Cold Email Deliverability: Secondary Domains, SPF/DKIM/DMARC, Warm-Up and List Hygiene

Cold email lives or dies on one question that has nothing to do with your copywriting: does your message actually land in the inbox? You can write the most thoughtful, relevant, perfectly personalised email in the world, but if it arrives in the spam folder, your reply rate is zero. Deliverability is the foundation everything else sits on, and it is the part most beginners skip because it feels technical and invisible.

The good news is that deliverability is not a dark art. Mailbox providers like Google and Microsoft publish exactly what they expect from senders, and almost all of it boils down to one principle: behave like a legitimate business emailing people who plausibly want to hear from you. This guide covers the infrastructure side of that promise — secondary domains, authentication records, warm-up, sending volume, and list hygiene — so that your outreach is built on solid ground before you send a single message.

One framing note before we start. Everything here is about genuinely being a good sender, not about evading spam filters. Filters exist to protect inboxes from abuse, and they are very good at their job. If your strategy depends on tricking them, you have already lost — usually within weeks. If your strategy is to send relevant, honest, low-volume email from properly configured infrastructure, the filters mostly leave you alone, because you are exactly the kind of sender they are designed to let through.

Why You Should Never Send Cold Email From Your Main Domain

The single most important infrastructure decision in cold outreach is this: do not send cold email from your primary company domain. Your main domain carries the reputation that governs whether your invoices, password resets, support replies, and internal mail reach their destinations. Cold outreach — even careful, compliant, well-targeted outreach — carries inherent reputation risk. Some recipients will mark unsolicited mail as spam no matter how relevant it is. A small number of those complaints is survivable for a dedicated outreach domain; it is a genuine business problem if it degrades the domain your operations depend on.

The standard practice is to buy one or more secondary domains used exclusively for outreach. These are often close variants of your brand: if your company runs on acmeanalytics.com, you might send from acmeanalytics.io, tryacmeanalytics.com, or acme-analytics.com. This isolates risk: if an outreach domain's reputation suffers, you can pause it, fix your process, and let it recover — or in the worst case retire it — without touching your core email.

Choosing a good secondary domain

Stay recognisably you. The variant should be obviously connected to your real brand. This is both an ethical requirement and a practical one: recipients who look you up should immediately find your real company. A domain that hides who you are is deceptive, and deception is illegal under CAN-SPAM and toxic to reply rates besides.
Prefer mainstream TLDs. .com, .co, .io, and .net variants are fine choices. Bargain-bin TLDs that cost a dollar or two are heavily used by actual spammers, and while a TLD alone will not doom you, starting from a neighbourhood with a bad reputation makes everything harder.
Check the domain's history. Before buying, look the domain up in the Wayback Machine and search for it in blocklist lookup tools. An aged domain with a clean history can be an asset; a domain that previously hosted spam or scams inherits its baggage.
Redirect it to your real site. A secondary domain should not resolve to a blank page. Set up a redirect to your main website (or a simple landing page identifying your company) so anyone who checks the domain sees a real business.

The gotcha: many founders register a lookalike domain, point it at nothing, and start sending the same day. A brand-new domain with no site, no history, and sudden outbound volume matches the exact profile of a throwaway spam domain, and mailbox providers treat it accordingly. Register your outreach domains well before you need them — ideally weeks or months early — set up the redirect immediately, and let them age with proper DNS in place before the first campaign.

A second, related trap: do not register a lookalike of someone else's brand, and be careful that your own variant cannot be read as impersonating another company. Sending from a domain confusingly similar to a third party's trademark is a fast route to legal complaints and abuse reports. Lookalikes of your own brand only.

SPF, DKIM, and DMARC: Non-Negotiable Authentication

Email authentication is how you prove to receiving servers that mail claiming to come from your domain actually does. Since 2024, Google and Yahoo have formally required authentication from senders — this is not optional hardening, it is table stakes. Unauthenticated mail is increasingly rejected outright or filed as spam by default.

SPF (Sender Policy Framework)

SPF is a DNS TXT record listing which servers are allowed to send mail on behalf of your domain. If you send through Google Workspace, your record looks like v=spf1 include:_spf.google.com ~all. Every sending service you use must be included. Keep the record tight: only include services that genuinely send for this domain.

Here is the trap most people miss with SPF: the ten-DNS-lookup limit. Each include can trigger further lookups, and once the total exceeds ten, SPF evaluation returns a permanent error and your authentication silently fails. Teams add tool after tool to their SPF record over the years, blow past the limit without noticing, and then wonder why deliverability quietly degraded. Run your record through an SPF validator whenever you change it, and prune services you no longer use.

DKIM (DomainKeys Identified Mail)

DKIM cryptographically signs each outgoing message with a private key; receivers verify the signature against a public key published in your DNS. A valid DKIM signature proves the message was not altered in transit and genuinely originates from your domain. Every reputable email platform (Google Workspace, Microsoft 365, and every serious sending tool) offers DKIM setup — usually generating a key and giving you a DNS record to publish. Use a 2048-bit key where offered, and actually complete the verification step. A surprising number of accounts sit half-configured with DKIM generated but the DNS record never published.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC ties SPF and DKIM together. It tells receivers what to do with mail that fails authentication and — crucially — sends you aggregate reports about who is sending mail claiming to be you. A minimal starting record is v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com. The p=none policy monitors without blocking; once you have confirmed all your legitimate mail passes, tighten to p=quarantine and eventually p=reject.

