Running email day to day

How do you stop cold sales outreach emails?

By iBlockSpam Team How we check our guides Updated Oct 16, 2026 9 min read 7 sources

Short answer

Cold sales emails often pass spam filters because they're low volume, authenticated and sent from real mailboxes. Unsubscribe from recognizable companies, since US law requires them to stop within 10 business days. Block senders that ignore you, and have an admin block repeat domains for the whole organization. Report persistent violators to the FTC at ReportFraud.ftc.gov.

On this page 11 sections

Cold sales outreach is the email equivalent of a stranger's sales call: "Quick question", "Following up on my last note", a calendar link, and three more nudges if you don't reply. It isn't usually malicious, which is exactly why spam filters let so much of it through.

This guide explains why that happens, what US law requires of senders, and the practical steps users and admins can take to cut it down.

What is cold sales outreach email?

Cold outreach is unsolicited commercial email sent to someone with no prior relationship, usually by a salesperson or an agency working a list. It's typically sent as a short sequence of personal-looking messages rather than a designed newsletter.

A typical example (illustrative, not a real company):

From: Jordan Lee <jordan@getexamplegrowth.example>
Subject: Quick question about your team's lead flow

Hi Sam,

Noticed your company is hiring for sales. We help firms like yours
book 20+ meetings a month. Worth a 15-minute call next week?

Jordan

123 Example Street, Springfield
Not interested? Reply "no thanks" and I won't follow up.

Note what it contains: a real name, a postal address and an opt-out line. Those are the marks of a sender trying to comply with the law.

Why do cold sales emails get past spam filters?

Spam filters weigh reputation, authentication and content. A competent sales sequence can score well on all three:

Low volume. Each mailbox sends relatively few messages a day, often from a mainstream provider with a good reputation.
Authenticated. The sender's domain usually has valid SPF, DKIM and DMARC, so it passes the checks described in SPF vs DKIM vs DMARC.
Plain content. Short, personal text without attachments or suspicious links looks like ordinary business mail.

Microsoft also separates spam, which it describes as "unsolicited and universally unwanted", from bulk email, where "some users want bulk email messages... while other users consider bulk email to be spam" (Microsoft Learn). Cold outreach sits awkwardly between the two. One person's spam is another's useful supplier introduction, so filters are cautious. Our guide to graymail vs spam covers that middle ground.

Is cold sales email legal?

In the US, mostly yes, if it follows the CAN-SPAM Act. The FTC's compliance guide says "the law makes no exception for business-to-business email", and lists what every commercial message must do:

CAN-SPAM requirement	What it means for you as a recipient
Accurate header information	The From and reply addresses should identify the real sender
Honest subject line	The subject "must accurately reflect the content of the message"
Identified as an ad	The message must disclose it's an advertisement, though the law is flexible about how
Physical postal address	A "valid physical postal address" must appear
Clear opt-out	You must be told how to stop future marketing email
Opt-out honored	"You must honor a recipient's opt-out request within 10 business days"

CAN-SPAM doesn't require your consent before the first message. It's an opt-out law. Penalties are up to $53,088 per violating email at the time of writing (October 2026), per the FTC. Other countries apply different rules, often stricter for email to individuals. This isn't legal advice; ask counsel if you're deciding whether to act against a sender.

Should you unsubscribe, reply or block?

It depends on who's writing.

Situation	What to do
A real company you recognize, with a postal address and opt-out	Use its unsubscribe link or opt-out method
The same company keeps writing after you opted out	Block the sender, then report it to the FTC
New salespeople from the same company keep appearing	Ask your admin to block the domain
No identifiable company, no address, odd links	Don't click or reply; mark it as junk or spam
It mentions an invoice, payment change or shared file you didn't expect	Treat it as possible phishing; report it

Unsubscribing from recognizable companies is generally safe. Clicking unsubscribe in outright spam isn't, for the reasons in our guide on whether it's safe to unsubscribe from spam.

How do you opt out so it actually sticks?

An opt-out request works better when you can prove you made it. Use this sequence for any recognizable company:

Use the sender's own opt-out method. CAN-SPAM requires a clear explanation of how to opt out, usually a link or a reply instruction. Hover over a link first and check it goes to the company's own domain or its email platform.
Opt out once per company, not per salesperson. Ask to be removed from all of the company's marketing lists, not just one rep's sequence.
Keep a record. Save the message, note the date, and keep any confirmation page or reply.
Wait 10 business days. That's the window the FTC gives senders to honor the request.
Then block and report. If mail keeps coming after that, block the sender, keep the later messages with headers, and report it at ReportFraud.ftc.gov.

If a message has no company name, no postal address and no working opt-out, it doesn't meet CAN-SPAM's basic requirements. Don't engage with it at all; mark it as junk.

How do users stop cold outreach in their own mailbox?

