Outbound for AI agencies without burning your domain or number
Three gates decide whether your outreach reaches anyone: the inbox, the phone label, and the rules you are actually under. Here are the exact thresholds Google, Microsoft and the FTC published, and the low-volume outbound that a one to ten person AI agency can run inside them.
Lumina14 min read
Outbound for an AI agency fails at three gates, and none of them is your pitch. Your email has to reach an inbox. Your call has to get answered. And the rules you are operating under have to be the ones you think they are. Miss one and the best offer in your market never gets read, because Gmail filed it, Outlook rejected it, or a carrier printed "Spam Likely" over your name before the phone rang.
The compressed version: keep each sending domain under 5,000 messages a day to consumer mailboxes, set up SPF, DKIM and DMARC before your first send, watch your user-reported spam rate like a fuse, and stop assuming that calling a business instead of a consumer puts you outside the telemarketing rules. The FTC closed most of that gap in 2024.
The rest is the detail, the numbers, and the part where we tell you what none of it fixes.
Why does cold email for AI services get filtered so hard?
Because the mailbox providers rewrote the rules in 2024 and then started enforcing them, and because most of what makes AI outreach easy to scale is what the filters are built to catch.
Google's sender guidelines split senders into two tiers. Everyone has to authenticate with SPF or DKIM, use TLS, and have valid forward and reverse DNS. Bulk senders do more: SPF and DKIM, a DMARC record at p=none or stricter, one-click unsubscribe on marketing mail, and a spam rate that stays down. The line between those tiers is where agency owners get caught.
What counts as a bulk sender, and why is 5,000 a trap?
Google defines a bulk sender as "any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period." Three details in Google's own FAQ turn that threshold into a trap.
It aggregates at the primary domain. Google's worked example is 2,500 a day from solarmora.com plus 2,500 from promotions.solarmora.com, which together make you a bulk sender, because subdomains roll up. The standard cold email rig of five domains with three mailboxes each does not buy five separate allowances when those domains share a root.
It is permanent. Google says senders who cross the line even once "are permanently considered bulk senders" and that the status "doesn't have an expiration date." Cutting your volume back later does not undo it.
And it only counts personal Gmail. The guidelines "don't apply to messages sent to Google Workspace accounts." Plenty of the businesses you are prospecting run their mail on Workspace under their own domain, so a chunk of your sends never touch the 5,000. The owner still using a gmail.com address on the side of his truck does count.
None of that argues for sending more. It argues for knowing which bucket you are in before a bounce tells you.
What is the one number that will end your domain?
User-reported spam rate. Google wants it "below 0.3%" as a hard requirement, and separately tells senders to hold below 0.10% and never reach 0.30%. It is measured in Postmaster Tools and calculated daily.
Three complaints per thousand delivered messages. That is your whole margin.
The consequence is specific. Since June 2024, bulk senders above 0.3% are ineligible for delivery mitigation, and eligibility only returns once the rate stays "below 0.3% for 7 consecutive days." The moment you need help, you have disqualified yourself from getting it. Google also warns that starting November 2025 it is "ramping up its enforcement on non-compliant traffic," with disruptions "including temporary and permanent rejections."
Run the arithmetic. Send 2,000 cold emails in a day, have six people hit the spam button, and you are at the ceiling. Six. In a campaign to people who never asked to hear from you, six is nothing.
That is the real argument against volume outbound for a one to ten person agency. Not taste. Math.
Does Google actually say cold email is against the rules?
Close enough that it is worth reading the exact language. Google's list of practices to avoid includes "Don't purchase email addresses from other companies" and "Don't send messages to people who didn't sign up to get messages from you," and it notes that those recipients tend to mark the message as spam, after which "future messages to these recipients will be marked as spam." A separate set of deception rules outlaws half the tricks in circulation: no "Re:" or "Fwd:" subject lines unless the message really is a reply, and no display names that include the recipient's name, imply a thread, or carry urgency copy.
Cold email is not illegal, and CAN-SPAM still allows unsolicited commercial mail with the required disclosures. But Gmail is a private filter, not a court, and its position is that unsolicited mail is unwanted mail. Plan around that instead of arguing with it.
Is Outlook a separate problem?
Yes, with its own threshold, its own date, and a harsher failure mode.
Microsoft's Outlook.com postmaster policies apply authentication requirements to domains sending more than 5,000 emails a day to Outlook.com accounts, effective May 5, 2025. You need SPF passing, DKIM passing, and DMARC at minimum p=none, aligned with SPF or DKIM.
