and a "reply with 'no more' and I will stop" sentence cover the mechanics. Founders get in trouble when volume runs so high they cannot track who opted out, one more argument for the small list this guide is built on.

Deliverability in plain words

Mailbox providers decide whether your message lands in the inbox, and they judge two things: whether your domain is set up like a legitimate sender, and whether the people you mail seem to want your mail.

The setup half is three DNS records you configure once. Google's email sender guidelines spell them out for anyone mailing Gmail addresses: every sender must authenticate with SPF or DKIM, and bulk senders above 5,000 messages a day need SPF, DKIM and DMARC together.

  • SPF publishes the list of servers allowed to send mail for your domain.
  • DKIM adds a cryptographic signature proving the message came from your domain and was not altered on the way.
  • DMARC tells receiving servers what to do when a message fails those checks.

Your email or DNS provider has a guide for each; this is an afternoon of copy-and-paste, done once. Google says unauthenticated messages might be marked as spam or rejected, so set up all three even if your volume sits nowhere near the bulk threshold.

The behavior half is slower and matters more:

  • Warm the domain. A new domain has no sending history, and history is what providers trust. Start with a handful of messages a day to people likely to reply, and raise the volume gradually over weeks, not days. Some founders send outreach from a separate domain to insulate the main one; that is fine, but the separate domain needs the same records and the same patience.
  • Keep daily volume human. Send batches a person could plausibly have written that day: tens, not hundreds. A sudden burst from a quiet domain looks exactly like what it is.
  • Write plain text with one link at most. A short, plain message with a single link reads like mail from a person. A designed template with images, a tracking pixel and five links reads like a campaign, to filters and to readers. No attachments to strangers, ever.
  • Chase replies, not spam reports. Replies, including polite refusals, are the best evidence your mail is wanted, and Google's guidelines require keeping the spam rate reported in Postmaster Tools below 0.3 percent, recommending under 0.1. Both point the same way: mail fewer people, more relevantly.
  • Clean as you go. Remove addresses that bounce immediately. Bounces tell providers you are mailing strangers from a stale list.

The message: under 120 words, their problem first

A cold email has one job: start a conversation with someone who plausibly has the problem you solve. Three rules get it there.

Open with their problem, not with you. The first line should be about something observable at their company, phrased so a yes or no starts forming before the line ends. "Are you still chasing invoice approvals over three email threads?" works. "I'm the founder of an exciting new platform" gives the reader nothing to answer.

Add one line of proof you have earned. A customer they would recognize, the job you held before this one, one number from your own work. Without it the note is a stranger's pitch; with it, it is a peer asking a fair question.

End with a question about the problem, never a meeting ask. "Is this still handled manually on your side?" invites an answer either way. A calendar link in the first message mostly invites deletion. The meeting comes after they say the problem is real.

Keep the whole message under 120 words; the reader should finish it in one glance on a phone. The subject line follows the same discipline as the body: short, plain and true, closer to a colleague's "question about your booking flow" than to anything with capital letters and promises. CAN-SPAM requires the honesty; the inbox rewards it anyway.

Twenty researched prospects beat two thousand bought addresses

Buying a list fails twice. Technically: sold lists carry stale addresses that bounce and recipients who never asked to be anywhere, and both tell mailbox providers what you are doing. Commercially: a message sharp enough to be under 120 words about one problem cannot fit a list assembled around a job title and nothing else.

Research twenty people instead. For each one, keep a row with their name, company, one sentence of evidence they have the problem, and a link to that evidence: a job posting, a public complaint, a tool they visibly use, something they wrote. If you cannot finish the evidence sentence, the row is not ready to mail. This is the same discipline as the hand-picked list in how to get customers from LinkedIn, pointed at a different channel, and if you cannot yet name a single real buyer, run the one-day exercise for finding people asking for your product first.

Twenty is not the ceiling; it is the batch size. Twenty researched rows a week, mailed well, is a serious pipeline motion for a founder.

