.com vs .io vs .co vs .ai: The Best Domain Extension for Cold Email

From February 25 to October 8, 2026, every cold email in our sending data went out from a .com address. That's 238 sending domains, and not one of them ended in .io, .co or .ai.

Buy .com domains for cold email. .io, .co and .ai are just as safe with spam filters, but they cost 2 to 8 times more. The extensions to stay away from are the ones that cost under $3 for the first year.

Because we only buy .com, our own data can't tell you whether .io does worse. We never sent from it. So for this piece I went to sources that see everyone's mail:

• Cloudflare's email data for 393 extensions over the last 52 weeks
• The published rules of SpamAssassin, an open-source spam filter, and Microsoft's admin controls
• Spamhaus's domain reputation reports
• Registrar prices, plus a check of 300 startups to see which .com names are still free

Here's what it all adds up to. A domain extension only matters at the cheap end. Between .com, .io, .co and .ai, filters don't pick a favorite, so your domain's own sending history decides where your email lands.

Does the domain extension affect cold email deliverability?

A domain extension only matters at the bottom of the market. Cloudflare Radar publishes the share of each extension's email that Cloudflare's filters flag as spam or malicious, based on the domain in the From line. We pulled 52 weeks of it, October 2025 to October 2026, and matched each extension to its first-year price at Porkbun, a large registrar. I checked both on October 9, 2026.

Source: Cloudflare Radar email data by sender extension, Oct 6, 2025 to Oct 5, 2026, and Porkbun prices checked Oct 9, 2026. n = 152 extensions with at least 0.01% of Cloudflare's email volume and a Porkbun price. Cloudflare publishes shares, not counts, so there are no confidence intervals.

Among the 39 extensions that cost under $3 for the first year, the median one had 65% of its email flagged, and 20 of them sent more junk than real mail. Among the 113 that cost $3 or more, the median was 6%.

It's a cliff, not a slope. Once you're past $3, paying more barely moves the number.

Source: Cloudflare Radar, Oct 6, 2025 to Oct 5, 2026, and Porkbun prices checked Oct 9, 2026. n = 152 extensions. "Mostly junk" means over half of the extension's email was flagged.

Price matters because spammers burn domains. They register thousands, use them for a few days and move on. Spamhaus runs a domain blocklist that mail servers check before they accept email. Its October 2024 to March 2025 report put it plainly: "the vast majority of newly registered malicious domains exist at the lower-priced tiers." The same report says .info registrations jumped 75% after its price fell below $3. Lower prices, it says, bring "more registrations" and "often more abuse." And .bond took 1.1 million new registrations in those six months, yet only 560,000 were left at the end. Spamhaus reads that as about a million suspensions.

Here's what the price tag hides. The cheap extensions aren't even cheap if you keep them. Their renewal price is a median 12.7 times the first-year price, against 2.7 times for everything else. Over two years, 26 of the 39 cost more than a .com. A .shop is $2.06 for the first year and $31.41 every year after. That price only makes sense for someone who won't be around for year two.

You're not buying a cheap domain. You're buying its neighbors.

Is .com really safer than .io, .co or .ai?

Not in the data. Cloudflare flagged 29% of mail from .com addresses, against 3.1% for .io, 3.2% for .ai and 5.4% for .co. That held every quarter. .com never dropped below 23%, and .io, .ai and .co never went above 6.1%.

If you've worried that .ai looks spammy, the numbers point the other way. Take the 26 extensions that each carry at least 0.5% of the email Cloudflare checks. .io and .ai had the 4th and 5th lowest flag rates, right next to .gov at 2.9%. .com came 24th, ahead of only .shop and China's .cn.

That sounds backwards until you look at what the .com mail is. 22 of those 29 points are malicious, meaning phishing or malware, not ordinary spam. Criminals pose as brands people know, and most of those brands are on .com. A From address can be faked, too, so a phishing email pretending to come from a bank's .com address counts as .com mail here. .com is also the biggest pile. It sends 36% of all the email Cloudflare classifies, good and bad. One more caveat. Cloudflare only sees mail sent to companies that use its email security, not the whole internet.

Count domains instead of emails and .com looks clean. In its October 2025 to March 2026 update, Spamhaus listed 506,482 .com domains, just 0.30% of the 168 million that exist. Spamhaus calls 5% of an extension's domains listed "a red flag." .io isn't spotless either. It entered Spamhaus's top 20 country extensions by listings in that report, with 2,194 listed domains, which Spamhaus links to its fast growth.

So none of the four carries a penalty. A filter has no reason to trust .com more, or .io, .co and .ai less.

Where .com still wins is with people and with your wallet. In a 2016 Nielsen survey for ICANN of 5,452 people in 24 countries, 91% rated .com, .net and .org trustworthy, against 45% for the newer extensions tested. It's an old survey, and it didn't test .io or .ai. But a cold email is a stranger asking for attention, and I don't want the domain to be the thing they notice.

Prices: Porkbun, 1-year registration, checked October 9, 2026. The .ai minimum term is from Dynadot, checked October 2026. Flagged share: Cloudflare Radar, spam plus malicious, Oct 6, 2025 to Oct 5, 2026.

Which domain extensions should you avoid for cold email?

Avoid any domain extension that costs under $3 for the first year, and any extension on SpamAssassin's list.

SpamAssassin is the open-source filter behind the spam settings in cPanel, the control panel many web hosts use. Unlike Gmail or Outlook, it publishes its rules, so you can read exactly what it does with your extension. Its rule file for abused extensions names 21 of them: .icu, .online, .work, .date, .top, .fun, .life, .review, .bid, .stream, .gdn, .click, .world, .fit, .ooo, .faith, .buzz, .trade, .cyou, .vip and .xyz. No SpamAssassin rule penalizes .io, .co or .ai as an extension.

