Cold Email Infrastructure: Domains, Mailboxes, SPF, DKIM, DMARC and Warmup

By Laurel · Updated Oct 8, 2026

Cold email infrastructure is the sending setup behind outbound: secondary domains, the mailboxes on them, the SPF, DKIM and DMARC records that prove each message is authorized, and the tracking, warmup and volume limits that govern how much each mailbox sends. Its job is to keep outreach reputation separate from your main business email.

This article covers the plumbing only. Placement, spam rates and provider rules are in cold email deliverability, and the message is in how to write a cold email. Targeting and follow-ups sit in cold email strategy and the cold email cadences guide, and tool selection in the BDR/SDR tech stack guide. Google and Microsoft publish platform limits, not cold email targets, so per-mailbox numbers from sending-tool companies are labeled as vendor guidance. This is general information, not legal advice.

Key Facts

• Sending more than 5,000 messages a day to Gmail from one primary domain, subdomains included, makes you a bulk sender permanently, and bulk senders need SPF, DKIM and DMARC.
• Google asks senders to keep their spam rate below 0.10% and never reach 0.30%.
• A Google Workspace user can send 2,000 messages a day, and an Exchange Online mailbox is limited to 10,000 recipients a day and 30 messages a minute.
• SPF evaluation stops at 10 DNS-lookup terms; past that, the check returns a permanent error.
• Vendor guidance, not a platform limit, runs from about 40 (Instantly) to up to 50 (Smartlead) cold emails per mailbox per day.

Why Teams Send Cold Email From Secondary Domains

Reputation Follows the Domain

Google's sender guidelines say user spam reports can lower your domain's reputation over time, and Postmaster Tools reports on the domains you authenticate with. Cold email goes to people who haven't asked to hear from you, so complaints are a bigger risk than on customer mail. If outreach shares a domain with invoices and support replies, a bad stretch can hurt all of it.

A separate domain contains that risk. Instantly, which sells sending software, calls secondary domains essential for protecting the primary domain in its secondary domains guide. The vendor has a stake in that advice, but the logic holds: a burned outreach domain can be dropped without touching the main one.

A Subdomain Isn't Enough for Google's Bulk Count

Google's bulk sender FAQ counts messages by primary domain: 2,500 from one domain plus 2,500 from its subdomain add up to 5,000 for the primary domain, and bulk status never expires once earned. So outreach.example.com shares a count with example.com, while a separately registered domain doesn't. Outreach sized like the example below sits far under 5,000 a day, but a permanent label is a reason to keep it off the domain that sends your newsletters.

The Trade-Offs of Lookalike Domains

Secondary domains usually resemble the real one (Instantly's examples are TryXYZCompany.com and GetXYZCompany.com). That helps recognition, and it has costs:

• Identity. The FTC's CAN-SPAM guide says the originating domain name and email address must be accurate and identify the person or business that sent the message. A lookalike containing your brand does that; one that doesn't is harder to defend. Name the real company in the signature either way.
• Impersonation. Google's guidelines say not to impersonate other domains or senders without permission. Mimic your own brand only, never a customer's, partner's or competitor's.
• Prospect checks. Recipients may type the domain into a browser, and an empty page looks like a red flag. Instantly's infrastructure post advises redirecting secondary domains to the main website.
• Replies. Instantly notes that secondary domains don't forward mail to the primary one automatically, so replies need a shared inbox or a CRM.
• Upkeep. Every domain needs DNS records, and every mailbox is a paid seat. Ten domains with three mailboxes each is 30.
• No history. A new domain has none, and Google warns against sudden volume spikes for senders without one. That's where warmup comes in.

And a second domain doesn't make a bad list safe. Complaints still get the outreach domain throttled, and swapping it only resets the problem. Outbound lead generation covers the targeting side.

How Many Mailboxes Per Domain

Vendors disagree. Instantly's secondary domains guide calls three sending accounts per domain best practice, and its infrastructure post suggests three to five inboxes on each sending domain. Smartlead's daily volume guide sets a domain ceiling instead of a mailbox count: keep a single domain under about 500 cold emails a day. These are rules of thumb, not provider limits.

Work backward from volume instead. Say the target is 1,000 first-touch emails a week over five sending days, or 200 a day (outbound pipeline math shows how to derive it). At 30 cold sends per mailbox per day, an assumption below both vendor figures that leaves room for warmup and replies, that's seven mailboxes. At three per domain, that rounds up to three domains and nine mailboxes, covering 270 a day.

SPF, DKIM and DMARC Explained

Three DNS records answer three questions. SPF: is this server allowed to send for this domain? DKIM: did this domain sign the message, and was it altered? DMARC: what should a receiver do when neither check matches the From address the reader sees? Google requires SPF or DKIM from all senders and all three from bulk senders. Yahoo is similar, and Microsoft requires all three above 5,000 a day to consumer Outlook addresses.

SPF: Who May Send

SPF is a list of servers allowed to send mail for a domain. A receiver checks the sending server against it, using the envelope sender (the MAIL FROM address), not the From address people see. Google's SPF setup page gives this record for a domain that sends only through Google Workspace:

example.com.   TXT   "v=spf1 include:_spf.google.com ~all"

include: authorizes Google's servers, and ~all treats anything else as a soft fail. Google recommends ~all; -all is a hard fail. A tool that sends from its own servers on your behalf needs its own include: in the same record.

