What is cold email outreach?
Cold email outreach is sending a targeted email to a named decision maker who has no prior relationship with your company, to start a sales conversation. It is legal in most markets when it identifies the sender honestly, carries a real postal address and lets the recipient opt out. What separates it from spam is not tone. It's whether a specific person was chosen for a specific reason.
That definition is the easy part. The hard part is that almost every number used to justify the channel comes from a company selling the channel, and the most famous number of all measures something else entirely. Below are the figures that survive checking, the ones that don't, and a calculator for your own arithmetic.
Does cold email outreach still work in 2026?
Yes, at roughly a 3 to 6 percent reply rate depending on whose platform did the measuring, with the top tenth of campaigns clearing 10 percent. Those are real numbers from large datasets. They are also all vendor numbers, so read them as a floor for planning rather than a promise.
Four datasets published in 2025 and 2026 put the average in a narrow band. Instantly's 2026 benchmark reports 3.43 percent across platform data through December 2025, drawn from more than 700,000 businesses. Saleshandy reports 3.7 percent across 53.1 million emails. Belkins reports 5.8 percent across 16.5 million emails on 93 domains. Cleanlist lands at 3.1 percent. The spread between the lowest and highest is almost two to one, and it tracks who is being measured rather than what year it is.
You'll also see these stitched into a decline story: 6.8 percent in 2023, 5.8 in 2024, 3.43 in 2026. Don't plan against that line. The first two are Belkins measuring its own campaigns, the third is Instantly measuring its own platform. Three points from two populations isn't a trend, and treating it as one means budgeting for a collapse that may not be happening in your segment.
What has genuinely changed is that open rate is no longer a metric. Apple's Mail Privacy Protection, shipped in September 2021, routes image requests through Apple's proxy and fetches the tracking pixel on delivery, whether or not a human ever reads the message. Measurement providers put Apple-related activity at roughly half or more of all tracked opens. An open rate built on that is a measure of Apple's infrastructure, not of your prospect's interest. Track replies, booked meetings and pipeline. Nothing above the reply.
| Dataset | Reported Average Reply Rate | Sample | Whose Data |
| Instantly, 2026 benchmark | 3.43% | Platform data through Dec 2025, 700,000+ businesses | Sending platform, own customers |
| Cleanlist | 3.1% | Not disclosed in detail | Vendor |
| Saleshandy, 2026 study | 3.7% | 53.1 million emails | Sending platform, own customers |
| Belkins, 2025 study | 5.8% | 16.5 million emails, 93 domains | Agency, campaigns it ran |
Sources: Instantly 2026 Cold Email Benchmark Report, Empra's cross-dataset comparison. Every row is the measuring company's own sending population. None is a representative sample of all cold email.
Who measured the benchmark you are about to plan with?
The single most quoted number in cold email is wrong, and it was wrong in the earlier version of this article too. "Email returns $36 for every $1 spent" is a Litmus survey figure. Respondents told Litmus what they thought their email programme returned. It describes permission-based marketing to opted-in lists, and it has nothing to do with cold outbound.
Three details matter. The 36:1 result is Litmus's 2020 reporting, down from 42:1 the year before, which is why both figures get quoted side by side as though they confirmed each other. They're the same survey a year apart. Litmus also excluded the respondents who said they measured their own ROI poorly or not at all, roughly 39 to 45 percent of them. And permission email has almost no marginal send cost against an existing list, while cold outbound pays for data, enrichment, verification, domains, mailboxes, warmup, copy and the sales time to work the replies. Leave those out and any cold email ROI figure inflates.
What we got wrong here
Until October 2026 this page led with "$36 to $45 ROI per $1" in its title and attributed it to a cold email vendor's benchmark. It was a permission-marketing survey figure applied to a channel it never measured. We've removed it. There is no credible primary-source ROI benchmark for cold outbound B2B email, because nobody has published audited revenue against the fully loaded cost of prospecting. If someone quotes you one, ask what was in the denominator.
Two of the numbers we removed were worse than borrowed. Earlier peppereffect articles claimed that properly aged domains hit 98 percent deliverability against 60 to 70 percent for rushed ones, and that a cold email meeting costs $3 to $12 against $50 to $500 for a LinkedIn InMail. When we traced those back, the only source was peppereffect's own blog. No study, no sample, no method. They're gone, and we're naming them here because a circular citation that flatters you is still a circular citation.
