The Most Hostile Filters in B2B Reward the Most Restrained Sender
Cold email to security companies is an asymmetric game. Your prospects' gateways are tuned by people who hunt sending patterns for a living, and every aggressive habit that works elsewhere — fast cadences, relentless bumps, midnight batch sends — is a signature they detect early and punish permanently. Against this audience, the winning posture isn't cleverness; it's restraint. The campaign that behaves most like one careful human writing a few considered emails a day is the campaign that keeps landing.
Woodpecker is unusually well suited to that posture. Human-like sending intervals randomize the rhythm of every send, timezone-aware delivery drops each email into the prospect's actual working hours, condition-based follow-up paths let a sequence de-escalate when a prospect shows no interest, and deliverability monitoring per campaign tells you the moment something starts to slip. ColdRelay supplies what Woodpecker doesn't: the secondary domains, mailboxes, and dedicated IPs all that careful behavior sends from. This guide covers how to pair them — a wide, quiet ColdRelay pool underneath, Woodpecker's cautious machinery on top.
Why Run Woodpecker on ColdRelay Infrastructure
Woodpecker controls how your emails behave — when they go out, how the gaps between sends vary, which follow-up path each prospect takes. What it can't control is what your emails are: the reputation of the domain, the history of the IP, the correctness of the DNS underneath each connected mailbox. A perfectly human-like sending rhythm from a mailbox on a shared, recycled tenant is still a flagged sender doing a good impression of a person — and security-company gateways score the identity before they ever score the behavior.
ColdRelay provides identities worth behaving carefully with. You provision dedicated mailboxes on isolated Azure tenants with dedicated IPs, SPF, DKIM, and DMARC pre-configured, ready in about an hour with no warmup period before sending. The conservative-sending strategy also shapes the pool: because each mailbox sends only 4 emails/day total — 2 outbound + 2 warmup — reaching meaningful volume means going wider, not louder. ColdRelay supports 100-150 mailboxes per domain, so a wide pool stays manageable on a couple of secondary domains, all of it separate from the corporate domain your customers trust.
The pairing is additive, not competitive: ColdRelay is the infrastructure layer — domains, mailboxes, dedicated IPs — and Woodpecker is the sending and sequencing layer on top. Restrained behavior on clean identities is the whole formula for this audience; each half supplies what the other can't.
Visit Woodpecker →Connecting ColdRelay Mailboxes to Woodpecker
Provision a wide, quiet pool on ColdRelay
Conservative sending means capacity comes from breadth: at 2 outbound sends/day per mailbox, a 50-mailbox pool delivers 100 carefully paced sends a day with no individual sender ever raising its voice. ColdRelay supports 100-150 mailboxes per domain, so that pool fits on one or two secondary domains kept apart from your corporate domain. Everything provisions on isolated Azure tenants with dedicated IPs in about an hour, with SPF, DKIM, and DMARC already configured.
Connect the mailboxes as Woodpecker email accounts
Export the mailbox credentials from the ColdRelay dashboard, then add each mailbox in Woodpecker under your email accounts via SMTP/IMAP. Each ColdRelay mailbox connects as its own sender so campaigns can distribute prospects across the pool. If you're an agency running this motion for security clients, Woodpecker's agency panel keeps each client's campaigns and connected accounts in their own workspace.
Cap each account at 2 sends/day and turn on human-like sending intervals
Set every account's daily limit to 2 outbound emails, mirroring ColdRelay's per-mailbox budget — 4 sends/day total, split 2 outbound + 2 warmup. ColdRelay's warmup runs continuously inside that budget, so there's no separate warmup period and nothing extra to enable on the Woodpecker side. Then switch on Woodpecker's human-like sending intervals so even those two daily sends leave at irregular, person-shaped gaps instead of on a clockwork schedule a gateway can fingerprint.
Build condition-based follow-up paths that de-escalate
In the campaign editor, use Woodpecker's if-opened and if-clicked conditions to branch the sequence by engagement. Prospects who open or click move to a path with a substantive next touch; prospects who show nothing get one more widely spaced, softer follow-up and then the sequence ends. Use Woodpecker's A/B testing on the follow-up timing as much as the copy — for this audience, the gap between touches is often the variable that moves replies.
Enable timezone-aware delivery, launch, and watch per-campaign deliverability
Set delivery to the prospect's timezone so every email arrives mid-morning in their working day, then launch. From day one, treat Woodpecker's deliverability monitoring per campaign as your tripwire: decide before launch what bounce level pauses the campaign, and honor it. Against security-company filters, the cheap save is the campaign you pause a day early — not the domain you try to rehabilitate a month late.
The Cybersecurity Woodpecker Playbook
Make every mailbox indistinguishable from a person
Gateway heuristics catch machines being machines: fixed send times, identical gaps, bursts at volumes no human types. The combination of Woodpecker's human-like sending intervals and ColdRelay's per-mailbox budget — 4 sends/day total, 2 outbound + 2 warmup — produces a profile with nothing to catch: a handful of irregularly timed messages a day, exactly what a real employee's mailbox looks like. Don't undermine it by raising limits in a good week; the consistency is the camouflage.
