5 outbound checks before you scale
Microsoft 365 spoofing, shared domain risk, and the metric volume hides
By Dimitar Petkov and Christian Sørensen, LeadHaste
Subscribers got this on 22 Sept 2026. Get the next one a week before it goes up here.
- One blank sender can bypass a Microsoft 365 control and expose staff to credible spoofing.
- Shared root domains can link reputation risk across every subdomain you use.
- More replies per send matter more than adding another AI agent to weak inputs.
Five checks now separate outbound scale from avoidable exposure. This week brought a Microsoft 365 control bypass, shared-domain concerns, and two sharper tests for tools and campaign quality.
We think most teams add capacity before testing the system underneath it. Audit the controls, fallbacks, and learning metric first. Scale only after each part can fail without taking the whole outbound operation with it.
Blank senders bypass one Microsoft control
- What happened
- A blank SMTP envelope sender can bypass Exchange Online RejectDirectSend and deliver an internal-looking message.
- Why it matters to you
- Sending controls alone may not protect staff or active domains from credible impersonation.
- Do this
- Audit Microsoft 365 inbound anti-spoofing controls separately from sending controls.
Shared roots can spread reputation risk
- What happened
- Operators in private groups debated whether one root domain can correlate spam risk across many subdomains.
- Why it matters to you
- One low-cost setup could put every campaign under that root at risk together.
- Do this
- Separate root domains before scaling subdomain and inbox volume.
Provider waterfalls survive missing data
- What happened
- Operators in private groups preferred multi-provider enrichment waterfalls because fallback coverage reduces single-provider failures.
- Why it matters to you
- Better coverage keeps targeting consistent when one data source misses or changes.
- Do this
- Test provider fallbacks against records your primary source cannot enrich.
Reply rate per send exposes waste
- What happened
- A fractional CMO told clients to improve reply rate per send before adding another AI content agent.
- Why it matters to you
- Higher volume can hide weak targeting, poor suppression, and campaigns that learn nothing.
- Do this
- Track reply rate per send alongside list quality and evaluation results.
Agent reachability changes tool buying
- What happened
- Frontal AI rebuilt its stack around whether agents could run each tool end to end.
- Why it matters to you
- A capable tool still creates friction when every action needs a person inside its interface.
- Do this
- Ask vendors to show an agent completing your real workflow without manual steps.
“What are your current rates?”
Takeaway Ask your vendor to write a first email that earns a direct pricing question.
Put this week to work.
15 Cold Email Templates That Sell Without Pitching
Hi [First Name],
I was looking at [Metric] benchmarks across [Industry] companies your size. The median is [Benchmark Number]. Most of the teams I talk to at companies like [Company] are running closer to [Lower Number], but they don’t realize it until they actually measure.
Templates that use Socratic questioning to surface hidden tensions. No pitching, no begging, just emails that make prospects see the problem differently.
Email Spam Checker
Paste your cold email and get an instant spam score. Flags the trigger words and formatting that hurt you. Runs in your browser.
Email Deliverability Test
Check SPF, DKIM, DMARC and MX for any domain in one pass, and get a single 0 to 100 score with specific fixes.
Want this running on your own pipeline?
We build and run the outbound system behind these notes, in your name, on infrastructure you own. It starts with a free ICP and campaign-fit review.
Book your free ICP review →