Cold Email for Founders: How to Write a Sequence That Gets Replies

1. Blog
2. Demand & Channels

By Saroj Jha · October 5, 2026 · 9 min read

A cold email gets a reply when it is about the prospect's problem, stays short and asks for one small thing. Send a few of them, each from a new angle, and meet the anti-spam law and the inbox providers' rules before the first one goes out.

Cold email is often run as a numbers game: a big list, one template, "quick call?" at the end. In my view that gets ignored, and done carelessly it can break the law. In a Gartner survey of 646 B2B buyers, "67% of B2B buyers state that they prefer a rep-free experience"^[1]. A cold email is a seller showing up uninvited, so in my view it must be useful in its first two lines. Here is the order I would work through it with a founder.

Running case: Example Co. Fictional

A fictional seed-stage B2B SaaS startup whose software automates the month-end close for finance teams at companies with 50 to 500 employees. The controller champions it, the CFO signs, IT reviews security. Illustrative numbers: about $1,500 a month, a 45-day sales cycle, a team of eight with one account executive, and a goal of 30 new customers in 12 months. Here, the founders want cold email to open conversations with controllers. Every number is fictional.

Step 1: Choose who to email and why now

In my view, cold email works best on a short, named list, not a bought one. Start with your ideal customer profile: the companies you can win and the one role that feels the problem most. Then find a relevance hook, a public signal that makes this the right week to write: a job posting, a new leader, a funding round. Finally, write the one pain that role feels, in their words. If you cannot say it in one sentence, you are not ready to write.

Example Co., step 1 Fictional

The founders build a named list of 300 companies (fictional). They email the controller, not the CFO, because the controller lives with the close. Hooks: a job post for a senior accountant, a new CFO, a recent funding round. The pain, in a controller's words: "We close on day 12 and everyone works the weekend." All fictional.

Do this

For each account, write the role, the hook and the pain in one line before you draft any email.

Step 2: Write each email about them, not you

Open in the prospect's world. Name one problem, add one true piece of proof if you have it, and ask for one small thing. In my view, 50 to 90 words of plain text is enough, written the way you would write to a colleague.

The ask matters most. "Can we book 30 minutes for a demo?" asks a stranger for half an hour before they trust you. A question they can answer in one line, or an offer of something useful, is a small yes. And proof must be real: if you have no customers yet, do not invent a result. Offer something useful instead, such as a checklist.

If you sell AI, or AI writes the emails

Two things change, in my view. First, "AI-powered" is not a reason to reply. Lead with the controller's pain, and make every claim about what your AI does one you can prove, like any other proof.

The FTC's case against Evolv Technologies shows the risk. Evolv sells AI-powered security scanners to schools and other venues. The FTC alleged it made "misleading claims that its use of artificial intelligence makes its screening systems more accurate, efficient, and cost-effective than traditional metal detectors," and misrepresented that its system would "cut labor costs by 70% compared to metal detectors." The FTC's then consumer protection director said "claims about technology – including artificial intelligence – need to be backed up"^[5]. The court entered the settlement order on December 5, 2024^[6]. These are the FTC's allegations and settlement terms, not a court finding, and not an account of how Evolv decided internally.

Second, if an AI tool drafts your emails, nothing in Step 4 changes. In my view, AI makes the risky parts cheap: a hook it got wrong, a claim nobody checked, more volume than your list deserves. Have a person read every hook and claim before it sends.

Example Co., step 2 Fictional

The founder's first email (fictional). Subject: "day 12 close". "Hi Dana, I saw you're hiring a senior accountant. Sometimes that's because the close keeps stretching. Is that what's behind it, or is it plain growth? If it's the close, I wrote a one-page checklist of where close days usually go. Want me to send it? Sam, co-founder, Example Co." Below it: the postal address and "Not relevant? Reply 'no' and I won't write again." About 50 words, one ask. If an AI tool drafts the first lines, Sam checks each hook against the real job post before it goes out.

Do this

Count the sentences about your own company in your draft. If there is more than one, rewrite it.

Step 3: Plan four to six touches, each from a new angle

I would not expect one email to be enough; busy is not the same as no. But a follow-up that only says "bumping this up" adds nothing. In my view, each touch should give a new reason to reply: the pain, then proof, then a different pain, a short question, and a break-up, spread over two to three weeks.

