A sales team spins up forty new mailboxes across Google Workspace and Microsoft 365, warms them for two weeks, then starts sending. Week three, half the accounts are asking for phone verification. Week four, a dozen are suspended and the rest are landing in Promotions or Junk. The copy was fine. SPF, DKIM and DMARC were all green. Bounce rates were under two percent.
What killed them was not the email. It was everything that happened before the email: how those mailboxes were created, logged into, and operated. Both Google and Microsoft treat account access as a first-class trust signal, and forty mailboxes touched from one office IP or one cloud server look exactly like what they are: a single operator running a fleet.
This article covers the access layer of cold outreach, the part most deliverability guides skip entirely. It matters more every quarter, because provider-side detection has shifted from content filtering toward behavioural and infrastructure correlation.
The Three Layers Where Cold Email Actually Dies
Most teams only optimise one layer and then wonder why results collapse at scale.
The domain and authentication layer. SPF, DKIM, DMARC, sending domain age, subdomain separation, and the reputation of the sending IP or relay. This is well-documented territory and most operators handle it competently.
The message and engagement layer. Copy, link density, image weight, spintax quality, reply rate, spam complaints, and how recipients interact. Google in particular now weights engagement heavily. A message nobody opens degrades the sender even when authentication is perfect.
The access and identity layer. Where the mailbox was created, which IPs log into it, whether those IPs change abruptly, what browser or client fingerprint accompanies each session, and whether that pattern is shared with other accounts. This is the layer that produces mass suspensions rather than gradual deliverability decay, and it is the one proxies address directly.
When twenty accounts get disabled the same afternoon, the cause is almost never content. Content problems degrade slowly. Correlation problems fail in clusters.
How Google and Microsoft Correlate Mailboxes
Google Workspace signals
Google has spent two decades building account linkage infrastructure for fraud and abuse. The signals that matter for cold email operators include login IP and ASN history per account, geographic distance between consecutive sessions, browser and device fingerprint reuse across accounts, recovery phone and email overlap, payment instrument reuse across Workspace tenants, and the timing pattern of API or IMAP authentication.
A single datacenter ASN serving dozens of unrelated business identities is a strong clustering signal. Google does not need to prove the accounts are related. It only needs a probability high enough to justify a verification challenge, and verification challenges at scale are where cold email programmes stall.
Microsoft 365 and Outlook signals
Microsoft leans harder on tenant-level and conditional-access telemetry. Impossible travel detection, unfamiliar sign-in location alerts, and risky sign-in scoring inside Entra ID were built for enterprise security, but they apply just as readily to an outreach operation. A mailbox that authenticates from Frankfurt at 09:00 and Ohio at 09:20 gets flagged as risky regardless of intent.
Outlook consumer accounts add another wrinkle: they are considerably more aggressive about locking accounts created or accessed from hosting ranges, and recovery flows are slower than Google's.
Why the Access Layer Breaks at Scale
Four patterns account for most avoidable damage.
Everything runs from one IP. The default setup. One office connection, one VPS, or one VPN exit serving the entire mailbox fleet. Cheap, simple, and the fastest way to link every account you own to every other account you own.
Shared VPN exits. Commercial VPN ranges are catalogued and heavily reused. Your mailbox shares an exit IP with thousands of strangers, some of whom are doing genuinely abusive things. You inherit their reputation.
Chaotic rotation. The opposite mistake. Teams point their sending stack at a rotating pool and every session arrives from a different city. Rotation is correct for scraping. For an authenticated mailbox it looks like account takeover, and both providers respond accordingly.
Geo mismatch. A mailbox on a domain registered to a UK company, with UK copy and a UK signature, logging in from Vietnam every morning. Nothing about that is illegal, but it contradicts the identity the account presents, and contradiction is what risk engines are built to detect.
What Proxies Fix, and What They Do Not
Be clear about the boundary, because vendors on both sides muddy it.
Proxies fix identity separation and location consistency. Each mailbox can present a stable, residential-grade origin in the country it claims to operate from, isolated from the rest of your fleet. That removes the clustering signal and the hosting-range signal, and it keeps sign-in risk scores quiet.
Proxies do not fix a bad list, aggressive volume ramps, thin copy, missing authentication records, or spam complaints. If recipients mark your mail as junk, no network configuration saves you. Treat proxies as the foundation that lets good practice survive at scale, not as a substitute for it.
