Episode 03 / 5
Cold Email Infrastructure
Everything to set up before your first cold email: sending domains, mailboxes, SPF, DKIM, DMARC, warm up and the rules.
What you'll learn
- Why you never send cold email from your main domain, and how to plan sending domains and mailboxes.
- The mailbox maths: daily volume, emails per mailbox, mailboxes per domain.
- MX, the tracking domain, SPF, DKIM and DMARC, explained without jargon.
- What warm up is for, and why it can't save a bad list.
- Google, Yahoo and Microsoft sender requirements, and the spam rate thresholds to watch.
- The legal frame for cold email: GDPR, ePrivacy rules by country, the UK and CAN SPAM.
Free resources
Chapters
- 01The problem isn't the message, it's the setup
- 02Sending domains and mailboxes
- 03DNS, MX and the tracking domain
- 04SPF, DKIM and DMARC
- 05Warm up: what it does, and what it doesn't
- 06What Google, Yahoo and Microsoft require
- 07What to watch: spam rate, bounces, replies
- 08The legal frame: GDPR and national rules
- 09Summary, and the next episode
Full text
The problem isn't the message, it's the setup
Your list is ready. Your message is ready. You send your first cold emails from your company's own domain. A week later, the replies stop. Then a message from finance: invoices to customers are landing in spam. The problem wasn't the message. It wasn't the list either. It was the infrastructure. In this episode, we set up everything you need before your first cold email, in order. Every email you send goes through a check on the other side. Gmail or Outlook decides whether to put it in the inbox or in spam. To decide, it looks at two things: identity and reputation. Did this email really come from who it claims to? And how has this sender behaved in the past? The infrastructure we build today answers those two questions. The whole subject is called deliverability: your email actually reaching the inbox.
Sending domains and mailboxes
First decision: which domain will you send from? Say your website is example dot com. Proposals, invoices and customer emails go out from there. Don't send cold email from that domain. In cold email you write to people who don't know you, and some of them may hit the spam button. If that reputation suffers, every email your company sends can be affected. So the common approach is to buy separate sending domains: like getexample dot com, or examplehq dot com. Keep the name close to your brand; avoid hyphens and numbers. And point these domains to your main website. A separate domain isn't there to hide who you are. It's there to protect your main domain. Each sending domain usually gets two or three mailboxes, meaning email accounts. With real names: like anna at getexample dot com. So how many emails should one mailbox send a day? The common practice in cold email is thirty to fifty a day. That's not a guarantee, it's a starting range. Your results will push that number up or down. The maths is simple: you want to write to five hundred people a day, at forty emails per mailbox. Five hundred divided by forty is thirteen mailboxes; at two or three mailboxes per domain, that's five domains. Spreading the volume stops one problem from shutting down the whole system. There are two big options for mailboxes: Google Workspace and Microsoft 365. Both are used for cold email. Google's daily limit is two thousand messages per user, Microsoft's is ten thousand recipients. But those are ceilings, not targets. When choosing, look at what your audience uses, and which one you can manage comfortably. Many teams use both. What matters is that every mailbox is a real account, with a name, a photo and a signature.
DNS, MX and the tracking domain
Now the technical part. Every domain has DNS settings; think of DNS as your domain's ID card. The first record is MX: it says where emails sent to you should be delivered. On Workspace, that's smtp dot google dot com. Don't skip it. The point of cold email is to get replies; the replies need somewhere to land. Then there's the tracking domain. Your sending tool uses a shared address to measure clicks; the reputation of everyone using that address reflects on you. The fix is your own subdomain: track dot getexample dot com. In DNS, it's a one line redirect record called a CNAME.