Two limits trip people up. RFC 7208 says a domain with more than one v=spf1 record returns a permanent error, so add senders to one record. And evaluation allows at most 10 lookup terms (include, a, mx, ptr, exists and redirect), so a pile of includes breaks SPF. Each domain needs its own record, and Google says it can take up to 48 hours to work.

DKIM: Proof of Signing

DKIM adds a cryptographic signature to each message. The sending server signs with a private key, and the public key sits in DNS at the selector, then _domainkey, then the domain. In RFC 6376, d= names the signing domain, s= the selector, h= the signed headers (From must be one), bh= the body hash and b= the signature:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google;
  h=from:to:subject:date; bh=(body hash); b=(signature)

google._domainkey.example.com.   TXT   "v=DKIM1; k=rsa; p=(public key)"

In Google Workspace, DKIM setup generates the key, uses google as the default selector, offers 2048-bit keys where your DNS host allows them, and can take up to 48 hours to start. Creating a mailbox doesn't switch DKIM on, so do it for every new domain.

DMARC: What to Do on Failure

DMARC ties the first two to the visible From address. A message passes when SPF or DKIM passes and the passing domain aligns with the From domain. Relaxed alignment (the default) means they share an organizational domain; strict means they match exactly. The classic failure is a sending tool whose own domain signs the mail: DKIM passes, but not for your domain, so DMARC fails.

_dmarc.example.com.   TXT   "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

p= is the policy (none, quarantine or reject) and rua= is where daily aggregate reports go. Google says a bulk sender's policy can be set to none. Its rollout guide starts at none for a week with daily report reviews, then moves to quarantine in steps, with reject optional. Point rua at a group or dedicated mailbox. RFC 9989 replaced the original RFC 7489, and it drops the pct tag that Google's guide still uses.

To test, send a message to a Gmail address, choose More, then Show original, and look for SPF, DKIM and DMARC all reading PASS.

Custom Tracking Domains, and Whether to Track at All

Open tracking uses an invisible image. Click tracking rewrites links to pass through a tracking domain. Instantly's help center says its default tracking links use a domain shared among customers unless you set your own. A custom tracking domain is a subdomain you own, pointed at the vendor's tracker with a CNAME record. This is Instantly's version; every tool gives its own target:

inst.example.com.   CNAME   prox.itrackly.com.

The case for it comes from vendors. Instantly's tracking and deliverability post argues that shared trackers share reputation and that rewritten links can resemble phishing redirects. It recommends a custom tracking domain, open tracking off on first touches, and judging by replies, but offers no placement data and calls the domain a best practice, not a requirement.

Open tracking is the easier call. Apple says Mail Privacy Protection stops senders using invisible pixels to collect information, so opens are noisy (see cold email subject lines). Instantly's text-only option turns off open tracking and, it says, improves the odds of reaching the inbox. A sensible default: no open tracking, no links in the first email, and a custom tracking domain before tracking clicks on later steps.

Warmup: What It Does and What the Evidence Is

A new mailbox on a new domain has no sending history. Google's guidelines say to avoid sudden volume spikes without a history of large volumes, send at a consistent rate, and cut volume if bounces or deferrals begin. That's the provider-backed part: ramp gradually, stay authenticated, keep complaints low.

Warmup tools go further. Instantly says its warmup enrolls your mailbox in a pool of other customers, opens every warmup email, replies to many and moves any that land in spam to the inbox, which it says builds trust with providers. It advises at least two weeks before campaigns. Smartlead's warmup guide describes a similar pool, a daily ramp-up setting for fresh domains, and 10 to 20 warmup emails a day while a campaign runs.

Every description of that mechanism and its benefit comes from the companies selling it. Google's own guidance for new senders covers volume, authentication and complaints, not pool exchanges, and warmup health scores measure the pool, not your prospects' inboxes. Treat warmup as cheap insurance, not proof. Smartlead's volume guide warns against going from zero to 50 sends in a fresh mailbox's first week, and Instantly suggests a 70/30 split of warmup to cold for newer accounts.

Sending Limits Per Mailbox

Platform limits are enforced by Google or Microsoft. Practical ceilings are what vendors advise to protect reputation, and they sit far lower.

Google says a user who hits a limit can't send for up to 24 hours. Microsoft says Exchange Online isn't suited to bulk mailing, and it throttles the default onmicrosoft.com domain to 100 external recipients per 24 hours, so don't send outreach from it. The binding constraint is reputation, not the platform cap: Google's 0.10% guideline is roughly one complaint per 1,000 messages, which a domain sending 120 a day to Gmail users reaches in about eight days.

Rotating Inboxes

Rotation attaches several mailboxes to one campaign and lets the tool alternate between them. Instantly's inbox rotation article says it rotates sending across selected accounts to make outreach look more natural, and its threading article says follow-ups come from the same account as the first email by default.

The benefit is spreading volume under per-mailbox caps and limiting the damage if one mailbox gets flagged. The cost is bookkeeping: replies arrive in many inboxes, and a struggling mailbox must leave rotation fast. To compare the tools that run this setup, start with Instantly vs Lemlist vs Smartlead, then the alternatives to Instantly, Smartlead and Lemlist.

Setup Checklist

Build It in This Order

Treat the first month as a test of the plumbing, not the pitch. Publish the records, read the authentication results on real messages, start small, and add volume only while bounces and complaints stay low. Whatever sends the mail, replies belong on a lead record with an owner, which is CRM work. Rework's Lead Ops and Sales Ops cover capture, routing and pipeline.