Cold Email Infrastructure: Domains, Warmup, and Sending Setup

Why Infrastructure Breaks Campaigns Before They Start

We have audited outbound programs for over 50 B2B companies. The most common failure mode is not a weak hook or a bad subject line. It is domains landing in spam on day 1 because someone skipped warmup, or a DMARC policy that tells Google you do not care whether your domain gets spoofed. Those mistakes burn weeks of pipeline and create a sender reputation that takes months to rebuild.

Infrastructure is the unsexy part of cold email that determines whether everything else works. Improving copy is a 5 to 10 percent lever. Infrastructure is a 30 to 50 percent lever. Most people work on the wrong layer first.

This is the complete technical setup, from domain purchase to safe sending volume, based on what actually works across client campaigns.

Cold Email Infrastructure

The technical foundation required to send cold email at scale without triggering spam filters or damaging your primary domain's reputation. Infrastructure includes: secondary sending domains separate from your main domain, configured mailboxes, DNS authentication records (SPF, DKIM, DMARC), an email warmup protocol, a sending platform with reputation management, and a rotation system for distributing volume across multiple inboxes.

How to Set Up Domains for Cold Outreach

The single most important infrastructure decision is keeping outbound sending completely separate from your primary domain. If a cold email campaign trips spam filters or gets flagged for bulk sending, you want that damage contained to a secondary domain, not the domain tied to your company email, your website, and your marketing sends.

The domain setup that works:

• Purchase secondary domains specifically for outbound. Use close variations of your primary. If your company is acme.com, use getacme.com, tryacme.com, or acmehq.com.
• Never send cold email from your primary domain. The risk of reputation damage to a mission-critical asset is not worth it.
• Create 2 to 3 mailboxes per domain. More than 3 per domain increases risk without proportional volume gain.
• Set each mailbox to send from a real person's name and a real-sounding email. "jordan@getacme.com" converts better than "sales@getacme.com" and looks less like automation to receiving servers.

How many domains and inboxes do you need? That depends on your target volume. At 30 to 50 cold emails per warmed inbox per day, the math is straightforward:

Most B2B companies running mid-market outbound need 500 to 1,000 emails per day to generate 10 to 20 qualified conversations monthly. Plan your domain and inbox count around that target before you buy anything.

For mailbox hosting, Google Workspace and Microsoft 365 are the standard. Both give your sending domains credibility with receiving servers. Generic SMTP providers or cheap shared hosting increase deliverability risk significantly and are not worth the cost savings.

SPF, DKIM, and DMARC: The DNS Records You Cannot Skip

These 3 records are the authentication layer that tells receiving mail servers your emails are legitimate. Google's sender requirements, updated in February 2024, require SPF, DKIM, and DMARC on all domains sending more than 5,000 emails per day. Microsoft enforces similar requirements. Non-compliant senders are rejected outright, not just filtered to spam.

SPF (Sender Policy Framework) tells receiving servers which IP addresses are allowed to send email on behalf of your domain. Without SPF, any server on the internet can send email claiming to be from your domain. SPF is a single TXT record added to your domain's DNS. For Google Workspace it looks like: v=spf1 include:_spf.google.com ~all

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The receiving server checks this signature against a public key stored in your DNS to confirm the message was not altered in transit. Both Google Workspace and Microsoft 365 generate DKIM keys automatically, but you must enable DKIM signing in the admin panel. It is not active by default.

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when an email fails SPF or DKIM checks. It has 3 policy options:

• p=none: Monitor only. Failing emails are delivered but logged. This is the right starting point.
• p=quarantine: Failing emails go to spam. Move here once you confirm your legitimate mail passes both SPF and DKIM.
• p=reject: Failing emails are blocked entirely. This is the strongest protection but requires confidence in your authentication setup.

Start at p=none to collect data through the DMARC reporting tag, then move to p=quarantine or p=reject once you verify all your legitimate sends pass authentication. Setting up all 3 records takes about 20 minutes per domain. Skipping them is a hard no in 2026.

DMARC

A DNS-based email authentication protocol that specifies how receiving mail servers should handle messages that fail SPF or DKIM verification. DMARC also enables domain owners to receive aggregate reports on authentication failures, giving visibility into whether someone is sending email impersonating your domain. DMARC is required for maintaining deliverability with Google and Microsoft in 2026.

How Email Warmup Actually Works

Warmup is the process of gradually building a new mailbox's sending reputation by starting at low volume and increasing over several weeks. Receiving servers track behavioral patterns. A brand-new mailbox that suddenly sends 100 emails on day 1 looks exactly like a spam operation to Google's filtering systems.

The warmup timeline that works across our client campaigns:

Warmup tools like Mailreach, Warmup Inbox, Lemwarm, and Instantly's built-in warmup run these sends automatically. They connect your inbox to a network of other inboxes, send emails between them, and generate the positive engagement signals that build domain reputation: opens, replies, removal from spam when flagged.

