How to set up cold email: domains, mailboxes and DNS

Most cold email problems start before anyone writes a word. A campaign that goes to spam usually does so because of how it was set up, not what it said. The good news is that the setup is the same for almost everyone, and it takes an afternoon. Here is the order I do it in.

1. Never send from your main domain

Your company's main domain carries your normal business email: invoices, customer replies, password resets. If cold email damages its reputation, all of that starts landing in spam too. So cold email goes out from separate domains that look like your brand, such as getacme.com or acmehq.com, each pointing to your main website.

Stick to .com where you can, avoid hyphens and numbers, and buy domains a few weeks before you need them. A domain that is a day old and already sending a lot looks exactly like what spammers do. You can check any domain's age with our domain age checker.

2. Work out how many mailboxes you need

Inbox providers watch how much each mailbox sends. A person sends a few dozen emails a day; a bulk sender sends thousands. So cold email at volume is spread across many mailboxes, each sending about 30 cold emails a day, with no more than three mailboxes per domain.

The maths is simple. If you want to reach 2,500 new people a month with four emails each, that is 10,000 emails. Over about 20 working days that is 500 a day, or roughly 17 mailboxes on 6 domains. Our mailbox calculator does it for any goal.

3. Use real mailboxes

Google Workspace and Microsoft 365 mailboxes are what businesses use, so email from them looks normal to filters. Each mailbox should belong to a real-sounding person, with a name, a photo and a signature. Set up reply handling too: people reply to cold email, and a mailbox nobody reads wastes your best leads.

4. Publish SPF, DKIM and DMARC

These three DNS records prove your email is really from you. Since 2024 Gmail and Yahoo require them from anyone sending in volume, and in practice cold email without them rarely reaches the inbox.

• SPF lists the servers allowed to send as your domain. For Google Workspace it includes _spf.google.com. Only one SPF record per domain. Build one with our SPF generator.
• DKIM signs every email so receivers can check it wasn't changed. Turn it on in your mail provider and publish the key it gives you. Check it with the DKIM checker.
• DMARC tells receivers what to do when an email fails and sends you reports. Start with p=none and a report address. Make one with the DMARC generator.

Add an MX record as well, so replies have somewhere to go. Then run the domain health checker on every domain: it checks all of the above plus blocklists in one go.

5. Warm up every mailbox

A new mailbox has no history, and a mailbox with no history that suddenly sends hundreds of emails gets filtered. Warm-up fixes that by sending a small, growing number of emails between real mailboxes that open them and reply. Give each mailbox about two weeks of warm-up before it sends any campaign, then build campaign volume over another week. I wrote about this in detail in email warm-up explained.

6. Prepare a clean list

While the mailboxes warm up, build and verify your list. Bounces are one of the quickest ways to damage a new domain, so keep them under 2% by verifying every address before it goes into a campaign. More on that in how to build a B2B lead list that doesn't bounce.

A checklist to keep

1. Separate sending domains, a few weeks old, pointing to your main site.
2. Around 30 cold emails a day per mailbox, three mailboxes per domain.
3. Real Google Workspace or Microsoft 365 mailboxes with names and signatures.
4. SPF, DKIM, DMARC and MX on every domain, checked.
5. Two weeks of warm-up before the first campaign.
6. A verified list with bounces expected under 2%.

If you'd rather not do the setup yourself, mailzy sells Google Workspace mailboxes for $4 a month each: we set up the domains' records, create the mailboxes within 48 hours and warm them up. See mailboxes.