Short answer: Cold email lead generation in India works when you send short, relevant emails to a researched list of business contacts from an authenticated secondary domain, stay well under the inbox providers' limits, and stop the moment someone opts out. The technical floor is SPF, DKIM and DMARC on every sending domain, a one-click unsubscribe header, and a user-reported spam rate below 0.1% (Gmail stops mitigating bulk senders above 0.3%). Legally, India has no email-specific anti-spam statute, but work emails of named people are personal data under the DPDP Act 2023, so record your source, keep the purpose narrow and honour objections at once.
Is cold email legal in India?
Yes, with conditions. Three layers apply, and none of them is a CAN-SPAM-style email law.
- No dedicated anti-spam law. Law firm TT&A's client alert (August 2023) states that "India does not have a comprehensive law or regulatory authority governing email marketing activities", and that TRAI's unsolicited commercial communication regulations cover voice calls and SMS, not email (TT&A). Calls and SMS in the same campaign are covered by TRAI's rules.
- The DPDP Act applies to the data. Under the Digital Personal Data Protection Act, 2023, "personal data" is any data about an identifiable individual, so rahul.mehta@company.in is personal data; info@company.in is not. Consent under section 6 must be "free, specific, informed, unconditional and unambiguous", and section 6(4) lets people withdraw it as easily as they gave it. Section 3(c)(ii) excludes data a person has made publicly available themselves; whether a public LinkedIn profile or a speaker bio counts has not yet been tested before the Data Protection Board. The DPDP Rules were notified on 14 November 2025 with an 18-month phased compliance period (PIB), and the top penalty is ₹250 crore for failing to protect data.
- Mailbox providers enforce their own rules. Gmail, Yahoo and Outlook will filter or reject mail that breaks their sender requirements, regardless of local law. For most senders this is the binding constraint.
What that means in practice: email only business contacts with a clear professional reason; record where each address came from and when; say who you are in every email; include an opt-out and honour it within two days across every mailbox; and delete non-responders' data when the campaign ends. For high-volume programmes or sensitive sectors, take advice on the consent position before the Rules' later phases commence.
How do you set up cold email deliverability?
Never send cold email from your main company domain. If it gets a poor reputation, your invoices and proposals start landing in spam. Register a secondary domain (for example, getcompany.in or company-team.com), point its website to your main site, and set up these records.
| Record | Example value | What it does |
|---|---|---|
| SPF (TXT on root) | v=spf1 include:_spf.google.com ~all | Lists servers allowed to send for the domain. One SPF record only; merge includes if you use several tools. |
| DKIM (TXT on selector) | Generated by Google Workspace or Microsoft 365; use 2048-bit | Cryptographically signs each message. Yahoo requires at least 1024-bit keys. |
| DMARC (TXT on _dmarc) | v=DMARC1; p=none; rua=mailto:dmarc@getcompany.in | Tells receivers what to do when SPF/DKIM fail, and sends you reports. Start at p=none, move to quarantine once reports are clean. |
| Custom tracking domain | CNAME such as track.getcompany.in | Avoids sharing a tracking domain with thousands of other senders. Better still, disable open tracking. |
| One-click unsubscribe headers | List-Unsubscribe: <https://...> and List-Unsubscribe-Post: List-Unsubscribe=One-Click | Lets Gmail and Yahoo show an unsubscribe button. Defined in RFC 8058; both headers must be covered by the DKIM signature. |
Yahoo's requirements spell out the alignment rule: publish DMARC with at least p=none, and the From domain must align with the SPF or DKIM domain. Most cold email tools support the one-click headers; check a raw message ("Show original" in Gmail) to confirm SPF, DKIM and DMARC all show PASS before the first campaign.
What spam-rate and volume thresholds apply?
| Provider | Who counts as a bulk sender | Spam-rate rule | Unsubscribe |
|---|---|---|---|
| Gmail | Close to 5,000+ messages to personal Gmail accounts in 24 hours; counted across the primary domain; status is permanent (Google FAQ) | Keep user-reported spam below 0.1%; bulk senders above 0.3% are "ineligible for mitigation" | One-click for marketing and promotional messages; process within two days |
| Yahoo | Bulk senders (no fixed number published) | Keep complaints below 0.3%, calculated on inbox-delivered mail (Yahoo) | RFC 8058 one-click plus a visible link; honour within 2 days |
| Outlook.com / Hotmail / Live | Domains sending more than 5,000 emails a day | No figure in the enforced rules; SPF and DKIM must pass, DMARC p=none with alignment | Not in the enforced list; include it anyway |
Outlook began enforcing on 5 May 2025; non-compliant mail from qualifying domains can be rejected with the error "550; 5.7.515 Access denied" (Twilio SendGrid summary). Gmail says it began ramping up enforcement on non-compliant traffic in November 2025.
Two points people miss. First, the 5,000 count is per primary domain, so ten mailboxes on one domain add up. Second, 0.3% is not a target. At 0.1% you are already being watched; three complaints per 1,000 delivered emails puts you over the line, and cold lists generate complaints faster than newsletters.
How many cold emails can you send per day?
Our own operating limits, which sit far below the bulk thresholds on purpose:
- Two to three mailboxes per secondary domain, and no more than 30–50 new contacts per mailbox per day once warmed.
- Warm new mailboxes for three to four weeks: start with a handful of real conversations a day and increase gradually.
- Plain text, no attachments, no images, at most one link (or none in the first email).
