Can an AI agent follow up on sales leads by email?

Yes, and inbound follow-up is the strongest version of the use case: the prospect wrote first, so the reply is invited, delivers well, and gets read. Cold outreach is a different activity with legal and deliverability constraints, and should be metered, reviewed, and always carry an unsubscribe.

How fast can an agent respond to an inbound lead?

Seconds. Mail arrives, a `message.received` [webhook](/docs/webhooks) fires, and the agent reads the thread and replies. The practical limit is your own model latency, not the mail path.

How many follow-ups should an AI agent send?

Two at most on an inbound thread, then stop. The third touch converts almost nobody and is where complaints start, and complaints damage the sending domain far more than a lost reply does.

Will this get my domain blacklisted?

Not if the agent is answering people who wrote to you. It can if you point it at a purchased list. Send from a dedicated subdomain, authenticate it, keep cold volume low and specific, and suppress on the first negative signal.

Can the agent book the meeting itself?

It can propose times, confirm, and record the outcome in the thread. Creating the calendar event is a job for your own calendar tool, which the agent calls alongside the email tools. See [scheduling agents](/for/scheduling-agents).

An AI agent for lead follow-up email that does not become spam

Inbound leads decay fast. The demo request that gets an answer in five minutes converts several times better than the one answered the next morning, and most teams answer the next morning because the person who answers is asleep, in a meeting, or working the pipeline they already have. An agent on the inbox closes that gap. What it must not do is turn into a cold outreach machine, which is the version of this idea that gets domains blocked.

25 July 2026 6 min read

An agent replying to an inbound demo request within seconds — Inbound first. The reply is invited, which is what makes it both effective and safe to send.

Start with inbound, not outbound

Every good sales agent project starts on the side of the funnel where the prospect wrote first: form fills, demo requests, pricing questions, referrals, replies to a human's sequence. These are invited messages, so they deliver, they get opened, and they carry no unsolicited-contact risk.

Cold outreach is the opposite on all three counts, and it is why MCPmailer treats the two differently at the API. Replies to existing threads pass straight through. First contact with a new address carries an unsubscribe link, draws down the same daily allowance, and is watched by the duplicate-content and velocity tripwires. The reasoning behind that split is in keeping an autonomous agent from becoming a spam problem.

The first reply is a qualification, not a pitch

The job of message one is to be useful in under sixty seconds of the reader's time and to learn one thing you need. A good first reply answers the actual question, offers two concrete meeting times, and asks a single qualifying question. Not five. One.

send_email {
  to: ["lead@prospect.io"],
  subject: "Re: Demo request",
  body: "Yes, we support SSO on the Business plan, and SCIM is included.\n\nWould Tuesday 10:00 or Wednesday 14:00 work for a 30 minute walkthrough?\n\nOne thing so I can tailor it: roughly how many seats are you sizing for?"
}

Three things are happening there. The question is answered, so the reply has value even if the meeting never happens. The times are specific, because "let me know what works" puts the work on the prospect. And the qualifying question is one they can answer in four words.

What the agent needs to know before it writes

An agent writing from a blank context sounds like a form letter. Two tool calls fix that.

lookup_contact returns what the workspace already knows about this address: previous conversations, the company, anything a colleague or an earlier run recorded with remember_about_contact. search_inbox finds prior threads with the domain, which is how the agent notices that someone else at the same company is already in a conversation with your team. Sending a fresh pitch into that situation is the classic embarrassment, and it is entirely avoidable.

Before writing	Tool	What it prevents
Who is this	`lookup_contact`	Asking for information you already hold
Have we spoken to this company	`search_inbox`	Two reps, or a rep and an agent, pitching in parallel
What did they ask	`get_thread`	Answering the subject line instead of the message
What did we promise	`read_note`	Contradicting a commitment made in another channel

Contacts, notes, and the vault are covered in contacts, notes, and vault, and the full tool list is in the reference.

