Cold email infrastructure: the complete checklist

Key takeaways

Warm up new domains progressively, not all at once, or you’ll trigger spam filters.
Set up SPF, DKIM, and DMARC before sending a single campaign, otherwise mail providers reject the mail.
Rotate sending domains and IP addresses weekly so inboxes stay fresh and avoid reputation clustering.
Use a dedicated IP only after you’ve hit 10,000 sends from a warm domain, otherwise you start at zero reputation.
Monitor bounce rates and engagement metrics daily, because a single spike can tank your deliverability overnight.

Most teams we see who try cold email treat infrastructure like an afterthought—something you bolt on after you’ve written the sequence. Then they wonder why their replies stay at 0.5% and their domains get suspended after two weeks. I’ve booked 300-plus meetings a quarter across two million cold emails sent, and the difference between a campaign that scales and one that gets blacklisted almost always comes down to how the infrastructure was built from day one. If you’ve failed at cold email before, this checklist is written for you: we’re going to cover the exact steps to set up domains, authenticate properly, warm up gradually, and keep your sender reputation healthy so your messages actually land.

Domain strategy and acquisition

The first decision you make is whether to use your primary business domain or a separate one for cold outreach. Most experienced operators advise against touching your main domain because any deliverability issues—spam complaints, high bounce rates—spill over into your brand’s primary email and can hurt customer trust. Instead, buy a few aged domains that match your niche closely enough that recipients don’t flag them as irrelevant, but distinct enough that any reputation damage stays isolated. Look for domains that have been registered for at least a year, have a simple WhoIs record, and avoid any that were previously used for spam; a clean history gives you a better starting reputation than a brand-new domain with no history.

Once you have your domains, set up the mailboxes you’ll actually send from. A common mistake is creating one mailbox per domain and blasting thousands of emails from it. In our experience, keeping 3–5 mailboxes per domain spreads the sending volume, makes rotation easier, and looks more natural to mail providers. Each mailbox should have a clear, human-sounding name—info@, sales@, hello@—and a complete profile with a profile picture, a signature, and a reply address that matches the domain. Fill out the “about” section if the platform supports it; mail providers look at these signals when deciding whether to trust a sender.

Authentication: SPF, DKIM, and DMARC

Authentication is non-negotiable. If you send without SPF, DKIM, and DMARC set up, most major mail providers will either reject the mail outright or dump it into the spam folder before a recipient ever sees it. SPF (Sender Policy Framework) tells receiving servers which IP addresses are allowed to send email for your domain; you’ll add a TXT record pointing to your ESP or sending platform. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message; you generate a public key that receiving servers verify against the private key held by your sending system. DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together and tells receivers what to do if neither passes—typically quarantine or reject—and gives you feedback reports so you can see if someone is spoofing your domain.

Set these up before you send a single campaign. I’ve seen teams skip authentication thinking they’ll “just fix it later,” and by the time they do, their sending reputation is already shot and they’re starting from scratch. The reports you get from DMARC are gold: they show you exactly how many messages passed or failed authentication, and whether there’s a pattern of spoofing or misconfiguration. Pay attention to those reports for the first few weeks; they’ll tell you if your infrastructure is solid or if something needs fixing before you scale.

Warm-up process that actually works

Warm-up is the phase where you gradually increase sending volume from a new domain so mail providers learn that your mailbox is a legitimate sender, not a spammer. Most teams we see start with 10–20 sends per day and ramp up 10% every 3–4 days until hitting 100–150 per day over 3–4 weeks. The key is consistency: send at roughly the same times each day, and include natural-looking engagement—replies, forwards, opens if your ESP supports it. If you try to go from 0 to 500 sends on day one, spam filters will flag the sudden spike and your domain will land in the junk folder before you’ve sent your first valuable reply.

Engagement matters more than volume during warm-up. Encourage recipients to reply, even if it’s just “thanks” or “not interested”; those positive signals tell mail providers that your mailbox is wanted. Some teams use automated warm-up services, but we’ve found that manual outreach to a small, targeted list of colleagues, friends, or existing customers produces more reliable results because the engagement looks authentic. Stop warm-up only when you’ve hit your target daily volume and your delivery rate stays above 95% for a full week. Rushing this phase is the fastest way to see your bounce rate climb and your domain get suppressed.

Sending limits, IP rotation, and dedicated IPs

Mail providers impose sending limits to protect their users from spam, and those limits vary by provider and even by individual mailbox health. Gmail and Outlook, for example, typically cap daily sends at 50–100 messages for a fresh mailbox, and those limits can increase as your reputation improves. Starting with a dedicated IP address before you’ve established a sending history is a mistake we see repeatedly; you begin with zero reputation on a clean IP, and mail providers treat that with suspicion. Instead, use the shared IP that your ESP provides for the first 10,000–20,000 sends from a warm domain, then evaluate whether a dedicated IP makes sense for your volume.

