How to test cold email deliverability when the tools disagree

A sender on r/Emailmarketing described sending 20 to 30 individualised cold emails a day from manually researched companies, on an eight-month-old domain with authentication in place. GMass told him everything from one of his domains was going to spam. Warmup Inbox told him the same emails were all landing in the primary inbox. A few days earlier GMass had said primary inbox too. On his second domain both tools agreed on primary inbox, and a test email he sent himself went to spam.

He said he felt like he was running blind. He is not wrong, and the reason is not that he picked bad tools.

The short answer for anyone at that volume: one part of this is verifiable and the rest is estimated. Authentication either passes or fails and you can settle it this afternoon for free. Where a message lands is a prediction, made by tools measuring different things in mailboxes that behave nothing like your recipients.

Three things called a spam score

Start with the number these tools hand you, because three of them share a name and none is convertible into another.

MailReach publishes its formula on its own blog. "Spam score (out of 10): This is calculated as (Emails in Inbox ÷ Total Emails Sent to Seed List) × 10. If 25 out of 31 emails land in the inbox, your score is roughly 8.1 out of 10." That is a measured placement ratio wearing a different scale. It says nothing about your content.

Mail-Tester's score is the opposite thing. Its own FAQ explains what is under the hood: "We have a vanilla install. In other words, it's an out of the box default installation. We reversed the score so a positive score is a good score and a negative one is bad." The installation is SpamAssassin, whose documentation describes its score as the sum of points from matched rules, compared against a threshold that the operator sets, 5.0 by default. So Mail-Tester's number is a content and configuration score from one rules engine, run at its factory settings. Mail-Tester says as much: "All spam filters work differently. What may pass in mail-tester, might not in your own office inbox."

InboxAlly adds a third. Its IA Score "predicts your inbox placement from dozens of features via a proprietary ML model." Not a measurement of where mail went. An estimate of where it would go.

A ratio, a rules total and a prediction. Two tools returning different scores on the same domain may both be right, because they are not answering the same question.

What a test can prove

One category of answer from these tools is solid, and it is the authentication check.

SPF, per RFC 7208, lets a domain owner "explicitly authorize the hosts that are allowed to use their domain names," so a receiving host can check that authorization. DKIM, per RFC 6376, proves responsibility for a message "through a cryptographic signature and by querying the Signer's domain directly to retrieve the appropriate public key." DMARC, per RFC 7489, is "a mechanism for policy distribution" telling receivers what to do with messages that fail those checks, from nothing at all through to rejection.

All three are DNS and cryptography. A pass or a fail is a fact, it is the same fact for every recipient, and it is the one thing a test can hand you that is not an estimate. If any tool reports an authentication failure, stop reading comparisons and go fix the record.

What no test can prove is a reputation problem, because reputation is a history rather than a property of the message being tested. Google defines its domain reputation categories that way explicitly. The worst is "History of sending a high volume of spam regularly." The best is "History of very low spam rates, and complies with Gmail's sender guidelines." One test message cannot expose an accumulated record.

Which provider rules actually apply to you

The requirements everyone writes about are mostly written for senders far above your volume. Here is what the three providers publish about themselves.

Two things in that table matter at your volume.

The all-sender tier is not volume gated. Google's guidelines require every sender, at any volume, to run SPF or DKIM, keep valid forward and reverse DNS records, use TLS, format to RFC 5322 and keep spam rates in Postmaster Tools below 0.3%. Yahoo's baseline is the same shape, with one difference in the instrument: Yahoo runs no equivalent of Postmaster Tools and states that its spam rate "is calculated in our system based on mail delivered to the inbox." That is your actual compliance list, and it is short.

The bulk tier is not yours, at Google and Microsoft. Mandatory SPF and DKIM together, DMARC, From-header alignment and one-click unsubscribe are gated at 5,000 messages a day. Microsoft's requirements begin and end there: its announcement covers "domains sending more than 5,000 emails per day," it names no spam-complaint threshold anywhere, and its own FAQ answers the question about smaller senders with "While enforcement first targets large senders, all senders benefit from these best practices."

Yahoo is the exception worth knowing, because it refuses to draw the line. From its own FAQ: "A 'bulk' sender is classified as an email sender sending a significant volume of mail. We will not specify a volume threshold." So at Yahoo you cannot determine from the published rules whether you are a bulk sender, which is an argument for meeting the bulk requirements anyway. They cost a DNS record each.

