Spamhaus on cold email, one year on: what it means for B2B senders

What Spamhaus published on 24 October 2026

On 24 October 2026, the Spamhaus Team published “Cold email, one year on: it got bigger, not better.” It follows a June 2025 article in which Spamhaus said that cold emailing, as it is practiced today, is spam. The new article says that position has only become firmer. ^{[1] [2]}

Spamhaus defines cold emailing as sending unsolicited emails in bulk to people or businesses with whom the sender has no prior relationship. It applies the industry definition of spam, unsolicited bulk email, and says personalization or claims of “legitimate interest” do not change the result. ^[1]

The article cites research by Tom Bartel of Validity, who chairs M3AAWG’s board. That research puts investor funding in the cold email market at roughly $100 million. It also estimates that cold email operators have bought about 1 million disposable domains at an average of $10 each. These are estimates cited by Spamhaus, not figures Sky has measured. ^[1]

Consent and bulk: how Spamhaus draws the line

In its 2025 article, Spamhaus summed up its definition in one line: “it’s not about content, it’s about consent.” Unsolicited means the recipient has not given verifiable permission. Bulk means the message is one of a larger batch with substantively identical content. ^[2]

Spamhaus also said that an unsolicited message is not automatically spam. A genuine one-to-one email between two people with no previous connection can be legitimate. In its view, the line is crossed when outreach becomes automated, scaled and sent in bulk. ^[2]

The practices Spamhaus listed include scraped or bought address lists, “email appending” to guess addresses, AI-written variations of the same template, large sets of throwaway domains that look like the main brand, tools that fake engagement, and misuse of free sending tiers. ^[2]

M3AAWG’s position: deceptive delivery is abusive

M3AAWG, the industry anti-abuse group whose members include large mailbox providers, published its Position on Cold Email in November 2025 as version 1.0. It describes cold email as unsolicited mail from identifiable senders that seeks a sale or business relationship from someone with no prior relationship, connection or consent. ^{[1] [4]}

The position focuses on deception. M3AAWG says bulk cold email often uses authentication, opt-out links and personalization so that it looks like one-to-one mail. It may also use random sending times, lookalike domains or many sending accounts to avoid spam filters. M3AAWG says using deceptive and misleading delivery methods to send unsolicited email, including cold email, is “an abusive practice.” ^[4]

Two points are very practical. First, M3AAWG names spam-trap hits, blocklisting, high unknown-user hard bounces and high complaint rates as signals of cold email. Second, it says consent cannot be moved between channels: permission to phone someone is not permission to email them. ^[4]

What Spamhaus says it did, and what it did not say

Spamhaus says it cross-checked a large dataset of known cold-email domains, supplied by Validity, against its own research. It found a considerable overlap among the top contributors, which let it classify a large batch of cold-email domains at the same time. ^[1]

The article does not name those domains, give a count, or say which Spamhaus list they were added to. It also does not announce a new rule, deadline or listing policy. Spamhaus had already said in 2025 that bulk cold outreach hitting its spam traps would be assessed for listing. ^{[1] [2]}

Spamhaus also says blocking alone is not a full fix, because operators rotate infrastructure faster when they are blocked. It asks sending platforms and hosting companies to enforce their Acceptable Use Policies, to share data, and to talk openly about the risks of cold email, including possible legal issues under laws such as CASL and GDPR. ^[1]

What this means for legitimate B2B senders

Spamhaus calls cold email a shared problem: left unchecked, it wears down the trust and deliverability that legitimate senders have built. For a B2B team, the useful question is simple. For every address you mail, can you show where it came from and what the person agreed to? ^[1]

Spamhaus’s sender guidelines make confirmed opt-in the first minimum requirement: each new recipient clicks a link in a confirmation email, and addresses that never confirm are not mailed. The guidelines say purchased, rented and harvested lists are the most common source of spam-trap hits, that permission is not transferable, and that senders should keep a timestamped record of when and how permission was obtained. ^[3]

Gmail’s sender guidelines point the same way. Google tells senders to email only people who want their messages, not to buy addresses, and not to email people who did not sign up. It also asks senders to keep the spam rate shown in Postmaster Tools below 0.10% and never reach 0.30%. ^[5]

Real warm-up is different from faked engagement. Spamhaus recommends starting slowly and consistently with a new or idle IP or domain, beginning with your most engaged recipients. Tools that artificially simulate engagement are something M3AAWG calls “not acceptable in any manner.” ^{[3] [4]}