How to Set Up Email Domains for Outbound Campaigns

The aged domain market is selling a variable that barely moves. We run AI outbound for 50 plus B2B companies and have sent over 8 million hyper-personalized cold emails this year, and the domains that die on us are never the young ones, they are the ones where the DNS records landed in the wrong order. Below, the sizing table that tells you how many domains and mailboxes to buy, the order the records have to land in, what the stack costs, and the 6 mistakes that burn a domain before send 1.

How Do You Set Up Email Domains for Outbound?

That is the whole architecture in one paragraph. The rest of this page is the arithmetic behind each piece, because the piece people get wrong is almost never the concept, it is a number. How many domains. How many mailboxes on each. How many sends per mailbox per day. What order the records go in. Those four numbers decide whether a program runs for 3 years or burns in month 2.

Secondary Domain

A domain registered specifically for cold outreach and kept separate from the company's primary domain. The secondary is a close lookalike, so getacme.com or acmehq.com rather than acme.com, which means the prospect still recognizes the brand on first read while the sending reputation stays quarantined from the rest of the business. Each secondary carries 2 to 3 mailboxes. The secondary domain explainer covers the naming patterns that read as legitimate and the ones that read as spoofing.

Sending Pool

The full set of domains and mailboxes a campaign sends through, treated as one unit of capacity. Pool size is derived from monthly send volume divided by the per mailbox daily cap, not chosen. A pool is healthy when no single mailbox is carrying a disproportionate share of daily volume, which is what mailbox rotation exists to enforce and what multi domain sending scales.

Start with the part most operators buy first and should not. Warmup Inbox analyzed 4,406 inboxes across five domain age brackets and measured placement over 30 days. The Pearson correlation between domain age and inbox placement came out at negative 0.096, which in plain terms is no relationship at all. Domains aged 6 to 12 months placed at 99.06 percent. Domains over 10 years old placed at 98.41 percent. The younger bracket won, by an amount too small to mean anything either way.

The same study named the three things that do predict placement: authentication configured correctly, warmup duration, and sending behavior. Every one of those is something you control this week for close to nothing. None of them is something you buy from an aged domain broker. It is worth saying plainly because the aged domain pitch is everywhere, and a domain that has sat dormant for 8 years has exactly as much sending reputation as one registered this morning, which is none.

So the first decision is not which domain to buy. It is how many, and that falls straight out of your monthly volume.

How Many Domains and Mailboxes Do You Actually Need?

Work the math backwards from the send target. Three inputs produce the whole pool: monthly sends, working days in a month, and the per mailbox daily cap. We use 21 working days and a cap of 30 sends per mailbox per day, then put 3 mailboxes on each domain.

The shorthand that comes out of the table is 1 secondary domain per 2,000 emails a month. Round up, never down. A pool sized exactly to target has no headroom, and the first time a domain needs to come offline for a reputation issue you are choosing between pausing the campaign and overloading what is left.

The 30 sends per mailbox per day cap is the most important number on this page, and it is the one people negotiate with. The temptation is obvious. Push each mailbox to 80 or 100 and the domain count drops by two thirds, which looks like a smart cost decision on a spreadsheet. It is not a cost decision, it is a reputation decision. Per mailbox daily volume is one of the cleanest bulk sender signals a filter has access to, and a brand new mailbox pushing 100 cold sends a day is describing itself accurately. Spreading 200 sends across 7 mailboxes on identical copy and an identical list outperforms 200 from one mailbox, every time.

Two adjustments once you are past a single domain. First, do not bring the whole pool live on the same Monday. Stagger it over 8 to 10 weeks, so a bad cohort or a list problem takes out a fraction of capacity instead of all of it. Second, size before you buy. The sending volume guide walks the arithmetic in more depth, and the infrastructure setup overview covers how the pool connects to the sending platform on top of it.

What Order Do the DNS Records Have to Land In?

Four records, and the order is not cosmetic. Each one depends on the state the previous one leaves the domain in, which is why a setup that has all 4 records present can still fail verification for a week while somebody stares at a correct looking DNS panel.