None of this touches how many you can send before your own provider throttles you, which is a separate ceiling we worked through in how many cold emails a day is actually safe.

What a seed test cannot see

The tools that report placement send to a list of mailboxes they control and report where the messages landed. That is a real measurement of a real thing. The gap is what those mailboxes are.

Twilio, whose SendGrid product has no incentive to talk anyone out of testing, states it plainly: "Seed accounts do not behave like real humans. They lack the engagement history mailbox providers use to determine inbox placement. As a result, seed test outcomes may not always accurately reflect what your actual subscribers experience." And on why the gap is not constant: "Two subscribers at the same mailbox provider may receive the exact same email differently based on their engagement history with your brand."

Yahoo confirms it from the receiving side: "Even if Yahoo's systems are not filtering out the email, the user may have specifically blocked certain domains and email addresses. These user rules will override the determination by Yahoo's spam filtering system and still put the email in the spam folder."

MailReach, which sells the test, concedes two more limits. Business and consumer inboxes filter differently, so a perfect score on Google Workspace and Office 365 is compatible with landing in spam at gmail.com. And on the feature that several competitors headline: "99% of blacklists have zero impact on inbox placement, Google and Microsoft rely on their own internal reputation systems, not external blocklists."

That is a vendor telling you that a large part of what this category sells does not move the number you care about.

Postmaster Tools may show you nothing

Google Postmaster Tools is the closest thing to a first-party answer, and Google publishes a warning that lands directly on this reader: "To protect the privacy of Gmail users, dashboards might not include all data on days when your outgoing email volume is low."

No threshold is given. At 30 to 100 emails a day split across two domains, expect incomplete dashboards. It is also aggregate by design, so even when it populates it reports how your domain is trending rather than where last Tuesday's forty messages went.

Set it up anyway. It costs a DNS record, it is the only source of Google's own view of your domain, and a domain reputation that drops to Low is worth knowing even without daily detail.

There is no published measurement of how far that gap goes, either. Searched on 6 September 2026, including phrasings aimed at M3AAWG, ACM and USENIX, nothing turned up that ran campaigns through a seed tool, tracked where they actually landed and reported how closely the two agreed. Which is why two tools contradicting each other cannot be settled by consulting a third.

What is actually worth checking

At 30 to 100 a day, the useful list is short and mostly one-time.

Fix authentication and verify it. SPF and DKIM at minimum, DMARC at p=none, alignment on the From header. This is binary, it is free, and Mail-Tester's free web tool checks it in one send with no signup.

Set up Google Postmaster Tools and read the domain reputation, not the daily detail.

Run a placement test occasionally rather than continuously, and read the free tiers accordingly. GlockApps gives two free tests a month across Gmail, Yahoo, AOL and Outlook. Folderly's placement product also gives two a month across Gmail, Outlook and Yahoo. MailReach publishes a free spam test across what it says is more than thirty inboxes. MXToolbox's free tier does not include placement testing at all, and its cheapest tier that does is $129 a month, which is a lot of money for a question you are asking twice a quarter. Seed counts and provider coverage are each vendor's own claim about its own product; none is independently audited.

Then measure the thing that is yours. Your bounce rate on your own send has a denominator you control, and it moves for reasons you can act on, which we went through in bounce rate as a data-quality metric. Your reply rate is the other real signal, and at your volume it is a better instrument than any placement dashboard, for the reasons in who actually replies to cold email.

And when the numbers still look wrong after authentication is clean, the next variable is usually the message rather than the plumbing, which is where what the shortest cold emails have in common is more use than another test.

Sources in this article were read on 6 September 2026: Google's email sender guidelines and its Postmaster Tools documentation; Yahoo's Sender Hub best practices and FAQ pages; Microsoft's TechCommunity announcement on high-volume sender requirements, published 2 April 2025 and updated 30 April 2025, and its support page on the 550 5.7.515 error; RFCs 7208, 6376 and 7489; SpamAssassin's own configuration documentation; each testing tool's own pricing and documentation pages; and blog posts by Twilio and MailReach. Microsoft publishes no dedicated requirements page of the kind Google and Yahoo maintain, and this article cites what it does publish.