The Deliverability Playbook for AI Outbound

AI agents can research a prospect, write a thoughtful first email and follow up at exactly the right moment. They can also send a few hundred messages before lunch if nobody tells them not to. That second ability is where most outbound programs get into trouble. Inbox providers do not care whether a human or a model wrote the email. They care whether recipients want it.

This playbook is for founders, growth leads and revenue teams who want the speed of AI outbound without burning the domain they rely on for invoices, onboarding emails and customer support. It covers how inbox providers judge senders, the authentication you need before the first send, how to ramp volume, how to keep lists clean, and the specific guardrails an autonomous agent should hit before every message leaves your mailbox. It ends with a 14-day launch checklist you can follow as written.

Executive summary

Cold email still works when it is relevant, personal and sent at a human pace. The risk with AI is not the writing. It is the volume and the speed. An agent that never sleeps can amplify a small mistake, such as a stale list or a missing unsubscribe link, into a reputation problem within days.

The answer is not to slow the agent down by hand. It is to give it guardrails that are enforced by the system, every time, regardless of what the prompt says. In practice that means:

• Authenticate every sending domain with SPF, DKIM and DMARC, and keep cold outreach off your primary domain if you can.
• Warm up new mailboxes with a small daily cap that rises gradually.
• Cap volume per mailbox and per agent, and space sends out within business hours.
• Suppress aggressively: anyone who unsubscribed, bounced, complained or already replied should never get another automated email.
• Handle replies fast, classify them, and stop sequences the moment a human answers.
• Monitor a short list of metrics and pause before small problems compound.

Tip: Treat deliverability as infrastructure, not as a campaign setting. Set it up once, enforce it everywhere, and let your agents work inside it.

How inbox providers judge senders

Mailbox providers such as Google and Microsoft make a decision on every incoming message: inbox, spam folder, or reject. They do not publish their full models, but the broad inputs are well understood.

The main signals

Signal	What it measures	What helps
Authentication	Is the sender who it claims to be?	Aligned SPF, DKIM and DMARC
Domain and IP reputation	How has mail from this sender been received over time?	Consistent volume, low complaints, no spam traps
Engagement	Do recipients open, reply, move to inbox, or delete unread?	Relevant targeting, genuine personalization
Complaints	How often do recipients click “Report spam”?	Easy unsubscribe, honest subject lines, good fit
Bounces	How often do you send to addresses that do not exist?	Verified contacts, fast bounce suppression
Content and format	Does the message look like typical spam?	Plain text, few links, no heavy tracking or attachments
Sending pattern	Does volume spike? Does it look automated?	Gradual ramps, randomized spacing, business hours

Reputation is per domain, and it is sticky

Reputation follows your sending domain more than anything else. A domain with months of clean history can absorb an occasional bad day. A domain created last week has no history at all, so every early signal weighs heavily. Recovery from a damaged reputation usually takes weeks of reduced, carefully targeted sending, which is why prevention is so much cheaper than repair.

Bulk sender requirements raised the floor

Since 2024, Google and Yahoo have required bulk senders to authenticate their mail, support one-click unsubscribe, and keep spam complaint rates low (their published guidance asks senders to stay below 0.3%, and well below that in practice). Cold outreach volumes are usually lower than the bulk threshold, but providers apply the same logic to everyone. Meeting these requirements is the sensible baseline for any outbound program.

Authentication checklist: SPF, DKIM and DMARC

Authentication proves that a message really comes from your domain. Without it, nothing else in this playbook matters much.

SPF (Sender Policy Framework)

SPF lists the servers allowed to send mail for your domain. It lives in a single TXT record.

example-mail.com.  TXT  "v=spf1 include:_spf.google.com ~all"

• Publish exactly one SPF record per domain (multiple SPF records break validation).
• Include every service that sends on your behalf: your mailbox provider, your SMTP relay, any transactional tool.
• Stay under the 10 DNS lookup limit. Flatten or remove unused includes.
• Use ~all (soft fail) while testing, and consider -all once you are confident the list is complete.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to each message so the receiver can confirm it was not altered and was sent by an authorized system.

• Generate a DKIM key in your mailbox provider (Google Workspace, Microsoft 365, or your SMTP provider).
• Publish the public key as a TXT record at the selector it gives you.
• Use a 2048-bit key where your DNS host supports it.
• Send a test email and confirm the header shows dkim=pass with your domain.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC tells receivers what to do when SPF or DKIM fail, and requires that at least one of them aligns with the visible From domain.

_dmarc.example-mail.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r"

• Start with p=none and a reporting address so you can see who sends as your domain.
• Review reports for a couple of weeks, fix any legitimate senders that fail.
• Move to p=quarantine, then p=reject when reports are clean.