Multi-turn without a scheduler

Most sales threads are three to six messages over several days, which does not fit inside one agent run. wait_for_reply holds the conversation server-side and returns when the prospect answers or the timeout expires, so you do not need a cron job waking the agent up to check for mail.

send_email { to: ["lead@prospect.io"], subject: "Demo times", body: "..." }
wait_for_reply { thread_id: "thr_...", timeout_seconds: 172800 }
reply_all { message_id: "msg_...", body: "Booked for Tuesday at 10:00. Invite sent." }

The timeout is a design decision, not a default. Two days is reasonable for a warm inbound lead. When it expires, the right move is usually one follow-up and then silence, which brings us to the part most teams get wrong.

Follow-up cadence, and when to stop

A follow-up to someone who wrote to you is fair. Four follow-ups to someone who wrote to you once and lost interest is a complaint waiting to happen, and complaints are what actually damage a sending domain.

One follow-up after two days of silence, adding something new: a relevant case, a specific answer, a shorter meeting option.
A second and final one a week later, explicitly closing the loop: "I will assume the timing is wrong and stop here, reply any time."
Then stop. Permanently, unless they write back.
Never follow up on a thread a human has taken over.
Suppress on any negative signal, including a soft one like "not right now."

A thread showing an initial reply, one follow-up, and a clean close — Two touches, then silence. The third touch converts almost nobody and costs reputation.

Handing over to a human at the right moment

The agent should hand over the second the conversation gets real: pricing negotiation, security review, a request for a custom contract, or anyone using the word "procurement." Because the whole conversation lives in a real mailbox, handover is a person opening the thread and replying as themselves, with every message of context already in front of them. There is no CRM note to write and nothing for the prospect to repeat.

Set the boundary explicitly in the prompt, and make the tempting actions impossible rather than discouraged. If the agent cannot issue a discount because it has no tool that issues discounts, it will not issue one.

The compliance floor for anything cold

If you do send first contact, and there are legitimate reasons to, the rules are not optional and they are not new. In the US, CAN-SPAM requires accurate headers and subject lines, a physical postal address, and a working opt-out that you honour promptly. In the EU and UK, GDPR and PECR require a lawful basis, which for business email usually means legitimate interest that you can actually justify, plus the same opt-out. Canada's CASL is stricter still and effectively requires consent.

None of that is legal advice, and all of it is easier to satisfy when volumes are small and targeting is specific, which is the same shape that makes cold mail work at all. Combine it with proper authentication on the sending subdomain, covered in deliverability for agent senders, and you are on the right side of both the law and the spam filter.

What good looks like after a month

Median time to first response measured in seconds, not hours.
Every inbound thread answered, including the ones a busy rep would have skipped.
Meetings booked from threads a human never touched until the meeting.
Cold volume low, specific, and reviewed, with quota left over.
Complaint rate at zero, because nobody is being contacted who did not ask.

The full picture of the sales use case, including what the dashboard shows a manager, is on the sales agents page. If you would rather start on the support side, where the volume is higher and the risk is lower, see building an agent that answers support email.

Questions

Can an AI agent follow up on sales leads by email?: Yes, and inbound follow-up is the strongest version of the use case: the prospect wrote first, so the reply is invited, delivers well, and gets read. Cold outreach is a different activity with legal and deliverability constraints, and should be metered, reviewed, and always carry an unsubscribe.
How fast can an agent respond to an inbound lead?: Seconds. Mail arrives, a message.received webhook fires, and the agent reads the thread and replies. The practical limit is your own model latency, not the mail path.
How many follow-ups should an AI agent send?: Two at most on an inbound thread, then stop. The third touch converts almost nobody and is where complaints start, and complaints damage the sending domain far more than a lost reply does.
Will this get my domain blacklisted?: Not if the agent is answering people who wrote to you. It can if you point it at a purchased list. Send from a dedicated subdomain, authenticate it, keep cold volume low and specific, and suppress on the first negative signal.
Can the agent book the meeting itself?: It can propose times, confirm, and record the outcome in the thread. Creating the calendar event is a job for your own calendar tool, which the agent calls alongside the email tools. See scheduling agents.

Give your agent an address it can answer from.

Create an inbox