Follow-up: three touches total, then stop

The rule of thumb: three touches total, the first email plus two follow-ups, then stop. Each touch gets one job. The first email asks the problem question. The second, a few days later, adds one new useful thing: a short observation about their situation, a relevant example, an answer to an objection you expect. The third is a polite close that leaves the door open. No touch repeats the pitch, and nothing sends after a reply arrives on any channel.

Past the third touch you are no longer following up; the person you picked because they fit your market now remembers you as noise. Silence after three honest touches is an answer; log it and move to the next twenty.

Before any of this gets delegated to software, read every draft the way our checklist for reviewing AI-written sales messages lays out. The sender's name on the message is yours, whoever typed it.

When cold email is the wrong channel

Cold email is a precision tool for reaching specific businesses you can research. It is the wrong tool more often than sending-software vendors admit:

  • Your whole market is a few hundred companies. You cannot afford to burn goodwill at that scale. Warm introductions and showing up where those buyers already gather beat any sequence.
  • You sell to consumers. The law still permits it, but consumer inboxes are harsher, the economics of low-ticket products rarely survive one-to-one outreach, and ads or content fit better. Should a small business run Meta ads or do SEO first? covers that decision.
  • Buyers already search for the solution. When demand exists as searches, a page that answers the search works while you sleep; outreach then supplements it rather than carrying everything.
  • You have no proof yet. Before anyone recognizable has paid you, conversations where your buyers already are will teach you more per hour than any sequence.
  • You cannot run the mechanics. No address you are willing to publish, no system for tracking opt-outs: fix that before the first send, not after.

Where Baljia fits

Everything above runs by hand, and by hand is how you should prove your first twenty rows. The ceiling is your time.

Baljia is an AI employee for founders and small businesses that gets you found and books meetings to your calendar. On the selling side it finds prospects, researches them, and drafts email and LinkedIn outreach with paced follow-ups that stop when someone replies. Nothing sends until you say yes, or until you deliberately switch sending on; LinkedIn campaigns come with the Growth and Scale plans. The legal mechanics stay yours either way: as the FTC notes, hiring a company to handle your email does not shift responsibility, so the address in the footer and the opt-out discipline belong to you whichever tool drafts the words. The AI sales outreach page covers costs and limits, and pricing lists the plans.

Frequently asked questions

Is cold email legal in the US?

Yes. The CAN-SPAM Act permits commercial email to people who never opted in, provided you follow its rules: truthful headers and subject lines, identification as an ad, a valid physical postal address, and an opt-out that works for at least 30 days and is honored within 10 business days. The FTC's guide puts the penalty at up to $53,088 per violating email.

Do I need an unsubscribe link in a short, personal cold email?

You need a clear way to opt out, which does not have to be a formal link. The FTC's guide asks for a return email address or another easy internet-based way to say no, so a plain sentence like "reply 'no more' and I won't email again" can do the job, as long as you honor it within 10 business days and the mechanism keeps working for 30 days after you send.

How many cold emails can I send per day?

There is no published safe number. The working tests are humbler: could one person have written today's batch by hand, and has your domain earned this volume gradually? Twenty well-researched prospects a week outperforms any number of unresearched ones.

Why do my cold emails go to spam?

Check in this order: missing SPF, DKIM or DMARC records; a new or quiet domain suddenly sending volume; a bought list generating bounces; template-style formatting with multiple links or images; and zero replies, which tells providers nobody wants the mail. Setup problems are fixed in an afternoon. Behavior problems are fixed by sending less, to better-chosen people.

Should I buy an email list?

No. Bought lists bounce, annoy people who never asked to be on them, and damage the sending reputation you spent weeks warming up, and a list built around a job title alone cannot support a message specific enough to get replies. Twenty rows you researched yourself will outperform the spreadsheet of two thousand, this week and every week after.

Research twenty people this week

Prove the loop by hand first: twenty rows, one problem-first message, two follow-ups, honest bookkeeping. If you then want the research and drafting handled while you stay the sender, Baljia offers a 7-day free trial, no credit card, at https://baljia.ai/. Outreach stays a draft until you approve it, and LinkedIn campaigns come with Growth and Scale.

Sources