How to set up cold email infrastructure in 2026

Why shouldn’t you send cold email from your main domain?

Your main domain carries your team’s everyday email: proposals, invoices, support, password resets. If cold email damages its reputation, all of that starts landing in spam too.

A surprising number of teams still run outbound from their main domain before they bring in outside help. It’s the first thing we change. Cold email goes out from secondary domains that look like the main one and redirect to the main website. If a prospect types the sending domain into a browser, they land on your real site, which tells them the email is genuinely from you.

If a secondary domain does get burned, you take it out of rotation. Nobody’s day-to-day email is affected.

How do you decide how many Google and Microsoft inboxes to buy?

We start from the prospect list, not the inboxes. Once we have at least 2,000 qualified leads, we run an MX lookup on their domains. MX records show which provider receives each company’s email, so we can see the split: how many of your buyers are on Google, how many on Microsoft, and how many on something else.

Then we buy inboxes in the same proportion. If most of your market is on Microsoft, most of your sending inboxes are Microsoft, with Google inboxes in line with the share of buyers on Google. When sending, we use provider matching (Gmail inboxes send to Gmail recipients, Microsoft to Microsoft). Instantly calls it Provider Matching and Smartlead calls it ESP matching. Some people say it no longer makes a difference. We still use it.

How many inboxes per domain, and how many emails per day?

This depends on the provider, and the two work quite differently.

	Inboxes per domain	Cold emails per inbox per day	Per domain per day
Google Workspace	3	up to 15	about 45
Microsoft (isolated tenant)	25	up to 2	about 50

Google: three inboxes on each secondary domain, each sending no more than 15 cold emails a day.

Microsoft: we use providers that put each domain in its own Microsoft tenant, so you never share sending reputation with other customers. That setup suits many inboxes each sending very little. Five a day per inbox is a common recommendation. We send two, to stay on the safe side.

The figure to watch is the last column. Both setups land at roughly 45 to 50 emails per domain per day, which keeps any one domain’s volume modest. If you need more volume, add domains rather than pushing each inbox harder.

What makes a good secondary domain name?

Something that’s clearly related to the main brand: tryexample.com, getexample.com, examplehq.com. We avoid numbers such as example1.com, because a careful recipient could read them as an impersonator rather than a second domain. We also avoid cheap or unusual top-level domains that spammers favour, and stick to familiar ones such as .com or .io.

To be fair, the name matters less than people think. Reports suggest it has very little effect on positive replies, and that’s what we’ve seen too. It’s still worth getting right for the recipient who checks.

How do SPF, DKIM and DMARC work for cold email?

All three are DNS records, and every secondary domain needs all three. Google and Microsoft both require them for anyone sending in volume: Gmail under its sender guidelines, and Outlook.com for domains sending more than 5,000 emails a day since May 2025 (Microsoft’s postmaster policies). Messages that fail can be sent to spam or rejected outright.

• SPF lists the servers allowed to send for your domain. v=spf1 include:_spf.google.com ~all (Google) or v=spf1 include:spf.protection.outlook.com ~all (Microsoft)
• DKIM signs each email so the receiver can tell it came from you and wasn’t altered. Your provider generates the key, and you publish it as a DNS record.
• DMARC tells receivers what to do with mail that fails those checks while claiming to come from your domain, and sends you reports. v=DMARC1; p=none; rua=mailto:[email protected]

One catch: DMARC only passes if SPF or DKIM passed for the same domain your email says it’s from. If a tool sends as you but signs with its own domain, the checks pass for the tool’s domain, not yours, and DMARC still fails.

This is more common than it sounds, and it starts with the inboxes themselves:

• Google Workspace: until you switch DKIM on in the Admin console and publish the key, Google signs your emails with one of its own domains (yourdomain.gappssmtp.com). The inbox works, so it looks set up, but DMARC fails.
• Microsoft 365: the same happens with your onmicrosoft.com tenant domain until you enable DKIM for your own domain.
• Marketing and CRM tools: HubSpot, Mailchimp and similar tools send “from” your address, but sign with their own domain until you complete their domain authentication step. This usually affects the main domain rather than the cold email domains, and it’s easy to miss because the emails still go out.

The fix is the same each time: complete the “authenticate your domain” step, which adds the tool’s DKIM record to your DNS. Running DMARC with reports switched on is what catches the ones you’ve forgotten, because the reports list every service sending as your domain.

Should DMARC be set to none, quarantine or reject?

Start on p=none with reporting switched on, then move to quarantine and finally reject once the reports show every legitimate send passing.

It helps to be clear about what DMARC does. It doesn’t keep your own cold emails out of spam. Those already pass authentication, so the policy doesn’t touch them. What reject does is stop someone else sending email that pretends to be your domain, which protects your brand. The risk runs the other way: put a new domain on reject before SPF and DKIM are aligned, and your own emails get rejected, often without anyone noticing. Monitor first, then tighten.

How long should you warm up a new inbox?

Two to four weeks, never less than two. Warm-up means the inbox sends and receives small amounts of email that looks real, building a history before any cold email goes out. The volume climbs slowly towards the daily limits above, and we use that time to finish mapping the market.

Instantly and Smartlead both have warm-up built in. We keep warm-up running after launch, but turn it down so most of each inbox’s daily capacity goes to cold email. That matches what most deliverability guides recommend, for example around 20 to 30% warm-up and 70 to 80% campaign (Snov.io). Warm-up counts towards an inbox’s total volume, so the two together stay within its limit.

Why we don’t track opens

Many teams still use open rates to show their emails are landing. Open tracking works by adding a tracking pixel to every email, and that pixel can itself hurt deliverability. The numbers aren’t reliable anyway: Apple Mail Privacy Protection loads images automatically, so many “opens” never happened.

We don’t track opens. Replies and bounces are a more honest signal. Even so, an email can land in spam without bouncing, so for the direct answer we run inbox placement tests. These send to test mailboxes and show whether you landed in the inbox, a tab or spam. Both main sequencers have them: Instantly’s inbox placement tests and Smartlead’s SmartDelivery.

What should you check every week?

Deliverability rarely fails loudly. It decays quietly. Every week we look at:

1. Bounce rate per inbox. We act at 2% and aim to stay under 1%. Verifying emails before they go into a campaign does most of the work here.
2. Reply rate by domain. A sudden drop, or no replies at all, is often the first sign of a placement problem.
3. Inbox placement tests, run on a schedule.
4. Domain health reports from the sequencer, plus blocklist checks: either the sequencer’s own blocklist monitoring or a free lookup such as MXToolbox. The lists that matter most for a domain are Spamhaus’s domain blocklist, SURBL and URIBL.
5. DMARC reports, especially in the first weeks after setup.

What do you do when a domain’s health drops?

When a domain shows warning signs (a health alert from the sequencer, bounces climbing, replies falling away), we take it out of rotation for two to four weeks.

First we find the cause. It’s usually the list, the copy or the volume, and resting the domain fixes none of those. We also look the domain up on the main blocklists, as above. If it’s listed, the blocklist’s site explains how to request removal once the cause is fixed. Then we bring it back slowly, ramping towards the daily limit while watching the same numbers.

Many domains recover this way. Some need longer: we leave them alone, then warm them up from scratch as if they were new. A domain that still doesn’t recover is cheaper to replace than to keep fighting for.

Why this matters

Getting into the inbox is half the battle. The best list and the best copy do nothing in a spam folder, and you rarely find out you’re there. None of this setup is complicated. It just has to be done properly and then watched every week.