How to Set Up Your First Cold Email Campaign

This playbook sets up a first B2B cold email campaign in the order the work has to happen, from one audience to launch checks, with the permission each step needs and the point where each step is done.

This applies to a B2B team sending its first outbound campaign from a Google Workspace mailbox it controls, to a list it built itself. Legal duties differ by country and recipient type, so the legal section covers US CAN-SPAM and UK PECR and GDPR basics only, and it is not legal advice.

How Do You Set Up Your First Cold Email Campaign?

A first cold email campaign takes seven steps in a fixed order, from audience and offer to mailbox, permissions, list, sequence and launch checks. Each step serves the floor Gmail sets for all senders, which is SPF or DKIM authentication and a spam rate kept below 0.3%.

This guide starts with the decisions, because a tool only executes what you decide. The sequencing tool used here belongs to the cold email platforms category, and if you need the category basics first, read what a cold email platform does, then come back here.

The table below maps each step to the tool used in this guide and the signal that the step is finished.

Each step has its own section below, in the same order. The daily volume and legal sections sit between step 6 and step 7 because both shape the launch, and step 7 is split into launch checks and measurement.

Two facts frame the volume side of every step. Google Workspace allows 2,000 messages a day per user, and a user who hits that limit cannot send for up to 24 hours. Woodpecker, the sequencing tool here, sends opening emails in daily batches that default to 50 per mailbox and lets you send each step to your own address before the campaign starts.

The step sections close with a short runbook block you can copy into your own notes. It gives what you decide, the inputs, when the step is done and its limitation, plus the tool and the permission needed where a step has them.

How Do You Choose The Audience For Your First Cold Email Campaign?

The audience for a first cold email campaign should be one segment narrow enough to describe in a sentence, such as one role at one company type with one problem, because a mixed list makes it impossible to tell whether the offer, the copy or the targeting failed.

Hunter's cold email guide puts the ideal customer profile before the list, and that order matters. Write the profile down before you open any data tool, or the data you can find will quietly decide who you target.

A narrow first audience has three properties.

• One role. "Heads of RevOps", not "sales and marketing leaders".
• One company type. A shared size, model or industry, so one proof point fits all of them.
• One problem. The pain your offer solves, phrased the way that role would say it.

Before you buy or build anything, it is worth knowing how to judge B2B contact data coverage for your segment, because thin coverage of one role is a reason to pick a different first audience.

Finding the contacts. Hunter Domain Search returns the professional addresses it holds for a company domain, with each person's name, job title, department and the public pages where the address was found. It filters by about 14 departments and has a Decision Makers tab, which suits a one-role audience. Each revealed email costs 1 credit, a real-time verification check costs 0.5 credit, and no credit is used when nothing is found. Teams that pull contacts into their own systems can compare email finder APIs instead of working in the web app.

Hunter tags addresses it built from public mentions as "Inferred". Its confidence score estimates deliverability, and Hunter says a score of 90% or more is a strong likelihood rather than a guarantee.

• The role is a single job title family
• The company type is defined by size, model or industry
• The problem is written in the buyer's own words
• The segment can be described in one sentence
• Contacts for this role exist in your data source
• Anyone outside the segment is left for a later campaign

What you decide: Which single role, company type and problem the first campaign targets.

Inputs: Company domains for the segment, and Hunter's department filter and Decision Makers tab to find the right people at each.

Tool: Hunter Domain Search, at 1 credit per revealed email and 0.5 credit per real-time verification.

Permission needed: No mailbox access is needed to search Hunter.

Done when: The audience fits in one sentence and every contact on the draft list matches it.

Limitation: Hunter's confidence score is an estimate, and inferred addresses come from public mentions rather than a confirmed mailbox.

What Is An Approved Offer In Cold Email?

An approved offer is the single request and promise a cold email makes, written down and signed off before copy exists, and the sign-off matters legally because the FTC's guide says the law makes no exception for business-to-business email and holds a company responsible for messages others send for it.

The owner is usually the founder, the sales lead or legal, depending on who answers for what the company says in public. The point of the sign-off is that copywriters, SDRs and agencies all work from one approved text, so nobody improvises a claim in a follow-up.

