The checklist
Everything below, compressed. If you can tick all ten, your infrastructure is ready to send.
- Cold email never leaves your main domain
- Three .com sending domains bought, each 301 redirecting to your site
- SPF record on every sending domain
- DKIM enabled with a 2048 bit key
- DMARC published, starting at p=none with reports, tightened after two weeks
- Maximum two mailboxes per domain
- Every mailbox warmed for at least three weeks before the first real send
- Daily volume capped at 20 to 30 emails per mailbox
- Every address validated before it enters a campaign
- Inbox placement tested before launch and monitored weekly
Rule zero: the main domain never sends
Deliverability is reputation, and reputation is attached to domains. The one unrecoverable mistake in cold email is spending your primary domain's reputation on outbound experiments. If a sending domain gets flagged you replace it for the price of a pizza. If your main domain lands on blocklists, your invoices, proposals and support replies start going to spam. This is one of the three reasons cold email stopped working for most teams.
Buy three variants of your name on .com. Exotic endings like .xyz or .site carry extra spam weight from years of abuse, and the few dollars saved are not worth the placement hit. Each variant gets a 301 redirect to your real site, so a curious prospect who types the domain lands somewhere true.
DNS: the three records that decide your fate
Mail providers check three DNS records to decide whether you are who you claim to be. Missing any of them in 2026 means the spam folder by default. All three go into the DNS panel of each sending domain.
SPF lists the servers allowed to send for your domain. For Google Workspace:
DKIM signs every message cryptographically. Generate the key in your provider's admin panel with 2048 bit length, then publish the record it gives you:
DMARC tells receivers what to do when SPF or DKIM fail, and sends you reports about who is sending as you. Start in monitoring mode:
After two weeks of clean reports, tighten the policy to p=quarantine. Add a custom tracking domain in your sequencer at the same time, so click tracking runs on your domain instead of a shared one you do not control. Both Google and Microsoft publish sender requirements worth following to the letter.
Mailboxes: two per domain, no more
More mailboxes per domain does not mean more volume. It means the domain's reputation is divided across more senders and a single bad mailbox drags down its siblings. Two mailboxes per sending domain is the durable pattern: first name and first name plus surname, both with a real photo, signature and a filled profile.
Google Workspace is the default choice for quality: its outbound reputation is the strongest in the market. Consider a specialised provider only at real scale or when your targets live deep in Microsoft country, where Outlook placement needs dedicated infrastructure.
Warmup: three weeks you cannot skip
A fresh mailbox that starts sending 30 cold emails on day one looks exactly like a spammer, because that is exactly what spammers do. Warmup services exchange real looking mail between real inboxes, building a history of sends, opens and replies that mail providers can see.
Three weeks is the floor, four is comfortable. Volume ramps automatically from a handful of messages to a few dozen per day. The warmup keeps running at a low level even after campaigns start. Skipping this step is the single most common way founders burn their first set of domains, usually in under ten days.
Volume and hygiene: stay under the radar on purpose
Cap every mailbox at 20 to 30 cold emails per day, spread over the working hours of the recipient's timezone. Six warmed mailboxes give you 120 to 180 sends a day, which is more than enough when targeting is signal based. If your reply rate depends on sending more than that, the problem is the list, not the limit.
Every address gets validated before it enters a campaign, no exceptions. Catch-all and unverifiable addresses are excluded or routed to a separate low-volume campaign. A bounce rate above two percent is not a statistic, it is an alarm.
Monitoring: placement is a metric, not a feeling
Before the first campaign, run an inbox placement test: send to a seed list of addresses across Gmail, Outlook and privacy focused providers and record where each message lands. Repeat weekly during campaigns. Watch three signals: placement rate, bounce rate and DMARC reports listing senders you do not recognise.
When placement dips, stop volume first and diagnose second. A paused campaign costs a week. A burned domain costs a month.
Five mistakes that burn domains
- Sending from the main domain
The unrecoverable one. Everything else on this list can be fixed with money and patience. This one follows your brand around.
- Full volume on day one
Reputation is history, and a new domain has none. Ramping from zero to hundreds of sends in a week is a flag no copy can fix.
- Mass AI personalisation
A thousand emails written by one model converge on patterns filters can cluster. Volume plus sameness reads as spam because statistically it is.
- Unvalidated lists
Bounces are the loudest reputation signal there is. A bought list with five percent bad addresses undoes a month of warmup in an afternoon.
- Ignoring the early warnings
Placement dropping, bounces creeping, replies going quiet. Every burned domain announced itself first. Nobody was watching.
What good looks like
| Metric | Target |
|---|---|
| Warmup before first send | 21 days minimum |
| Inbox placement | above 90 percent |
| Bounce rate | under 2 percent |
| Spam complaints | under 0.1 percent |
| Daily volume per mailbox | 20 to 30 |
| Reply rate, signal based targeting | 8 to 15 percent |
| Reply rate, stacked signals | 15 to 25 percent |
| Infrastructure cost, 3 domains and 6 mailboxes | about $80 per month plus your sequencer |
Those reply rates are not a promise of this playbook. They are what engineered targeting achieves on top of this foundation. The foundation just stops you from losing before the game starts.