Creator Outreach and Domain Health

Mailchimp is not the exception. Every major permission-based email platform has the same rule, and each one names scraped or publicly available addresses specifically:

• Mailchimp. Its audience requirements state that contacts must be collected entirely by you and that purchased, rented, and lists scraped from third-party sources, including public websites, are not allowed. Poor audience quality can lead to account shutdown. Requirements and Best Practices for Audiences and The Importance of Permission.
• HubSpot. Its Acceptable Use Policy prohibits emailing purchased, rented, or borrowed lists, and any list likely to produce excessive spam complaints. HubSpot's own guidance defines third-party lists to include scraped and publicly available email addresses, and says HubSpot may check for verifiable opt-in after a spam report. Customer Trust and Safety Guidelines and Acceptable Use Policy.
• Constant Contact. Users may not upload or send to purchased, traded, shared, borrowed, or web-scraped lists. Accounts that do are flagged for review and locked. Contact list policy.

The reason is the same in every case. These platforms send from shared IP pools, so one customer's spam complaints hurt everyone on the platform. They protect that shared reputation by refusing any list where the recipient did not sign up directly. A creator export from any database is, by their definition, a scraped list.

Cold outreach to creators is a normal, legitimate business practice. Creators publish these addresses precisely so that studios and brands can contact them about work. The rules below exist to keep that outreach looking like what it is: a person offering a specific creator a specific opportunity.

Legal note

Cold email to business contacts is legal in most jurisdictions with conditions. This is general guidance, not legal advice. Confirm with your counsel for the countries you send into.

• United States (CAN-SPAM): no consent required. You must identify yourself accurately, include a physical mailing address, offer a way to opt out, and honor opt-outs within 10 days.
• EU and UK (GDPR, PECR): business-to-business outreach can rely on legitimate interest, but many creators operate as individuals or sole traders, which brings them under stricter rules. Keep emails relevant, state why you are contacting them, and stop immediately on request.
• Canada (CASL): stricter. Consent is generally required, with a narrow exception for addresses the recipient has conspicuously published without a no-solicitation notice, and only if the message relates to their business.

Practically: target carefully, personalize, keep volume low, include an opt-out line, and remove anyone who asks. The same practices that protect your domain also keep you on the right side of these rules.

What the providers allow vs what is safe

Providers publish hard caps. Those caps are the point at which your account is locked, not the point at which your emails start going to spam. Spam filtering starts long before the cap.

Why newsletter platforms are the wrong tool for creator outreach

Mailchimp, Constant Contact, HubSpot Marketing, and similar platforms are built for permission-based email: recipients who signed up to hear from you. Their terms of service prohibit sending to purchased, rented, scraped, or publicly available contact lists. Creator emails gathered from YouTube About pages, Twitch panels, or a database fall into that category.

Three practical consequences:

• Account suspension. These platforms monitor bounce and complaint rates and suspend accounts that look like cold outreach, often after the first campaign.
• Shared infrastructure. Emails go out from the platform's shared IP pool. Your deliverability depends on thousands of other senders you do not control.
• Wrong format. Newsletter templates, tracking pixels, and unsubscribe footers signal "marketing email" to both filters and creators. Creators respond to short, personal emails that look like they came from a person.

Cold-outreach tools such as Lemlist, Instantly, or Smartlead do allow this use case. They work the same way the Cloutboost Portal does: they send through your own Gmail or Microsoft mailboxes, with daily caps and delays between sends. The difference is that the Portal combines sending with the creator database, campaign tracking, and key delivery in one place.

How the Cloutboost Portal sends email

The Portal does not send email from Cloutboost servers or a shared IP. It connects to your Gmail or Google Workspace mailboxes through Google's official API and sends each email individually from your account, exactly as if you had written it in Gmail.

• Each creator receives an individual email. No CC, BCC, or mail-merge headers.
• Sends are spread out over time rather than fired in a burst.
• You set a daily cap per mailbox and the Portal stays under it.
• Multiple mailboxes and domains can be connected. The Portal rotates between them within your caps.
• Follow-up sequences stop automatically when a creator replies.
• Every sent email and reply is mirrored in your Gmail. If you stop using the Portal, your history and creator relationships stay with you.

Because the Portal sends from your own mailboxes, your domain reputation is in your hands. The Portal makes it easy to stay within safe limits, but the limits themselves come from Google and Microsoft, not from us.

