Is Cold Email Spam? What Spamhaus Says and Where I Stand

By the definition the blocklist operators use, most cold email is spam. Spamhaus runs some of the blocklists mail servers check. In June 2025 it wrote that "by definition, there is no difference between cold email and spam" and that what makes a message spam is whether the recipient agreed to get it, whatever the message says (Spamhaus on cold emailing).

In November 2025 the anti-abuse group M3AAWG added its own verdict, aimed at method: cold email sent with deceptive delivery methods is an abusive practice.

Spam and illegal are different things, though. In the US, a first B2B cold email needs no prior consent if it follows the CAN-SPAM rules. Canada, the EU and the UK lean further toward consent, especially for individuals. The full legal picture is in my guide to whether cold email is legal and in legitimate interest for cold email.

I send this kind of email for a living, and my answer is narrower than theirs: a cold email becomes spam when it goes out in bulk, with the same text, to people nobody checked, with no honest way to say no.

A short list of people picked for a stated reason, from a real person, with an easy exit, is not what buyers mean when they press the spam button. Spamhaus would still call it spam. Below is exactly where we part, and why their view matters to you anyway.

One disclosure first: I run a cold email and LinkedIn agency out of Prague, so I have a stake in the answer. Read everything below with that in mind.

What counts as spam, by the industry definition?

The definition Spamhaus applies is unsolicited bulk email. Both halves have to be true at once:

• Unsolicited: the recipient never gave verifiable permission for the message.
• Bulk: the message goes out as part of a larger batch, all with substantively identical content.

Nothing in it mentions how good the copy is. A beautifully written email to 30,000 people who never asked for it is still unsolicited bulk email.

Cold email fails the first half by design, so everything turns on bulk and on how honest the sender is about it. The usual defense, that each cold email is "one-to-one", does not get far: Spamhaus answers that there is still no business relationship, no transaction and no confirmed opt-in.

What M3AAWG added in November 2025

M3AAWG is an anti-abuse group whose members include mailbox providers and email service providers. Its position on cold email defines cold email as unsolicited mail from identifiable senders to someone with no prior relationship, connection or consent.

The verdict is about method: "using deceptive and misleading delivery methods to send unsolicited email (including Cold Email) is an abusive practice."

If you send cold email, read these closely:

• The warning signs it names are spam trap hits, blocklisting, a high rate of hard bounces to unknown users and high complaint rates. Each one grows out of a badly built list or a careless send.
• The practices it calls "particularly egregious" are getting around volume limits, dodging spam filters, masking sending domains and simulating engagement.
• Consent does not travel between channels. Someone who agreed to phone calls has not agreed to cold email.

Where I agree with Spamhaus and M3AAWG, and where my own setup sits

The Spamhaus piece lists the practices that make this kind of sending possible. In my words: scraping contacts from social profiles and websites and appending email addresses, warmup tools that spread sending across many platforms, "personalized" text generated by AI, faked engagement, lookalike domains registered in bulk to slip past filters, and abuse of free sending tiers.

A program built on those is spam in any sense of the word.

Two items on the list need honesty from me, because my own setup does something close to them. My team sends cold campaigns from separate domains, kept apart from the client's main one, and we warm the mailboxes up before they send.

The full setup is in my write-up of how we build sending infrastructure. The short version: the domain your invoices come from should never carry the risk of cold sending.

Spamhaus would count those domains as part of the problem. You should know that going in.

M3AAWG draws the domain line more narrowly. Its footnote defines lookalike domains as ones that resemble a legitimate domain while being unrelated to it, such as paypal-security.com for paypal.com. A variant of your own brand that leads to your own website falls outside that footnote.

The same document names multiple sending accounts as a misleading method when the aim is to avoid spam filters. A serious campaign in my setup runs on 20 to 40 mailboxes. The reason is keeping the volume on each mailbox low. A filter cannot read reasons, so I would rather you hear it from me.