Users can handle most of it without IT:

Gmail: open the message, select More next to Reply, then Block "sender". Google says "all future emails from them go to Spam" (Gmail Help).
Outlook: add the sender to Blocked senders, or the domain to Blocked domains, in junk email settings. Our guide to blocking senders in Microsoft 365 lists the steps for each Outlook version.
Report it. The FTC advises marking unwanted messages as spam or junk and telling the FTC at ReportFraud.ftc.gov (FTC).

Personal blocks only protect one mailbox. If a seller writes to ten people in your company, ten people have to block them.

How do admins block cold outreach for the whole company?

When the same senders hit many staff, handle it centrally. A practical sequence:

Find the pattern. Use Microsoft 365 message trace or Google Workspace Email Log Search to list sending domains that reached several users.
Decide whether staff ever need to reply. If they might, avoid blocks that also stop outbound mail.
Block in Microsoft 365. The Tenant Allow/Block List blocks a domain for everyone, but Microsoft notes users "also can't send email to these blocked domains" (Microsoft Learn). To block inbound only, Microsoft suggests the blocked senders or blocked domains lists in anti-spam policies (Microsoft Learn).
Block in Google Workspace. Add the domain to Blocked senders under Gmail > Spam, Phishing and Malware. Matching mail is rejected, with an optional custom rejection notice (Google Workspace Admin Help).
Set an expiry and a note. Tenant Allow/Block List blocks expire after 30 days by default. Record who asked and why.
Review the bulk threshold. If outreach arrives through bulk-sending platforms, Microsoft 365 may score it as bulk. Our anti-spam policy guide explains Microsoft's Standard (6) and Strict (5) bulk thresholds.

Avoid broad keyword rules such as quarantining every message that says "quick call". They catch real customers.

How do you reduce cold outreach before it starts?

Cold outreach lists are built from public sources. Reduce what they can find:

Publish role addresses, not personal ones. Route sales@ or info@ to a shared mailbox, as our guide on protecting public email addresses explains.
Keep personal addresses off your website and out of PDFs and press releases.
Know your exposure. Our guide to where spammers get email addresses covers scraping, guessing and data brokers.

You won't stop it completely. Anyone can guess firstname@yourcompany.com.

When is cold outreach really phishing?

Some "sales" emails are the opening move of a scam. Be suspicious when a message:

Claims to follow up on an invoice, contract or order you don't recognize.
Comes from a domain that's one letter off a supplier's (see lookalike domain phishing).
Pushes you to open a shared document or sign in to view a proposal.
Asks to change payment details or move a conversation to text or phone.

If it fits, don't block and forget it. Report it, and use our guide on how to spot a phishing email to check the details.

When does an MX-level filter help?

No filter can know which supplier introductions you wanted. What a filter at the MX level can do is give you control in one place for every mailbox and alias on the domain, and let users see what was held.

iBlockSpam filters mail before it reaches Microsoft 365, Google Workspace or your own server. Admins can block persistent senders or domains for the whole domain, with sender verification available on list entries, and each user gets a personal quarantine with scheduled digests to release anything they wanted. Pricing is per domain, not per mailbox; see iBlockSpam for small businesses.

Next steps

Unsubscribe from the cold emailers you recognize, and note the date.
Block repeat senders yourself, then ask your admin to block domains that reach several people.
Report senders that ignore opt-outs at ReportFraud.ftc.gov.
Check whether your domain's filtering is set up as you think with the free Email Health Check.
If you want domain-wide block lists and per-user quarantine digests, see iBlockSpam for small businesses.

Browse more guides on running email day to day.

Frequently asked questions

Is it legal for a company to send me a cold sales email at work?

In the US, usually yes. CAN-SPAM doesn't require consent for commercial email and makes no exception for business-to-business messages. The sender must use accurate headers and subject lines, include a valid postal address and an opt-out, and honor opt-outs within 10 business days. Other countries have stricter rules, so check local law.

Why doesn't my spam filter catch cold sales emails?

Because many look like ordinary business mail. They're often sent one at a time from real, authenticated mailboxes at major providers, with personalized text and no malware. Spam filters judge reputation, authentication and content, and a well-run sales sequence can pass all three. Filters also can't know whether you wanted to hear from that seller.

Does replying 'remove me' to a cold sales email work?

It often works with legitimate companies, but it isn't the most reliable route. CAN-SPAM lets the sender specify how to opt out, typically a link or a reply address in the message. Using that method creates a record. Replying also confirms your address is read, so don't reply to anything that looks like outright spam or a scam.

Where can I report a company that ignores my unsubscribe request?

Report it to the FTC at ReportFraud.ftc.gov, which the FTC names as the place to tell it about spam. Keep the original messages with headers and note the date you opted out. Inside your organization, mark the messages as junk and ask your admin to block the sender's domain for everyone.

Should I block the sender's address or the whole domain?

Block the address first if the company might also send mail you want, such as invoices or support replies. Block the whole domain when every message from it is unwanted, or when new salespeople from the same company keep appearing. If the company sends from more than one domain, block each one.

Sources

See how your domain measures up

Run a free Email Health Check: MX, SPF, DKIM, DMARC and transport security in one scan, with the raw records shown. No sign-up.

Keep reading