A cold email that landed in my primary inbox three times: a header-by-header teardown

A creator-marketing agency sent me a three-step cold sequence over six days. I did not ask for it, I did not reply to it, and it landed in my Microsoft 365 primary inbox all three times — not Junk, not Other, not Promotions. That is rare enough that I pulled the raw headers to see what they did. Names and identifiers below are changed; the structure is exact.

1. Authentication was perfect

Authentication-Results: spf=pass (sender IP is 46.x.x.x)
  smtp.mailfrom=agency-sending-domain.com;
  dkim=pass (signature was verified) header.d=agency-sending-domain.com;
  dmarc=pass action=none header.from=agency-sending-domain.com;
  compauth=pass reason=100
X-MS-Exchange-Organization-SCL: 1
X-Microsoft-Antispam-Mailbox-Delivery: …dest:I…

Read that bottom to top. dest:I is Inbox. SCL: 1 is Microsoft's spam confidence level — 1 means "not spam." And compauth=pass reason=100 is Microsoft's composite authentication fully satisfied: SPF, DKIM and DMARC all passed and all aligned to the same domain. That last line is the one that matters. Aligned DKIM on a domain with no history of abuse is the entry ticket. Everything else is what you do with the ticket.

2. It was not sent from the agency's real domain

The sending domain was a lookalike of the agency's brand, not the domain their website lives on. This is correct practice, not a trick: cold volume from your real domain risks the reputation that carries your customer mail. The lookalike also resolved to a real site — a curious recipient who typed it in landed somewhere.

3. The three messages were one thread

Subject:     Re: Essential nutrition + electrolytes, what I think of it
Message-ID:  <01a06301-…@agency-sending-domain.com>
In-Reply-To: <01a058b2-…@agency-sending-domain.com>
References:  <01a058b2-…@agency-sending-domain.com>

Step one had a subject about my product. Steps two and three were Re: that subject, carried In-Reply-To pointing at the previous step, and quoted the earlier messages in both the plain-text and HTML parts inside a proper gmail_quote blockquote. In my inbox it was one conversation with three messages. That is the whole reason I read step three.

Two things were slightly wrong here, and I will come back to them.

4. Zero links, zero images, zero tracking

This is the part most senders cannot bring themselves to do. None of the three emails contained a single link. No signature banner, no logo, no tracking pixel, no "book a call" button. Every call to action was a reply: "Reply Yes and I'll send the first three." There was nothing for a link scanner to follow or an image proxy to fetch, and nothing that looked like a campaign.

There was also no List-Unsubscribe header and no unsubscribe footer — which filters read as "not bulk" but which is, under CAN-SPAM, a compliance risk the sender was quietly accepting. More on that below.

5. It was a real multipart message

Content-Type: multipart/alternative with a genuine plain-text part and an HTML part that said the same thing. A lot of tools ship HTML with an empty or auto-generated text part; this one looked like a mail client wrote it.

6. Cadence and timing

Thursday, then Monday, then Wednesday: a four-day gap, then two. Every message went out between 4:26 and 4:45 in the afternoon, my local time, on a weekday. Not morning, not weekend, not the 9:00 am blast slot everyone else uses.

7. The first email did the research

Step one named a specific creator, her follower count, her tracked sales, and why she fitted one of my products. That is not a template with my company name dropped in; someone or something looked at my catalog and found a real match. Step two referred back to that creator by name. Step three added social proof and softened the ask to "want me to pull that for your category?" Each step was short — under 120 words — and prose, not bullets.

What they got wrong

The References header only carried one Message-ID. By step three it should have listed steps one and two. Outlook threaded it anyway on In-Reply-To plus subject, so they got away with it — but a client that had lost step two would have had nothing to attach step three to, and a reply-matching system on their side cannot use the chain to match a reply from an unexpected address.

Reverse DNS was missing. The connecting IP had PTR: InfoDomainNonexistent. They were sending from a bare Postfix box on a rented VPS with no PTR record. Microsoft let it through because everything else was clean, but a missing PTR is the single most common tell of a burner setup, and it would have been the first thing to go wrong under any pressure.

No postal address and no opt-out. CAN-SPAM requires a physical mailing address in commercial email and a working way to opt out. "Reply to stop" arguably covers the second; nothing covered the first. A plain-text line — "Not the right person? Reply 'no' and I'll close the file" — plus an address in the signature costs nothing, reads as human, and doubles as a reply prompt.

The takeaway

Landing in the primary inbox was not a trick. It was aligned authentication on a clean lookalike domain, a genuine reply chain, no links or tracking, a real text part, sensible timing, and a first email that had clearly been researched. Every one of those is reproducible. The two mistakes — a one-link References chain and no reverse DNS — are the kind a tool should make impossible rather than leave to the sender.