- Send in business hours of the recipient's city, Tuesday to Thursday for first touches.
- Pause a mailbox if bounces exceed 2% or replies turn hostile on a segment.
At those limits, three mailboxes reach 90–150 new contacts a day, roughly 2,000–3,000 a month: plenty for a researched B2B list, and nowhere near Gmail's bulk definition.
How should you build a cold email list in India?
Start from accounts, not contacts. Define the segment tightly (for example, "logistics companies in Bhiwandi and Chakan with 50–500 staff that are hiring dispatch managers"), list 200–500 accounts, then find one or two people who own the problem. Sources that hold up: your CRM's lost deals and old enquiries, LinkedIn Sales Navigator for research (copy nothing automatically), company websites, trade association member directories and event exhibitor lists.
Verify every address before sending, and record the source and date in a column you keep. Avoid bought "10 lakh Indian CEO emails" databases: they are full of dead addresses and spam traps, and you cannot say where a single record came from if anyone asks. Our ICP guide helps define the segment first.
What does a good cold email sequence look like? Sample emails
Four emails over about 14 working days, each adding something new. Example below for a company selling warehouse management software to Indian 3PLs; adapt the specifics.
Email 1 (day 1): the observation
Subject: dispatch cut-off at your Chakan site
Hi Priya, noticed [3PL name] is hiring two dispatch supervisors for Chakan. When we see that at 3PLs, it's often because pick lists are still built in Excel and the evening cut-off keeps slipping.
We help 3PLs move pick-and-dispatch to scanner-based workflows; [one real, approved result from a similar client].
Is cut-off timing a problem for you, or is it something else driving the hiring?
Ankit Sharma, [Company], Noida
Not relevant? Reply "no" and I won't email again.
Email 2 (day 4): one useful idea
Subject: re: dispatch cut-off
Priya, one thing that usually helps even without new software: batch-picking orders for the same route before the 4 pm wave rather than order by order. It is a cheap test: run it for a week and compare the evening queue.
Happy to send the one-page checklist we use. Want it?
Email 3 (day 8): proof
Subject: how [peer 3PL] handles peak-day dispatch
Short version of what changed at [peer 3PL, named with permission]: scanners on the floor, pick lists by route, live dock status for the dispatch head. If a 20-minute walkthrough of their setup would be useful, Tuesday or Thursday afternoon works on my side.
Email 4 (day 14): close the loop
Subject: should I close this?
Priya, I haven't heard back, so I'll assume dispatch isn't a priority right now and stop here. If someone else owns this at [3PL name], a name would be appreciated.
Rules behind these: a subject line a colleague might write, one claim that you can back up, one question, a real name and city, and an opt-out line in every email. Email 2 uses "re:" only because it continues your own thread; a fake "Re:" on a first email is deceptive. The bracketed proof in emails 1 and 3 must be a real, approved example; if you do not have one yet, leave proof out rather than invent it. The broader multi-channel cadence (calls and LinkedIn alongside email) is in our appointment setting guide.
Which cold email metrics matter, and when should you stop?
| Metric | Healthy sign | Stop or fix when |
|---|---|---|
| Bounce rate | Under 2% | Above 2%: pause, re-verify the list |
| Spam complaints (Postmaster Tools) | Under 0.1% | Rising toward 0.3%: stop the segment |
| Reply rate | Replies, including "not now", show the message is read | Near zero after 300 contacts: change segment or problem |
| Positive reply rate | The core message metric | Under 1% after 300–500 contacts: rewrite the hypothesis |
| Meetings held and sales-accepted | The business metric | Positive replies but few accepted meetings: list or qualification problem |
The thresholds are our working rules, not industry standards. Ignore open rates: Apple Mail Privacy Protection and image blocking make them unreliable, and tracking pixels add a deliverability risk. Feed replies and meetings into your CRM with the segment and email variant so you can judge which hypothesis created pipeline; our lead nurturing guide covers what happens to "not now" replies.
What should a cold email lead generation company in India provide?
- Domains and mailboxes registered in your company's name, transferable at exit.
- A documented list source for every contact, and a suppression list you can download.
- Copy you approve before sending, with no invented results.
- Daily reply handling with positive replies answered within hours, not days.
- Weekly reporting on bounces, complaints, positive replies and meetings held, not "emails sent".
- A data processing agreement: under section 8 of the DPDP Act your company remains responsible for what the vendor does with the data.
Use our agency evaluation scorecard to compare providers, or see how we run outbound inside our B2B lead generation service. For costs of tools and outsourced programmes, see the B2B lead generation cost guide.
Sources
- Google: Email sender guidelines FAQ for bulk-sender definition, permanence, 0.1%/0.3% spam-rate guidance, one-click scope and November 2025 enforcement.
- Yahoo Sender Hub: Best practices for SPF/DKIM, DMARC p=none, 0.3% complaint rate and 2-day unsubscribe.
- Twilio: Outlook's new sender requirements for the 5,000/day threshold, 5 May 2025 enforcement and 550 5.7.515 error.
- IETF RFC 8058 for one-click unsubscribe headers.
- Digital Personal Data Protection Act, 2023 for personal data, consent, withdrawal, public-data exclusion and processor responsibility.
- PIB: DPDP Rules, 2025 for notification date, phasing and penalties.
- TT&A: Email marketing in India for the absence of a dedicated email marketing law and TRAI regulations' scope.