Cold email outreach is still one of the cheapest ways for a small business to start conversations with buyers who have never heard of you. Done well, it is a short, relevant note to a carefully chosen person, sent from a properly set-up domain, with an easy way to say no. Done badly, it is spam that burns your domain and breaks the law. This guide covers both sides: the rules in the US, UK and EU, the technical setup, templates and a follow-up sequence you can copy.
✔ Key takeaways
⏱ About 10 min read · the short version is right here
- Cold email outreach works best as one-to-one, highly targeted messages, not bulk blasts.
- US CAN-SPAM allows B2B cold email without prior consent but requires honest headers, a postal address and a working opt-out. UK and EU rules are stricter, especially for sole traders and some countries.
- Set up SPF, DKIM and DMARC, use a separate sending domain or subdomain and warm it up slowly before any campaign.
- Keep emails under about 120 words, make one soft ask and plan four or five spaced follow-ups that each add something new.
🔍 How I checked: legal points from the US FTC CAN-SPAM compliance guide, the UK ICO guidance on PECR and UK GDPR legitimate interests, and Google and Yahoo sender guidelines; tool prices from vendor pricing pages. Checked on 4 November 2026. This is general information, not legal advice.
📋 In this guide
Does cold email outreach still work?
Yes, but the bar is higher than it was. What still works is what has always worked in sales: a specific person, a specific reason for writing now and a low-effort next step.
Think of cold email outreach as a way to start conversations, not close deals. Your goal for the first email is a reply, even a ‘not now’. Treat it as one channel in a wider lead generation plan alongside referrals, content and partnerships, and borrow the mindset from the habits of successful salespeople: research first, listen more than you pitch.
📌 Cold email vs spam
The difference is not the word ‘cold’. It is relevance and respect. A cold email is a personalised message to a business contact whose role makes your offer plausibly useful, with an honest sender and an easy opt-out. Spam is untargeted volume, often to purchased lists, hiding who sent it.
Cold email rules: US, UK, EU and Canada
Rules depend on where the recipient is, not where you are. Here is a plain-English summary for the most common markets.
| Region | Main rules | Consent needed for B2B cold email? | Must include |
|---|---|---|---|
| USA | CAN-SPAM Act (enforced by the FTC) | No, opt-out model | Accurate sender and subject line, valid postal address, clear opt-out honoured within 10 business days |
| UK | PECR + UK GDPR | Not for corporate addresses (limited companies, LLPs); yes for sole traders and some partnerships unless soft opt-in applies | Who you are, a valid opt-out, a lawful basis (usually legitimate interests) and privacy information |
| EU | ePrivacy Directive (national laws) + GDPR | Varies by country; some, such as Germany, generally require prior consent even for B2B | Identity, opt-out, lawful basis, privacy notice |
| Canada | CASL | Generally yes (express or limited implied consent) | Identity, contact details, unsubscribe mechanism |
CAN-SPAM in practice. The FTC’s guide says the law covers all commercial email, including business-to-business. You must not use false or misleading header information or deceptive subject lines, you must identify the message as an ad where required, include a valid physical postal address and give a clear way to opt out. Opt-out requests must be honoured within 10 business days, and you stay responsible even if you hire someone else to send for you. Penalties are assessed per email and are large enough to matter.
UK PECR and legitimate interest. PECR’s consent rules for marketing email apply to individual subscribers, which includes sole traders and some partnerships. Emails to ‘corporate subscribers’ such as limited companies do not need prior consent under PECR, but you must say who you are and offer an opt-out. Because a named work address like jane@company.co.uk is still personal data, UK GDPR applies too. Most B2B senders rely on legitimate interests: you document a short legitimate interests assessment (purpose, necessity, balance), only target roles where the offer is genuinely relevant, tell people where you got their details and honour objections immediately. In the EU, check each country’s national ePrivacy rules or get local advice before emailing prospects there.
