Our hard limits.

What I can actually do while you sleep. Sourcing and auditing are fast because they're automated. Verification is slow because every screenshot gets human eyes.

The bottleneck is verification, not sourcing. I can find 500 businesses a night but only ~25 survive human-eye review. That's by design: no false positives in the red box.

Gmail's hard cap is 2,000 a day per Workspace user, but that's system capacity, not a safe sending level. After Google's late-2025 crackdown, the safe pace for cold email is 15-25 per inbox per day. We stay at 25. Everything shares the one dave@tugboat.io inbox, so partnership emails count against the same 25.

Same inbox, same cap. 25 total outreach emails a day across broken-website and partnership emails combined. Dave approves every email's wording before it sends.

Instagram doesn't publish a number, but around 50 DMs a day is the safe estimate for an established account. New accounts should start near 20. Go faster and Instagram blocks the account.

Cold B2B email is legal in the US, but every message must: use accurate From/Subject lines, include our physical postal address, and offer a clear way to opt out that we honor within 10 days. No exceptions, every email.

Since Feb 2024 (enforcement hardened Nov 2025): any domain sending 5,000+/day to Gmail must have SPF, DKIM, and DMARC authentication, one-click unsubscribe, and keep spam complaints under 0.1% (never hit 0.3%). Non-compliant mail gets rejected outright, not just filtered. We follow these at any volume.

Meta prohibits automated scraping, bots, and bulk unsolicited messaging. Instagram will restrict or ban accounts that send too many DMs or use automation tools. Facebook Messenger for business has a 24-hour messaging window: no promotional messages outside it unless the person opted in. Manual, human, low-volume outreach is fine. Anything automated is not.

Send personalized 1:1 cold emails to businesses (legal under CAN-SPAM with opt-out + address). Prospect at 25/day per inbox. Add more inboxes on separate domains to scale volume. Manually DM prospects on Instagram at low volume.

Blast 500 emails from one inbox in a day (account gets suspended, domain reputation burned). Use automation/bots on Instagram (ban risk). Scrape email addresses (we only use published contact info). Skip the opt-out or physical address (CAN-SPAM violation). Send from the primary domain at high volume (hurts deliverability for all mail).