Domain strategy

• Use a dedicated outreach domain or subdomain that is close to your brand (for example trybrand.com or mail.brand.com), so your main domain stays protected.
• Point the outreach domain’s website to your real site, so a curious prospect lands somewhere legitimate.
• Set up a real mailbox with a real name, signature and profile photo. Replies will come back to it.
• Let a brand-new domain age a little before cold sending. A couple of weeks of light, normal use helps.

Tip: Check authentication by sending a message to a personal Gmail account and opening “Show original”. You want SPF: PASS, DKIM: PASS and DMARC: PASS in one view.

Warmup and volume ramp

A new mailbox with no history that suddenly sends 200 emails looks exactly like a compromised account. Warmup builds history gradually so providers can learn that your mail is wanted.

Principles

• Start low. A first-week cap in the low tens per day is normal for a fresh mailbox.
• Raise in small steps. Increase the daily cap a little each day rather than doubling it.
• Stay consistent. Sending 30 one day and 0 the next three days is noisier than a steady 15.
• Prefer business hours. Real people send during the working day, in their own time zone.
• Spread mailboxes, not volume per mailbox. If you need more capacity, add mailboxes on separate domains rather than pushing one mailbox hard.

How Norixia handles warmup

Norixia ships with a warmup ramp that starts at 10 emails per day and adds 5 per day. In the product’s own words: “Start low and raise the daily cap a little every day, to protect a new domain’s reputation.” Warmup is one of the checks EmailGuard runs before every send, so an agent cannot exceed the ramp even on autopilot.

A ramp on that schedule looks like this, until it reaches the mailbox cap:

Day	Daily cap during warmup
1	10
2	15
3	20
4	25
5	30
6	35
7	40
8	45
9 onward	50 (default mailbox cap)

On top of warmup, Norixia applies default sending guardrails:

• 50 emails per day per mailbox.
• 30 emails per day per agent (configurable in each agent’s settings).
• Random spacing of 90 to 300 seconds between sends.
• A send window of Monday to Friday, 09:00 to 18:00, in the workspace or project time zone.
• An optional workspace-wide daily cap, for teams that want a hard ceiling across all projects.

Tip: If your reply rate is healthy and bounces stay low after the ramp, add a second mailbox before you consider raising the per-mailbox cap.

Content and personalization

Content matters less than reputation, but it is the part you control on every single email, and it drives the engagement signals providers watch.

What good AI-written outreach looks like

• Short. Four to seven sentences. One idea, one ask.
• Specific. A real reason you are writing to this person, at this company, now.
• Plain. Plain text or very light formatting. No images, no attachments on the first touch.
• Few links. Zero or one link in the first email. Avoid link shorteners.
• Honest subject lines. No fake “Re:” or “Fwd:”, no clickbait.
• A clear, low-friction ask. “Worth a quick chat next week?” works better than a calendar link and three paragraphs.
• A human signature. Name, role, company. A simple way to opt out.

Personalization that earns replies

Swapping in {{lead.first_name}} and {{lead.company}} is table stakes. Real personalization references something the recipient would recognize: a recent launch, a hiring push, a page on their site, a problem common to their role. This is where agents shine, because they can read a prospect’s website and recent news before writing.

Give them good material to work with. In Norixia, each project has a knowledge base with nine sections (Company, Offers, ICP, Personas, Selling arguments, Objections, Tone and signature, FAQ, Competitors), described as “what every agent of this project knows about your business.” The clearer your ICP and tone guidance, the less generic the drafts.

Agents also write to each lead in the lead’s language, which avoids the jarring experience of receiving an English pitch on a French-language business address.

Tracking, carefully

Open pixels and click tracking give useful signals, but tracking domains and pixels can also count against you, especially on new domains. Norixia lets you disable open and click tracking per project or per mailbox. Many teams turn tracking off during warmup and rely on replies as the primary metric.

Review before you trust

Even good models drift. Start in Validation mode, where every email waits for your approval, and read a meaningful sample before you move an agent to Autopilot. The Approvals queue shows each draft with its lead context, so you can edit, approve and send, or reject with a reason that helps the agent improve.

List hygiene and suppressions

Bounces and spam traps are the fastest way to damage a domain. Most of them come from stale or poorly sourced lists.

Before you send

• Source from reliable data. Verified B2B data (Norixia integrates with Apollo) and contacts found on a company’s own site are a better start than scraped lists of unknown age.
• Verify addresses where possible, and drop role addresses (info@, contact@) from person-to-person sequences.
• Deduplicate. Never let two people, or two agents, email the same contact in parallel.
• Respect your own history. Anyone who previously unsubscribed, bounced or complained stays out.