1. Register at the registrar you intend to keep it at. The ICANN Transfer Policy lets a registrar deny any inter registrar transfer requested within 60 days of the creation date, and imposes the same 60 day lock after a transfer or a change of registrant. Buying at one registrar and planning to move the domain somewhere else before launch costs you 2 months you did not budget.
2. MX first. Point the domain at your mailbox provider before anything else. Until MX resolves, the provider cannot verify the domain, warmup cannot run a single conversation, and every reply a prospect sends bounces into nothing. A campaign that can send but cannot receive is worse than one that has not launched.
3. SPF second, and exactly one record. Two SPF TXT records on the same domain is a permanent error, not a merge. Keep the record to a single provider include on a cold sending domain, because these domains have no reason to carry a marketing platform, a helpdesk, and an invoicing tool the way a primary does.
4. DKIM third, published before it is switched on. The provider generates the keypair. You publish the public selector as a TXT record, wait for it to propagate, and only then enable signing. Reversing those two steps means your first signed messages get verified against a record that is not live yet, and those failures land on the domain's record on day one.
5. DMARC last, at p=none with a reporting address. Publishing an enforcing policy over authentication you have not confirmed is how people reject their own mail. Run p=none with an rua address for 2 to 4 weeks, read the aggregate reports, confirm both SPF and DKIM are aligning, then move to p=quarantine and then p=reject.
6. Verify with a live send before the first warmup message. Send one message from each new mailbox to a seed address you control on a different provider, open the raw headers, and confirm SPF pass, DKIM pass, and DMARC pass in the authentication results. This takes 5 minutes per mailbox and catches the entire class of problems that otherwise surface as a mysterious 3 week placement slump.

The SPF lookup limit deserves its own paragraph because it is the most common silent failure we find in audits. RFC 7208 caps SPF evaluation at 10 DNS querying mechanisms, and the include, a, mx, ptr, exists, and redirect terms all count. Cross the limit and the receiver is required to return a permanent error, which most filters treat as an authentication failure. The record still looks fine in a DNS panel. It resolves. It just does not pass. Cold sending domains rarely hit this because they run a single include, but a team that reuses the primary domain's SPF record on a secondary imports the whole stack of marketing and billing includes along with it.

On the DMARC side, publishing the record at all now puts you ahead of most of the internet. EasyDMARC's 2026 DMARC Adoption Report across the top 1.8 million domains found 937,931 domains, or 52.1 percent, with a DMARC record, up from 47.7 percent a year earlier, and only around 9 percent combining an enforcing policy with aggregate reporting. Over half of DMARC enabled domains sit at p=none indefinitely. For the record syntax itself, the SPF, DKIM, and DMARC explainer and the DNS records guide carry the exact values and the alignment rules underneath them.

Google Workspace or Microsoft 365 for Cold Sending?

Pick one and run the entire program on it. Mixing providers inside a single campaign produces placement differences you cannot attribute to anything, because you no longer know whether a soft week was the list, the copy, or the platform.

The rules both providers publish are worth reading once rather than inferring from a blog. Google's email sender guidelines tell bulk senders to hold the spam rate reported in Postmaster Tools below 0.10 percent and never to reach 0.30 percent, on top of requiring SPF, DKIM, DMARC alignment, valid reverse DNS, TLS, and one-click unsubscribe on marketing mail. Yahoo publishes parallel guidance in its Sender Best Practices. Microsoft's requirements for high volume senders took effect May 5, 2025, and as dmarcian documented, non compliant mail there is rejected outright rather than quietly filed in junk.

A 24 mailbox pool sending 15,000 a month is nowhere near either 5,000 a day threshold, which is the point of building the pool that way. You stay under the bulk sender line at every individual provider while still moving real volume in aggregate.

What Does an Outbound Domain Stack Actually Cost?

Less than almost anyone expects, which is why skipping any line on this list to save money is the worst trade available in outbound.

Set against that, the cost of getting it wrong is the whole program. A burned domain cannot be rehabilitated on any timeline that matters to a campaign, and recovering one is mostly an exercise in deciding when to stop trying. Domains are close to free. Weeks are not.

The line people cut first is verification, and it is the one that costs the most to cut. Bounces are read by every provider as evidence you do not know who you are mailing, which is exactly the inference a filter is trying to make. Verification is a hard gate for us on every list, and bounce rate is the first number we pull when placement moves.

How Long Before a New Domain Can Send Real Mail?

Three to 4 weeks, and the useful part of that window is front loaded. The Warmup Inbox data set found placement reaches 98 percent by week 2 of warmup and then plateaus, which reframes what the back half of the ramp is for. Weeks 3 and 4 are not buying you more trust. They are buying volume tolerance, so the mailbox can carry 30 sends a day without the jump itself reading as a change in behavior.

Microsoft's high volume sender rules make 14 days the hard floor. We run to 30 because the marginal cost of 2 more weeks is a rounding error and the marginal cost of a domain that never recovers is the quarter.

