Cold Email Domain Setup: Secondary Domains, SPF, DKIM and DMARC

Yes, you need a separate domain for cold email. Send outreach from a secondary domain, never from your primary company domain. If a cold campaign damages a sending domain's reputation, you want the damage contained on a throwaway lookalike, not on the domain that carries your website, your invoices and your customer support.

This single decision separates outbound programs that survive from the ones that quietly stop working in month three. It costs about twelve dollars a domain and an afternoon of DNS work, and it is the cheapest insurance in the entire outbound stack.

Why not just send from my primary domain?

Because domain reputation is permanent, shared and invisible until it is too late. Every email your company sends from yourcompany.com draws on one reputation score: your marketing newsletters, your password reset emails, your invoice reminders, the reply your account manager just sent to a paying customer, and your cold outreach.

Cold email is the riskiest of those by a wide margin, because it goes to people who did not ask for it. Some of them will hit the spam button. That is not a failure of your copy; it is the base rate of sending unsolicited mail to strangers. When enough of them do it, the mailbox providers downgrade the domain, and the downgrade applies to everything.

The failure mode is genuinely bad. Your invoices land in spam. Your password reset emails stop arriving and customers cannot log in. The contract you sent to a client sits unread in a junk folder for a week. You will find out about this from an angry customer, not from a dashboard. And domain reputation, once damaged, takes months to rebuild, if it rebuilds at all.

A secondary domain makes that entire scenario survivable. If get-yourcompany.com gets burned, you retire it, spin up another, and your actual business never notices.

How many domains do I need for cold email?

Two or three secondary domains is the normal starting point, with two or three mailboxes on each. That gives you six to nine mailboxes, which supports roughly 150 to 400 cold emails a day once everything is warmed, and it spreads risk so a single bad campaign cannot take out your whole sending capacity.

The arithmetic assumes 35 cold emails per mailbox per day, which is the middle of the safe band. If you want the reasoning behind that figure, we cover it in detail in how many cold emails you can send per day. The short version: mailboxes are the unit of capacity, so you buy volume by adding mailboxes, not by pushing existing ones harder.

What domain should I use for cold email?

Pick a close, obvious variant of your real brand. The recipient should be able to glance at the sender address and recognize who you are, because a domain that looks like a disguise reads like a scam. Good patterns:

• Prefix: get-yourcompany.com, try-yourcompany.com, hey-yourcompany.com
• Suffix: yourcompany-hq.com, yourcompanyapp.com, yourcompany-team.com
• Alternate TLD: yourcompany.io, yourcompany.co, yourcompany.net

What to avoid matters just as much. Do not use unrelated words, random strings, or hyphen-heavy monstrosities. Do not use exotic new TLDs like .xyz, .top or .click, which carry poor sending reputations by association and start you in a hole through no fault of your own. Stick to .com, .io, .co or .net. Buy them all at once from a single registrar so renewals and DNS stay manageable, and if you are choosing between a handful of variants it is worth checking what the close matches to your brand actually cost before you commit to a naming pattern.

One more rule: buy the domains and then leave them alone for a bit. A domain registered yesterday that starts emailing today is a red flag. Let it age a couple of weeks while warm-up runs.

Do I need to set up SPF, DKIM and DMARC?

Yes, on every sending domain, without exception. Since the 2024 bulk sender rules and their tightening through 2026, all three are effectively mandatory rather than best practice. A domain missing DMARC will see mail rejected or filtered outright by Google and Microsoft, regardless of how good the content is.

Start DMARC in monitoring mode with p=none so you can see what is failing without blocking legitimate mail, then tighten to p=quarantine once the reports are clean. Jumping straight to a strict policy on a live domain is how people accidentally block their own email.

The custom tracking domain is the step most people skip, and it is a real one. If your emails come from get-yourcompany.com but every tracked link points at some shared tracking domain used by thousands of other senders, you inherit their reputation. Point tracking at a subdomain of your own sending domain instead.

How long does it take before I can send?

Plan on three to four weeks between buying the domain and sending your first real prospect email. It feels slow when there is a pipeline target on the wall, and it is the single most common corner people cut, and cutting it is why their domains die.

1. Day 1. Buy the domains. Set up SPF, DKIM and DMARC. Create the mailboxes. Add a real forwarding redirect from the secondary domain to your main site, so anyone who types it in lands somewhere legitimate.
2. Day 1 to 3. Fill in the mailbox profiles properly: real name, real photo, real job title, a real signature with a physical address. An empty profile is a bot tell.
3. Day 3 to 21. Automated warm-up only. No prospects. The mailboxes exchange real conversations with other real mailboxes and build a sending history from nothing.
4. Day 21 to 28. First live campaign at 10 to 20 emails per mailbox per day. Watch bounce rate and spam complaints like a hawk.
5. Week 5 onward. Ramp toward 35 to 50 per mailbox per day, keeping warm-up running underneath the whole time.

Warm-up never actually stops. It runs continuously beneath live campaigns, replenishing the reputation your cold sends spend. An email warmup tool should handle this automatically rather than being something you remember to switch on.

Can I use Google Workspace for cold email?

Yes, and most teams do. Google Workspace and Microsoft 365 are the two standard choices, and both work fine for cold outreach provided you respect per-mailbox limits and keep every mailbox properly warmed. Google Workspace runs about six dollars per mailbox per month, which is the main cost driver once you are running twenty-plus mailboxes.

The one thing to understand is that Google Workspace's 2,000 emails per day per user limit is not a cold email allowance. It is an infrastructure ceiling. The number that keeps you safe is 20 to 50 cold emails per mailbox per day, and the vast gap between those two figures has swallowed a lot of domains belonging to people who assumed the bigger number was permission.

Once you are running eight or ten mailboxes across several domains, the operational annoyance stops being deliverability and starts being logistics: replies scattered across a dozen inboxes, none of which you check. Some teams solve that by reading every connected mailbox from a single place. The better answer is for your outreach platform to detect the reply, pause the sequence and route it to you, so you never go hunting for it at all.

What does the full setup cost?

Call it $150 to $350 a month all in for a serious nine-mailbox setup sending 300 or so emails a day. Set against a single closed B2B deal, the infrastructure is a rounding error, which is worth remembering the next time the instinct is to save six dollars by sending from the primary domain.

The setup checklist

• Buy two or three secondary domains that clearly resemble your brand, on .com, .io, .co or .net.
• Redirect each secondary domain to your main website so it resolves to something real.
• Configure SPF, DKIM and DMARC on every sending domain. Start DMARC at p=none.
• Set up a custom tracking domain so tracked links match your sender.
• Create two or three mailboxes per domain with real names, photos, titles and signatures.
• Warm every mailbox for two to three weeks before touching a prospect, and never turn warm-up off.
• Verify every email address before it enters a sequence.
• Rotate sends across the mailbox pool and spread them through the working day.
• Keep your primary domain entirely out of it.

That is the whole discipline. It is not complicated, but it is a lot of small things that all have to be right at once, and every one of them is a place where a campaign can quietly break. Cold email software earns its keep by making most of this automatic: AutoMail handles inbox rotation across your whole mailbox pool, keeps warm-up running continuously, runs a spam-score check on every send, and writes personalized sequences that earn the replies your domain reputation feeds on. Your job is to buy the right domains and set the DNS correctly. After that, the machine should be looking after itself.