An approved offer holds five things.

• The problem. One problem the audience has, in their words.
• The outcome. The specific result you promise, without inflating it.
• The proof. The case studies, figures or customer names you are allowed to cite.
• The call to action. One ask, such as a short call or a reply.
• The off-limits claims. Promises, figures and names nobody may use.

CAN-SPAM gives the sign-off real weight. The FTC lists no deceptive subject lines and no false or misleading header information among the rules, and it expects a company to monitor what others do on its behalf. An agency or contractor sending for you is still sending as you.

APPROVED OFFER, campaign name and version

Audience - One sentence describing the segment
Problem - The problem, in the buyer's words
Outcome - The specific result we promise
Proof allowed - Case studies, figures and names we may cite
Call to action - The one ask
Off-limits claims - Promises, figures and names nobody may use
Subject line rule - Subject lines describe the email honestly
Sender identity - From name, sending domain, postal address
Approved by - Name, role, date
Review date - When this offer is checked again

What you decide: The one request and promise the campaign makes, and who owns the claims in it.

Inputs: The audience sentence, the proof you hold and the claims your company stands behind.

Done when: The owner has signed the offer and every writer works from that version.

Limitation: CAN-SPAM has no B2B exception, so the approved offer still has to meet its header, subject line and opt-out rules.

How Do You Set Up A Sending Domain And Mailbox For Cold Email?

A cold email mailbox is ready only when its domain passes SPF, DKIM and DMARC checks, and in Google Workspace that means a super administrator generating a 2048-bit DKIM key in the Admin console and waiting up to 48 hours before the record authenticates.

Use a separate domain. Hunter's getting-started guide recommends a separate domain for cold outreach, authenticated with SPF, DKIM and DMARC and warmed up before sending at volume. A separate domain keeps outreach reputation away from the domain your invoices and customer email depend on.

Meet Gmail's floor. Gmail's sender guidelines require every sender to set up SPF or DKIM, keep valid forward and reverse DNS, use TLS and keep the spam rate in Postmaster Tools below 0.3%. Senders of more than 5,000 messages a day to Gmail accounts must also set up both SPF and DKIM, a DMARC record and From-domain alignment. A first campaign is far below that, but setting all three records now costs nothing later.

Set up DKIM in Google Workspace. A super administrator generates the key in Admin console, under Apps, Google Workspace, Gmail, Authenticate email. Google recommends a 2048-bit key, and 1024-bit only if the DNS host cannot take the longer one. The public key goes into a TXT record named with the selector, which defaults to google.

DKIM TXT name    google._domainkey
DMARC TXT name   _dmarc
DMARC starting   v=DMARC1; p=none

DKIM can take up to 48 hours to start working. After that, click Start authentication in the Admin console, then send a message to a Gmail or Workspace user other than yourself and check the Authentication-Results header for DKIM=pass.

Start DMARC at p=none. A p=none policy reports without blocking mail, which suits a new domain. Add a rua reporting address to the record if you want aggregate reports sent to you.

Check every record in MXToolbox. MXToolbox has an MX Lookup, an SPF Record Lookup, a DKIM Lookup entered as the selector followed by ._domainkey and the domain, and a DMARC Lookup. Green in the SuperTool results means the record is fine.

• Outreach domain registered and separate from the main company domain
• Google Workspace mailbox created on the outreach domain
• One SPF record published, not two
• SPF record stays under the 10-DNS-lookup limit
• DKIM key generated at 2048 bits and published under google._domainkey
• Start authentication clicked after the record has propagated
• DMARC record published at p=none
• MX, SPF, DKIM and DMARC lookups all show green in MXToolbox

The failure messages map to fixes. "No SPF record found" means the TXT record is missing. "Multiple SPF records found" means two records must be merged into one. An SPF record over the 10-DNS-lookup limit needs fewer includes. A DKIM "Record not found" usually means the wrong selector or a record that has not propagated, and "No DMARC record found" means the _dmarc record is missing.

What you decide: Which outreach domain to send from and who in your company holds super administrator rights.

Inputs: Access to the domain's DNS host and a Google Workspace mailbox on the outreach domain.