The gotcha: publishing p=none and never looking at it again. DMARC's alignment requirement means your DKIM signing domain (or SPF domain) must match your From domain. Plenty of sending tools sign with their own domain by default, which passes DKIM in isolation but fails DMARC alignment. If you never read the reports, you never find out. Use a DMARC report parsing service (several have free tiers) rather than trying to read the raw XML, check it for the first few weeks after any infrastructure change, and only tighten your policy once alignment is confirmed clean.

While you are in DNS, set up two more things: a custom tracking domain if your sending tool uses link tracking (so tracked links resolve through your domain rather than a shared one used by thousands of other senders), and an MX record plus mailbox on the outreach domain itself so replies and bounces actually come back to you.

Warm-Up: Earning Reputation Before You Need It

A new domain and new mailbox have no sending reputation. Mailbox providers are deeply suspicious of new senders that go from zero to hundreds of emails a day, because that is what compromised accounts and spam operations look like. Warm-up is the process of building a normal-looking sending history gradually.

Legitimate warm-up looks like this:

Weeks 0–2: Use the mailbox like a human. Send genuine one-to-one emails to colleagues, partners, and existing contacts. Reply to threads. Subscribe to a few newsletters and interact with them.
Weeks 2–4: Begin very low-volume real outreach — perhaps five to ten messages a day per mailbox — to your best-researched, most relevant prospects, where reply likelihood is highest.
Weeks 4–8: Increase gradually, adding volume only while bounce rates stay low and replies keep coming. Roughly doubling weekly capacity is a sane ceiling; slower is fine.

Genuine replies are the strongest positive signal a mailbox provider sees. That is why warming up on your most relevant prospects first is not just a courtesy — it is the mechanism by which the warm-up works.

A note on automated warm-up tools: these services exchange automated emails among a network of mailboxes, opening and replying to each other to simulate engagement. Be aware that Google's terms prohibit this kind of simulated activity, and providers have taken action against warm-up networks. The durable, terms-compliant approach is real human usage and slow volume ramps. If you feel you need artificial engagement to reach the inbox, that is usually a signal your volume ambitions are ahead of your infrastructure or your targeting.

The gotcha: warm-up is not a one-time event. Reputation is a moving average, not a badge you earn once. If a mailbox sits idle for a month and then blasts out a campaign, or if you triple your daily volume overnight because a big list arrived, you can undo months of careful history in days. Treat volume changes the way you treat warm-up: gradual, monitored, and reversible.

Volume Discipline: The Boring Habit That Protects Everything

More email does not mean more meetings. Past a modest threshold, more email means degraded reputation, which means fewer inboxed messages, which means fewer meetings from far more sending. Sustainable cold outreach is a low-volume, high-relevance discipline.

Practical volume guidelines

Keep per-mailbox volume modest. Somewhere in the range of 20–50 cold emails per mailbox per day (including follow-ups) is a widely used ceiling among careful senders. A real human sales rep does not send 300 personal emails a day, and your sending pattern should be plausible as human correspondence.
Scale with mailboxes and domains, not per-mailbox volume. If you legitimately need more capacity, add mailboxes (two or three per domain, no more) and additional secondary domains rather than pushing one address harder. But be honest with yourself: if your model requires thousands of cold emails a day to work, the problem is your targeting, not your infrastructure.
Randomise and space sends. Sending tools can add human-like intervals between messages and restrict sending to business hours in the recipient's time zone. Use those features — not to disguise anything, but because bursty machine-gun sending patterns are both a spam signal and a worse experience for recipients.
Mind Google's bulk-sender thresholds. Providers now enforce complaint-rate expectations, with spam complaint rates above roughly 0.3% treated as a serious problem and below 0.1% as the target. At cold-email volumes, that means even a handful of complaints matters. The way you stay under it is relevance and easy opt-outs, covered below.

Here is the trap most people miss: follow-ups count against your volume. If your sequence has four steps and you add 40 new prospects a day, within two weeks each mailbox is attempting far more than 40 sends daily. Plan your daily new-prospect intake around total sequence volume, not first-touch volume, or your carefully chosen ceiling gets blown through on autopilot.

List Hygiene: Where Most Reputation Damage Actually Comes From

The fastest way to destroy a sending domain is not bad copy — it is a dirty list. Two metrics dominate how providers judge you: hard bounce rate and spam complaint rate. Both are almost entirely determined by list quality before you write a word.

Verify every address before sending

Run every list through an email verification service before it goes anywhere near a campaign. Verification catches invalid addresses, dead domains, and disposable mailboxes. Aim to keep hard bounces under 2% of sends; a bounce rate of 5% or more marks you as someone who sends to scraped or stale data. Remove role addresses (info@, sales@, support@) from cold sequences — they bounce and complain at higher rates and rarely reach a decision-maker anyway.