Google-verified integration

Connecting a Gmail account to a third-party app is a security decision, so it is fair to ask what Cloutboost has been checked for. The Portal's Gmail integration has passed Google's full OAuth app verification for restricted scopes. In practice this means:

• Google reviewed and approved the app. The Cloutboost project (Google Cloud project ID: cloutboost) is approved for the gmail.send, gmail.modify, and gmail.settings.basic scopes. These are restricted scopes, which Google only grants after a manual review of the app, its privacy policy, and a demonstration of how the data is used.
• Independent security assessment. Restricted Gmail scopes require a CASA (Cloud Application Security Assessment) Tier 2 review by a Google-authorized assessor. Cloutboost's assessment was conducted by TAC Security and covers application security, data handling, and access controls. Google requires this to be repeated every year, and Cloutboost is enrolled in the annual recertification.
• Limited Use compliance. Under Google's API Services User Data Policy, the Portal may use Gmail data only to provide the outreach features you see in the product. Cloutboost does not read your inbox for any other purpose, does not sell or share Gmail data, and does not use it to train models or for advertising.
• You stay in control. The Portal never sees or stores your Google password. Access is granted through Google's OAuth consent screen and can be revoked at any time from your Google Account under Security, Third-party access. Revoking access stops the Portal from sending immediately. Everything already sent stays in your Gmail.

Unverified apps show a warning screen during Google sign-in and are capped at 100 users. Verified apps do not. If you are comparing outreach tools, ask each vendor whether their Gmail integration has passed Google's restricted-scope verification and CASA assessment. Many have not.

Reference: Google OAuth API verification and annual reassessment, App Defense Alliance CASA.

Recommended setup for a creator outreach campaign

1. Spread the load across domains

Do not put all outreach volume on your primary company domain. Most teams want to send some emails from their main domain because creators recognize it, and that is fine at low volume. But the bulk of outreach should go through one or more dedicated variants (yourstudio-games.com, yourstudio.co, hello-yourstudio.com) used only for this purpose. If reputation on one of them drops, your main domain and your team's everyday email are unaffected. Set each outreach domain to redirect to your main website so creators can verify it is legitimate.

2. Two to three mailboxes per domain

Create real mailboxes for real people (firstname@outreach-domain.com). Avoid generic addresses like info@ or marketing@. Two to three mailboxes per domain is the practical ceiling before the domain itself starts to look like a sending farm.

3. Authenticate every domain

Before sending the first email, set up all three DNS records. Google and Yahoo have required these for bulk senders since February 2024 and now reject unauthenticated mail outright.

• SPF lists which servers may send for your domain.
• DKIM cryptographically signs each message so it cannot be tampered with.
• DMARC tells receivers what to do when SPF or DKIM fail. Start with p=none, move to p=quarantine once reports are clean.

Google Workspace sets up SPF and DKIM through the admin console. Verify with Google's checker or MXToolbox.

4. Warm up new mailboxes

A brand-new mailbox that sends 100 emails on day one gets flagged. Ramp up over two to three weeks:

During warm-up, send some normal one-to-one emails from the mailbox and reply to anything that comes in. Replies and engagement build reputation faster than volume.

5. Keep the daily cap at 50 or below

Fifty new contacts per mailbox per day is the industry-wide accepted safe limit for cold outreach. Cloutboost runs its own campaigns at 30 to 50 per mailbox and only pushes toward 100-200 on established mailboxes during peak launch windows, with close monitoring. Follow-ups to existing threads count toward the total but carry less risk than first-touch emails.

6. Scale with domains, not volume

To reach 3,000 creators in a launch window, do not send 3,000 emails from one address. Use the math below and add domains as needed.

7. Watch the metrics that matter

• Spam complaint rate. Google's guideline is below 0.1%, and never above 0.3%. One complaint per 1,000 emails is already the ceiling.
• Bounce rate. Keep under 3%. High bounces mean stale addresses and signal a bad list.
• Reply rate. Positive replies are the strongest reputation signal. Short, personal emails get more of them.

Register each domain in Google Postmaster Tools to see spam rate and domain reputation directly from Google.

8. Write emails that look like emails

• Plain text, no images, no HTML templates, no tracking pixels beyond open tracking.
• Personalize the first line with something specific to the creator's channel.
• Include a way to opt out. A plain "reply and let me know if you'd rather not hear from us" is enough for outreach; a formal unsubscribe link is not required at these volumes.
• Two to three follow-ups, spaced two to four days apart, then stop.

Common questions

• ‍Will using the Portal put my domain at risk?

Only if the domain is used outside the limits above. The risk comes from volume and list quality, not from the tool. This is true of every outreach tool on the market.

• ‍Why not send from Cloutboost's domain?

With a Portal subscription, you send from your own mailboxes. Creators reply to you, and the relationship and reply history are yours. Nothing is locked inside the platform.

If you would rather not set up outreach domains, mailboxes, and warm-up yourself, that is what our managed service is for. In a managed campaign, Cloutboost runs outreach from its own domains and mailboxes, which are already authenticated, warmed, and maintained across multiple domains for volume. Our team handles the targeting, sending, follow-ups, negotiation, and key delivery, and you receive the shortlist, replies, and reporting. This is the right option when you need to reach a few thousand creators for a launch without building the infrastructure first.

• ‍What happens if I hit the provider's hard cap?

Google and Microsoft lock sending for up to 24 hours. Repeated violations can lead to account suspension. The Portal's daily cap is there to make sure this never happens.

• ‍Does this apply to Twitch and TikTok creators too?

Yes. The platform where you found the creator does not matter. What matters is that you are sending email to someone who has not opted in, so the same domain-health rules apply.

‍