Email Deliverability for M&A: Domain Architecture, Warmup, and the Mistakes That Kill Campaigns

When an M&A firm tells us their outbound "isn't working," the first thing they blame is the spam filter. Nine times out of ten, the spam filter is doing exactly what it's supposed to do. The problem is upstream — in the domain architecture, the warmup, or the sending behavior of the prior six months.

Deliverability is not a feature your sending tool turns on. It is the cumulative reputation of your domain and the mailboxes on it, judged daily by Gmail, Outlook, and Yahoo against thresholds that have tightened sharply since 2024. If you are an M&A advisor running outreach to business owners, here is the actual playbook.

Domain Architecture: Don't Send From the Domain Your Bankers Live On

The single most expensive mistake in M&A outreach is sending cold email from your primary domain — the one your partners use for client deals, NDAs, and CIM distribution. Burn that domain's reputation and you lose the email channel that closes business.

The right architecture separates assets:

Primary domain (e.g., yourfirm.com) — used only for client and counterparty mail. Never used for cold outreach.
Sending domains (e.g., yourfirm-ma.com, yourfirm-deals.com, getyourfirm.com) — purpose-bought, redirected to the primary, used exclusively for outbound.
Sub-domains for transactional or marketing mail — for example, news.yourfirm.com for nurture, kept separate from the cold sender.

Each sending domain gets its own DNS authentication stack. Three records carry the weight:

SPF — a TXT record listing every IP authorized to send for that domain.
DKIM — a public-key signature your sending platform attaches to outgoing headers, with the matching key published in DNS.
DMARC — the policy that tells receivers what to do when SPF or DKIM fails, and where to send the aggregate reports. Per RFC 7489, a message satisfies DMARC if at least one of SPF or DKIM produces a pass based on an identifier in alignment with the From: header domain. Misalignment is the silent killer — your mail is "signed" but the signing domain doesn't match the visible sender, and the message fails DMARC anyway.

Starting February 2024, Gmail requires SPF, DKIM, and DMARC — with a DMARC policy of at least p=none — for any sender hitting 5,000 or more messages per day to its users. Yahoo's sender guidance requires the same stack — SPF, DKIM, a DMARC policy of at least p=none, and a spam rate below 0.3%. If your sending domain is missing any of these, it is being filtered before a human sees it.

One more piece: the MX record. A sending domain with no MX record looks like a spoofed shell to most receivers. Point it to a real mailbox provider — Google Workspace or Microsoft 365 are the only two that matter — even if you never read mail there.

Mailbox Warmup: Slow Is Cheap, Fast Is Expensive

A new mailbox on a new domain has zero reputation. Send 200 cold emails on day one and you will be in the spam folder by day three, with no path back without rotating off the domain entirely.

The defensible warmup ramp looks like this:

Week 1: 5 to 25 emails per day, sent only to addresses that will reply, open, and move you out of Promotions. Real conversations with real humans.
Week 2: 25 to 50 per day. Volume increases of no more than ~20% per day. Pause and hold if open rates dip below 40% or you see a single spam complaint.
Weeks 3–4: 50 to 75. Begin mixing in low-volume real outreach with strong personalization.
Week 5 onward: Real cold sending, capped at 25 to 30 prospects per mailbox per day. Industry guidance from Mailreach puts the ceiling for B2B mailboxes at 75 to 100 sends per day post-warmup on Google Workspace or Microsoft 365 — and we run conservative at 30 because M&A list quality is rarely as clean as we want.

Warmup is not a one-time event. Keep an automated warmup pool running behind every active mailbox. The moment you stop sending engagement-positive mail, your reputation starts decaying.

The threshold you cannot cross is the spam complaint rate. Google enforces a hard ceiling: since June 2024, bulk senders with a user-reported spam rate above 0.3% are ineligible for mitigation, and only become eligible again after their spam rate stays below 0.3% for seven consecutive days. Practically, you want more headroom — Google's own sender guidelines say to keep the Postmaster Tools spam rate below 0.10% and avoid ever reaching 0.30%.

The Five Mistakes That Kill M&A Campaigns Specifically

Sending from the firm's main domain. Covered above. The cost of a burned @yourfirm.com is measured in lost deals, not lost campaigns.
Buying a list and skipping verification. We treat bounce rates above 2-3% as list failure. M&A lists we audit from third-party providers routinely come back high-single-digit to low-teens invalid before scrubbing. Run every list through a verifier and remove catch-all domains from cold outreach entirely.
Identical templates across mailboxes. When eight sending mailboxes push the same 280-word "I represent a strategic buyer..." template, receivers spot the pattern and bucket all eight as one campaign. Vary subject lines, opening lines, and signature blocks per mailbox.
No reply-handling discipline. Every "unsubscribe," "wrong person," or angry reply that doesn't trigger an immediate suppression update becomes a future spam complaint. M&A targets are senior operators; they hit "report spam" instead of replying.
Sending HTML-heavy mail with tracking pixels and link rewriting. A plain-text email with one or two natural links lands. The same message in a marketing template with a tracker pixel, image hosting, and a click-redirect URL gets routed straight to Promotions or Junk. M&A outreach should look like a personal note from a banker, because that is what we are claiming it is.

The Seed-Inbox Test Protocol

Before any new domain hits production, and weekly for active domains, run the seed-inbox test. You need real inboxes — not a deliverability tool's emulator — across the three providers that matter:

Gmail (consumer + Google Workspace)
Microsoft (Outlook.com consumer + Microsoft 365 business)
Yahoo (Yahoo + AOL, since AOL is on the same backend)

Send a representative campaign email to one inbox in each provider. Wait 10 minutes. Check three things in every inbox:

Placement: Primary/Inbox, Promotions, or Spam.
Authentication: View the original headers. SPF, DKIM, and DMARC should all show PASS. If any one says FAIL or NEUTRAL, the DNS is wrong.
Rendering: Does the message look like a personal email, or like a marketing blast?

Microsoft 365 is the hardest to land in for M&A outreach because most middle-market business owners and their advisors run on it, and Microsoft's filter weighs IP and content reputation heavily. A domain that lands Primary on Gmail but Junk on Outlook will burn the majority of your real list. If you only test on Gmail, you do not know your deliverability.

Monitoring: What to Watch, Weekly

Three free tools cover most of what you need:

Google Postmaster Tools — the only direct read on how Gmail sees you: compliance status, user-reported spam rate, domain and IP reputation, and authentication. The spam rate dashboard is the metric to defend.
Microsoft SNDS — IP-level data for Outlook.com and Hotmail. Requires dedicated sending IPs (most cold outreach platforms share IPs, which limits SNDS visibility — but register anyway).
Blacklist monitoring — check Spamhaus, Barracuda, and SORBS weekly for your sending IPs and domains. A single Spamhaus listing can crater your inbox placement overnight.

The M3AAWG Sender Best Common Practices is the underlying standards document if you want the industry consensus view — it is what mailbox providers use to define "legitimate sender." Read it once. It will reshape how you think about list acquisition.

The Short Version

Deliverability for M&A is not a tool problem. It is a domain hygiene problem and a list quality problem dressed up as a tool problem. Buy purpose-built sending domains. Authenticate them properly. Warm slowly. Send like a banker, not a marketer. Test in real inboxes weekly. Monitor the spam rate like it is the only number that matters — because for the next six months of campaign performance, it is.

If you want a second set of eyes on your domain architecture or warmup plan before you scale a campaign, we do this for M&A firms full-time.