One more boundary worth stating: proxies are for account access, mailbox management and automation sessions. They are not a way to relay outbound SMTP through consumer connections. Reputable providers prohibit that, mail on residential ranges gets rejected on arrival anyway, and it moves you from aggressive outreach into abuse.
Best Practices for Multi-Mailbox Infrastructure
One mailbox, one persistent IP. The single highest-impact change. Assign a sticky session or a static residential address to each mailbox and keep it for the life of that account, including creation, warmup and steady-state sending. Consistency beats diversity here.
Match geography to identity. If the sending domain, signature and offer are German, the mailbox should log in from Germany. Include timezone alignment in the browser profile, not just the IP.
Isolate the browser too. IP separation without fingerprint separation is half a solution. Pair each proxy with its own browser profile in an antidetect browser or a separate containerised session so cookies, canvas hashes, fonts and user agents do not overlap across accounts.
Warm the IP alongside the mailbox. Do not create an account on one connection then move it to a proxy in week three. Create it where it will live.
Keep human rhythms. Sending windows aligned to the mailbox's local business hours, realistic gaps between actions, no 03:00 bursts from an account whose owner is supposedly in Chicago.
Stagger everything. Create mailboxes over weeks, not one afternoon. Fleet-wide simultaneity is itself a signal.
Instrument the access layer. Track sign-in challenges, suspension events and per-mailbox placement rates against the IP each mailbox uses. Most teams monitor deliverability and ignore the correlation between account health and network origin.
Common Mistakes That Undo Good Work
Recycling IPs from a dead account onto a new mailbox, which transfers whatever suspicion attached to the original. Sharing one proxy between a mailbox and unrelated scraping work, which mixes traffic profiles. Buying the cheapest pool available without knowing how the IPs were sourced, which is both an ethical problem and a reputation lottery. Skipping validation entirely and discovering mid-campaign that a third of the assigned addresses are already flagged: running each address through a proxy tester before you attach it to a mailbox takes minutes and prevents days of recovery work.
Where Proxies Fit In
The practical requirement for a cold email operation is unglamorous: a set of clean, geographically appropriate, persistently assignable IPs, one per mailbox, sourced in a way that will not embarrass you or expose you to shared abuse history.
That is where pool type matters more than headline price. Static residential proxies and ISP-backed addresses suit mailbox operations because they combine residential-grade reputation with the session stability an authenticated account needs. Rotating residential pools remain the right tool for the other half of the workflow: prospect research, enrichment, and verifying how your landing pages render across markets. Mobile addresses are useful where a target market is genuinely mobile-heavy, though they are rarely necessary for mailbox access alone.
EnigmaProxy positions itself in the professional tier of that market, with residential, ISP, datacenter and mobile pools available from one account, ethically sourced peer networks, broad geo-coverage for country-level matching, and session control that lets you pin an address to a mailbox rather than rotate it out from under an active login. For teams scaling from a handful of mailboxes to a few hundred, the ability to budget per-mailbox cost predictably matters as much as raw throughput, which is worth checking against the available plans before you commit to a fleet size.
Strategic Outlook
Bulk sender rules keep tightening. Google and Yahoo's 2024 requirements were a floor, not a ceiling. Expect complaint-rate thresholds, mandatory one-click unsubscribe and authentication enforcement to extend further, with less tolerance for high-volume senders who cannot demonstrate engagement.
Detection is moving to behaviour graphs. Providers increasingly evaluate the relationship between accounts rather than each account in isolation. Infrastructure separation therefore becomes more valuable over time, not less.
AI personalisation raises the content floor. As generated copy becomes universal, engagement signals do more of the filtering work. Volume without relevance will get quieter results even from perfectly configured infrastructure.
Compliance is becoming operational. GDPR, CAN-SPAM and equivalents are enforced more actively against outbound programmes. Consent posture, suppression hygiene and honest sender identity are now infrastructure decisions, not legal afterthoughts.
Conclusion
Cold email at scale fails in three places, and the access layer is the one that fails loudly. Fix authentication and copy by all means, but if forty mailboxes share one origin IP and one browser fingerprint, they will be treated as one operator, because that is what they are.
The fix is straightforward and unexciting: a persistent, geo-appropriate, cleanly sourced IP per mailbox, isolated browser profiles, staggered account creation and human sending rhythms. Get that foundation right and the rest of your deliverability work actually compounds. Providers such as EnigmaProxy supply the pool diversity and session control that foundation depends on, which leaves your team free to spend its attention on lists and messaging rather than on recovering suspended accounts.