The enforcement sequence is the part to note. Non-compliant mail from high volume senders goes to the junk folder first. Microsoft then says it will "reject the messages until the DNS records are corrected," returning a 550; 5.7.515 Access denied error naming the sending domain.
Microsoft also bans namespace mining, which it defines as "the practice of verifying email addresses without sending (or attempting to send) emails to those addresses." If your list building tool advertises real-time verification against the provider, read that sentence again.
Your DNS has to be right before the first send, not after the first campaign underperforms. One afternoon of work decides everything downstream.
Why do my calls show up as Spam Likely?
Because your number carries a signature that says how much your carrier actually knows about you, and most agency owners dial from a number with a weak one.
STIR/SHAKEN is the framework that "allows voice service providers to verify that the caller ID information transmitted with a particular call matches the caller's number," and the FCC describes it as establishing "a chain of trust back to the originating voice service provider." In the order that implemented it, the Commission laid out three attestation levels:
A, full attestation. The provider can confirm who the subscriber is and that the subscriber is using its associated telephone number.
B, partial attestation. The provider can confirm the subscriber but not the telephone number.
C, gateway attestation. The provider is only the point of entry to the IP network for a call that started somewhere else.
A cheap VoIP number you bought this morning and started dialing from tends to land at B or C. Analytics engines at the terminating carrier read that, combine it with your call pattern, and decide what label the recipient sees. Fresh number, high volume, short calls, low answer rate is the profile of a scam campaign, and you cannot argue with a heuristic.
Two limits on what any of this buys you. The framework "only operates on the IP portions of a voice service provider's network," so a call path can lose the header entirely. And attestation is not a good-behavior badge. It says your carrier knows who you are. It does not say your call is welcome.
What helps: register the number to your business with the carrier, dial from a number that also receives calls and has a real voicemail, keep daily volume per number low enough to look human, and check your numbers against a labeling lookup before deciding your offer is broken.
Aren't business-to-business calls exempt?
Less than they used to be, and this is the change most AI agency owners have not registered.
The Telemarketing Sales Rule historically exempted most business-to-business calls, carving out only retail sales of nondurable office and cleaning supplies. On March 7, 2024, the FTC announced a final rule under the subhead "Final rule extends telemarketing protections to business-to-business calls." It "expands prohibitions against misrepresentations to business-to-business telemarketing," and the FTC updated the recordkeeping requirements at the same time to cover call detail records, records of consent, and records of compliance with the Do Not Call Registry.
One caveat, because it matters if you go looking. The FTC's own compliance guide for the TSR still describes the old B2B exemption and lists the amendment history as 2003, 2008, 2010 and 2015. It has not been rewritten for the 2024 rule. Read that page, conclude you are exempt, and you have relied on a page that predates the change.
This does not mean cold calling businesses became illegal. It means the misrepresentation rules now reach your B2B pitch. Every claim you make on a cold call about what the system does, what it costs, what results it produces and who else uses it is a claim the FTC can act on. Which is a good reason to sell with a working demo instead of an adjective.
We are not your lawyer and this is not legal advice. If you are running real volume, an hour with a telemarketing attorney costs less than the alternative.
What if I use an AI voice in my own outbound?
Then you are in a stricter category than you were, and the rule has been in force for a while.
On February 8, 2024, the FCC adopted a Declaratory Ruling recognizing that calls made with AI-generated voices are "artificial" under the Telephone Consumer Protection Act. It took effect immediately. The Commission's framing is direct: the TCPA "requires telemarketers to obtain prior express written consent from consumers before robocalling them," and the ruling "ensures AI-generated voices in calls are also held to those same standards."
Now read that against your own prospecting. The AI receptionist you sell answers inbound calls from people who chose to dial, a completely different legal posture. An AI voice that dials out to contractors who never consented is not the same product wearing a different hat. We wrote up the disclosure rules for voice agents separately, and it is the piece to read before you point anything outbound.
If you send SMS as part of outbound, your system has to catch opt-out language and stop. Not eventually. On the next send.
So what should a small AI agency actually do?
Send less and make each touch heavier. That is the whole strategy, and the deliverability rules push you toward it whether you like the conclusion or not.
At 30 to 60 emails a day from one warmed domain you are nowhere near 5,000, you are not a bulk sender, and one complaint does not move a rate calculated across a meaningful denominator. At 3,000 a day you live inside a 0.3% ceiling with hundreds of strangers holding the button.
The version we run and recommend:
Pick one trade and stay in it. Same objections, same price bands, same vocabulary. Your tenth call in a vertical beats your first in ten verticals. The ninety day version of this is in how to get your first ten AI agency clients.
