Winnowed builds the list and stops. What happens next is a set of decisions most people get wrong once, expensively: a burnt sending domain, a compliance problem, a sequence that gives up after one email. This is the whole of it in 6 steps, with the mistakes named.
This guide covers the decisions and why they go the way they do. The setup walkthrough covers the same ground as button presses: which field, what to type in it, and the 6 settings that are wrong by default. Roughly 2 hours of work spread across 5 weeks, because 4 of those weeks are spent waiting on purpose.
The first decision is where the mail goes out from, and it is the one that causes the most lasting damage when it goes wrong.
Your everyday address is the one your customers, your bank and your accountant use. If a cold campaign damages its reputation, the cost is not a worse open rate. It is your invoices landing in other people's spam folders. That damage is slow to repair and hard to notice until something important has already gone missing.
Cold outreach goes out from a separate domain, bought for the purpose, with its own mailboxes. If it burns, you throw it away and buy another one.
A dedicated cold email platform, not a newsletter tool. Newsletter platforms (Mailchimp and its equivalents) generally prohibit lists you have built or bought rather than collected as opt-ins, and enforcing that is a real suspension risk. Cold email platforms are built for this and rotate sending across several mailboxes.
We use Instantly. Smartlead, Lemlist and Woodpecker do the same job, and all 4 do the 6 things in the table below. Prices move and features change, so compare them against that table rather than against each other's marketing.
None of these is an endorsement and we have no arrangement with any of them. What matters is the list of capabilities, not the name on it.
| What you need it to do | Why |
|---|---|
| Send from several mailboxes at once | Volume comes from more mailboxes, never from pushing one mailbox harder. |
| Warm up each mailbox automatically | Builds a sending history before real mail goes out. See step 02. |
| Cap the daily send per mailbox | You will need this low at first and it must be adjustable. |
| Show bounces by category, not just a total | A dead address and a policy block are different problems with different fixes. |
| Hold a permanent suppression list | Required by law, not a nicety. See step 03. |
| Stop the sequence when someone replies | Nothing loses a warm reply faster than the follow-up arriving anyway. |
Most platforms have an account-wide option to pause a campaign automatically when its bounce rate is high. It is usually on by default, and when it fires it can look identical to a campaign that is simply sending slowly.
Find that setting before you launch and know it exists. Step 06 covers how to tell the difference between a paused campaign and a quiet one.
3 DNS records, 4 weeks of patience, and 1 check that almost nobody runs. This step decides whether your mail arrives at all.
Buy something close to your real domain that a reader will recognise:
yourcompany.co.uk becomes yourcompanyhq.co.uk or
getyourcompany.co.uk. Point it at a real page, even a single one. A
domain with no website behind it looks exactly like a throwaway, because usually
it is.
We use Hostinger, which sells the domain and the mailboxes together and is the cheaper end of the market. Namecheap, Cloudflare Registrar and 123 Reg are all fine alternatives; Cloudflare sells at cost but does not do mailboxes, so you would buy those separately.
A .co.uk is usually £8 to £12 a year and mailboxes a couple of pounds a month
each. Again, these are examples, not endorsements, and no arrangement with any of them.
| Record | What it does |
|---|---|
| SPF | Lists which servers are allowed to send mail as your domain. Published once, as a text record. |
| DKIM | Signs each message cryptographically so the receiver can confirm it was not altered and came from you. |
| DMARC | Tells receivers what to do when the first two fail, and asks them to send you reports. Start it in monitoring mode. |
Your sending platform and your mailbox provider will each give you the values. Both sets go in, and there is only ever 1 SPF record on a domain. If you have 2, neither works.
An SPF record can name another provider's record rather than list servers directly. That is normal, and it is how most platforms tell you to set it up.
If the provider you name does not actually publish a record at that address, your SPF does not fail. It errors. Most checkers report it as a warning rather than a failure, and mail keeps going out, so nothing looks broken.
On one of our own domains this went unnoticed across 2,146 messages over 11 weeks. SPF had never once passed. Everything was riding on the signature alone, and every borderline message was one check worse off than we thought it was.