The working rule we apply to every figure that reaches a client document: name the measuring organisation, the sample, the period and what population it represents. A number that can't carry those four things isn't evidence, it's decoration. Apply the same test to this page.
Work out your own number instead
Benchmarks tell you what a vendor's average customer achieved. They can't tell you how many emails you need to send to book the meetings your pipeline requires, or whether your sending setup can carry that volume without burning domains. That's arithmetic, and it's yours. Put your own figures in below. If you've never measured your reply rate, start with the 3.4 percent platform average and replace it with your real number after the first 500 sends.
Cold email capacity and sends-per-meeting planner
| What you need | Your number | Read it like this |
| Emails sent per month | 2,353 | to produce 10 meetings at 3.4% reply |
| New contacts needed per month | 588 | verified and not yet contacted, at 4 emails per contact |
| Sends per working day | 107 | across 22 working days |
| Mailboxes required | 3 | about 1 sending domain at 3 mailboxes each, 40 sends per mailbox per day |
| Your bounce budget | 47 | total hard bounces allowed at the 2% ceiling, about 2 a day |
Arithmetic on figures you supply. It assumes replies arrive at a steady rate and that your sequence reaches every contact, neither of which is quite true in a live campaign, so treat the contact requirement as a floor. The number that usually shocks people is the contact count: ten meetings a month at average performance means sourcing and verifying several hundred genuinely new, genuinely reachable people every month, forever. That sourcing capacity, not the sending, is what caps most outbound programmes.
Want this built as infrastructure rather than a monthly scramble?
What do the inbox providers actually require?
Since February 2024, Gmail requires any sender of about 5,000 or more messages a day to personal Gmail accounts to authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe, and keep the user-reported spam rate below 0.3 percent. Google recommends staying under 0.1 percent. Microsoft imposed equivalent requirements on domains sending more than 5,000 a day to its consumer services from 5 May 2025.
Two details get misreported constantly, and both cost money. First, Google's threshold is 0.3 percent, with 0.1 percent as the recommended operating target. Articles that present 0.1 percent as the hard limit are describing the target, and articles that treat 0.3 percent as comfortable are describing the cliff edge. One spam complaint per 333 emails puts you at the boundary. Second, Google and Microsoft both accept a DMARC policy of p=none. Authentication has to be present and aligned, meaning SPF or DKIM must match the domain in the visible From address. You are not required to reach p=reject to deliver, whatever your vendor's upgrade path suggests.
Microsoft's enforcement has hardened since launch. The original announcement said non-compliant high-volume mail would go to Junk, with outright rejection to follow. By 2026, Microsoft's own support documentation describes unauthenticated high-volume mail being rejected at SMTP time with a 550 5.7.515 error. Plan for rejection, not for a junk folder you can win your way out of.
| Requirement | Gmail | Microsoft Outlook consumer |
| Volume that triggers the rules | ~5,000 messages per 24h to personal Gmail accounts | More than 5,000 per day to consumer services |
| SPF and DKIM | Both required, one must align with the From domain | Both must pass, with DMARC alignment |
| DMARC policy | Required, p=none accepted | Required, p=none accepted |
| Spam complaint rate | Below 0.3%, under 0.1% recommended | Parallel thresholds enforced |
| Failure mode | Filtering, loss of delivery mitigations | Junk, and SMTP rejection (550 5.7.515) |
Sources: Google Email sender guidelines, Google sender guidelines FAQ, Microsoft, Outlook requirements for high-volume senders.
For context on the ceiling you're sending into: Validity's 2026 benchmark report, covering 2025 data from seed-address testing across hundreds of providers, puts global inbox placement at 87.2 percent, with Gmail at 89.8 percent. Microsoft trails the field as the most restrictive major provider. Those figures describe permission-based marketing mail. Cold senders have no engagement history, so treat them as the best case you are working towards.
Why your list is worse than your verifier says
Verification tools report on syntax and server responses, not on whether a human reads the mailbox. peppereffect measured the gap on its own campaigns in August 2026, and the results are the reason we now treat every verifier output as a hypothesis. These are our own numbers from our own sending, not an industry benchmark.