Tool: The Google Workspace Admin console, under Apps, Google Workspace, Gmail, Authenticate email.

Permission needed: A super administrator must generate the DKIM key and start authentication.

Done when: A test message to another Gmail or Workspace user shows DKIM=pass in its Authentication-Results header.

Limitation: Google Workspace caps a user at 2,000 messages a day, 500 on a trial account, and blocks new sends for up to 24 hours when a limit is hit.

What Permissions Do Cold Email Tools Need?

Connecting Woodpecker to a Google Workspace mailbox gives it permission to check, send and manage that mailbox's email, and the connection works only if the Workspace admin has not blocked unconfigured third-party apps or has marked Woodpecker as Trusted or Limited. The other tools here need far less.

That is full send and read access to the mailbox. Say it plainly to whoever approves the tool, and connect a dedicated outreach mailbox rather than a personal inbox or the main company account that holds contracts, invoices and HR mail.

The connection itself is short. In Woodpecker you choose Gmail / G-Suite, pick Automatic connection, add the mailbox and click Allow on Google's consent screen.

Who controls third-party access. In Google Workspace, admins with the Service Settings administrator privilege decide which apps reach company data. Each app can be set to Trusted, which overrides a service restriction, Limited, which reaches only unrestricted Google services, or Blocked, which reaches no Google service.

Hunter and MXToolbox sit outside the mailbox entirely. Hunter Domain Search spends credits but touches no email account, and MXToolbox lookups read DNS records anyone can query, so neither needs an admin's approval beyond the account owner's budget.

How Do You Build And Verify A Cold Email List?

Verification sorts a cold email list into send, hold and drop, and the hold pile matters most on a first campaign because Hunter says an accept-all address cannot be confirmed and may bounce, while Bouncer labels the same kind of result risky rather than deliverable.

Build first, verify before import. Pull the contacts that match the audience sentence from Hunter Domain Search, then run every address through a verifier before it reaches Woodpecker. Hunter's real-time check costs 0.5 credit per address.

The two verifiers name their statuses differently, so map them to one decision.

What the statuses mean. Hunter's Accept All, also called catch-all, means the domain accepts any address, so the address cannot be confirmed and using it may lead to bounces. Hunter's Unknown means the check could not reach a result, often because the server blocks or greylists checks, and Hunter charges no credit for it. Disposable addresses are temporary and do not belong in cold outreach. Bouncer returns deliverable, risky, undeliverable or unknown, each with a reason such as catch-all, disposable, free provider, role account, full mailbox or disabled account. Bouncer says it would rather flag an address risky than mark it deliverable wrongly.

The decision rule. Send the first campaign only to Valid or deliverable addresses. Hold accept-all, risky and unknown results for a later, smaller test once the domain has a clean sending record. Drop invalid, undeliverable and disposable addresses for good.

A catch-all address is not a verified address. Hunter says an accept-all address cannot be confirmed and that using it may lead to bounces, so it stays in the hold pile even when the server accepted the check.

Read the guarantee closely. Bouncer's guarantee covers only addresses it marked deliverable that bounce within 72 hours of verification for an objective reason. Spam-related and soft bounces are excluded, and the remedy is a credit or refund for those checks, not for any damage to your domain.

The single-tool route. Woodpecker includes unlimited email verification, catch-all checks among them, and its campaign settings have a catch-all handling option. Teams that prefer one tool can verify inside Woodpecker and apply the same send, hold and drop rule there.

What you decide: Which statuses go into the first send, which wait and which are deleted.

Inputs: The draft list from Hunter Domain Search, built against the audience sentence.

Tool: Hunter's verification statuses and Bouncer's four statuses with their reasons.

Permission needed: Verification needs no mailbox access.

Done when: The import file holds only Valid or deliverable addresses, with the hold pile saved separately.

Limitation: Bouncer's guarantee covers only deliverable-marked addresses that bounce within 72 hours for an objective reason, excluding spam-related and soft bounces.

How Do You Build A Cold Email Sequence In Woodpecker?