Back in February 2021 I wrote on LinkedIn: "Many people think that lead generation is the 'science of sending spammy messages'." I still think they are wrong.

Lazy cold email is where that belief comes from, and it hurts everyone who sends cold email. Every careless blast trains a full inbox to delete the next cold email unread, including the good one.

Where I part ways, and why

Spamhaus draws the line at consent. I draw it at bulk and at care.

Sending spam does not work, and my rule is that you need quantity AND quality. Volume comes from many tight segments, each picked on purpose, not from one giant list of everyone with a matching job title.

That difference is practical. In a segment of a few hundred people picked on purpose, you can say why each one is on the list and write something true about their situation. In one undifferentiated list of 50,000 you cannot.

I will be straight about the limit. A campaign to one tight segment still runs on a template. Read strictly, Spamhaus's definition covers it, and a strict reading is not wrong.

Where we differ is weight. Spamhaus treats the missing permission as the end of the discussion. I put the weight on the parts a sender controls: how the list was built, how many people get the same words, and what happens when someone says no.

Disagreeing does not make their view irrelevant, because filters and recipients decide where your email lands. Gmail's sender guidelines cap every sender at a 0.3% spam rate as Postmaster Tools reports it, and recommend staying under 0.10%. That is 3 complaints in 1,000.

Legal, spam and ethical are three different issues

Most answers to this blur three questions into one. Separated:

Legal. The FTC's CAN-SPAM guide is explicit that B2B email gets no exemption: honest headers and subject lines, the message identified as an ad, your postal address and a working opt-out. Four rulebooks side by side, with the ceiling each regulator can reach:

The ICO says its PECR guidance is under review. None of the four lets you hide who is writing or ignore a request to stop. EU countries differ from each other on company addresses, and the country-by-country legality guide goes through them. Spam-filter wording is a separate topic, covered in spam trigger words. This is not legal advice.

One cold email, judged line by line

Here is a sample email I made up for this post. The sender is the founder of a 12-person software development company that builds scheduling tools. The recipient is the head of operations at a freight forwarder with about 80 staff.

Subject: Two dispatcher roles in Leeds

Hi Martina,

You are hiring two dispatchers in Leeds this month. When a forwarder adds dispatchers, the re-planning after a cancellation usually still lives in one person's head or a spreadsheet.

My team builds scheduling tools for freight forwarders with 50 to 150 people.

Worth 15 minutes before the new hires start? If not, just reply "no" and you will not hear from me again.

Tomas, founder

Under his name sit the company's registered name and postal address, which CAN-SPAM requires in commercial email.

Now the same campaign built the other way, line by line:

The twin uses most of the practices Spamhaus names, and its subject line alone could break the FTC's rule on deceptive subjects. The first version is still unsolicited bulk to Spamhaus. It does not hide who sent it, and it makes "no" easy to say.

Six checks before you press send

1. Do you have a legal basis where each recipient sits? Where the table above says consent, get it or leave that contact out.
2. Can you say in one sentence why this person belongs on the list? "Their job title matched" is not a reason.
3. Swap in a different prospect. If nothing beyond the name and company has to change, you are writing to a job title. Split the segment until the opening line has to change.
4. Are the sender and subject honest? A real person, on a domain that plainly belongs to your company, with a subject that says what the email is about.
5. Does one word stop everything? A "no" ends the sequence, goes on a suppression list the whole team shares, and is handled well inside the 10 business days CAN-SPAM allows.
6. If the recipient asked where you found their address, could you tell them the truth without wincing?

A campaign that fails any of the six waits. List quality and sending volume come next, because those are what filters count first.

How do I keep a running campaign out of the spam folder?

Filters judge what they can count: bounces, complaints and how much identical mail arrives from one sender. So three things matter in practice.

A verified list. Every address is verified before it enters a campaign, and anything unconfirmed stays out. Once a list's bounces go over half a percent, it comes out of the campaign and is re-verified before any domain sends to it again.