Thirty sends were enough to fail. 13.3% hard bounce rate.
A list that had passed content enrichment across 428 rows went out to 30 contacts and produced 4 hard bounces. Our own internal ceiling is 2 percent. The enrichment chain had checked everything about those companies and never once checked whether the mailbox existed. Read your bounce rate on the first sending day, not in the first week. Thirty sends told us everything.
A verifier scored a known-live address identically to three that bounced.
Our verifier gave a working internal peppereffect address exactly 69 points, the same score it gave three addresses that hard-bounced that same morning. The cause is catch-all servers, which accept every address at the RCPT TO stage and tell you nothing. A "risky" verdict on a catch-all domain is not a soft no. It's an absence of information. Catch-all domains now get their own sending wave, never a filter and never normal treatment.
A failed check is not a verdict. 96 of 144 written-off records were fine.
One verification run wrote 144 rows away as request_failed. They were stored as "risky" and skipped on the next pass. Re-checking resolved 96 of them as perfectly deliverable. Anyone who had trusted the first run would have thrown away 96 live contacts and called it diligence.
79 of 142 uploads were silently rejected, and the dashboard didn't say so.
Our sending platform accepted an upload of 142 leads and quietly dropped 79 of them because an earlier campaign had already contacted those people. The upload dialog reported what went in, not what was accepted. Never take a number from an upload confirmation. Read it back from the leads table or the API.
Eleven of eighteen enriched records were broken. 61% error rate.
Before one launch we read 18 enriched leads end to end, every email from first touch to last. Eleven were defective. That campaign would have sent in two hours. The lesson isn't to add another gate, because three of our five gates had already leaked. It's that passing a gate is a statement about a sample, not a guarantee.
Key takeaway
Verification answers whether a server accepts an address. Delivery answers whether a person has it. A catch-all address that took your first email without bouncing has passed a test no API can reproduce, which is why the first wave of any campaign should be small enough that failing it is cheap. Thirty sends is enough to learn what you need.
How should you structure the follow-up sequence?
Send four to five emails spaced three to seven days apart, each one able to stand alone, and stop there. Most of your replies arrive on the first email. The follow-ups are worth running because they're nearly free, not because they rescue a bad list or a bad offer.
The published data contradicts itself, which is instructive. Martal Group's analysis of its own B2B campaigns reports 58 percent of replies from the first email, the first follow-up adding up to 49 percent more, the third bringing 20 percent fewer responses than the second, and the fourth declining by 55 percent. Elsewhere you'll read that a four-touch cadence captures 93 percent of replies by day 10, which would make a day-17 email pointless, and the same source prescribes one anyway.
The defensible reading is the shape rather than the percentages: the first email does most of the work, the first follow-up adds meaningfully, and returns fall off hard after the third. So invest in the first two touches. Each follow-up needs a genuinely new reason to exist, a different angle, a specific case, a narrower question. "Just checking in" is a reply-rate tax. For prospects who say not now, move them to a dated nurture sequence rather than extending the cold cadence, which is where most of the recovered pipeline in an outbound programme actually comes from.
One more structural choice matters more than cadence. The commonly reported pattern, and it matches what we see in our own campaigns, is that contacting two to four people at one company beats contacting one and beats contacting ten. We have not found a primary study behind the specific percentages quoted for this, so treat it as a rule of thumb: pick complementary roles, a VP Sales and a VP Marketing rather than five people in the same function, and stop well short of anything that reads as carpet bombing.
What makes the copy work, and what the Boomerang study actually says
Keep the body between 50 and 125 words, write plainly, and ask for one thing. That advice is sound, and it comes from a study worth understanding before you cite it, because it's older and narrower than the way it gets quoted.
Boomerang published the analysis in 2016, across more than 40 million emails that its own users had flagged for reminders. Messages of 50 to 125 words drew the highest response rates, above 50 percent, with the 75 to 100 word band usually quoted as the peak. Emails written at roughly a third-grade reading level drew about 36 percent more responses than college-level writing, and about 17 percent more than high-school level. Two caveats that the summaries drop: the dataset is email in general, not cold sales email, and the findings are correlational. Short, plain emails were associated with replies. Rewriting a weak email down to 90 words does not cause one.
