Cold email infrastructure, and how we broke ours

Your main domain never sends cold email

This is the one rule with no exceptions. Cold email carries bounce risk, spam-complaint risk and blocklist risk. If your primary domain absorbs that, you lose the mail your business depends on: invoices, support threads, password resets, replies from customers.

Buy separate domains for sending. Point them at the same brand so a curious prospect finds something real, but keep the mail streams completely apart. The reputation of a sending domain is a consumable, and you should plan for consuming it.

Vary the domain names, and take this one seriously

Everyone knows to buy several domains. Far fewer people think about what they are called, and this is where we made an expensive mistake.

We bought a set of sending domains built on obvious variations of one brand word. It was tidy, easy to manage, and instantly recognisable as a pattern. That is precisely the problem: a pattern legible to you is legible to a filter, and blocklists cluster on exactly this signal.

The rule: if you can describe your domain set in one sentence, so can a filter. Vary the stem, not just the suffix.

How many mailboxes, and how many per domain

Work backwards from volume. A warmed mailbox sustains roughly 20 to 30 cold sends per day. That is the working ceiling, not a target to beat, and pushing past it is one of the fastest ways to damage a domain.

Three to five mailboxes per domain is a sensible default. It keeps any single domain's exposure small, and it means losing one domain costs you a slice of capacity rather than a third of it.

Some providers group mailboxes far more densely, and we run domains carrying around 49 mailboxes where the provider is built for it. That works, but understand the trade: it concentrates risk, and it changes how you have to read your own metrics, which is the subject of section 05.

Warmup is a schedule, not a switch

A new mailbox on a new domain has no sending history, and receivers treat unknown senders with suspicion by default. Warmup builds that history by sending small, growing volumes that get opened and replied to.

Plan on two to three weeks before real campaign volume, and keep warmup running underneath live sending rather than switching it off the day you start. A rough ramp that works: a handful of sends per day in week one, scaling gradually through week two, reaching the 20 to 30 ceiling in week three.

Domain age matters separately from mailbox age. A domain registered yesterday is a weaker signal than one registered six months ago, regardless of warmup. Buy sending domains before you need them and let them sit.

Retire mailboxes on bounce rate, never on reply count

This is the least intuitive thing on this page and the one that will save you the most wasted effort.

It is tempting to look at a mailbox with one reply next to a neighbour with six and conclude the first one is burnt. That conclusion is almost always wrong. Sending platforms distribute volume across the mailboxes on a domain, so any individual mailbox's reply count is a small sample of a shared pool. Per-mailbox reply rate is noise. Reply performance is a property of the domain, and of the copy and list, not of one mailbox.

Bounce rate is the opposite. Deliverability is genuinely mailbox-specific, so a single mailbox with a high bounce rate is a real, isolated problem worth acting on even when its domain is healthy.

We run this as a daily snapshot so decay shows up as a trend rather than a surprise. A domain whose reply rate is drifting down over two weeks is a far more useful signal than a single day's number.

Authenticate everything, then verify what is actually published

Every sending domain needs SPF, DKIM and DMARC before its first send. Gmail and Yahoo require all three from bulk senders, and everyone else weighs them.

The trap here is assuming that what you configured is what is live. SPF in particular fails silently: the specification allows a maximum of 10 DNS lookups per evaluation, every include costs at least one and usually more, and crossing the limit turns the whole record into a permanent error. Your DNS panel will show the record sitting there looking perfectly correct.

Build the records with the SPF and DMARC generator, which counts lookups as you add providers, then confirm what is actually resolving with the deliverability checker. When a message goes wrong, the header analyzer tells you what the receiver actually saw.

Should sending domains redirect to my main site?

Yes. A sending domain with nothing behind it is a weak signal. Put up a real page, or redirect to your main site. A prospect who checks should find something legitimate, and so should a filter.

Google Workspace or Microsoft 365?

Both work. Microsoft tends to be cheaper at volume and supports much denser mailbox grouping per domain. Google tends to be simpler to administer. What matters more than the choice is that you authenticate properly and respect the per-mailbox ceiling.

Can I recover a blocklisted domain?

Sometimes, through the blocklist's delisting process, but treat recovery as a bonus rather than a plan. Reputation recovery is slow and uncertain. The cheaper move is usually to retire the domain and replace it, which is why domain naming diversity matters so much: it caps how much you lose at once.

How much should this cost?

Domains are a few dollars a year each. Mailboxes are the real cost and scale roughly linearly with volume. We publish our full modelled infrastructure cost by volume tier on the agency cost page and in the ROI calculator.