Sending domains and mailboxes

Treat the sending setup as a boundary around reputation. Spread cold volume across several domains and mailboxes, and make each sending path prove who may send before increasing volume.¹ A fully authenticated domain still needs to build sending reputation gradually.² Authentication and warm-up are separate problems that both need solving.³ Do the identity checks before the reputation work: DNS proves identity, and reputation work earns continued delivery.

Set up the sending boundary

Start with the domain boundary, then assign the mailboxes that will send cold email inside it. Give outreach its own place to absorb reputation damage while normal business mail stays protected.

Use dedicated sending domains so a deliverability problem stays away from the primary domain's reputation.⁴ A campaign that goes wrong damages the sending subdomain's reputation.⁵ A subdomain inherits some of the apex domain's age signal while starting with a fresh sending track record.⁶ Subdomains can have their own DKIM keys and DMARC policies, and they can be retired if their reputation becomes unrecoverable.⁷

The primary domain carries the website's search authority, the team's daily email, and transactional messages.⁸ Keep those functions separate from cold outreach because cold outreach generates spam complaints at some baseline rate.⁹

Before you configure anything, answer these questions:

• Which domain will carry cold email?
• Which mailboxes will send from it?
• Which mailboxes or services must stay on the primary domain?
• What is your plan if the sending domain needs to be retired?

Inventory every sender

Build the sender inventory before you edit DNS. This keeps a legitimate system from appearing later as an authentication failure.

List every service that sends email claiming to be from the domain before you touch SPF.¹⁰ Authorize each service in SPF and, where possible, have it sign with DKIM.¹¹ Missing a sending service can make its legitimate mail fail DMARC when you enable it.¹²

Cold email setups often combine a sending platform, a warm-up service, and sometimes a CRM integration. Each can add an include statement to the SPF record.¹³ Record the services, their sending domains, and whether each one still needs access before you publish the final record.

Ask:

• Which systems send as this domain today?
• Which systems will send cold email?
• Which services have stopped sending and can be removed?
• Which services provide DKIM signing?
• How many SPF lookups will the complete setup use?

Authenticate in order

SPF includes every approved

DKIM signing is active

DMARC has a published

The authenticated domain matches

• SPF includes every approved
• DKIM signing is active
• DMARC has a published
• The authenticated domain matches

Handle authentication as a sequence. Finish each record's job before moving to the next one, then test the complete chain.

Configure SPF, then DKIM, then DMARC.¹⁴ Doing these records in the wrong order is the most common reason an apparently correct setup fails.¹⁵

SPF is a single TXT record on the sending domain.¹⁶ Its version identifier is v=spf1.¹⁷ DKIM adds a cryptographic signature to outgoing messages, which receivers verify against a public key published in DNS.¹⁸ DMARC tells receiving servers what to do when SPF or DKIM fail and reports who is sending mail as the domain.¹⁹ It also requires alignment with SPF or DKIM before applying the published policy when both fail.²⁰

Check the records in work order:

• SPF includes every approved sender.
• DKIM signing is active for the sending domain.
• DMARC has a published policy and a reporting destination.
• The authenticated domain matches the domain used by the sending mailboxes.

Move on when the records agree with the sender inventory. A green result for one record does not settle the others.

Control the tracking domain

Tracking creates another reputation path inside the email setup. Audit it whenever click or open tracking is enabled.

A default tracking domain is shared with every other sender on the same platform.²¹ That means senders share its reputation.²² When another sender is flagged, blacklisted, or burned by a spam filter, the tracking domain's reputation takes a hit, and links pointing to it can reduce your deliverability.^{23, 24}

Use a custom tracking domain to fix this and keep the path under your control.²⁵ When click or open tracking is enabled, the sending tool rewrites every link in the email.²⁶ With a custom tracking domain, the open tracking pixel appears to come from your domain.²⁷

Before launch, inspect a test message and ask:

• What domain appears in each rewritten link?
• Is that domain dedicated to your sending setup?
• Does the open tracking pixel use the same controlled domain?
• What happens to tracking if the sending domain is retired?

Run reputation work separately

Once the domain and tracking paths are configured, handle reputation building as separate work. Keep the ramp gradual and change volume only after the sending domain has had time to establish a track record.

Use the handoff between setup and sending as a gate. Confirm that the domain boundary is clear, every sender is accounted for, SPF, DKIM, and DMARC are in the required order, and the tracking domain is controlled. Then begin the warm-up work before increasing cold volume.

Watch for failures by path. A DNS failure points you back to the sender inventory or authentication records. A problem with rewritten links points to the tracking domain. A reputation problem after those checks points to the sending domain or mailbox allocation. This keeps you from changing several parts of the setup at once.

What not to do

Avoid these mistakes because each one removes a layer of separation or makes the result harder to diagnose.

• Do not send cold email from the primary business domain.²⁸
• Do not skip SPF, DKIM, or DMARC, because omitting any of them leaves a real gap in the authentication setup.²⁹
• Do not let the SPF record exceed ten lookups, because it can fail entirely and silently.³⁰