Cold Email Domain Setup: The Exact DNS, Mailbox, and Redirect Configuration We Use

Cold email delivery can suffer before the copy is read when domain setup is wrong. Authentication, mailbox limits, redirects, and warmup all affect whether a message reaches the inbox; diagnose actual failures across domain reputation, sending behaviour and message content.

The short answer: never send from your root domain. Configure all three DNS authentication records, redirect each sending domain to your main site, and warm every mailbox before emailing a real prospect.

Why Sending Domains Are Separate From Your Main Domain

Your root domain (yourcompany.com) is tied to your product emails, password resets, invoices, and customer communications. One spam complaint that triggers a blocklist can silence all of those overnight.

Sending domains can separate some operational risk. You register variations (yourbrand-outreach.com, yourbrandco.com, yourbrand-hq.com) and point each one back to your website with a simple HTTP redirect. Prospects who check the URL see your real site. Receiving servers see a domain with a clean history, but this does not guarantee that your root domain is untouched; monitor every domain independently.

Warmup is not optional. Skipping it is the fastest way to burn a domain you spent three weeks configuring.

A sensible ratio at scale is one domain for every three mailboxes, spread across multiple providers. At five hundred emails per day, that means roughly eight to ten domains and fifteen to twenty mailboxes. Do not put twenty addresses on one domain.

The Three DNS Records You Cannot Skip

Every sending domain needs these three records before a single email goes out.

SPF (Sender Policy Framework) is a TXT record on your domain that lists which mail servers are allowed to send on its behalf. A typical SPF record for Google Workspace looks like v=spf1 include:_spf.google.com ~all. Your sending tool will provide the exact value. If you have multiple providers, include each one, but keep the lookup count under ten or SPF will fail silently.

DKIM (DomainKeys Identified Mail) is a cryptographic signature. Your sending platform generates a public and private key pair. You publish the public key as a TXT record under a specific selector subdomain (for example google._domainkey.yourdomain.com). Every outgoing message is signed with the private key. Receiving servers verify the signature against your public record. A mismatch or missing record is an immediate deliverability penalty.

DMARC is the policy that ties SPF and DKIM together and tells receiving servers what to do when either check fails. Start with v=DMARC1; p=none; rua=mailto:reports@yourdomain.com to collect reports without rejecting mail, then tighten to p=quarantine or p=reject once you confirm both SPF and DKIM are passing cleanly. Google and Yahoo now enforce DMARC for bulk senders, so this is no longer optional. Google’s official sender guidelines at support.google.com cover the current requirements.

Mailbox Configuration and Provider Choice

Once DNS is clean, you provision mailboxes. Standard configuration:

• Two to three mailboxes per sending domain
• A real first and last name as the display name, not a generic “Sales Team” label
• A reply-to address that points to a monitored inbox
• Sending volume within the limits. Most tools cap each mailbox at thirty to fifty emails per day during warmup, then eighty to one hundred twenty at full volume

Google Workspace and Microsoft 365 are the two default providers. Microsoft inboxes often get slightly better placement when sending to Outlook, Hotmail, and corporate Exchange addresses. That matters because a large share of business email runs on Microsoft infrastructure. Split domains across both providers so a policy change at one does not take down the whole setup.

In a managed done-for-you cold email setup, provider selection and domain provisioning are usually part of onboarding. DNS verification finishes before any sequence goes live.

Warmup: The Step Most Teams Skip

A new mailbox with zero sending history looks suspicious to receiving servers. Warmup builds a reputation gradually by sending small volumes of mail that get opened and replied to.

Start at ten to twenty emails per day in week one. Increase volume by ten to twenty percent every two to three days, and run warmup tool traffic alongside real sends. Most sending platforms include this. By week three to four, a well-warmed mailbox can handle sixty to one hundred emails per day without triggering filters.

What kills warmup:

• Sending a campaign before warmup finishes
• Identical copy across all mailboxes on day one
• No real engagement signals during the warmup period

Infrastructure problems spread quickly as volume grows. With the outbound engine builder model, configuration, warmup, and launch are handled before you write a line of copy. A done-with-you outbound engagement builds the system inside your accounts so your team can own the stack afterward.

Connecting Infrastructure to Copy and Deliverability

A clean domain does not rescue bad email. High unsubscribe rates, spam complaints, and low engagement damage sending reputation even when the technical setup is correct.

Three things protect deliverability over time: copy that does not read like a template, suppression lists that remove unsubscribes and bounces immediately, and sending volume that stays within the limits earned during warmup.

Once the infrastructure is solid, our guide on cold email that avoids spam filters covers copy and timing. If you are deciding between an internal build and an external operator, the managed outbound service page shows what the managed setup includes.

Domain setup is not creative, and there is no shortcut. It is also where most campaigns fail before they start.