A cold-email sequencer
that is safe to leave running
Multi-touch cold campaigns are easy to automate and easy to automate badly. The failures are not crashes — they are a second email to someone who already said no, a follow-up that doesn't thread so it reads as a fresh cold email, or two runs in one day putting 60 messages out under a rule that says 30.
coldstart sends through your own AWS SES or SMTP relay. No account, no SaaS, no per-seat pricing, no contact limit.
Python 3.10+ · one dependency · $49 one-time, source included
# dry run: reads the queue, prints exactly what would go out, sends nothing
python3 -m coldstart --campaign campaign.yml --list prospects.csv --day 1
# for real
python3 -m coldstart --campaign campaign.yml --list prospects.csv \
--day 3 --transport ses --send
Dry run is the default everywhere. Sending requires an explicit --send.
Every rule in here exists because of a specific failure
| Behaviour | Why it is in here |
|---|---|
| Warmup ramp (10/20/30/40 → 50, configurable) | A new sending domain that puts 200 cold emails out on day one gets filtered. Gradual volume is the biggest deliverability factor you control. |
| The cap bounds total sends per calendar day | Follow-ups are charged against the same cap, and a second run the same day gets only the remaining headroom — not a fresh cap. |
| Follow-ups queue ahead of new prospects | Replies concentrate on touches 2 and 3. A due follow-up outranks a cold first touch. |
| Threaded follow-ups (In-Reply-To / References) | Rebuilt from the sent log, so a thread survives the prospect row being deleted from your CSV. An untethered "following up" reads as a fresh cold email to anyone who never opened the first one. |
| Any reply ends the sequence — including a negative one | "Not right now" is an answer. Following up on it is the most damaging thing a campaign can do to its own reputation. |
| Append-only, permanent suppression | An opt-out is a decision about all future contact, not a per-campaign flag. Re-checked immediately before every individual send, so an opt-out that lands mid-batch is still honoured. |
| RFC 8058 one-click unsubscribe | Gmail and Yahoo require it from bulk senders. Links are HMAC-signed, so your unsubscribe endpoint can't be used to suppress third parties or enumerate your list — and the verifier ships with it, so the two sides can't disagree about the scheme. |
| CAN-SPAM footer enforced at load time | No postal address, or an unsubscribe URL that isn't https, and the campaign refuses to build rather than reaching a transport. |
| Crash-safe sent log | Written the moment the transport accepts a message, before the next send starts. If the process dies mid-batch, that log is what stops you re-mailing everyone. |
| A missing merge field fails loudly | A body referencing a column your CSV doesn't have raises at build time, naming the column — instead of mailing {industry} to 300 people. |
A campaign is a YAML file, not a code change
Sender identity, the ramp, and the body of every touch. Merge fields are your CSV's own
column names plus {greeting}.
name: Acme Migrations
sender: Dana at Acme <hello@mail.acme.example>
subject: scoping migrations before you quote them
postal_address: |
Acme Migrations
1 Example Street, Springfield, 00000, US
unsubscribe_url: https://unsub.acme.example
steps:
- number: 1
body: |
{greeting}
When a client shows up with a decade of records...
- number: 2
due_days: 4
body: ...What you get
The full source
Seven modules: config, message construction, state, queue building, transports, the send loop, CLI. Readable in one sitting.
23 tests, no network
The console transport keeps every message it was handed, so the exact bytes are asserted rather than mocked. No AWS account needed to run the suite.
Three transports
SES (boto3 or the AWS CLI, whichever you have), any SMTP relay, and console for dry runs.
Yours outright
One-time $49. Commercial single-organisation licence, no subscription, no contact tiers, no phone-home.
What this is not
Not an inbox, not a CRM, not a lead scraper, and not a way to email people who never had any relationship with you in a jurisdiction that forbids it. It sends and it enforces; sourcing addresses lawfully and honouring local law — CAN-SPAM, GDPR/PECR, CASL — is yours. Under GDPR/PECR the legitimate-interest route for B2B contact is narrower than CAN-SPAM's, and the README says so in the same words.
Get coldstart
One payment, yours to keep and modify. Commercial single-organisation licence — use and modify it across your whole company, no subscription, no per-seat pricing. Instant download through Gumroad.
Buy coldstart — $49Checkout and delivery are handled by Gumroad, which is the merchant of record.