The check: look up each provider you name in your SPF record and confirm a record actually comes back. It takes 2 minutes and almost nobody does it.
A brand new domain has no sending history, and receiving servers treat that with suspicion no matter how correct your records are. Warm-up builds that history by exchanging small volumes of ordinary mail before your campaign starts.
A domain registered 6 weeks ago will collect reputation-based rejections that an identical, correctly configured 2-year-old domain will not. We watched exactly this happen: a cluster of policy blocks on a domain that was technically perfect and simply too young.
If you are planning a campaign, buy the sending domain a couple of months before you need it. It is the cheapest deliverability improvement available and the only one that cannot be bought later.
Business-to-business email in the United Kingdom is more permissive than most people assume, and the obligations that do exist are specific and easy to satisfy.
This is a plain description of the rules as they apply to ordinary business-to-business mail, written to help you ask better questions. It is not advice, and if your case is unusual you want someone qualified looking at it.
United Kingdom marketing rules draw a line between corporate subscribers (limited companies and limited liability partnerships) and everyone else. Marketing email may be sent to a corporate subscriber without prior consent, provided the sender is identified and an opt-out is offered.
Sole traders and most ordinary partnerships are not corporate subscribers. They are treated like individuals and need consent.
Everything on the company register is a registered company. Sole traders never appear on it, which is listed as a limitation of the tool, and on this particular question it works in your favour. A list built this way contains corporate subscribers by construction.
These apply to every message you send, to role addresses and named people alike. They are a separate obligation from the one below and the two are often confused.
An address that identifies an individual is personal data. If you obtained someone's details from somewhere other than that person, you are required to tell them where you got them, generally at first contact.
Winnowed does not put named individuals' addresses in your file at all. Where the only published address belongs to a person, you get the company, its website and its phone number, and the reason the address was held back. Nobody's personal contact details reach your file from us.
This is the part most suppliers leave you to discover. Once you hold a file of business contacts you are the data controller for it, with any list, from any supplier, however it was built. 2 things follow.
The 2 documents you need: a legitimate interests assessment with all 3 parts worked through for a list built this way, and a privacy notice to put on your site. 44 fields in square brackets to change and the rest already written.
A starting structure rather than advice, and the Information Commissioner's Office publishes its own template worth reading next to it. But an assessment you edited in 20 minutes beats the one you meant to write.
2 things make this lighter than it sounds, and they are both properties of how the list was built rather than promises. Your list is registered companies, so no sole traders. A sole trader's business details are that person's personal data, and they are not on the register to be found. And no named individual's address is in the file, because those are withheld at source.
What is left is lighter to hold than a bought list of named contacts. It is not nothing, and any supplier telling you it is nothing is telling you what you want to hear. None of this is legal advice and it is not a substitute for taking your own.
When someone opts out, that is permanent and it survives everything: a new campaign, a new list, a new sending domain. Keep one suppression list, keep it forever, and check every send against it before it goes out.
Add hard bounces to the same list. They are not opt-outs, but continuing to mail an address that has permanently rejected you damages your sending reputation for no possible gain.
3 emails, spaced out, then stop. Most of the replies you will ever get arrive on the second and third.
| When | What it does | |
|---|---|---|
| 1 | Day 1 | Who you are, what you do, one specific ask. Short. |
| 2 | Day 3 | The reason a customer would care, put a different way. Not "just following up" and nothing else. |
| 3 | Day 10 | A clean close. Acknowledge the timing may be wrong, leave the door open, stop. |
This is campaign B from part 3, word for word as it went to 236 car dealers. 6 said yes. The fields in braces are merge fields filled from the list:
Hi {dealer_name} team,
{car_count} of your current cars caught our eye:
{car_list}
We're building short-form video and carousel content around cars like these for
Kerb's TikTok, Instagram, YouTube and Facebook, and we'd like your permission to
use the photos already on your listings.
No new photos, no time from your team, no cost. We handle everything, and every post
credits {dealer_name} by name with a link back to you.
