Most cold email problems are deliverability problems that get misdiagnosed as copy problems. The open rates are low. The reply rates are low. The instinct is to rewrite the subject line. The actual problem is that the emails are going to spam before anyone reads them.
We have a diagnostic threshold: after 200 emails sent, a healthy domain should produce at least a 1% reply rate. Below that, something is broken in the infrastructure, not the copy. The audit starts with authentication.
Here is the full setup we run for every new client before a single email goes out.
Why the Primary Domain Can Never Send Cold Email
The first rule of email infrastructure: the primary business domain does not touch cold email sequences.
Your primary domain, the one your team emails from, the one on your website, has a reputation that took years to build. It is what gets you to the inbox when you email customers, partners, and vendors. Cold email from a list degrades that reputation permanently. One bad campaign can take your deliverability from excellent to damaged, and recovery is slow.
We set up dedicated sending domains for every client. These domains are variations of the brand, prefixes, suffixes, or slightly different TLDs, that are purchased specifically for outbound campaigns. The primary domain stays untouched.
Domains and Inboxes
Domain naming: Short, clean domains that look like real brands. Common patterns: go{brand}.com, try{brand}.com, {brand}hq.com. We avoid hyphens, numbers, and anything that reads as throwaway. The domain should look like a real company could legitimately own it.
Domain registrar: For most clients, we use Dynadot for domain purchase. For Build to Scale campaigns, domains are on Porkbun. After purchase, nameservers are pointed to Zapmail, which provisions the DNS records and inboxes.
Inbox count per domain: We create two to three inboxes per domain. Email providers flag high-volume single-inbox senders. Multiple inboxes on the same domain share the sending load while maintaining the domain's reputation.
Volume limits: Each inbox sends a maximum of 30–40 emails per day. This is well below the thresholds that trigger spam filters. Volume scaling happens only after inboxes have warmed.
DNS Authentication, The Non-Negotiables
Three records need to be in place before any inbox goes live. We verify each one with dig commands before sending.
SPF (Sender Policy Framework): Declares which servers are authorized to send email from your domain. An SPF record that is missing or incorrectly configured allows spammers to spoof your domain, and trains email providers to distrust it.
A valid SPF record looks like: v=spf1 include:zapmail.ai ~all
DKIM (DomainKeys Identified Mail): A cryptographic signature that proves the email was actually sent from your server and not modified in transit. Zapmail uses default as the DKIM selector. We verify it is present and valid on every domain.
DMARC (Domain-based Message Authentication, Reporting, and Conformance): Tells receiving servers what to do when SPF or DKIM fails, and where to send reports. We start with p=none for new domains, monitoring mode, not blocking, and move to p=quarantine once the domain has a sending history.
Zapmail handles DNS provisioning automatically once the nameservers are pointed. The audit we run after setup checks all three records are resolving correctly before any sending starts.
The Warmup Protocol
New inboxes cannot start at full volume. Email providers track the sending history of every domain and inbox. An inbox that sends zero emails for months and then suddenly sends 100 per day looks like a compromised account. It gets filtered.
Warmup is the process of building a legitimate sending history. We use Smartlead's warmup network for this. Smartlead routes small volumes of emails to other inboxes in the warmup pool, those inboxes receive the emails, mark them as not spam, and occasionally reply. It simulates real engagement.
Warmup timeline:
- Week 1–2: Warmup only, no campaign emails
- Week 3: Campaign sends at 20% of target volume
- Week 4: 50% volume
- Week 5+: Full volume, warmup remains running alongside campaign sends
We never turn warmup off. For the full list of tools in this setup, see The Outbound Stack We Use and Why. The warmup network is always running alongside active campaigns, maintaining engagement signals that offset the cold-email reputation risk.
Monitoring during warmup: Smartlead's inbox health dashboard shows warmup status, reputation score, connection success rates, and whether the inbox has been blocked. We check this weekly for each client's infrastructure. Any inbox flagged as blocked gets pulled from active campaigns immediately.
Volume Ramp and the 1% Rule
After the warmup period, campaigns launch at controlled volume. The benchmark we use: after 200 emails sent from a domain, overall reply rate should be at least 1%.
Below 1% after 200+ sends is a diagnostic flag. Not necessarily a deliverability problem, could be copy, targeting, or list quality, but it is the threshold that tells us to stop scaling and run the audit first.
The audit checks in this order:
- Spam placement test, are emails reaching inboxes?
- Bounce rate, if above 2–3%, list quality is the problem
- Domain authentication, are SPF/DKIM/DMARC all resolving correctly?
- Inbox health, are any inboxes flagged as blocked?
- Copy, only after infrastructure is confirmed clean
Most deliverability problems that look like copy problems are actually bounce rate problems or spam placement problems. A clean contact list is the other half of the equation. Copy is the last thing to check.
What We Check Weekly
Infrastructure is not set-and-forget. We run a weekly health check on every active client's sending infrastructure.
- Bounce rate per domain: any domain above 2% gets investigated before more sends go out
- Inbox health in Smartlead: warmup status, reputation score, connection failures, blocked flags
- Reply rate by domain: if one domain is underperforming relative to others on the same campaign, it goes into the audit queue
- DNS records: occasionally records get dropped by registrar changes or zone file errors, we verify monthly
When something looks off, we run the full audit, spam placement test included, before scaling or launching a new campaign from that infrastructure.
The primary domain is sacred. The sending domains are tools. Treat them accordingly. A sending domain that gets damaged by a bad campaign is replaceable in days. A primary domain with degraded reputation affects every email your business sends, and recovery takes months.
Frequently Asked Questions
How many sending domains do you set up per client? Typically two to four, depending on the campaign volume. Each domain carries two to three inboxes, so four domains give you eight to twelve inboxes and 240–480 emails per day of sending capacity. Most clients start with two domains and expand as the campaign proves out.
What if the warmup period is already running and a campaign needs to launch sooner? We do not cut the warmup short. The warmup period exists because email providers can see sending history, a domain with two weeks of engagement history behaves differently from one with zero. Cutting it in half typically produces worse deliverability for the first month of sending. The two weeks pays for itself.
What does a domain reputation problem look like in practice? Reply rates drop without explanation. Open rates stay similar (opens can be inflated by security scanners) but genuine replies decline. Running a spam placement test through Smartlead's Smart Delivery shows what percentage of emails are landing in the primary inbox versus spam. If spam placement is above 20–30%, the infrastructure needs repair before any more volume goes out.
Can you recover a domain once it's been flagged? Sometimes. It depends on how far the reputation has degraded. A domain with a minor reputation hit can often recover with a reduced-volume period, continued warmup, and list cleaning. A domain that has been spam-blacklisted may be too expensive to recover, it is faster to start fresh with a new domain and do the warmup correctly this time. That is why we audit before scaling rather than after.
The primary domain is sacred. The sending domains are tools. Treat them accordingly and most deliverability problems disappear before they start.
We run this setup for every new email client. See how we would do it for yours.