The short answer
Cold email to businesses is lawful under CAN-SPAM without prior consent, provided the headers and subject are truthful, the message identifies itself as an advertisement, a physical address appears, and opt-outs are honoured within ten business days. The binding constraint is not the law but deliverability — mailbox providers enforce sender reputation far more aggressively than regulators enforce the statute.
Two things have to be true for cold email to work: it has to be lawful, and it has to arrive. Brokers spend their attention on the first and lose on the second.
The infrastructure comes first
- Send from a separate domain, not the one your client email runs on. A burned sending domain should not take your business email with it.
- Authenticate with SPF, DKIM and DMARC before the first send. Unauthenticated mail is filtered on arrival.
- Warm the domain over several weeks, starting at a handful of messages a day.
- Keep volume per mailbox low and add mailboxes rather than raising the per-mailbox rate.
- Verify the list before sending. Hard bounces are the fastest way to wreck a new domain.
What to write
| Element | What works |
|---|---|
| Subject | Specific and plain. No urgency theatre. |
| First line | About them, and demonstrably researched |
| Body | Three or four sentences. One idea. |
| Ask | One question, answerable in a word |
| Footer | Physical address and a working unsubscribe |
The single biggest lift is the first line being genuinely about that business. Everything else in cold email is hygiene; that is the part that decides whether a reply happens.
What it is good for, and what it is not
Cold email is slow and cheap: it builds a pipeline over months and it does not produce a merchant who wants money this week. Inbound leads do the opposite. Running email as a complement to bought leads is sensible; running it as a replacement is a decision to have a much longer sales cycle.