You can see exactly what we're proposing and say yes or no in one click here:
{preview_url}
Or register as a Kerb dealer and we'll promote more than just this one:
kerb.autos/dealers/join
Hans
Kerb Autos
hans@kerb.autos
Measured against the 5 rules above it is 137 words, not under 120, it carries 3 links where the rule says ideally none, and the follow-up at day 3 opened "Following up on my note…", which is the exact thing the table further up tells you not to do. The longer variant that went out alongside it was 258 words.
2.5% said yes against 0.1% for the campaign that was better written. What this email has is nothing to do with the prose: it names their own cars, it costs the reader nothing, it shows them the finished thing on a page before they decide, and saying yes is one click. Those are the 5 questions in part 3, and it passes all of them.
The rules above are worth following and they are the smaller half. Fix the offer first, then tighten the writing. Tightening the writing on an offer that asks for a budget decision does not get you to 2.5%.
One campaign in one market, shown because it is ours and we can say what is in it. Your trade and your offer will want a different email. Take the questions, not the wording.
Open rate is driven by the subject. If you change the body at the same time you cannot tell which change did what, and you have learned nothing from the sends you spent.
You also need real volume before the result means anything. 25 sends per variant tells you nothing. We have made this mistake and read far too much into a difference that was noise. Wait for a few hundred per variant, and judge on replies rather than opens, for the reasons in step 06.
3 emails. The instinct to add a fourth and a fifth is strong and it is wrong: later steps in a sequence attract a disproportionate share of policy-based rejections, because that is where a recipient's patience and their filter's patience both run out. When we saw reputation-based blocks cluster anywhere, it was on the last step.
A contact who has ignored 3 emails is not a contact who needed a fourth. Put them down and let the phone rows in step 05 have your attention instead.
About 1 row in 6 in your finished file comes back with a phone number and no general email address: 15% of the rows you get, measured across 809 companies. Not 1 in 6 of everything you searched: most of those return nothing at all. Most people delete those rows. They are frequently the best ones in the file.
A company that publishes only a named person's address is usually small enough that the person answering is the person deciding. And because every other list in the market either drops these rows or guesses an address for them, nobody else is contacting them at all. You are not the fourth cold approach that week.
20 calls in an hour is a normal rate once you have a script you are not reading.
3 numbers are worth your attention. 2 of the most prominent ones on your dashboard will mislead you, and 1 silent failure will cost you weeks if you do not know to look for it.
| Number | Healthy | What it tells you |
|---|---|---|
| Bounce rate | under 3% | List quality and sender reputation together. Above 5% most platforms will pause you automatically. |
| Reply rate | 2 to 3% | Whether the offer and the audience match. The only number that responds to better writing. |
| Conversations started | the point | Replies that became a real exchange. This is what the campaign is for; everything above is a means to it. |
A paused campaign and a slow campaign look identical on a dashboard showing all-time averages. Both display a reassuring, unchanged number.
We lost 21 days to exactly this. The platform's automatic high-bounce pause had fired, the campaign had stopped sending entirely, and the all-time figures sat there looking stable. It read as recovering deliverability. It was a stopped campaign.
The check: look at how many emails were sent in the last few days, not the campaign's lifetime total. If that number is not moving, nothing else on the page means anything.
A bounce total is not a diagnosis. Break it down before you change anything, because the categories have opposite fixes:
| Category | What it means | What to do |
|---|---|---|
| Invalid recipient, bad domain | The address or domain is dead | A list problem. Suppress and improve the source. |
| Routing error | Ambiguous, could be temporary | Wait. Do not suppress on a single soft bounce. |
| Policy blocked, spam or reputation | The address is fine; you were rejected for who sent it | A reputation problem. Cutting the list will not fix it. Slow down and go back to step 02. |
That last row is the one people misread most often. It looks like bad data and it is not. It is the receiving server declining your domain. The fix is patience and volume discipline, not a better list.
1 row per week in a spreadsheet: sent, bounced, replied, conversations. 4 numbers, taken on the same day each week. A trend across 6 weeks will tell you more than any dashboard, and it is the only record that survives you changing platforms.
Winnowed