A first Woodpecker campaign needs only an opening email and two or three follow-ups, spaced by the editor's default 2-day delay, sent inside up to three daily windows, and stopped automatically for anyone who replies, sends an out-of-office or unsubscribes. That is enough to test one approved offer cleanly.

Woodpecker's editor allows up to 16 steps mixing emails, manual tasks, LinkedIn steps, calls and YES/NO conditions. A first campaign uses a fraction of that on purpose, because every extra branch is another variable to read. Teams still choosing a sending tool can compare the best cold email platforms before committing.

Step 1   Day 0        Opening email
         Purpose      State the problem and the approved offer, one ask

Step 2   2 days later Follow-up 1
         Purpose      Add the proof the approved offer allows

Step 3   2 days later Follow-up 2
         Purpose      Restate the ask in one or two lines

Step 4   2 days later Follow-up 3, optional
         Purpose      Close the loop politely, no new claims

Every step   Snippets with fallbacks, unsubscribe line, postal address

Settings to fix before you start.

• Snippets with fallbacks. Personalisation fields need a fallback, so a missing first name never prints as a blank.
• Daily enroll. It defaults to 50 opening emails per mailbox and is capped by the mailbox's Daily Sending Limit.
• Sending windows. Up to three windows a day, in the campaign's or the prospect's timezone.
• Campaign settings. Unsubscribe, catch-all handling, ESP matching and auto-pause for same domains.

How Woodpecker paces mail. Messages go out at random intervals no more often than every 90 to 140 seconds per mailbox, about 30 an hour. Woodpecker sends nothing more to a prospect who replies, sends an out-of-office reply, unsubscribes or is paused by hand. The Daily Limit counts opening emails only, and follow-ups take priority when the two overlap.

What it costs to run. Woodpecker prices by the number of contacted prospects, and the base includes unlimited email verification, 4 warm-ups, 100 Lead Finder credits and unlimited email accounts and team members. Extra warm-ups, Google or Microsoft mailboxes bought through Woodpecker, LinkedIn accounts and integrations or API access are paid add-ons, and prices exclude VAT. A first campaign on mailboxes you already own usually needs the base alone.

What you decide: How many steps the sequence has and what each step adds to the approved offer.

Inputs: The verified list, the approved offer and the sending windows that suit the audience's timezone.

Tool: Woodpecker's campaign editor, with snippets, delays, daily enroll and campaign settings.

Permission needed: Woodpecker's Google connection, which lets it check, send and manage the mailbox's email.

Done when: Every step has been sent as a test to your own address and the snippets render with their fallbacks.

Limitation: Woodpecker's Daily Limit counts opening emails only, so follow-ups add sends on top of it.

How Many Cold Emails Can You Send Per Day?

Google Workspace lets one user send 2,000 messages a day, but that number is a lockout threshold rather than a cold email target, and Woodpecker's own guidance caps cold sending at 100 messages a day per mailbox even where a provider allows more.

The provider cap. Google Workspace allows 2,000 messages per user per day, 1,500 through mail merge and 500 on a trial account, a limit that does not rise during the trial. A user who hits a limit cannot send new messages for up to 24 hours.

The vendor's guidance. Woodpecker's sending-limits article says not to send more than 100 messages a day even where the provider allows more. It also says any new or inactive mailbox needs warming up first, and the app suggests a limit when a mailbox is first set up.

The Gmail threshold. Gmail's stricter bulk-sender rules start above 5,000 messages a day to Gmail accounts, which a first campaign should never approach.

The decision rule. Start well under Woodpecker's 100 a day, at or below the limit the app suggests for the new mailbox. Raise the daily limit only while bounces and spam complaints stay low, and lower it the moment either climbs. Remember that follow-ups sit on top of the opening-email limit, so total daily sends run higher than the number you set.

Is Cold Email Legal For B2B Campaigns?

B2B cold email is legal in the US and UK only on conditions, because CAN-SPAM requires a postal address and an opt-out honoured within 10 business days, and the ICO says the PECR email rule does not apply to corporate subscribers while sole traders still need consent and named work addresses remain personal data.