Handle "catch-all" or "accept-all" domains — where the server accepts mail for any address so verification cannot confirm the mailbox exists — deliberately. Either exclude them, or send to them in small, monitored batches so a cluster of bounces cannot spike your rate in a single day.

The gotcha: verification results expire. People change jobs constantly, and a list verified three months ago has quietly accumulated dead addresses. B2B contact data decays at a rate that surprises everyone the first time they see it. Re-verify any list older than about 30 days before sending to it, every time, even if it "was clean when we bought it."

Suppression lists are a compliance requirement, not a courtesy

Maintain a permanent suppression list containing everyone who has opted out, complained, or asked you to stop — and check every new campaign against it. Under CAN-SPAM you must honour opt-outs promptly (within 10 business days at the outside; in practice, immediately), and under GDPR an objection to direct marketing is absolute — once someone objects, that is the end of the discussion. Your suppression list must survive tool migrations, list imports, and team changes. When you switch sending platforms, migrating the suppression list is the first task, not an afterthought.

Also suppress structurally: exclude existing customers, open deals, and current conversations from cold sequences. Nothing burns goodwill like a customer receiving a "have you heard of us?" email, and nothing says "careless sender" to a mailbox provider like mail that recipients report because it is obviously misdirected.

Targeting is hygiene

The deepest form of list hygiene is only emailing people for whom your message is plausibly relevant to their professional role. This is also the heart of legal compliance outside the US: under GDPR and PECR-style rules in the UK and Europe, B2B outreach generally rests on the "legitimate interests" basis, which requires that your interest in reaching this person is not overridden by theirs — a balance you can only credibly strike when the message relates to their job and you make objecting effortless. A tightly targeted list of 200 relevant people will outperform a scraped list of 5,000, in replies and in reputation, every single time.

Monitoring: Know Your Numbers Before the Inbox Tells You

Deliverability problems announce themselves quietly. Reply rates sag, then bounce alerts trickle in, and by the time it is obvious, the damage is weeks old. Build a small monitoring habit instead:

Google Postmaster Tools. Free, and it shows your domain reputation, spam complaint rate, and authentication pass rates as Google sees them. Set it up for every sending domain on day one.
DMARC reports. As above — they tell you whether authentication is actually passing and whether anyone is spoofing your domain.
Blocklist checks. Periodically check your domains and sending IPs against major public blocklists. Being listed is a symptom; if it happens, fix the underlying cause (usually list quality or volume) before requesting delisting.
Reply and bounce trends per mailbox. A mailbox whose reply rate suddenly drops while nothing else changed is often a mailbox that stopped inboxing. Pause it, reduce volume, send only to your warmest segments, and let it recover rather than pushing through.
Seed tests, used honestly. Sending a campaign to a handful of your own test accounts across Gmail and Outlook tells you where messages land. Use this as a smoke alarm, not as a lab for tweaking your way around filters.

When something does go wrong, the recovery playbook is always the same: stop, shrink, and slow. Pause campaigns, cut volume dramatically, send only to your most relevant and engaged segments, fix whatever caused the problem (dirty list, misconfigured DNS, volume spike), and rebuild gradually. There is no shortcut that restores reputation faster than good behaviour over time.

A Setup Checklist You Can Run This Week

Register one or two brand-adjacent secondary domains with clean histories; redirect them to your main site.
Set up mailboxes on a reputable provider (Google Workspace or Microsoft 365), two or three per domain maximum.
Publish SPF, DKIM (2048-bit), and DMARC (p=none with reporting) for each domain; validate with an online checker and confirm DMARC alignment.
Add a custom tracking domain if you use link tracking, and confirm MX records so replies come back.
Enrol every domain in Google Postmaster Tools and a DMARC report parser.
Use each mailbox manually for two weeks, then begin outreach at five to ten sends a day, ramping only as replies and clean bounces allow.
Verify every list within 30 days of sending; build your suppression list and wire it into every campaign.
Set per-mailbox ceilings that include follow-ups, and put a recurring reminder in your calendar to review Postmaster and DMARC data.

Conclusion: Reputation Is the Asset — Protect It Like One

Cold email deliverability is not a bag of tricks; it is the compound interest of doing ordinary things properly. Separate your outreach from your main domain so risk is contained. Authenticate everything, and actually read the reports. Warm up slowly with real activity, hold your volume to levels a human could plausibly send, and treat list hygiene as the reputation-critical process it is. None of this is glamorous, and all of it is the difference between outreach that quietly compounds and outreach that quietly dies in the spam folder.

The senders who win at cold email long-term are not the ones with the cleverest workarounds — they are the ones mailbox providers have no reason to distrust. Build infrastructure that tells the truth about who you are, send mail that respects the person receiving it, and deliverability largely takes care of itself. Get the foundation from this article in place first; then the writing and sequencing work in the rest of this series will actually have a chance to pay off.