A From address on that list costs 0.5 points. If the email isn't a reply and has no Sender or mailing-list header, it costs 2.0 more (current scores, checked October 2026). A first cold email usually has none of those headers. So it starts at about 2.5 points, and SpamAssassin's default spam line is 5. A first cold email from a .xyz address is halfway to the spam folder before anyone reads it. Sell SEO? An email from one of these extensions that promises first-page Google rankings gets one more point.

The list is blunt. .work and .life look clean in Cloudflare's data, at 3.0% and 4.6% flagged, and get the penalty anyway. SpamAssassin's maintainers took .xyz off the list in 2023 and put it back in December 2024. A rule like that doesn't check whether you're one of the good ones.

Company admins can go further. In Microsoft 365, an admin can block a whole extension with one entry like *.xyz. Microsoft then marks that mail as high-confidence phishing and quarantines it (Microsoft Learn, checked October 2026). Nobody publishes how many companies do this, and no bounce tells you it happened.

Google's sender guidelines don't mention extensions at all (checked October 2026). They cover authentication, spam complaints and unsubscribe links. Between mainstream extensions, those decide where you land.

My company is on .ai or .io. Should my sending domains match?

Your sending domains don't need to match your main domain's extension. The question keeps coming up because fewer new companies start on .com. We grouped 372,682 B2B companies in Kenso's database by the year they were founded.

Source: Kenso company database, companies added January 2024 to October 2026 with a website and a known founding year, founded 2005 to 2025. n = 372,682 unique company domains. The extension is the company's website today, not at founding. Shaded bands are 95% confidence intervals. The database reflects the markets Kenso's clients sell into, not every company.

83% of companies founded in 2005 use .com. For companies founded in 2025, it's 63%. .ai went from 0.3% to 12.1%, and most of that jump came after ChatGPT launched in late 2022. It doubled from 4.4% of companies founded in 2022 to 8.8% of those founded in 2023. .io peaked at 4.4% for companies founded in 2021 and has slipped to 3.5% since. .co has stayed between 3.1% and 3.5% since 2020.

If your brand is acme.ai, the exact acme.com is almost certainly taken. We picked 300 random .ai and .io companies from that database, founded 2022 or later, and checked their .com names against Verisign's registry on October 9, 2026. The exact .com was taken for 297 of them, or 99%. But for 278, or 93%, at least one of get[name].com, try[name].com, [name]hq.com or use[name].com was still unregistered. For 194, or 65%, all four were.

So the .com route is open to almost everyone. After that it's a cost question. Here's what five sending domains cost for two years at Porkbun's prices:

That isn't life-changing at five domains. It adds up when you run more, or when you replace domains that wear out. My take is simple. Buy .com versions of your brand name. A matching extension buys you nothing with filters, and your prospect reads "Sam from Acme" long before they look at what comes after the dot.

One catch if you like .app or .dev. Browsers force HTTPS on every domain under them (Chromium's preload list). If your sending domain redirects to your website, that redirect needs a valid certificate, or the click fails.

What matters more than the domain extension?

A sending domain's own history matters more than its extension. Spamhaus's DBL FAQ says "unknown reputations begin as 'poor' by default." A new .com doesn't get a pass. It has to earn trust like any other domain.

What earns it:

• Warm it up. We warm new domains for 2 to 4 weeks before real sending. Our warmup guide compares private warmup with warmup networks.
• Keep volume per inbox low. Grow by adding inboxes and domains, not by pushing one harder. Our guide to how many cold emails you can send per day has the math.
• Don't look like a throwaway operation. Spamhaus warns that "domains which act like they are snowshoeing will get treated like snowshoers." Snowshoeing means spreading spam across many domains and IP addresses that change often, so no single one looks bad. Dozens of fresh $2 domains, each sending a trickle, look a lot like that.
• Keep your main domain out of it. Send cold email from separate domains, so a bad week never touches your invoices or support email.

Kenso runs cold email and LinkedIn outreach for B2B companies, done for you, on infrastructure we own: our own SMTP servers, dedicated US and EU IPs, private warmup and live monitoring. We never send from your main domain. For authentication, list hygiene and the rest, see our cold email deliverability guide.

Frequently asked questions

Is .co bad for cold email?

No. Over the past year Cloudflare flagged 5.4% of .co mail, close to .io and .ai and far below .com. SpamAssassin doesn't penalize it, and Spamhaus listed 63% fewer .co domains in its latest report than in the one before.

Will .io domains stop working?

Not any time soon. The UK and Mauritius signed a treaty on May 22, 2025 to hand over the Chagos Islands, the territory behind .io, but it had not taken effect as of September 23, 2026 (Diplomacy and Law). Even if it does, IANA's retirement rules give a country extension five years by default and up to ten. That's plenty of runway for a sending domain.

Can I use my country's extension, like .de or .co.uk?

Yes, if you mostly email people in that country. In the 2016 ICANN survey, people trusted their own country's extension about as much as .com, 95% on average, though only 76% in the US for .us. If you sell across borders, .com travels better.

Should I send from a subdomain of my main domain instead?

No. Spamhaus lists at the main domain level, and "all hostnames and subdomains of that domain also return a 'listed' result." If cold email from a subdomain gets your domain listed, your invoices and support email go down with it.

Do .io or .ai domains need a different email setup?

No. SPF, DKIM and DMARC, the DNS records that prove an email really came from your domain, work the same on every extension. The only differences are price and paperwork. A .ai domain, for example, has to be registered for at least two years at a time.

The short version

Buy boring .com names that clearly belong to your brand, warm them up, and keep the $2 extensions out of your setup. The extension is the easy part. The domain's history is the hard part. If you'd rather not deal with any of it, your first campaign with us is free.