This post is a hands-on setup checklist. If you want the bigger picture first, read Cold email that works: land, list, then ask for the order to fix things in, and Cold email infrastructure that won't burn your domains for how the whole sending stack fits together. Here we stay on one question: is your setup ready to send, and how do you keep it that way?
Why good copy can't fix a bad inbox
Inbox providers decide where your email goes before anyone reads it. They look at who is sending, whether the sender can be verified, how the domain has behaved in the past, and how recipients react. If those signals are weak, the email goes to spam or gets rejected. Your subject line never gets a chance.
That is why deliverability problems are so frustrating. Replies drop, so people rewrite the copy. But the copy was never seen. The fix sits in the setup, and the setup is mostly a checklist you can work through in order.
The setup checklist, step by step
1. Use a separate domain for outreach
Never send cold email from the domain your business runs on. Your main domain carries invoices, password resets, client replies and team mail. If cold outreach hurts its reputation, all of that can start landing in spam too.
What to do:
- Register one or more outreach domains that clearly relate to your brand, for example a close variation of your main name.
- Set up a simple website or a redirect to your main site, so a curious recipient who types in the domain sees something real.
- Create a small number of real mailboxes on each domain, with real names and a profile photo where your provider supports it.
- Keep transactional and customer mail on the main domain only.
How to check it: look at the “From” address of every active cold campaign. None of them should be your main domain.
2. Set up SPF, DKIM and DMARC before the first email
These three DNS records let inbox providers confirm that mail claiming to be from your domain is really from you. Many large providers now expect them from bulk and outreach senders, so treat them as required.
- SPF lists which services are allowed to send mail for your domain. You publish one TXT record. Only one SPF record per domain is allowed, so if you use several services, combine them into one record.
- DKIM adds a digital signature to each email. Your email provider gives you the record to add. Turn signing on in the provider after you publish it.
- DMARC tells providers what to do when SPF or DKIM checks fail and where to send reports. A common starting point is a policy of
p=nonewith a reporting address, then moving toquarantineonce you're confident everything legitimate passes.
How to check it: send a test email to an inbox you control, open the original message or headers, and look for SPF, DKIM and DMARC results. All three should show “pass”. Free online DNS lookup tools can also confirm the records are published correctly.
The carousel lists this step last, but in practice you set it up first, before warm-up, because warm-up on a domain that fails authentication builds the wrong history.
3. Warm up every inbox for 2 to 3 weeks
A new mailbox has no history. Inbox providers are cautious with senders they don't know. Warm-up builds that history slowly with small amounts of normal-looking mail that gets opened and replied to.
What to do:
- Turn on warm-up for every new inbox, not just the first one.
- Start small and increase gradually over 2 to 3 weeks.
- Send a few real, one-to-one emails from each inbox too, to people you know who will reply.
- Keep warm-up running at a low level after you start campaigns, if your tool supports it.
How to check it: each inbox should have at least two weeks of warm-up history before its first cold email. Write the start date down so you don't guess.
4. Keep each inbox to a modest daily volume
Sending a lot from one mailbox is one of the fastest ways to hurt its reputation. Sudden jumps look like spam behaviour. Instead of pushing one inbox harder, spread the work across several inboxes and domains.
What to do:
- Set a daily cap per inbox in your sending tool and keep it conservative. Your tool's own recommendations are a sensible starting point.
- Ramp up slowly when a new inbox moves from warm-up to live sending.
- Spread sends across the working day instead of firing them all at once.
- If you need more volume, add inboxes rather than raising the cap.
How to check it: look at sends per inbox per day for the last week. No inbox should spike far above its usual level.
5. Clean the list before it touches your inboxes
Bounces are a strong negative signal. Verify email addresses before you upload them, remove role addresses you don't actually want to reach, and suppress anyone who has bounced, unsubscribed or asked not to be contacted. Include a simple way to opt out in every email, and honour it quickly.
The monthly check
Setup is not one-and-done. Records get overwritten when someone changes DNS or adds a new tool. Inboxes drift. Put a recurring reminder in your calendar and go through this once a month:
- SPF, DKIM and DMARC still pass on a fresh test email from each domain
- Only one SPF record per domain, and it includes every service that sends for you
- DMARC reports show no unknown services sending as your domain
- Bounce rate per inbox is low and not rising
- Spam complaints are near zero
- Daily volume per inbox is within your caps
- Warm-up is still running on every inbox
- No inbox or domain has been flagged or blocked by your provider
Full setup checklist
- Outreach domains separate from the main domain
- Outreach domains have a basic site or redirect
- Real-name mailboxes created on each domain
- SPF published (one record), DKIM published and signing on, DMARC published with reporting
- Test email shows SPF, DKIM and DMARC pass
- Warm-up running 2 to 3 weeks per inbox before campaigns
- Daily cap set per inbox, with a gradual ramp
- List verified, suppression list loaded, opt-out in every email
- Monthly check scheduled
Common mistakes
- Two SPF records. Adding a second SPF record for a new tool breaks SPF for the whole domain. Merge them into one.
- Publishing DKIM but never turning it on. The record alone does nothing if your provider isn't signing.
- Warming up only the first inbox. Every new mailbox starts from zero.
- Raising caps to hit a target. Add inboxes instead.
- Setting it up and never checking. A DNS change months later can quietly break authentication.
- Judging health by open rates. Open tracking is unreliable. Bounces, complaints and replies tell you more.
FAQ
Why shouldn't I send cold email from my main domain?
Because your main domain's reputation also affects invoices, client replies and everyday business mail. If cold outreach damages it, that important mail can start going to spam as well.
How long should I warm up a new inbox?
Plan for 2 to 3 weeks of gradual warm-up before sending campaigns, and keep warm-up running at a low level afterwards if your tool allows it.
What are SPF, DKIM and DMARC?
They are DNS records that prove your email is really from your domain. SPF lists approved senders, DKIM signs each message, and DMARC sets what happens when checks fail and sends you reports.
How often should I check my deliverability setup?
Once a month is a good routine, plus any time you change DNS, add a new sending tool or notice a drop in replies.
More on the Sheik Oli blog.