United States. CAN-SPAM makes no exception for business-to-business email. Each message needs honest header information and a subject line that does not deceive, must identify itself as an ad, must give a valid physical postal address and must tell recipients how to opt out. Opt-outs must be honoured within 10 business days. Each separate email in violation can carry a penalty of up to $53,088.

United Kingdom. PECR's rule on electronic mail marketing does not apply to corporate subscribers such as limited companies. Sole traders and some partnerships can only be emailed with their specific consent or under the soft opt-in. Every sender must give its identity and a valid address to opt out. UK GDPR still applies whenever an individual can be identified, even in a business role, so a named work address like jane.doe at a company is personal data.

Gmail. Senders of more than 5,000 messages a day to Gmail accounts must support one-click unsubscribe on marketing messages. Woodpecker's campaign settings include an unsubscribe option, which covers the opt-out link in each email.

This section is general information, not legal advice.

What Should You Check Before Launching A Cold Email Campaign?

Before a first cold email campaign starts, the sending domain should show passing SPF, DKIM and DMARC records, a test message to a Gmail user should show DKIM=pass in its headers, and every sequence step should have been sent to your own address once.

Tick every line before the campaign goes live.

• SPF, DKIM and DMARC show green in MXToolbox
• A test to another Gmail or Workspace user shows DKIM=pass in Authentication-Results
• Every sequence step has been sent as a test to your own address
• Snippets render correctly, with fallbacks for missing data
• Each email carries an unsubscribe line and a postal address
• The list holds only Valid or deliverable addresses
• Daily limit, daily enroll and sending windows are set
• Auto-pause for same domains is switched on
• The copy matches the signed approved offer word for word on claims

What you decide: Whether the campaign is ready to start or needs one more fix.

Inputs: The MXToolbox MX, SPF, DKIM and DMARC lookups for the outreach domain.

Tool: MXToolbox lookups and the SuperTool results, where green means the record is fine.

Done when: A message to another Gmail or Workspace user shows DKIM=pass in its Authentication-Results header.

Limitation: A checklist confirms setup, not demand, so a clean launch can still meet silence if the offer misses.

How To Measure A Cold Email Campaign

Measure a cold email campaign by bounces, spam complaints, replies and meetings, in that order, because a bounce or complaint problem damages the domain before reply numbers mean anything, and Gmail's ceiling for complaints is a spam rate below 0.3% in Postmaster Tools.

Bounces first. A bounce problem points back to verification. If bounces climb, pause and check whether accept-all, risky or unknown addresses slipped into the send.

Complaints second. Gmail expects the spam rate in Postmaster Tools to stay below 0.3%. Pause sending if complaints approach it, because the domain's reputation is what every later campaign depends on.

Replies read cleanly. Woodpecker stops follow-ups when a prospect replies or sends an out-of-office, so each reply reflects the step that earned it rather than a pile of extra follow-ups.

Change the offer, not the volume. When delivery is clean and replies are absent, more volume only spreads the same miss wider. Rewrite the approved offer, get it signed off again and test it on the next slice of the audience. Teams that want inbox placement data beyond these signals can look at email deliverability tools.

Common Cold Email Mistakes When Launching Your First Campaign

The most common cold email mistakes are sending at the provider cap, skipping warm-up, trusting catch-all addresses, connecting the wrong mailbox and mixing audiences. The first is the costliest, because Google Workspace stops a user sending for up to 24 hours once a daily limit is hit, and Woodpecker advises no more than 100 messages a day.

• Sending at the provider cap. Google Workspace allows 2,000 a day, Woodpecker advises no more than 100. Fix it by starting below the vendor's figure.
• Skipping warm-up. Woodpecker says any new or inactive mailbox needs warming up first. Fix it by warming the outreach mailbox before the first send.
• Treating catch-all as verified. Hunter says accept-all addresses cannot be confirmed and may bounce. Fix it by holding them out of the first send.
• Connecting the wrong mailbox. A sending tool gets check, send and manage rights, and an admin may block it. Fix it with a dedicated outreach mailbox and admin approval first.
• Mixing audiences or offers. Two segments in one campaign hide which one failed. Fix it with one audience and one approved offer per campaign.

Frequently Asked Questions

Sources