Cold email domain setup: SPF, DKIM, and DMARC done right

Why you never send cold email from your primary domain

Rule one: your main company domain sends invoices, contracts, and password resets. It never sends cold outreach. If a cold campaign torches your reputation, you do not want that fire spreading to the domain your business runs on.

Instead you buy secondary sending domains. These are close variants of your brand, usually a .com, .co, or getbrand/trybrand style pattern, that exist only to send outbound. If one gets flagged, you rotate it out and your primary domain never feels it. Think of them as disposable by design.

Here is my quotable line: I treat every cold email domain as a burner I hope I never have to burn.

How many domains and inboxes do I actually need?

Work backwards from your monthly send volume. The math I use is deliberately conservative:

• 2 to 3 inboxes per domain. More than that starts to look like a spam farm to the mailbox providers.

• Roughly 30 to 40 emails per inbox per day once fully warmed. I do not push past this, and I explain why below.

• So one domain with 3 inboxes gives you around 90 to 120 sends a day, or roughly 2,000 to 2,600 a month.

If you need to reach 500 new prospects a week, you need enough domains and inboxes to cover that at 30 to 40 per inbox, not by cranking one inbox to 200. Spread the load. Redundancy is the point, not efficiency.

The DNS records that decide everything

Three records do the heavy lifting: SPF, DKIM, and DMARC. Mailbox providers use them to answer one question, "is this sender who they claim to be?" Get any one wrong and you are gambling with the spam folder.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a TXT record on your sending domain listing which servers are authorized to send on its behalf. Conceptually it looks like:

v=spf1 include:_spf.yoursendingprovider.com ~all

Two things I check every time. First, only include the providers you actually send through. Second, watch the 10 DNS lookup limit. Chaining too many include statements silently breaks SPF, and a broken SPF record is worse than a strict one.

DKIM: proof the message was not tampered with

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message using a private key, and publishes the matching public key as a TXT record at a selector subdomain, for example selector._domainkey.yoursendingdomain.com. Your sending platform generates the key pair. Your job is to publish the public half exactly as given, no truncation, no extra spaces. A single mangled character means DKIM fails and your authentication story falls apart.

DMARC: the policy that ties it together

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when SPF or DKIM fails, and where to send reports. A starter record looks like:

v=DMARC1; p=none; rua=mailto:dmarc@yoursendingdomain.com

DMARC is now expected for bulk senders. In 2026 the guidance is clear that p=none is an acceptable starting point, but you should progress toward quarantine or reject as you build confidence (MarTech / redsift, 2026). I start every new domain at p=none with reporting on, read the reports for a couple of weeks, then tighten the policy. Starting at reject on day one is how you accidentally block your own legitimate mail.

For the deeper mechanics of alignment and reputation, I go into more detail in our guide on cold email deliverability 2026.

Warmup: earn the reputation before you spend it

A brand new domain has no sending history, which to a mailbox provider is indistinguishable from a threat. Warmup is how you build a track record before you send a single real prospect anything.

The mechanics are simple even if the patience is hard:

1. Turn on automated warmup the moment inboxes are created. Warmup tools exchange low volumes of email that get opened and marked important, simulating real engagement.

2. Wait 3 to 4 weeks minimum before you send real campaigns. There is no shortcut here. I have never regretted waiting longer.

3. Ramp gradually. Start real sends at a trickle, maybe 10 to 15 a day per inbox, and climb toward your 30 to 40 ceiling over one to two weeks.

4. Keep warmup running in the background even after launch. It cushions your reputation on the days you send heavier.

Skipping warmup is the most common self-inflicted wound I see. The domain looks fine, the records validate, and then the first campaign lands in spam because the domain has zero history.

Sending limits and the metrics that get you shut off

Once you are live, discipline on volume and complaints is what keeps you alive.

Hold your daily limits

I keep each fully warmed inbox at 30 to 40 sends per day. Could a warmed inbox technically send more? Sometimes. But the goal is a durable domain, not a record-breaking Tuesday. Consistency reads as human. Spikes read as a bot.

Watch your spam complaint rate like a hawk

This is the number that will end you fastest. Keep spam complaints below 0.10%. At 0.30% or above, a domain becomes ineligible for Gmail delivery mitigation for 7 days even after you fix the underlying problem (PowerDMARC, 2026). That is a full week of dead sending, which for most outbound programs is catastrophic. Low complaints come from tight targeting and an easy opt out, not from clever copy.

The payoff for doing this right

None of this is busywork. Senders with compliant authentication and clean hygiene see roughly 89% inbox placement, versus just 22 to 34% landing in spam for non-compliant senders (Revnu, 2026). That gap is the entire game. The difference between a campaign that works and one that quietly vanishes is almost always infrastructure, not messaging.

My end-to-end setup checklist

Here is the sequence I run, in order, for every new sending operation:

1. Buy secondary sending domains, never the primary.

2. Create 2 to 3 inboxes per domain, real human names.

3. Set up SPF, DKIM, and DMARC on each domain, validating every record.

4. Start DMARC at p=none with reporting, plan to tighten later.

5. Turn on warmup immediately and leave it running.

6. Wait 3 to 4 weeks before any real send.

7. Ramp real volume gradually toward 30 to 40 per inbox per day.

8. Monitor spam complaints daily, keep them under 0.10%.

9. Rotate any domain that starts degrading, protect the pool.

Once the plumbing is solid, the rest of your stack has something to stand on. If you want to see how this fits into the broader tooling, our cold outreach automation stack walks through the layers that sit on top.

If you would rather have this whole stack stood up and monitored for you instead of managing DNS records and warmup schedules yourself, book a call and we will handle the plumbing.