Cold outreach that earns a reply

What a stranger sees in a cold message that gets an answer, and the sender set-up and federal rules behind it.

Published by Heirloom Acquisitions LLC. Drafted with AI help. Sources checked and approved by Heirloom Acquisitions on September 27, 2026.

Published . Last verified .

The Federal Trade Commission's CAN-SPAM guide says the law has no exception for business-to-business email, and Gmail's sender guidelines ask senders not to buy email addresses from other companies. A cold message to a business therefore carries the same opt-out and postal address as any other commercial email, and it goes to names the sender found and recorded itself. This page covers federal rules in the United States and is general information, not legal advice.

Who goes on the list

Before pulling a new name, the seller writes one page on what the accounts signed in the past year have in common. The page answers five questions, and each answer sets a filter on the list.

Question about the signed accountsWhat it sets on the list
What kind of business was it?The industry and type filters
How big was it when it bought?The size filter, by staff or revenue
What happened just before it bought?The trigger to look for in public records
Who signed?The role on each row
Where did it first hear of the seller?The source worth repeating

A trigger is an event that gives an account a reason to care now: a new location, a new license, a key hire or a rule change that reaches its trade. Names come from public business directories, state licensing boards, trade association member lists and the company's own past inquiries. Each of those sources has terms of use, and the list keeps to them.

Made up for this example: a list of 120 commercial cleaning firms is sorted by trigger. The four that opened a second location in the last 90 days sit in the first rows, each with the opening date in the trigger column.

FieldExample entry (made up)
CompanyA regional commercial cleaning firm
Contact and roleThe owner, who signs service contracts
Source and dateState business license lookup, September 2026
Fit reasonSame size and type as the last three accounts the seller signed
TriggerOpened a second location in July 2026
ChannelEmail, then a call to the office line
Suppression checkedSeptember 27, 2026

What the first line shows

Made up for this example: two first lines offer the same janitorial supply service to the same owner. One reads "Businesses like yours trust our supplies." The other reads "Saw the second location on Route 9 opened in July, so the supply order probably just doubled." The second line can only have been written to that owner, and it names the trigger from the list row.

Alex Hormozi's book $100M Leads (2023) builds its cold outreach chapter on three parts: a list, a message personalized to each person on it, and enough volume to learn what works.

When a stranger becomes an engaged lead

A lead becomes engaged when the reply states a problem, for example, that the second location is still buying supplies at retail prices. From that reply on, the work is qualification, covered in how to qualify leads when you are the whole sales team.

What federal email law asks of every message

The FTC's compliance guide sets these requirements for each commercial email, with penalties of up to $53,088 for each email in violation.

  • The header information is accurate, including the From, To and Reply-To lines.
  • The subject line reflects what the message says.
  • The message identifies itself as an ad, in words the sender chooses.
  • The message carries a valid physical postal address.
  • The message says how to opt out of future marketing email.
  • Each opt-out is honored within ten business days.

The guide adds that a sender may not sell or transfer the address of anyone who opted out, even inside a mailing list, and that hiring another company to send the mail leaves the legal responsibility with both the company promoted and the company that sends.

A camera maker's marketing email

Verkada sells security cameras and other building security products to businesses, including schools and medical facilities, according to the complaint the Department of Justice filed for the FTC in August 2024. The complaint says the company's sales and marketing teams sent more than 2 million commercial emails in 2019, more than 6 million in 2020 and more than 22 million in 2021, with several messages going to the same recipients. Recipients complained that they could not unsubscribe. The emails did not consistently carry a valid postal address, gave no clear notice of the chance to opt out, and kept arriving more than ten business days after people asked to stop.

Verkada agreed to settle for a $2.95 million civil penalty, which the FTC's release of August 30, 2024 calls the largest the agency had obtained for a CAN-SPAM violation.

Sender set-up before the first send

Gmail's sender guidelines require every sender to set up SPF or DKIM and to keep the spam rate reported in Google's Postmaster Tools below 0.3 percent (ideally below 0.1 percent), and anyone sending more than 5,000 messages a day to Gmail accounts also needs SPF, DKIM and DMARC. Marketing mail from those bulk senders supports one-click unsubscribe. Gmail tracks volume, feedback and limits for each sending domain and IP address, so complaints about a campaign count against the domain it came from.

Three Internet standards define the set-up records:

  • SPF lets a domain's administrators name the servers allowed to send mail using that domain (RFC 7208).
  • DKIM lets the owner of a domain sign a message, so the receiver can check that the domain takes responsibility for it (RFC 6376).
  • DMARC lets the domain owner state how receivers should treat mail that fails those checks, and ask for reports on the domain's use. The current standard is RFC 9989, published in May 2026, which replaced RFC 7489.

Some senders run cold outreach from a second domain so that complaints stay off the domain their invoices and proposals come from. No standard or provider rule requires it, and Google's own guidelines recommend a separate From address for each kind of message, such as sales receipts, promotions and account alerts.

Keeping the list clean

  1. Keep a permanent suppression list of everyone who opted out, complained or bounced as an invalid address.
  2. Check each new batch of names against it before the first message goes out.
  3. Remove an address the first time it bounces as invalid.

Business calls and AI voices

The FTC's telemarketing Q&A says most calls to a business to sell to that business are exempt from the Do Not Call provisions, and that a seller required to use the registry syncs its lists with it at least every 31 days. The exemption covers calls to businesses, so personal and consumer numbers on a mixed list fall outside it.

In February 2024 the FCC ruled that AI-generated voices count as artificial voices under the Telephone Consumer Protection Act, and its release restates that telemarketers need prior express written consent from consumers before robocalling them (FCC, February 8, 2024).

How many new messages one person can answer

The daily ceiling for new cold messages is the number of replies the sender can answer the same day, divided by the reply rate. Made up for this example: a founder can answer 5 replies a day and gets a reply to 5 percent of messages, so 100 new messages a day is the ceiling. At 200 a day the same founder gets about 10 replies, and half of them wait until tomorrow. The guide to counting outreach before judging a channel covers how many messages a reply rate needs.

Sources

Talk through your outreach numbers

A 30-minute call about your outreach counts and reply rates. Bring the weekly tally from the worksheet.

Book a 30-minute callOpen the worksheet

Booking opens Google Calendar in a new tab.