SPF, DKIM and DMARC
For identity, there are three records: SPF, DKIM and DMARC. SPF is a guest list: it says which servers are allowed to send email on behalf of your domain. The rule: a domain has exactly one SPF record. If you add a new tool, you add it to the existing line. DKIM is a digital seal. Each email is signed with a private key; the receiving side checks the seal with the public key in your DNS. If the seal holds, the email really came from you and wasn't changed on the way. It can take up to forty eight hours to kick in. And if the check fails, what happens? DMARC decides. DMARC is your domain's rule book. There are three options. None: just report. Quarantine: put it in spam. Reject: don't accept it at all. There's one more condition: the domain in the From line must match the domain that SPF or DKIM verified. This is called alignment. People usually start with none; once the reports show everything works, the policy gets stricter. In short: SPF, who can send. DKIM, is it really from me. DMARC, what to do if it doesn't check out.
Warm up: what it does, and what it doesn't
A new domain has no history. If you send hundreds of emails on day one, you look suspicious. That's where warm up comes in: starting at low volume and increasing it slowly. Warm up tools have your mailboxes exchange emails with other accounts: the emails get opened, answered, and taken out of spam. The common practice is two to four weeks before the first campaign. Google's guidance points the same way: start with low volume, increase slowly. But warm up isn't magic. It won't save a bad list or an irrelevant message. Your real reputation is set by real recipients.
What Google, Yahoo and Microsoft require
The big providers now have written requirements too. Since February twenty twenty four, Google has required everyone sending to personal Gmail addresses to have at least SPF or DKIM, correct server records, an encrypted connection, and a spam rate below zero point three percent. For senders close to five thousand emails a day or more, the bar is higher: SPF and DKIM together, DMARC, alignment, and one click unsubscribe in marketing emails. Every email from the same main domain counts toward that number, and the status is permanent. Yahoo introduced similar requirements. And since May twenty twenty five, Microsoft has required SPF, DKIM and DMARC from anyone sending more than five thousand emails a day to Outlook, Hotmail and Live addresses, and rejects those who don't comply. In cold email, you're probably below these thresholds. Still, treat all of it as the minimum standard.
What to watch: spam rate, bounces, replies
You've started sending. The first thing to watch is your spam complaint rate. For that there's Google Postmaster Tools: it's free, and it shows your spam rate on the Gmail side. Google recommends staying below zero point one percent. Zero point three percent is the red line. Roughly: one complaint in a thousand emails is a warning, three is a serious problem. Second, bounces: emails that come back. They drag your reputation down. We'll talk about verifying your list in episode five. Third, replies. If they suddenly stop, your emails may not be reaching the inbox. The golden rule: if the numbers get worse, don't increase volume. Stop, find the cause, then continue.
The legal frame: GDPR and national rules
Finally, the rules. This isn't legal advice, but you need to know the frame. In the European Union, personal data falls under the GDPR. A work email with a person's name in it is personal data too. The GDPR can treat direct marketing as a legitimate interest. But that's not an automatic permission: you need to be able to explain why this person, why this message, and how they can say no. On top of that, each country has its own rules for marketing email under the ePrivacy rules, and they differ for business addresses. Some countries allow cold email to companies with an easy opt out; others, like Germany, are much stricter. In the UK, you can email people at companies, as long as you say who you are and offer an easy way out. In the United States, CAN SPAM asks for an honest subject line, a physical address and a working unsubscribe. Whatever the country, every email should say who you are and how to reach you, and opting out should be easy and free. Get legal advice for your own situation. And our rule is simple: if someone says they're not interested, never write to them again.
Summary, and the next episode
Let's sum up. Your main domain is off limits; cold email goes out from separate domains, from real mailboxes, at a reasonable volume. SPF, DKIM, DMARC, MX and the tracking domain are set up. Warm up is done, and volume grows slowly. Spam rate, bounces and replies are checked every week. This week, check your own sending domain: is there exactly one SPF record, is the DKIM signature on, is DMARC set up at least with none? Every no is a gap to close before your first cold email. Infrastructure opens the road. In the next episode, we'll talk about the right people to send down that road: where to find lead data. You'll find the other episodes at techsales tr dot com, slash academy. See you next time.
Build this system yourself.
TechSales brings ICP scoring, list verification, email and LinkedIn campaigns and every reply into one place.
Next episode: 04 · Where to Find Lead DataRead