1. Week 1, 5 to 10 warmup sends per mailbox per day, zero cold. The only thing that matters this week is that authentication passes on a live test send. Everything else is noise until that is confirmed.
2. Week 2, 15 to 25 warmup sends, zero cold. Watch the warmup reply rate. Runs holding a 30 to 35 percent reply rate meaningfully outperform runs under 20 percent, and pushing far above that band does not help, because providers weight plausibility rather than volume.
3. Week 3, 25 to 35 warmup sends, 5 to 10 cold. First cold cohort goes to the tightest list you own. Bounce rate under 2 percent or stop and re-verify.
4. Week 4, 30 to 40 warmup sends, 15 to 25 cold. Read the complaint rate daily. Any movement toward 0.10 percent means hold volume where it is.
5. Week 5 and after, warmup stays on permanently at 20 to 30 a day. Cold outbound earns a fraction of the replies warmup traffic does, so switching warmup off on launch day collapses the engagement to volume ratio on the domain exactly when it is most exposed.

That last line is the single most common failure mode we find on campaigns we inherit. The warmup tool did its job, the operator switched it off, and placement decayed over 6 weeks with no obvious cause. The full ramp and the signals underneath it are in the warmup explainer, and the new domain specific version lives in the new domain ramp. For invite led campaigns specifically, domains and warmup for podcast invites covers where the timeline differs.

What Are the 6 Setup Mistakes That Burn a Domain?

Every one of these shows up in audits, and the symptoms are close enough to each other that the diagnosis is the slow part.

Mistake 1: sending live before warmup finishes. Deadline pressure produces this one almost every time. The early sends land in spam, get reported from spam, and the domain's first impression is a complaint rate. The cost of waiting is 2 weeks. The cost of skipping is a domain you cannot reuse.

Mistake 2: DMARC parked at p=none forever. p=none is correct while you confirm alignment. It is not a destination. Move to p=quarantine once the aggregate reports come back clean, then to p=reject. Both Google and Microsoft now want a published policy from anyone sending at volume, and staying in monitoring mode indefinitely puts you in the majority rather than in the clear.

Mistake 3: reusing the primary domain's SPF record on a secondary. It is a copy and paste that feels efficient and imports a stack of includes a cold sending domain has no use for, frequently blowing past the 10 lookup ceiling in the process.

Mistake 4: mixing cold and warm on the same mailbox. A rep running both cold prospecting and warm reply work out of one mailbox blends two engagement patterns that should not be adjacent. Cold goes on cold-only mailboxes. Once a conversation is genuinely warm, move it to a mailbox that does no cold sending.

Mistake 5: overloading the per mailbox cap. Covered above and worth repeating, because it is the mistake people make deliberately. Thirty a day is not a suggestion, it is the line between a program that compounds and one that decays.

Mistake 6: no monitoring after launch. Setup is not a one time event with no follow up. Reputation moves weekly. Deliverability monitoring, seed placement tests, and blacklist monitoring are the three checks that turn a silent decay into a fixable alert, and domain reputation is the score all three are watching.

Where Domain Setup Stops Being the Bottleneck

Every number on this page controls one thing: whether your message gets considered. None of them control whether it gets answered. That is the part operators skip past, because infrastructure is measurable and the ask inside the message is not.

It matters mechanically, not just commercially. Copy earning a 1 percent reply rate feeds your domain 1 percent of the engagement that copy earning 5 percent feeds it, and engagement is an input to the same reputation score every record on this page is protecting. That is the reason the invite versus pitch distinction shows up in deliverability data and not only in booking data, and why positive reply rate turns out to be a leading indicator of placement rather than a lagging indicator of revenue. A well built pool sending a bad ask decays. A well built pool sending an ask people want to answer gets stronger every week it runs.

Which is also why targeting belongs in a deliverability conversation. Mailing people with no reason to care produces low replies and high complaints, the exact signal pair that describes a spammer, and no DNS record repairs that. The ICP definition guide treats that as a deliverability constraint on purpose, and list building from scratch covers how to source against it. Where the whole stack lands is in reply rate benchmarks, and what lands in the spam folder despite correct setup is in the spam folder guide.

Build the pool from the volume, not from a number you read somewhere. One domain per 2,000 monthly sends, 3 mailboxes each, 30 sends per mailbox per day, MX then SPF then DKIM then DMARC, 30 days of warmup that never fully switches off. Then spend the rest of your attention on the ask, because that is the only variable left with real upside.