The break-up says you will stop and leaves the door open. Then stop. Anyone who says "no" or asks to be removed comes off the list that day.

Example Co., step 3 Fictional

Five touches over 14 days, shown below (fictional). The math, all assumed: if 300 accounts get the sequence in a quarter and 5% reply with interest, that is 15 conversations; at a 25% win rate, about 4 customers. Cold email alone will not reach 30, so it runs alongside LinkedIn and accounting partners.

Do this

Write each touch's angle in one line before drafting. If two lines match, change one.

Step 4: Make it legal and deliverable before you send

In the US, cold sales email falls under the CAN-SPAM Act, and the FTC is clear: "The law makes no exception for business-to-business email." Each email needs honest headers and subject lines, a disclosure that it is an ad, "your valid physical postal address" and a clear opt-out. "You must honor a recipient's opt-out request within 10 business days." Each violating email can cost "up to $53,088", and if you hire an agency, "you can't contract away your legal responsibility"^[4].

The inbox providers add their own rules. Since February 1, 2024, Gmail has required all senders to "Set up SPF or DKIM email authentication for your sending domains" (DNS records that prove an email came from your domain) and to "Keep spam rates reported in Postmaster Tools below 0.3%". Its monitoring guidance goes further: stay "below 0.10% and avoid ever reaching a spam rate of 0.30% or higher". Senders of more than 5,000 messages a day also need both SPF and DKIM, plus DMARC (a policy built on them) and one-click unsubscribe^[2]. Yahoo asks all senders to "Implement SPF or DKIM at a minimum" and "Keep your spam rate below 0.3%"^[3].

For UK prospects, the ICO says "You can email or text any corporate body (a company, Scottish partnership, limited liability partnership or government body)." But "Sole traders and some partnerships are treated as individuals", so you need their consent, or they must have bought a similar product from you and not opted out. And "You must not disguise or conceal your identity"^[7]. The ICO notes this guidance is under review after the Data (Use and Access) Act.^[7] I am not a lawyer and this is not legal advice; check with one before sending at scale.

What the FTC's case against Verkada shows

Verkada sells security cameras to businesses. In 2024 the FTC said it "relied on commercial email campaigns to help market its products, sending more than 30 million commercial emails over a three-year period," and that those emails "violated the CAN-SPAM Act in four ways, including not honoring email recipients' requests to unsubscribe"^[8]. The complaint filed by the United States also alleged that Verkada's emails "failed to clearly and conspicuously notify recipients of their opportunity to opt out" and "failed to include a valid physical postal address." To settle, the court's stipulated order requires Verkada "to pay a $2.95 million civil penalty"^[9]. The FTC called it "the largest penalty obtained by the FTC for a CAN-SPAM violation."^[8]

These are the regulators' allegations and settlement terms, not a court finding, and not an account of how Verkada ran its email internally. The lesson: the failures were basic, and each one is a line in a template.

Example Co., step 4 Fictional

Before the first send, the founders (fictional) check SPF, DKIM and DMARC, add the postal address and an opt-out line to every email, and keep one shared do-not-email list. In the UK they email companies only. Each week they check replies, opt-outs and the spam rate in Google Postmaster Tools, and pause if complaints rise.

Do this

Check your domain's SPF, DKIM and DMARC today, and add your postal address and an opt-out line to your template.

Free tool

Check your domain before the first send

The free Email Authentication Checker reads your live SPF, DKIM and DMARC records and says what to fix. No sign-up.

What changes by stage?

• Pre-seed — The founder writes each email by hand to 20 to 50 accounts, to learn the pain in the buyer's words.
• Seed — A written sequence, a named list and one owner for the do-not-email list. Example Co. is here.
• Series A–B — Sales reps or an agency send at volume. You stay responsible for what they send, and volume can cross Gmail's 5,000-a-day line.

What mistakes should I avoid?

• Opening with your company, your funding or your features.
• Asking for a 30-minute demo in the first email.
• Inventing proof you cannot back.
• Follow-ups that only say "just bumping this."
• Buying a list of strangers.
• Leaving out the postal address or opt-out line, or emailing people after they said no.

When a prospect says yes, my post on the discovery call picks up from there.

Example Co. is a fictional company. Example Co. and all its numbers are illustrative. This post is not legal advice.