Why that strict? A hard bounce says nobody checked whether the address exists, the exact signal M3AAWG says gives cold email away. The cheap freelancer-built lists I have seen come with a high bounce rate and few opens, so where a list came from matters as much as who is on it.

The same goes for the people who said no. With 10 to 20 sending domains, an opt-out on one has to stop all of them. Check every new list against your suppression list before import, so nobody who opted out in March hears from another domain in May.

Four cold emails, with real time between them. Cold email gets four steps in our sequences, fewer than our 7-step LinkedIn and warm-email sequences. Each step has to bring something new: another angle, a different problem, a piece of proof, or one short question. "Just checking in" adds nothing and leans on guilt.

Across our campaigns, the meeting most often comes from follow-up number three, and only when there has been real time between sends. Squeeze four emails into a few days and the reader never gets a different week to answer in. My write-up on how my team builds a follow-up sequence covers the LinkedIn side too.

Low volume on every mailbox. Take one real month for a software development client: 15,000 emails spread over 20 mailboxes, which works out near 25 a day for each. That arithmetic is why my setup needs the 20 to 40 mailboxes I owned up to above. Every new mailbox warms up for at least 10 days, two weeks if possible, and volume rises only after that.

Already landing in spam?

If replies drop or your test emails land in junk, pause the affected domain first. The step-by-step recovery is in what to do when cold emails go to spam, and the weekly readings are in how I check sender reputation every week.

One shortcut to skip: swapping a burned domain for a fresh one and sending the same list through it. The cause travels with the list, and M3AAWG counts that kind of filter-dodging as egregious.

1. Stop sending from the affected domain. Pause its mailboxes today. Pushing through only adds bounces and complaints to a falling reputation. Other domains can keep going while you look, as long as they share nothing with the problem.
2. Confirm authentication actually passes. Gmail asks any sender for at least SPF or DKIM, and bulk senders for all three records. Postmaster Tools shows pass rates, but only for mail to personal Gmail accounts, and it may skip low-volume days (Postmaster Tools dashboards). So also send a test to your own Gmail and check that its details show your sending domain under "Mailed by" and "Signed by" (Gmail Help).
3. Check what your bounce rate has been running at. Pull the last 7 days per mailbox. At 0.5% or more, treat the list as the cause: take it out, re-verify every address, and drop whatever fails before anyone sends to it again.
4. Read your spam rate against Gmail's line. Under 0.10% is where Google wants you. Between that and 0.3%, send less from that domain and narrow who you target. At 0.3% or above, the domain stays stopped until you know why. Check every sending domain against the public blocklists too, because a listing is its own repair job.
5. Find the cause, then come back slowly. One domain slipping while the rest hold points at something only it did: its segment, its copy variant, its mailboxes. All of them slipping in the same week points at something shared, usually a new list source or sequence. Fix that, restart at low volume per mailbox, and raise it only once the readings hold clean.

For the full weekly routine, with every reading and what each tool misses, see how I check sender reputation every week.

What spam costs you when it is perfectly legal

Deliverability damage gets attention because it shows up in a dashboard. The bigger cost does not.

B2B markets are small. If you sell to heads of operations in one region, there may be only a few hundred of them. Take a firm that sells to UK freight forwarders. IBISWorld counts 7,046 businesses in the UK Freight Forwarding & Customs Agents industry, a market it sizes at £26.3bn in 2026. That is every company in the sector, not every buyer.

Those buyers go to the same events, use the same suppliers and swap notes on vendors. Your name sits in the From line of every email.

A blocked domain can be replaced in a few weeks. Being remembered as "the company that spams us" by the very buyers you want is much harder to undo.

I have always put reputation above any single deal. The same judgment decides which clients my team takes on, and I once turned down very good money over it, a story I told in the post on who outbound works for.

A campaign can be legal, deliverable and still a bad idea. If the only thing keeping it clean is that nobody has complained yet, stop and rebuild the list.

If you worry that your cold email could read as spam, I am happy to look at your setup with you. Book a call whenever suits.