Suppressions as a first-class list

A suppression list is the set of emails and domains you will never send automated outreach to. It should be workspace-wide, not per campaign, and it should update itself.

In Norixia, suppressions live at the workspace level and have four types:

Type	How it gets there
Unsubscribed	Added automatically when a recipient unsubscribes
Bounced	Added automatically on a bounce
Complaint	Recorded when a recipient complains
Manual	Added by your team, by email or by whole domain

Suppressing a whole domain is useful for customers, competitors, partners in active negotiation, or any company that asked you to stop.

Dedup across agents

When several agents work the same market, collisions are easy. Norixia deduplicates leads by email, then by domain and type, and an agent never takes a lead owned by another agent. Cross-agent dedup is also one of the checks that runs before every send.

Reply handling and unsubscribes

Replies are your best deliverability signal. They tell providers that real people engage with your mail. They also need fast, careful handling, because the worst thing an automated system can do is keep sending to someone who already answered.

Stop on reply, always

Every follow-up sequence should stop the moment the recipient replies, whatever they said. In Norixia, the default follow-ups (a bump, a value email and a breakup) stop automatically on reply, and “lead already replied” is checked by EmailGuard before every send.

Classify replies

Norixia syncs the inbox every 5 minutes and classifies replies into five categories:

Classification	Typical next step
Interested	Hand to a human or book a meeting
Not now	Note the timing, schedule a much later touch
Not interested	Close politely, no further automated mail
Unsubscribe	Suppress immediately
Out of office	Pause and resume after the return date

Routines can react to these classifications with the “When a lead replies” trigger, filtered by classification, and the Reply triage template is a good starting point. For conversations that need a person, email threads can be marked “Needs you” and taken over with one toggle.

Make unsubscribing effortless

A recipient who cannot find an unsubscribe link has one option left: the spam button. Complaints hurt far more than unsubscribes.

• Include a clear, plain-language opt-out in every cold email.
• Support one-click unsubscribe through the List-Unsubscribe header, so mail clients can show their own unsubscribe button.
• Honor unsubscribes immediately, across every agent and project.
• Treat replies like “please remove me” as unsubscribes, even without the link.

Norixia provides one-click unsubscribe with a List-Unsubscribe header and a public unsubscribe page, and adds unsubscribes to suppressions automatically.

The guardrail stack for autonomous agents

This is the core of AI outbound safety. A prompt that says “be careful with volume” is a suggestion. A check that runs in code before every send is a guarantee. Autonomous agents need guarantees.

The layers

Think of the guardrails as a stack. Every outgoing email must pass all of them, in order. If any check fails, the email does not leave.

Layer	Question it answers	EmailGuard check in Norixia
1. Suppression	Is this address or domain on the do-not-contact list?	Suppression list (email or domain)
2. Consent and state	Has this lead unsubscribed or already replied?	Lead unsubscribed or already replied
3. Volume	Would this exceed the mailbox, agent or warmup cap?	Quotas and warmup
4. Timing	Is it within business hours, and has enough time passed since the last send?	Send window and spacing
5. Ownership	Is another agent already working this contact?	Cross-agent dedup
6. Autonomy	Is this agent allowed to send without approval?	Autonomy

EmailGuard runs these checks before every send. Manual replies sent from Norixia go through the same checks, so a human cannot accidentally email a suppressed address either.

Autonomy is a dial, not a switch

Norixia agents have two autonomy modes:

• Validation: every email waits for your approval in the Approvals queue.
• Autopilot: the agent sends on its own, within quotas and sending hours.

Even on Autopilot, a routine step can force “Always ask for approval”. That is a useful pattern for sensitive moments, for example the first email to an enterprise account, or any reply to a lead classified as Interested.

Bounded agent behavior

Beyond sending, a few structural limits keep agents predictable:

• Each agent run is capped at 8 tool-use turns, and every run is logged with tokens and USD cost.
• Agent-to-agent hand-offs are capped, so a team of agents cannot loop on itself.
• Each project has a soft LLM budget (by default $50 per month) shown next to usage, so cost drift is visible early.

A rollout pattern that works

1. Week one, Validation only. Approve every email. Use rejections with reasons to teach the agent.
2. Week two, selective Autopilot. Switch the agent to Autopilot, but keep “Always ask for approval” on the first-email step of your routines so first touches still wait for you.
3. After that, full Autopilot with checkpoints. Keep “Always ask for approval” on high-value segments and on interested replies.

Tip: Pause is a feature. Every Norixia agent can be paused and woken up, and the “Team active” toggle stops the whole team at once. Use it the moment a metric looks wrong.

Monitoring metrics

You do not need a wall of charts. You need a few numbers, checked on a regular rhythm, with clear actions attached.