What warmup is not: it is not a guarantee. Warmup builds baseline reputation but cannot compensate for poor list hygiene, spam-trigger words in email copy, or sending to invalid addresses at scale. A warmed domain that hits a purchased list with 30 percent invalid addresses will still land in spam. HubSpot's deliverability research consistently shows that list quality and authentication setup are the 2 highest-impact factors in inbox placement.

Keep warmup running continuously in the background even after your inboxes are fully ramped. The ongoing engagement signals maintain reputation over time. Stopping warmup entirely after launch is a slow-motion deliverability problem that shows up 2 to 3 months later as open rate erosion.

Sending Volume: The Real Numbers

The safe daily sending limit per warmed inbox is 30 to 50 cold emails. Some senders push to 100, but that carries real deliverability risk. Google's infrastructure flags unusual sending spikes, and a jump from 30 to 80 sends per day can trigger a soft suspension even on a well-warmed domain that has been running for months.

The numbers that work consistently across campaigns:

Timing matters as much as volume. Spread sends across business hours in your target timezone rather than batching everything at 9am. Receiving servers notice when large volumes from a single domain arrive in the same 30-minute window. Tools like Instantly, Smartlead, and Lemlist handle send-time randomization automatically.

One mailbox per person profile. Do not stack multiple aliases on a single Google Workspace account and blast from all of them. Each active sending address needs its own warmup history, its own sending pattern, and its own daily limit configured in your sending tool.

Managing Multiple Inboxes at Scale

Rotation across inboxes is not optional once you pass 500 emails per day. Cold email sending platforms like Instantly, Smartlead, and Lemlist handle rotation automatically, distributing sends evenly across your connected inboxes so no single mailbox carries the full load.

The rotation setup that works:

• Connect all inboxes to a single sending platform. This gives the tool visibility into the full pool of available sending capacity.
• Set per-inbox daily limits in the platform to match each mailbox's warmup stage. A 2-week-old inbox gets capped at 15. A 3-month-old inbox gets 50.
• Rotate prospects across inboxes rather than assigning campaigns to specific mailboxes. This distributes reputation risk evenly.
• If one inbox gets flagged or shows deliverability issues, pause it while the others continue. Isolation at the inbox level is the difference between a minor incident and a full campaign shutdown.

Blacklist monitoring is part of ongoing infrastructure maintenance. Tools like MXToolbox check whether your sending domains or IP addresses have been added to spam blacklists. Build this check into a weekly ops cadence. A blacklisted domain that keeps sending compounds the problem and can get your entire Google Workspace account flagged, taking down every inbox on the account simultaneously.

Google Postmaster Tools is free and gives you domain reputation data directly from Google. Any campaign running on Google Workspace should have Postmaster Tools set up for every sending domain. Reputation tiers in Postmaster are High, Medium, Low, and Bad. A drop from High to Medium is an early warning that something needs attention before it becomes a full deliverability failure.

How to Know When Your Infrastructure Is Breaking

Open rates are your primary warning system. A campaign delivering 45 to 55 percent open rates that drops to 15 to 25 percent in 48 hours is almost always an infrastructure problem, not a copy problem. The copy did not change overnight. Something in the sending environment did.

Warning signals that require immediate investigation:

• Open rate drops more than 15 percentage points in 48 hours
• Reply rate holds steady or increases while open rate drops (messages are visible but fewer recipients are opening, suggesting spam placement for a growing segment)
• Bounce rate spikes above 3 percent (list quality issue or the domain is being rejected outright)
• Google Postmaster Tools shows domain reputation drop from High to Medium or Low
• Receiving server rejection errors appearing in your sending tool logs

When signals break, the response sequence:

1. Pause sends from the affected inbox or domain immediately
2. Check Google Postmaster Tools for domain reputation status
3. Run MXToolbox to check for blacklist status on the sending domain and IP
4. Verify DNS records are still intact (hosting changes and domain renewals can silently break SPF and DKIM)
5. Run a seed test using a tool like GlockApps to see where test emails land across major providers
6. Resume at 20 percent of previous volume after 72 to 96 hours of pause

Deliverability is not a set-and-forget configuration. The sender reputation you build over 8 weeks can erode in 72 hours. Monitoring has to be part of the operational cadence, not something you check when performance drops. We cover the most common spam folder causes in more detail in our cold email deliverability guide.

Infrastructure Is the Unsexy Work That Determines Everything Else

Most founders treat cold email infrastructure as a one-time setup and move straight to obsessing over copy. That is the wrong priority order.

A technically sound message that reaches the inbox at 50 percent open rates will outperform a masterpiece landing in spam at 8 percent. Infrastructure is not a competitive advantage because it is technically difficult. The setup described in this article is not complicated. It is a competitive advantage because most senders skip it or rush it.

The companies running the most effective outbound programs we have seen are not always the best copywriters. They are the most disciplined infrastructure operators: 4-week warmup protocols before a single cold send, daily limits that leave a buffer below the safe ceiling, dedicated secondary domains for every campaign, and weekly Postmaster checks built into ops cadence.

Get the foundation right before spending time optimizing anything else. The best hook in the world does not matter if it never reaches the inbox. The infrastructure review comes first, and the copy work follows it.