Real Inquiry or Bulk Sales Pitch? How to Tell Before You Filter

The expensive mistake in a busy inbox is not letting one more sales pitch through. It is filtering out the message that turns out to be a warm inbound lead, a partner introduction or a candidate who found you on their own. Those arrive dressed up in ways that look, at a glance, exactly like outreach — a name and a company you do not recognise, a subject line that could go either way, a first paragraph that mentions your product. Delete it and you never hear about the lost deal.

This guide is a decision procedure for that moment. It scores the observable signals in a first-contact email — headers, reply-to address, personalisation depth, mutual context, and what the sender actually asks you to do — then tells you when to trust the score and when to quarantine instead of delete. Every claim here can be checked against the message on your screen in under a minute, and none of it depends on paying for anything.

The short answer#

Two signals do most of the work. First, open the raw headers and look for a List-Unsubscribe header, a Reply-To address that does not match the From, or a sending subdomain (e.brand.com, mail1.brand.com, o.brand.com). Any one of those means the message was sent by a marketing or sequencing platform, not by a person typing into their own client. Real inquiries almost never carry them.

Second, read the body for research the sender could only have done if they actually looked at you. A genuine first contact names a specific thing — a recent post, a launch, a mutual connection, a piece of your product they used. A sequence at best merges your first name and your company name into a template. When the two signals disagree — clean headers but generic body, or trigger headers but a personal ask — quarantine the message for seven days instead of deleting it. The cost of holding a real inquiry for a week is small; the cost of losing one is not.

Criteria that actually matter#

Every signal below can be observed without leaving the message. None require a plugin or a tool. Weight them together — no single one is proof — but the pattern across four or five gives you a reliable answer.

• List-Unsubscribe header. Legitimate marketing platforms add this because CAN-SPAM and GDPR effectively require an unsubscribe path on bulk mail. A real person emailing you for the first time does not add one. Presence of a List-Unsubscribe header on a message that reads as personal is the single strongest bulk-sending tell.
• Reply-To does not match From. Sequencing tools rotate sending addresses to preserve deliverability, then set Reply-To to the salesperson's real address so replies land in their inbox. A mismatch is not evidence of bad faith — it is evidence of infrastructure. A genuine one-to-one email leaves both fields alone.
• Sending subdomain. Real people send from example.com. Marketing platforms send from e.example.com, mail1.example.com, o.example.com, or from a lookalike domain the company registered specifically to protect the primary domain's reputation. Check the Return-Path header for the actual envelope sender.
• Personalisation depth. A merge field ("Hi {First}, I saw {Company} is doing great things in {Industry}") is a sequence. A specific reference ("I read your post on cold-email routing last Tuesday and it clarified something I've been stuck on") is a person. The dividing line is whether the sender could have written the same sentence to a hundred other recipients.
• The ask. Genuine inquiries ask a specific question or request a specific thing. Bulk outreach asks for a fifteen-minute call, a quick chat, or five minutes on your calendar next week — the CTA of a sales sequence, not a customer.
• Mutual context. A referral name, a mention of where they found you, a reference to a shared connection, a note that they are already using the free plan — all of these are extremely rare in cold outreach and extremely common in genuine inbound.
• Tracking pixel. A 1×1 image loaded from a third-party domain (hubspot.com, mailtrack.io, streak.com, mixmax.com) is a read-tracking pixel. Sales tools use them so the rep knows when to follow up. Real people do not track opens on the first email they ever send you.
• Signature. A signature block with a real title, direct phone and a personal domain is neutral. A signature that includes a company logo, social handles laid out in a template, and a legal disclaimer is a marketing template — not proof of bulk, but a hint.

Scoring table#

Score each signal you can observe. A strong-bulk score of 3 or more is a sequence; a total under 1 is almost certainly a real person. Anything in the middle is where quarantine wins over delete.

A worked example#

Consider a message from "Sarah Chen, [email protected]", subject "Quick question about your onboarding flow". The body reads: "Hi Nafiul, I've been following AI Emaily since your Product Hunt launch and noticed you moved onboarding to a single-question interview last month. We help SaaS companies benchmark first-week activation and I'd love fifteen minutes to compare notes."

