Sending domains and mailboxes

Build cold email on a sending surface you can isolate, authenticate, and retire without touching the business's normal mail. Keep the primary domain out of cold volume so a deliverability problem stays away from its reputation.¹ Correct DNS records do not earn sending reputation for you. Authentication and warm-up are separate problems that both need solving.² Set the boundary, inventory every sender, publish records in order, check tracking, then add mailboxes and volume.

Choose the sending boundary

Decide where the risk can live before changing a record, and choose the boundary before connecting mailboxes.

Keep the primary domain out of cold volume so its normal reputation has separate protection.¹ Use a subdomain for cold email and keep the apex out of that traffic.³ A subdomain can have its own DKIM keys and DMARC policy, and you can retire it if its reputation becomes unrecoverable.⁴

Choose the sending domain or subdomain, decide which mailboxes will use it, and write down that boundary before connecting a sending service. Keep any mailbox used for ordinary business communication outside the cold sending setup.

Inventory every sender

DNS changes are safe only when you know every sender that will depend on them. Confirm access to the domain's DNS and identify the services that send on its behalf.

You can begin once you have DNS access and know which services send email for the domain.⁵ Before editing SPF, list every service that sends email claiming to be from the domain.⁶ Authorize each service in SPF and have it sign with DKIM where possible.⁷

Keep the list beside the DNS record while you configure it. Include the sending service, any service used for warm-up, and any other system that sends mail under the same domain. Move to authentication only when the list is complete.

Publish authentication in order

Handle authentication as a handoff, checking each record before adding the next. Use the sequence SPF, DKIM, DMARC.⁸

SPF tells receiving servers which mail servers may send for the domain.⁹ Use v=spf1 as the SPF version identifier.¹⁰ Keep the authorized services from your inventory in that record.

DKIM adds a cryptographic signature to outgoing messages, which receivers verify against the public key published in DNS.¹¹ Configure the signing service and confirm that the public key is visible before moving on.

DMARC sets the policy receivers should follow when SPF or DKIM fail and reports who is sending mail as the domain.¹² Publish the policy and reporting destination your setup requires, then inspect the result from a controlled test message.

At each handoff, check the DNS record and send a test message. Move forward when the record is present and the test passes. This gives you a clear point to find a missing or malformed record before cold volume is involved.

Check the tracking domain

Tracking creates a second reputation surface, so inspect it before launching links. Check an actual sent message so you can see the domain used in the redirect.

The default tracking domain is shared with every other sender on its platform.¹³ If that shared domain is damaged, links pointing to it can reduce your deliverability.¹⁴ When click or open tracking is enabled, the sending tool rewrites every link in the email.¹⁵

Use a custom tracking domain when tracking is part of the setup. A custom tracking domain fixes the shared domain problem.¹⁶ Inspect the rewritten URL before moving on. If it still points to a shared domain, stop and correct the tracking configuration before adding mailboxes or volume.

Add mailboxes and build reputation

Assign mailboxes only after the domain boundary and authentication are clear. Use this step to spread exposure across the sending setup, then control how quickly each part takes on volume.

Spread cold email volume across several domains and mailboxes so no single domain carries all of it.¹⁷ A fully authenticated domain still needs to build sending reputation gradually before volume rises.¹⁸ Treat completed authentication as permission to test sending, not permission to raise volume without a gradual build.

Start with a distribution you can monitor. Increase volume only after each sending surface has had time to establish its sending track record.

What not to do

Use these as hard stops during setup. Fix any one that appears before adding volume.

• Do not treat SPF, DKIM, and DMARC as interchangeable. Putting them in the wrong order is the most common reason an apparently correct setup fails.¹⁹
• Do not leave a sending service out of the authorization list, because legitimate mail can fail DMARC once DMARC is enabled.²⁰
• Do not let the SPF record exceed ten lookups. After that, the record fails entirely and silently.²¹
• Do not send cold email without the necessary precautions. The domain's reputation can suffer enough to affect regular mail to colleagues and existing customers.²²

Run this sequence for every sending domain before it enters a campaign. Keep the boundary intact as volume and tracking change, and treat a failed check as a stop signal.