What to watch

Metric	Healthy direction	If it drifts
Bounce rate	As low as possible; many teams aim to stay under 2%	Pause the source, review list quality, verify addresses
Spam complaints	Near zero; keep well under the 0.3% bulk sender threshold	Review targeting and copy, check unsubscribe visibility
Reply rate	Steady or rising	Revisit ICP, personalization, and subject lines
Positive replies	Rising share of replies	Tighten targeting, improve the offer framing
Unsubscribe rate	Low and stable	Check relevance, reduce follow-up count
Open rate (if tracked)	Directional only	Sudden drops can hint at spam placement
Daily sends vs capacity	Within limits	Add mailboxes rather than raising caps

Open rates have become less reliable as mail clients prefetch images, so treat them as a trend signal rather than a precise number. Replies and bounces are harder to fake.

Where to see it in Norixia

• The mailbox health panel shows emails sent over 14 days, replies over 30 days, today’s capacity and bounce rate.
• The project Overview shows 24h, 7d and 30d tiles, KPIs by agent role (for prospecting: leads sourced, emails sent, open rate, reply rate, positive replies, meetings), and usage: sends today against limits, warmup status and LLM cost.
• The lead timeline shows every email, open, click, task and status change for a single contact.

Automate the alerts

You can react to problems without watching a dashboard. A routine can start on the “When an email bounces” trigger, and webhook events such as email.bounced and email.replied let you pipe signals into your own monitoring.

{
  "id": "evt_...",
  "type": "email.bounced",
  "created_at": "2026-08-28T09:14:00Z",
  "workspace": { "id": 1, "slug": "acme" },
  "data": { "...": "..." }
}

Webhooks are signed with a Norixia-Signature header (HMAC-SHA256 with a timestamp), so you can verify them before acting.

A weekly review, in fifteen minutes

• Check bounce rate per mailbox. Anything rising gets investigated today.
• Read a sample of ten sent emails per agent. Are they still specific and on-brand?
• Read every reply classified as Not interested or Unsubscribe. Is there a targeting pattern?
• Confirm suppressions grew as expected.
• Decide on next week’s caps: hold, raise slightly, or add a mailbox.

14-day launch checklist

Follow this sequence for a new domain or a new team of agents. It assumes a fresh outreach domain. If your domain already has clean history, you can compress the first few days.

Days 1 to 3: foundations

• Register an outreach domain close to your brand and redirect its website to your main site.
• Create the mailbox with a real name, photo and signature.
• Publish SPF, DKIM and DMARC (p=none with reporting).
• Verify all three pass with a test email to a personal inbox.
• Connect the mailbox to Norixia (Gmail OAuth or SMTP/IMAP).
• Add your existing do-not-contact entries to suppressions as manual entries, including customers and partners by domain.

Days 4 to 5: knowledge and agents

• Run project setup from your website and refine the nine knowledge sections, especially ICP, Personas, Objections and Tone.
• Create your starter team and set every agent to Validation.
• Assign the mailbox, confirm the send window and time zone.
• Decide on tracking: many teams keep it off during warmup.

Days 6 to 9: first sends

• Let warmup run from 10 per day. Do not override it.
• Source a small, tightly defined first batch of leads.
• Approve or edit every draft. Reject weak ones with a reason.
• Watch the first replies and confirm sequences stop on reply.
• Check bounce rate daily. Pause the source if it climbs.

Days 10 to 12: build the routine

• Create a routine from the Daily prospecting template on weekdays at 09:00.
• Add a Reply triage routine on the “When a lead replies” trigger.
• Add a bounce routine on the “When an email bounces” trigger, or subscribe to the email.bounced webhook.
• Test, then publish.

Days 13 to 14: review and decide

• Run the weekly review from the monitoring section.
• If bounces and complaints are clean and replies are coming in, switch the agent to Autopilot.
• Keep “Always ask for approval” on first touches to high-value accounts.
• Plan capacity: add a second mailbox on its own domain rather than raising caps.

Tip: Write down your pause rule before launch, for example “if bounce rate on any mailbox crosses our threshold, pause the team and review.” Decisions made in advance are easier to follow when numbers move.

Put the playbook to work with Norixia

Norixia was built around the idea in this paper: AI agents should do the research, writing and follow-up, while the system enforces the rules that protect your domain. Warmup, quotas, send windows, suppressions, cross-agent dedup and autonomy checks run before every send, and you choose how much the agents do on their own. You approve. They execute, day and night.

You can start free, with your own API keys and no credit card. Create your workspace, connect a mailbox, and launch your first team in Validation mode. To see how the sending pipeline fits together, read about outbound in Norixia, or explore how routines turn this checklist into a schedule your agents follow every weekday. For a shorter read, see cold email deliverability: protect your domain and how security and guardrails work in Norixia.