⚠️ Never buy email lists
Purchased lists usually fail the relevance test under UK and EU law, contain spam traps that wreck deliverability and break the acceptable use policies of almost every email platform. Build your own list from public business sources instead.
Deliverability setup before you send
Most cold email outreach fails before anyone reads it, because it lands in spam. Fix the plumbing first.
Use a separate domain or subdomain
Send outreach from something like getyourbrand.com or mail.yourbrand.com rather than your main domain, so any reputation damage does not hit your invoices and client email. Redirect the secondary domain to your website.
Authenticate: SPF, DKIM and DMARC
Add an SPF record listing your sending service, turn on DKIM signing in your email provider and publish a DMARC record (start with p=none and a reporting address, then tighten). Google and Yahoo require authentication for bulk senders, and it helps every sender.
Warm up gradually
New inboxes should start with a handful of real, hand-written emails a day and increase slowly over several weeks. Keep volume per mailbox small and steady; sudden spikes from a new domain look like spam to filters.
Write like a person
Plain text, a real signature, one link at most and no attachments in the first email. Avoid image-heavy HTML, link shorteners and tracking pixels if deliverability is shaky.
Watch complaints and bounces
Google’s sender guidelines ask senders to keep spam complaint rates very low, under 0.3%. Verify addresses before sending and stop mailing anyone who bounces or complains.
💡 Test before every campaign
Send a test to your own Gmail and Outlook accounts and check the headers for SPF, DKIM and DMARC ‘pass’. If any fail, fix the DNS record before going further.
Building a targeted prospect list
A smaller, sharper list always beats a bigger one. Start with your ideal customer profile: industry, company size, location, role and a trigger that makes your offer timely, such as a new location, a hiring spree, funding or a website relaunch.
Then find people from legitimate public business sources: company websites, LinkedIn, trade directories, conference speaker lists and press releases. Record where each contact came from; under UK and EU rules you may need to tell them. A competitor analysis is also a goldmine: competitors’ case studies and review pages reveal exactly which customers buy this kind of service. Aim for a few dozen well-researched prospects a week, each with one specific detail for your opener.
Anatomy of a cold email that gets replies
Every part of a cold email has one job: subject line, personalised opener, value line, soft ask and a clear opt-out.
- Subject line: short, lower-key and specific, like a colleague would write. ‘Question about your Leeds clinic’ beats ‘Revolutionise your growth!!!’
- Personal opener: one line that proves you looked: a recent post, launch or job ad.
- Problem and value: one or two sentences on a problem people in their role commonly have, and how you have helped similar businesses. Your value proposition belongs here in a single line.
- Soft ask: an easy yes or no question, such as ‘Worth a 15-minute chat next week?’ or ‘Shall I send a two-minute video?’
- Signature and opt-out: full name, company, postal address where required and a plain line like ‘Not relevant? Reply “no” and I won’t email again.’
2 cold email templates
Replace every bracket with real research. If you cannot fill the personal line honestly, do not email that person yet.
✉ Template 1: The trigger email
Subject: your new [city] location
Hi [First name],
Saw that [Company] opened in [city] last month, congratulations.
New locations often struggle to fill the diary in the first few months. We help [type of business] get local bookings through [method], most recently for [similar client].
Worth a quick chat next week to see if it fits?
[Name], [Company], [postal address]
Not relevant? Just reply “no” and I won’t follow up.
✉ Template 2: The useful resource
Subject: idea for [Company]’s [process]
Hi [First name],
I noticed [specific observation, e.g. your booking page has no reminder step].
I put together a one-page checklist we use with [type of client] to fix exactly that. Happy to send it over, no strings attached.
Want me to share it?
[Name], [Company]
Prefer not to hear from me? Reply “stop” and I’ll remove you.
The follow-up sequence
A five-touch follow-up sequence spaced over 18 days. The reply bars in this graphic are illustrative, not benchmark data.