Read cold, that could be a genuine peer. Open the headers.

Four strong-bulk signals. The Reply-To domain does not match the From. The Return-Path is a subdomain (e.acme-growth.com). There is a List-Unsubscribe pointing at a sequencing tool. And the X-Mailer header names the tool outright. The body reads personal — the launch reference is real, the onboarding detail is real — but the reference is the kind of thing a research assistant enriches into a template.

Verdict: bulk sequence. The right response is a rule that catches future mail from this domain and drops it into a Cold Emails folder — not a spam report, because the sender is not spam in the CAN-SPAM sense, just outreach the reader did not ask for. Contrast that with the same body from [email protected], no List-Unsubscribe, Return-Path matching, no X-Mailer, and a P.S. that quotes a line from your latest post. That is a real inquiry, and the fifteen-minute ask is a genuine one.

Red flags — one of these tips the balance on its own#

Most signals need a majority vote. A few are strong enough to decide the message by themselves.

• The From domain and the Reply-To domain are different, and one of them belongs to a sequencing platform (smartlead.io, instantly.ai, apollo.io, salesloft.com, outreach.io, lemlist.com, reply.io, woodpecker.co). This is the defining signature of an automated sequence and it does not appear in genuine one-to-one mail.
• A List-Unsubscribe header on a message that reads as personal. A person hand-typing you an email would have no reason to include one; a sequencing tool adds it by default so the message survives spam filters.
• The message is a second-touch "just bumping this to the top of your inbox" and you have no record of the first one. Sequences ship reminders three business days apart regardless of whether the previous message was read.
• The body opens with a fact about you that a scraper could have pulled from your LinkedIn or your homepage in the last five minutes — company size, funding round, job title — and nothing that required a human to actually look.
• The signature contains a company logo and social icons rendered from a CDN. This is a marketing signature, not the four-line block a person types by hand on their laptop.

What we'd pick and why (honest)#

For someone who gets three or four pitches a week, the manual scoring above is the whole answer. Open the header on anything ambiguous, apply the five-minute check, quarantine when unsure. You do not need a tool for a volume that small, and paying for one would be a rounding error you also have to log in to.

For someone getting twenty or more first-contact emails a day — founders on any Show HN or Product Hunt launch cycle, hiring managers with open roles, exec inboxes that publish an address — the manual pass stops working around the second week. That is the reader we built AI Emaily's cold-email filter for. It scores the same signals described above, quarantines bulk mail into a separate Cold Emails folder, and leaves genuine first-contact through — with an audit trail that shows which signal caused any given decision, and a one-click undo when it is wrong. We build AI Emaily; this is our site, and that disclosure is why we are naming ourselves rather than pretending to review the market from the outside.

The reader we are not right for: someone who wants to keep bulk outreach entirely out of their provider before it ever reaches an inbox we sit on top of. For that job an ISP-level or address-alias service — SimpleLogin, Fastmail's masked email, or your provider's own reputation filter — does something we do not do. Gmail's Promotions tab, in particular, already catches a large share of clearly-templated outreach for free, and if that is what you have you should try turning it back on before installing anything. We work on top of Gmail, Outlook and IMAP — we do not replace the provider — so the honest comparison is that the provider's filter runs first and we sort what it lets through.

When automated classification is uncertain — quarantine, don't delete#

No filter, ours or anyone else's, gets this right one hundred percent of the time. The signals overlap: a genuine boutique consultant might use Mailerlite for a real one-to-one intro because that is what they installed; a lookalike domain might be a legitimate marketing subdomain the target company set up years ago. The correct response to uncertainty is a folder, not the trash.

Set the rule so that anything the score marks as bulk lands in Cold Emails (or Promotions, or a filtered label), where it stays visible and searchable for at least seven days. Skim the folder once a week for genuine inbound that scored wrong. This is the workflow SaneBox has built its business on for years, and it is a good one. The point is not to have a perfect classifier — it is to make the cost of a false positive small enough that you can afford one.