So treat the ranges as guardrails, not a mechanism. Brevity works on a cold prospect because a short email forces one clear reason for writing and makes the absence of one obvious. If you can't say why this person, this week, in two sentences, the problem is targeting and editing won't fix it.
On subject lines: keep the load-bearing words inside the first 33 characters, because that's what survives truncation on most clients. On the ask: one call to action, phrased as interest rather than a calendar demand. And on tracking: if your platform still reports open rates, turn the column off so nobody on your team optimises against Apple's proxy.
What are the legal requirements for B2B cold email?
In the United States, the CAN-SPAM Act permits cold email to business addresses without prior consent, provided each message carries accurate header information, a non-deceptive subject line, a valid physical postal address and a working opt-out that you honour within 10 business days. The FTC states that each separate email in violation carries penalties of up to $53,088.
Jurisdiction follows the recipient, not the sender. A US company emailing a procurement director in Munich is operating under GDPR, where B2B outreach generally rests on legitimate interest and the documentation is the deliverable: where the data came from, why this role is a reasonable prospect, how suppression persists. One trap that catches B2B senders repeatedly sits in the national ePrivacy rules rather than GDPR itself: the UK's PECR, and several EU implementations, treat sole traders and some partnerships as individuals for electronic marketing, so they need consent even when the address is a business one. Canada's CASL is the strictest of the three, requiring express or implied consent before you send at all, with implied consent expiring, and penalties reaching CAD $10 million per violation.
The practical architecture is to build to the strictest regime you touch and apply it everywhere. It costs less than maintaining three compliance paths, and it means data provenance and suppression are solved problems in your workflow orchestration rather than a quarterly panic.
| Regime | Applies to | Consent model | Maximum penalty |
| CAN-SPAM | US recipients | Opt-out, no prior consent needed | Up to $53,088 per email |
| GDPR | EU and UK recipients | Documented legitimate interest for B2B | Up to EUR 20M or 4% of global turnover |
| CASL | Canadian recipients | Express or implied consent required first | Up to CAD 10M per violation |
Source: FTC, CAN-SPAM Act Compliance Guide for Business. Penalty maximums are adjusted for inflation annually, so check the FTC page rather than a secondary summary before quoting a figure.
Where does AI actually help?
AI earns its place in two jobs in cold outreach: compressing prospect research, and classifying replies. It does not reliably earn its place writing the email, and the published lift figures for AI personalisation are the weakest numbers in this whole field.
Research compression shows up in your own time sheets. Reading a company's last two quarters, its hiring pattern and its public positioning used to take 20 minutes per prospect. With a well-scoped AI research agent it takes a couple, which is the difference between personalising 20 emails a day and 200. Reply classification is the other clear win: an agent that sorts incoming mail into interested, objection, referral, not now, out of office, bounce and unsubscribe, then routes each one, gives a salesperson back a couple of hours a day and cuts time-to-first-response from hours to minutes. Response speed is one of the few outbound levers with an unambiguous effect.
Be sceptical about the copywriting claims. You'll see "AI personalisation lifts replies from 9 percent to 18 percent, a 142 percent increase", which is arithmetically wrong before you even question the data, since 9 to 18 is a 100 percent increase. Numbers that can't survive division shouldn't survive into your forecast. Our position is that AI drafts from your evidence and a human decides what the offer is. Agentic workflows are worth building around research, routing and fulfilment. The sentence that asks a stranger for 20 minutes is still worth writing yourself.
On tooling, and the Apollo versus Hunter question that comes up constantly: they solve different halves of the problem. Apollo is a contact database with sending bolted on. Hunter is strongest at finding and verifying addresses on a domain you already care about. Neither publishes an audited ROI figure, so don't choose on one. Choose on list accuracy in your segment: buy a month of each, export 200 contacts matching your real target profile, and measure the bounce rate yourself. A few hundred dollars, and it beats every comparison table online, including ours.
Key takeaway
Automation improves the parts of outbound that are mechanical: research, verification, routing, suppression, follow-up timing. It does not improve targeting or offer, and those are what determine whether a campaign works. A faster machine pointed at the wrong list just reaches the wrong people sooner.
Frequently asked questions
Does cold email outreach still work in 2026?
