How to set up a domain for cold email: SPF, DKIM, DMARC and warm-up

Cold email lives or dies on deliverability. The best-written email is worthless if it lands in spam, and inbox providers decide where it lands largely on the reputation and authentication of the domain that sent it. Getting the setup right takes an afternoon, plus a few weeks of patience while new mailboxes build a reputation.

This guide covers the domain, the mailboxes, the three DNS records every sending domain needs, warm-up, and how to check it's all working. Our guide to cold email for B2B startups covers the rest: who to email and what to say.

Why use a separate domain

Your main domain carries the email your business can't afford to lose: invoices, customer support, password resets, replies to investors. Cold email, even done carefully, carries more risk of spam complaints than any of those. If cold email damages a domain's reputation, you want it to be a domain that doesn't matter for anything else.

Microsoft makes the same recommendation in its own documentation: for email services you don't directly control, such as bulk sending, use a subdomain or a separate domain, so problems don't affect the reputation of your main domain.

Many cold emailers prefer a separate domain to a subdomain, because a subdomain still shares its parent's name. Either approach separates the reputation of cold email from your day-to-day email more than sending from your main mailbox.

Choosing the domain

Pick something obviously connected to your brand, so recipients recognize you and don't feel tricked:

• a variation of your name, such as getacme.com, tryacme.com or acmehq.com, if your main domain is acme.com,
• the same extension as your main domain where possible, and
• nothing that imitates another company's brand.

Redirect the new domain's website to your main site, so anyone who checks it lands somewhere real. A new domain has no reputation at all, which is why warm-up matters. Register it for a few years rather than one, and keep it renewing automatically, so a lapsed renewal never takes your mailboxes offline in the middle of a campaign.

Setting up mailboxes

Create mailboxes for real people, with first names, matching display names, a profile photo and a simple signature. Generic addresses such as sales@ get fewer replies and look more like bulk mail.

Many teams use two or three mailboxes per sending domain and add more domains as they grow, rather than sending heavy volume from a few mailboxes. Each mailbox needs its own paid account. On Google Workspace, Business Starter costs $7 per user a month on an annual plan or $8.40 on the flexible plan. Make sure each mailbox can receive mail too, so replies arrive, by keeping the MX records your email provider gives you.

SPF: who is allowed to send

SPF, the Sender Policy Framework, is a TXT record on your domain that lists the servers allowed to send email for it.

For Google Workspace, Google's recommended record is:

v=spf1 include:_spf.google.com ~all

For Microsoft 365, Microsoft's recommended record is:

v=spf1 include:spf.protection.outlook.com -all

The difference at the end is the policy for unlisted senders: ~all is a soft fail and -all is a hard fail. Google recommends ~all for its record. Microsoft recommends -all when DKIM and DMARC are also set up.

Three rules catch people out:

• One SPF record per domain. Two SPF records cause SPF to fail. If another service sends from the domain, add its include to the same record.
• No more than 10 DNS lookups. Each include counts as at least one lookup, and nested includes count too. Exceed 10 and SPF fails with a permanent error.
• Each subdomain needs its own record. The record for acme.com doesn't cover mail.acme.com.

DKIM: a signature on every email

DKIM, DomainKeys Identified Mail, adds a cryptographic signature to each email, which receiving servers check against a public key published in your DNS.

In Google Workspace, generate the key in the Admin console under Gmail authentication. Choose a 2048-bit key if your DNS provider supports it, and keep the default selector, google. Google gives you a TXT record to publish at google._domainkey on your domain. Two timing points: you may need to wait 24 to 72 hours after turning on Gmail before you can generate the key, and after you publish the record it can take up to 48 hours to start working. Messages aren't signed until you click Start authentication in the Admin console.

In Microsoft 365, DKIM for a custom domain uses two CNAME records, at selector1._domainkey and selector2._domainkey on your domain, pointing to values Microsoft gives you in the Defender portal. Once both records are published, you turn on DKIM signing for the domain.

DMARC: what to do when checks fail

DMARC ties SPF and DKIM to the "From" address the recipient sees, tells receiving servers what to do with mail that fails, and sends you reports. It's a TXT record at _dmarc on your domain. A sensible starting record:

v=DMARC1; p=none; rua=mailto:dmarc-reports@acme.com

• p=none asks receivers to report but not change how they handle failing mail. Google recommends starting here.
• rua is the address where aggregate reports go. Use a dedicated mailbox or group, because reports can arrive in volume.

Once reports show your legitimate mail passing, you can move to p=quarantine and then p=reject. For a cold email domain that sends only through one email provider, that can happen fairly quickly.

What Gmail, Yahoo and Outlook require

The large inbox providers now publish sending requirements. The strictest apply to bulk senders, but they're good practice for everyone.

A cold email domain rarely reaches bulk volumes. Set up all three records anyway. It costs nothing, and authenticated mail is treated better.

Tracking links and custom domains

Many sending tools can track opens and clicks by rewriting links through their own domain. Shared tracking domains can carry other senders' reputations. If you track clicks, set up a custom tracking domain, usually a CNAME record your sending tool provides. Many cold emailers turn open tracking off entirely for the first email, since it adds a tracking pixel and opens are an unreliable measure anyway.

Check that everything works

Before warm-up, send a test email from each mailbox to a Gmail address you control. Open it, choose Show original from the message menu, and look for three results near the top:

• SPF: PASS
• DKIM: PASS
• DMARC: PASS

If any fails, check the record for typos, extra spaces or a duplicate SPF record, and allow time for DNS changes to spread. Free online DNS tools can also check each record and count your SPF lookups.

Warm-up: building a reputation

A new mailbox on a new domain has no history, and inbox providers are wary of mail from unknown senders. Warm-up builds a reputation gradually.

• Start small. A handful of emails a day per mailbox in the first week, ideally to people likely to open and reply.
• Increase slowly. Add a few emails a day each week, watching bounces and complaints, over roughly three to four weeks.
• Use automated warm-up. Tools such as Instantly include warm-up that sends emails between real mailboxes in a network, opens them, replies and marks them as important. Instantly's plans include unlimited warm-up.
• Keep warm-up running. Many senders leave it on at a low level even after campaigns start.

Then keep real cold email volumes modest, a few dozen emails a day per mailbox, and add mailboxes rather than volume to grow.

Keep watching after launch

Deliverability isn't something you set up once. Watch three things:

• Bounces. A rising bounce rate means a stale list. Verify addresses before sending.
• Spam complaints. Google and Yahoo want them below 0.3%. Google Postmaster Tools shows your rate once you send enough volume to Gmail.
• DMARC reports. They show which services send as your domain, and whether they pass.

If a domain's results drop sharply, pause it, find the cause, and send only warm-up for a while before you resume.

A setup checklist

• Register a secondary domain and redirect it to your main site.
• Create two or three named mailboxes, with photos and signatures.
• Add one SPF record listing your email provider.
• Turn on DKIM and publish the key.
• Publish a DMARC record at p=none, with a reporting address.
• Set up a custom tracking domain if you track clicks.
• Test each mailbox and confirm SPF, DKIM and DMARC pass.
• Warm up for a few weeks before sending real campaigns.

Once your domain is ready, you need a sending tool and a list. Our comparison of Instantly and Smartlead covers the tools, and our guide to building a B2B lead list covers finding the right people to email.