Build the demo before the outreach, not after the meeting. Twenty minutes with their business name, their trade and their website produces a page you can send. The live demo on our home page is the same thing your prospect opens, under your brand.
Make the first message about one thing you observed. The call that went to voicemail at 2pm on a Tuesday. The contact form that does not send. Something checkable.
Lead with the link, not the meeting request. A demo link asks for thirty seconds of curiosity. A calendar link asks for a commitment from a stranger.
Call the people who opened it. That is not cold anymore, and the conversation starts at the demo instead of at "do you have two minutes."
Run the demo on the first real call. Hand them the phone and let them talk to the agent. The demo call playbook has the sequence.
Sixty emails a day, a dozen calls to openers, one trade. That is a week of outbound a two person agency can run, and it stays under every threshold in this post.
Who this does not work for
The advice above is not universal, so here is where it breaks.
If you need 500 meetings a quarter, none of this scales to it. Hire an SDR team, buy infrastructure built for that volume, and pay a deliverability specialist who does nothing else. We are describing outbound for a small shop that needs ten to thirty good conversations a month.
If you are selling into a trade you have never worked in and cannot describe a day in, the specific first message we recommend is impossible to write. You will fall back on generic AI copy, which lands where everyone else's generic AI copy lands.
If your domain is already burned, nothing here repairs it. A domain with a history of high complaint rates does not recover because you got thoughtful. You buy a new one, warm it over weeks, and accept the delay.
And if you are waiting for the compliance picture to be perfectly clear before you start, you will wait forever. The rules move, the guidance pages lag the rules, and the providers change enforcement without much warning.
Where Lumina Sales fits
Our argument is that the demo is the outbound asset, so the volume you need drops.
Lumina Sales is $49 a month: a live demo site on your own subdomain, a client portal and fulfillment platform under your agency's brand, onboarding help, and 100 live voice minutes, 500 chat messages and 50 website audits a month. Packs for 100+ trades carry the services, price bands and objection language for each one, so the demo you send a garage door company sounds like a garage door company. Client builds are priced at wholesale on a 30-minute call, with no build fee on the platform itself, and you set retail. The pricing page lists the tiers and limits in full.
What it does not do is send your email or place your calls. No sequencer, no dialer. Deliverability stays your problem, on your domain and your number. What we remove is the reason you were sending 3,000 emails in the first place, which was that you had nothing specific to say and hoped volume would cover it.
One timing note, stated plainly because it is on our home page: our prices rise October 1.
FAQ
How many cold emails a day can I safely send?
Fewer than you think, and the real answer depends on your domain's age and reputation rather than a universal number. Staying well under Google's 5,000 a day threshold to personal Gmail accounts keeps you out of the bulk sender category permanently, which is worth more than the extra volume. For a small agency, 30 to 60 a day per warmed domain is a sane range.
Is cold calling small businesses still legal?
It is not prohibited, but the FTC's 2024 final rule extended the Telemarketing Sales Rule's misrepresentation prohibitions to business-to-business telemarketing, and the recordkeeping requirements changed with it. Calls to mobile numbers placed with an autodialer or an artificial or prerecorded voice, including an AI voice, sit under the TCPA no matter who answers. Talk to a telemarketing attorney before you run volume.
Can I use an AI voice agent to do my own cold calling?
Technically yes. Legally it is a much narrower path than most people assume, because the FCC's February 2024 ruling puts prior express written consent in play for telemarketing calls made with an AI voice. Selling an inbound receptionist and running an outbound AI dialer are different products with different exposure.
My emails land but nobody replies. Is that a deliverability problem?
Usually not. Check Postmaster Tools first. If authentication passes and your spam rate is low, the mail is arriving and your message is the problem. Silence after delivery is a relevance failure, and the fix is a more specific first line, not a bigger list. There is a similar version of this after the demo, which we covered in what to do when a prospect goes quiet.
Do this before your next campaign
Open the DNS for whatever domain you send from and confirm three records: SPF, DKIM with a key of at least 1024 bits, and DMARC at p=none. If one is missing, fix it today and delay the campaign. Then open Postmaster Tools and look at your spam rate. Above 0.1%, halve your daily volume before you do anything else.
Then build one demo. Pick the trade you know best, use a real local business's name and website, and send that link to ten owners in that trade with one observed detail in the first line. Ten specific messages beat a thousand generic ones, and at ten a day you will never see the inside of a spam folder.
Start your agency workspace for $49 a month, or talk to the demo receptionist on our home page first and see what you would be sending.