Yes. Four large vendor datasets published in 2025 and 2026 put the average reply rate between 3.1 and 5.8 percent, with the top decile of campaigns above 10 percent. Treat those as planning floors rather than forecasts, because every one of them measures the sending population of the company that published it. The requirements to reach those numbers are authenticated domains, verified contacts, a specific reason for contacting each person, and a sequence of four to five standalone emails.
What is the ROI of cold email?
Nobody has published a credible one. The "$36 per $1" figure quoted everywhere is a Litmus survey of self-reported returns on permission-based email marketing to opted-in lists, from a survey that excluded the 39 to 45 percent of respondents who said they could not measure their own ROI. It does not measure cold outbound. A real cold email ROI figure would need audited revenue divided by the fully loaded cost of data, verification, infrastructure, copy and sales time. Calculate your own from your own cost per booked meeting instead.
What does the Boomerang study say about email length and response rates?
Boomerang's 2016 analysis of more than 40 million emails found that messages of 50 to 125 words drew the highest response rates, above 50 percent, with 75 to 100 words usually cited as the peak. It also found that emails at approximately a third-grade reading level drew about 36 percent more responses than college-level writing. Two limits to carry with the citation: the dataset is general email that users flagged for reminders, not cold sales email, and the findings are correlational rather than causal.
Can you personalise cold outreach at scale in 2026?
Yes, if you automate the research and keep the judgement human. An AI research agent reduces per-prospect reading from around 20 minutes to a couple of minutes, which is what makes genuine personalisation viable at a few hundred emails a day. What does not work is generating the whole email automatically, which produces technically competent mail with nothing specific in it. Use the calculator above to see how many contacts per month your meeting target actually requires before deciding how much personalisation you can sustain.
Which AI SDR platforms handle GDPR, CAN-SPAM and list validation?
Most of the established outbound platforms, Instantly, Smartlead, Saleshandy and Apollo among them, now bundle suppression lists, one-click unsubscribe, physical-address footers and some level of address verification, which covers the mechanical parts of CAN-SPAM and helps with bounce control. None of them provides your GDPR legal basis, because legitimate interest is a documented argument about why a given role is a reasonable prospect, and no vendor can make it for you. Judge platforms on whether suppression persists across campaigns and whether verification results are auditable, then keep the provenance record yourself.
How many cold emails can I send per day?
Keep each mailbox under roughly 40 to 50 sends a day and spread the volume across several warmed domains. The binding constraints are a hard bounce rate under 2 percent and a spam complaint rate under Gmail's 0.3 percent ceiling, with 0.1 percent as the target Google recommends. The calculator above converts your meeting target into the number of mailboxes and domains that volume needs. Note that Gmail's and Microsoft's formal bulk-sender rules start at about 5,000 messages a day, so most B2B outbound sits below the threshold while still being judged on the same reputation signals.
What reply rate should I expect from automated investor or executive outreach?
Automation on its own does not raise reply rates, and the published figures claiming it does are unreliable. What automation changes is throughput and response speed, so the same reply rate produces more total replies and those replies get answered in minutes instead of hours. Expect the channel average of 3 to 6 percent unless your targeting is genuinely narrow. The vendor datasets consistently show campaign size working against you, with sub-50-recipient campaigns outperforming thousand-recipient ones by roughly two to one, which is a targeting effect rather than an automation one. If a tool promises a reply-rate lift from personalisation alone, ask for the sample size and check the arithmetic in the claim.
Build the outbound engine, not another campaign
peppereffect installs outbound infrastructure for B2B teams: authenticated domains, verified data pipelines, reply classification and suppression that holds across campaigns. We measure before we scale, because volume has never been the bottleneck.
Resources
- FTC: CAN-SPAM Act Compliance Guide for Business
- Google: Email sender guidelines
- Google: Email sender guidelines FAQ, spam rate and bulk sender definitions
- Microsoft: Outlook requirements for high-volume senders
- Validity: 2026 Email Deliverability Benchmark Report
- Instantly: 2026 Cold Email Benchmark Report
- Empra: B2B cold email reply rate benchmarks across datasets
- Apple: Mail Privacy Protection
- peppereffect: Lead Generation Architecture
- peppereffect: LinkedIn outreach automation
- peppereffect: Metrics and KPIs for agentic systems
