A lot of small business owners avoid cold email because they assume it's illegal, or they do it carelessly because they assume nobody's watching. Neither is right. In the US, cold B2B email is legal when you follow a short list of rules. Separately, the big inbox providers have their own requirements, and those decide whether your email gets delivered at all.
A quick note before we start: this isn't legal advice. It's the practical version of what I follow. If your situation is unusual, get qualified legal advice from someone who handles marketing law.
CAN-SPAM: the US law
The CAN-SPAM Act covers commercial email, and it has no exception for business-to-business messages. An email to a company's purchasing manager counts the same as an email to a consumer. The FTC's guidance boils it down to a handful of requirements:
- Don't use false or misleading header information. The From name, the reply-to address and the sending domain have to accurately identify who sent it.
- Don't use deceptive subject lines. The subject has to reflect what's in the email. No fake "Re:" or "Your invoice" to get an open.
- Identify the message as an ad. The law gives you leeway on how, but the disclosure has to be clear.
- Tell people where you are. Include a valid physical postal address. A street address, a registered post office box or a registered private mailbox works.
- Tell people how to opt out. A clear way to stop getting your emails, like a link or "reply and I'll take you off."
- Honor opt-outs promptly. The law gives you 10 business days. Do it faster. You can't charge a fee or ask for more than an email address to opt someone out, and you can't sell or share their address after.
- Watch what others do for you. If you hire someone to send email on your behalf, you're still responsible for following the law.
Penalties are set per email and adjusted for inflation each year, and they run to tens of thousands of dollars per message. That's reason enough to take the basics seriously.
Outside the US, the rules are stricter
CAN-SPAM is an opt-out law: you can email first, as long as you let people stop. Canada's anti-spam law, CASL, generally requires consent before you send, with limited exceptions. The UK and the EU have their own rules on top of GDPR. If you sell into those markets, get advice before you build a list there.
The Gmail and Yahoo sender requirements
In February 2024, Google and Yahoo started enforcing new requirements for anyone sending email to their users. They're not laws, but they decide whether your message reaches an inbox. Microsoft announced similar requirements for high-volume senders to its consumer Outlook addresses in 2025. The main points:
- Authenticate your domain. Set up SPF and DKIM, the records that prove your email really comes from you. Bulk senders need both.
- Publish a DMARC record. Required for bulk senders. A policy of "none" meets the minimum, though stronger policies offer more protection.
- Make unsubscribing easy. Bulk marketing email needs one-click unsubscribe and has to honor it within two days.
- Keep spam complaints low. Google says to keep the rate reported in its Postmaster Tools below 0.3 percent, and recommends staying under 0.1 percent.
Google defines a bulk sender as one sending close to 5,000 or more messages a day to personal Gmail accounts. Most small B2B companies send nowhere near that, and much of B2B email goes to company domains, not personal Gmail. I'd still set all of it up. Authentication is basic housekeeping, other providers look for the same signals, and a low complaint rate is good business whether a rule requires it or not.
Should you use a separate sending domain?
Many companies send cold email from a second domain, like getyourcompany.com instead of yourcompany.com. The thinking is that if cold email hurts that domain's reputation, your main domain, the one your invoices and customer email go out on, stays protected.
It's a reasonable choice, with tradeoffs:
- Pros: Your main domain's reputation is kept apart from your outreach. Problems stay contained.
- Cons: A new domain has no history, so it needs to start at low volume. A domain that looks like a knockoff of yours can make people suspicious. And it still needs SPF, DKIM and DMARC, plus everything CAN-SPAM requires.
A separate domain doesn't make careless outreach safe. It limits the damage if something goes wrong. The rules still apply either way.
Habits that keep you out of trouble
- Send from a real person's name and a real inbox that can receive replies.
- Verify every address before sending, so bounces stay low.
- Keep daily volume modest and steady, on business days.
- Write subject lines that describe the email honestly.
- Put your postal address and an opt-out line in every message.
- Keep a do-not-contact list and check every new list against it.
- Stop the sequence the moment someone replies, whatever they say.
The short version
Be honest about who you are, make it easy to say no, respect the no, and set up your domain properly. Do that and cold email is a legitimate way to reach businesses that could use what you sell. Skip it and you risk fines, a damaged domain and a reputation as the company that spams people.