Let non-engagement end the conversation
Most platforms treat silence as an instruction to send again; security-company filters treat repeated mail into an inbox that never engages as a complaint waiting to happen. Build your Woodpecker condition paths so silence de-escalates: no open and no click after two touches routes to a single, final, wider-spaced message — then the sequence stops. One caveat this audience demands: gateways pre-fetch links and images, so treat an "opened" branch as a weak maybe, and treat sustained non-engagement as the only signal you fully trust.
Arrive inside the prospect's working day, every time
A SOC analyst who pulls the mail-flow logs — and at a security company, someone eventually does — sees timestamps. Fifty emails landing across an org at 3:47 a.m. local is a campaign; one email arriving at 9:40 on a Tuesday is correspondence. Woodpecker's timezone-aware delivery makes the human-hours pattern automatic across every region you target, which both nudges deliverability and survives the exact scrutiny this industry uniquely applies.
Pre-commit your stop rules, then let the monitoring enforce them
The most expensive deliverability failures come from optimism — the bounce rate creeps, the team finishes the week anyway, and the domain is cooked. Write the stop rules before launch: the bounce percentage that pauses a campaign, the engagement floor that retires a list segment, the signals that bench a mailbox. Then check Woodpecker's deliverability monitoring per campaign against those rules daily and execute without debate. Replacement mailboxes are about an hour away on ColdRelay; a burned reputation with a security-vendor gateway is effectively forever.
Typical Cybersecurity Outbound Benchmarks (Woodpecker + ColdRelay)
| Metric | Benchmark | Notes |
|---|---|---|
| Inbox placement rate | 95%+ | Dedicated IPs, isolated tenants, and pre-configured SPF/DKIM/DMARC — the identity layer that makes careful behavior count |
| Reply rate | 1.5-3% | Security buyers reply sparingly; restrained cadences and human-hours delivery keep you at the top of the range |
| Share of replies from follow-up touches | 40-55% | Patient, widely spaced follow-ups do real work with this audience — when the branch logic stops them before they become noise |
| Follow-up cap for non-engaged prospects | 2-3 touches | Condition-based paths end silent threads early — repeated sends into a non-engaging inbox is the pattern hostile filters punish |
| Time to first campaign | Same day | ~60 minutes to provision on ColdRelay, plus connecting accounts and building condition paths in Woodpecker |
What It Costs: Woodpecker + ColdRelay
You pay per mailbox per month for the infrastructure, with volume tiers that drop as you scale (see the table below). Dedicated IPs, isolated Azure tenants, and pre-configured DNS are included — and since the conservative strategy favors a wider pool of quieter mailboxes, the tiers reward exactly the shape of pool this motion needs.
Woodpecker is billed separately on its own subscription covering campaigns, condition-based follow-up paths, timezone-aware delivery, deliverability monitoring, and the agency panel — priced per its current plans.
Infrastructure cost scales with mailbox count; Woodpecker's cost scales with its plan and connected slots. Because per-mailbox volume stays fixed at 2 outbound/day, your budget maps directly to capacity — every mailbox you add is a known quantity of careful, deliverable sends.
| Mailboxes | ColdRelay price / mailbox / month |
|---|---|
| 1–199 | $1.00 |
| 200–999 | $0.85 |
| 1,000–4,999 | $0.70 |
| 5,000+ | $0.55 |
Each mailbox sends 4 emails per day — 2 outbound to prospects + 2 warmup. ColdRelay provisions mailboxes on isolated Azure tenants with dedicated IPs; Woodpecker handles the sending, sequencing, and inbox rotation on top.
Frequently Asked Questions
Does ColdRelay replace Woodpecker?
No — they're complementary layers and you use them together. Woodpecker is the sending and sequencing layer: campaigns, condition-based follow-up paths, human-like intervals, timezone-aware delivery, per-campaign deliverability monitoring. ColdRelay is the infrastructure layer underneath: the secondary domains, mailboxes, and dedicated IPs those campaigns send from. Neither does the other's job.
Woodpecker already monitors deliverability — why do we need dedicated infrastructure too?
Monitoring detects problems; infrastructure prevents them. Woodpecker's per-campaign deliverability monitoring tells you when bounces climb or placement slips — but if the mailboxes behind the campaign share tenants, sit on recycled IPs, or carry sloppy DNS, the monitoring will simply confirm bad news on schedule. ColdRelay's isolated Azure tenants with dedicated IPs and pre-configured SPF/DKIM/DMARC give each sender its own clean standing, so the monitoring becomes an early-warning system for rare exceptions rather than a chronicle of structural failure.
Do ColdRelay mailboxes need a warmup period before Woodpecker campaigns can start?
No separate warmup period. Warmup runs continuously as part of each mailbox's 4 sends/day budget — 2 outbound + 2 warmup — so mailboxes are campaign-ready the day they provision. Cap each Woodpecker account at 2 outbound sends/day and leave the warmup side to ColdRelay; layering additional warmup on top would push volume past the budget the deliverability is built around.
Two outbound emails per mailbox per day sounds tiny — how do we reach real volume?
Width, not loudness. Each mailbox sends 4 emails/day total — 2 outbound + 2 warmup — and capacity scales by adding mailboxes: 50 mailboxes is 100 outbound sends/day, 150 is 300/day. ColdRelay supports 100-150 mailboxes per domain, so even a large pool sits on a few secondary domains, and Woodpecker distributes prospects across the connected accounts. Against security-company gateways this is the point, not a workaround — many quiet senders survive scrutiny that one loud sender never would.