Cold Email Outreach skill for Codex

Outreach is done well when every recipient is a business contact you researched and could explain in one sentence why the message is relevant to their role, the sender is a real named person at a real company, opting out takes one click or one reply and is honoured at once, and nothing is sent until the user has approved the list and the text.

Out of scope

This skill does not help with, and Codex should decline:

• Buying, renting or scraping email lists, or harvesting personal addresses.
• Spoofed or misleading sender names, domains or headers.
• Deceptive subject lines (“Re:” or “Fwd:” on a first email, fake order or invoice wording).
• Techniques meant to get past spam filters: domain or inbox rotation, lookalike domains, text spinning, hidden text, link cloaking, automated “warm-up” networks.
• High-volume blasting. If the plan needs thousands of cold sends, it is the wrong channel; suggest content, partnerships, events or opt-in marketing instead (email-marketing).

Step 1: legal check (summary, not legal advice)

Establish where recipients are, summarise the rules for the user, and recommend their lawyer review the approach before outreach in a new country.

Recipient location	Key rules for B2B email to a named business contact
United States (CAN-SPAM)	Truthful headers and sender, non-deceptive subject, identify the message as an ad where required, valid physical postal address, working opt-out honoured within 10 business days (honour it immediately in practice)
United Kingdom (PECR + UK GDPR)	Corporate subscribers may be contacted about things relevant to their role with clear sender identity and an easy opt-out; sole traders and some partnerships are treated as individuals and need prior consent; a documented legitimate interests assessment (LIA) covers the personal data
EU (ePrivacy + GDPR)	Varies by member state; Germany and several others effectively require prior consent for marketing email, including B2B. Where legitimate interest is permitted, document an LIA and give the GDPR Art. 14 information (who you are, where the data came from, how to object) in the first email
Canada (CASL)	Consent required. Implied consent can apply when the person conspicuously published the address for business contact, did not state they refuse unsolicited messages, and the message relates to their role. Sender identification and an unsubscribe mechanism are mandatory
Australia (Spam Act)	Consent required; inferred consent from a published address is narrow

If a country’s rules require consent you do not have, do not email that contact.

Step 2: a small, researched list

1. Define the fit precisely: industry, company size, role, and a concrete trigger that makes the message relevant now (a public hiring post for the problem you solve, a product launch, a published talk on the topic).
2. Research each company and person individually. Use business contact details the person or company published for that purpose (company site, professional profile contact info), introductions, event attendee lists shared with consent, or existing CRM relationships.
3. Record for every contact: source, date found, why they are relevant, country and the lawful basis. You need this to answer “where did you get my address?” honestly.
4. Exclude existing customers in active deals (sales owns them), anyone on the suppression list, and personal (non-work) addresses.
5. Keep it small: tens of contacts per week per sender, each one researched.

email,first_name,company,role,country,source,source_date,relevance,lawful_basis

Step 3: sending setup

• Send from a real person’s mailbox on the company’s own domain, or a clearly branded subdomain of it, so recipients can see exactly who is writing.
• Authenticate that domain: SPF, DKIM (2048-bit) and DMARC (start p=none with rua reports, tighten once aligned). Showing the exact DNS records to the user and getting approval comes before any change.
• Include a List-Unsubscribe header with a one-click HTTPS endpoint (List-Unsubscribe-Post: List-Unsubscribe=One-Click) when the sending tool supports it, plus a plain-language opt-out line in the body.
• Keep a suppression list shared across every tool the team sends from; an opt-out stops all outreach to that person immediately.
• Plain text, no tracking pixels needed, no attachments.

Step 4: writing honest, personal emails

Default sequence: one email plus at most two follow-ups over about two weeks, then stop.

Step	Day	Purpose	Length
1	0	Why them, the problem, one low-effort ask	50-120 words
2	4-5	One genuinely new, useful item (a short case, data point, resource)	40-80 words
3	10-14	Brief close: offer to stop, leave a way back	20-40 words

Template for email 1:

Subject: <plain description of the topic, e.g. "invoice approvals at Northwind">

Hi <first name>,

<One sentence on why you are writing to them specifically, citing the public trigger.>

<The problem you think they may have, stated as a question or observation, in one sentence.>
<What your company does about it and one verifiable proof point.>

Would it be useful if I sent a 2-minute overview, or is this not a priority right now?

<Full name>, <role>, <Company Ltd>
<Company postal address>
You're receiving this because <reason, e.g. your post about finance tooling>. I got your
address from <source>. If you'd rather not hear from us, reply "stop" or use this link:
<unsubscribe link> and we won't contact you again.

Rules:

• The personal line must be specific and true; if you cannot write one, do not email that person. Fact-check anything drafted with AI against its source.
• Claims and numbers must be accurate and attributable.
• Each follow-up adds something new; never send “just bumping this”.
• Stop immediately for the whole company when anyone replies, declines or opts out.
• Reply to “how did you get my address” with the recorded source and offer deletion.

Step 5: user approval before anything is sent

Prepare everything, then show the user: recipient count by country with the lawful basis, the full text of each step, the sender identity and address, the opt-out mechanism, and the planned daily volume. Load contacts into a sequencing tool or start sending only after the user explicitly confirms. Send test emails to the user’s own inbox first and check rendering, variables and the opt-out link.

Measuring

Metric	Healthy	Act when
Positive reply rate	Rising as targeting improves	Near zero after ~50 researched contacts: revisit fit and relevance, not wording tricks
Any reply rate	Track by segment	Mostly “not relevant”: tighten the fit definition
Opt-outs and complaints	Rare	Any complaint: pause and review list quality and relevance
Bounces	Very low (well under 2%)	Higher: the research and sources are stale; stop and fix

Judge outreach by conversations started and meetings that were useful to both sides, not by volume sent.

Gotchas

• Treating “B2B” as a blanket exemption; several countries require consent anyway.
• A missing or broken opt-out link in a follow-up step.
• Personalisation tokens failing (“Hi {{first_name}}”); preview every row.
• Continuing a sequence after someone at the company replied.
• Reusing one country’s template for another without rechecking the legal table.

Verification

• Every list row has source, date, relevance and lawful basis filled in.
• A test send shows SPF, DKIM and DMARC passing for the sending domain (Gmail “Show original”) and the one-click unsubscribe adds the address to suppression.
• Opt-out by reply is processed end to end within the same business day.

Output template

## Outreach plan: <campaign>
**Fit and trigger:** ...
**Countries and legal basis:** US (CAN-SPAM), UK (PECR corporate + LIA); lawyer review: <status>
**Sender:** <name, role, domain>; SPF/DKIM/DMARC status; postal address
**List:** N researched contacts, sources recorded
**Sequence:** step table + full text, opt-out wording
**Awaiting user confirmation:** DNS changes, list upload, first send