Many replies come after the first email, simply because people were busy. The trick is to space follow-ups out and make each one add something, rather than ‘just bumping this’.
| Touch | Day | Purpose | Example angle |
|---|---|---|---|
| 1 | Day 1 | Break the ice | Trigger email or resource offer |
| 2 | Day 3 | Gentle nudge | Short reply-in-thread: one new sentence of context |
| 3 | Day 7 | Deliver value | Send a tip, short teardown or useful link |
| 4 | Day 12 | Show proof | A brief case study or customer quote relevant to them |
| 5 | Day 18 | Break-up | Polite last email: “Shall I close your file?” |
Stop the sequence the moment someone replies, books a call, asks you to stop or bounces. If a prospect says ‘not now’, move them to a reminder for the date they suggest instead of continuing the sequence. Turning those ‘later’ replies into customers is where a nurture email sequence and good testimonials (see how to get customer testimonials) earn their keep.
⚠️ Opt-outs apply to every touch
If someone opts out after email two, they must not receive emails three to five, from any of your inboxes or tools. Keep one shared suppression list.
Tools: what you need and what you do not
You can start with nothing more than a properly set-up mailbox and a spreadsheet. As replies grow, you will want two things: a sending tool that handles scheduled follow-ups and stops on reply, and a CRM that tracks every conversation and deal.
Dedicated cold email senders such as Instantly, lemlist or Apollo focus on inbox rotation, warm-up and sequences. For the CRM side, GoHighLevel is what I recommend to small agencies and service businesses: pipelines, a shared inbox for email and SMS, booking calendars, workflows to follow up with warm leads and reminders for ‘not now’ prospects. Plans start at $97 a month (Starter) and $297 a month (Unlimited), with a 14-day free trial (checked on 4 November 2026 on gohighlevel.com/pricing). My GoHighLevel review covers it in depth.
📌 Be honest about the fit
GoHighLevel is a CRM and marketing platform, not a specialist cold email sender. Its built-in email, like most CRM email services, is designed for people who have opted in, so read its acceptable use policy before importing cold prospects. Many small teams send outreach from a separate warmed mailbox and use GoHighLevel to manage everyone who replies.
Metrics to track
Track a few numbers weekly and change one thing at a time.
- Deliverability: bounce rate and spam complaints. If these rise, pause and fix before sending more.
- Reply rate: the main health metric. Open rates are unreliable because of privacy features in mail apps.
- Positive reply rate: replies that show interest, not just ‘no thanks’.
- Meetings booked and revenue: what actually pays the bills. Log them in your KPI tracker.
Manage every reply in one place
Track prospects, follow-ups and booked calls with GoHighLevel pipelines and calendars. Try it free for 14 days.
Start your GoHighLevel trial →
Affiliate link. I may earn a commission at no extra cost to you.
Frequently Asked Questions
Is cold email outreach legal?
In the US, B2B cold email is legal under CAN-SPAM if you use honest headers and subject lines, include a postal address and honour opt-outs. In the UK, emailing corporate addresses is generally allowed with an opt-out and a lawful basis under UK GDPR; sole traders need consent or a soft opt-in. EU and Canadian rules are stricter in many cases.
What is legitimate interest in cold email?
It is a UK and EU GDPR lawful basis that lets you process business contact data without consent when you have a genuine business reason, the processing is necessary and it does not override the person’s rights. Document an assessment, target relevant roles and honour objections.
How many follow-ups should I send?
Four or five touches over two to three weeks is common. Each should add new value, and the sequence must stop as soon as someone replies or opts out.
Do I need SPF, DKIM and DMARC for cold email?
Yes. Authentication is required by Google and Yahoo for bulk senders and strongly improves inbox placement for everyone. Set all three up on your sending domain before warming it up.
How long should a cold email be?
Roughly 50 to 120 words: a personal opener, one line of value, one soft ask and a clear opt-out.
Related reading: how to build a sales funnel and how to create a landing page.
Affiliate disclosure: some links in this post are affiliate links, so I may earn a commission at no extra cost to you. I only recommend tools I’d use myself.