Rotation of domains and IP addresses is how you keep your reputation fresh and avoid the clustering effect where one bad mailbox drags down all others under the same IP. We rotate sending domains every 2–3 weeks, and we rotate IP addresses when we hit the volume thresholds our ESP recommends—usually after sustained high-volume sends. If you’re using multiple mailboxes under one domain, spread the sends evenly across them rather than letting one mailbox do all the heavy lifting. This distribution prevents any single mailbox from shouldering too much spam risk and makes it easier to identify which mailbox might need a break if engagement drops.

Content and formatting to avoid spam triggers

Even with perfect infrastructure, the content of your emails can trip spam filters if you’re not careful. Avoid subject lines that are all caps, excessive punctuation (!!!), or spammy words like “free,” “guaranteed,” or “risk-free” especially in the first few words. Keep the ratio of text to images high; an email that’s 80% image and 20% text looks like a marketing blast rather than a personal message. Include a plain-text version of every HTML email you send; most ESPs do this automatically, but double-check that the plain-text version isn’t just a stripped-down copy that looks hollow—it should read naturally and include your signature.

Links also matter. Too many outbound links, especially to domains that aren’t warmed up or have poor reputations, can trigger filters. Keep internal links to a minimum and make sure any external domains you link to are reputable and relevant. If you’re using link tracking parameters (UTM codes, etc.), place them at the end of the URL so the core link looks clean. One practice that works well is to hide the full URL behind a short, descriptive phrase like “read more here” rather than dumping a long, parameter-heavy URL in the body. The goal is to make the email look like a one-to-one conversation, not a mass mailing.

Monitoring metrics and iterating

Set up a dashboard that tracks your most important deliverability metrics daily: send volume, bounce rate, spam complaint rate, open rate, and reply rate. Most ESPs provide these natively, but if you’re sending at scale you may want a dedicated deliverability platform that aggregates data across all your domains and mailboxes. A bounce rate above 2% per campaign is a red flag; above 5% and you’re at risk of being suspended. Spam complaint rates should stay below 0.1%; anything higher and mail providers start investigating your sender profile. If you see either of those numbers creep up, pause sends immediately and diagnose what changed—was it a new domain, a new mailbox, a content tweak?

The data you collect should drive your next iteration. If open rates are sub-20% after two weeks, test different subject lines or send times. If reply rates are stagnant, revisit the opening line of your sequence to see if it’s resonating with the target persona. We typically run A/B tests on subject lines every campaign, and we’ll rotate entire sequences every 4–6 weeks to keep the content fresh for recipients who might be seeing the same flow multiple times. The infrastructure you’ve built makes this iteration possible; without good data, you’re just guessing.

Common mistakes that tank deliverability

One of the biggest mistakes we see is buying email lists and sending to them without any authentication or warm-up. It’s the fastest route to a blacklisted domain and a damaged sender reputation. Another is neglecting the plain-text version of emails; mail providers compare the HTML and plain-text versions, and if they don’t match or the plain-text looks like generated gibberish, it’s a spam signal. Sending too many attachments—especially .exe, .zip, or .doc files—also blows up spam scores; if you need to share a file, host it on a cloud link and reference the link in the email body instead.

Using no-reply@ addresses is another practice that hurts engagement and can trigger spam filters. Recipients can’t reply to no-reply addresses, and mail providers see low engagement as a sign that the mailbox isn’t wanted. Instead, use a real person’s address or a monitored info@ address that you actually check and respond from. Finally, many teams skip the DMARC reporting phase entirely, leaving the policy set to “none” forever. That gives you the authentication benefits but loses the visibility into who’s trying to spoof you or misconfiguring their end. Move your DMARC policy to “quarantine” after a couple weeks of good delivery, and then to “reject” once you’re confident everything is passing.

Comparing dedicated vs. shared IP warming curves

If you’re deciding between a dedicated IP and a shared IP from your ESP, the main trade-off is control versus speed to volume. A dedicated IP gives you full control over your sender reputation; you’re not affected by other senders on the same IP, but you also have to do all the warm-up work yourself from day one. Most ESPs will tell you that you need 30,000–50,000 sends per month to make a dedicated IP worthwhile, otherwise you’re spinning your wheels warming up an IP that never reaches the volume needed to establish reputation. We’ve used dedicated IPs for high-volume campaigns hitting 100,000+ sends a month, and the payoff is a stable reputation that isn’t swayed by seasonal fluctuations or other senders’ behavior.

Shared IPs, on the other hand, let the ESP handle the warm-up and reputation management across all users on that IP. You can start sending sooner because the ISP already has a baseline of trust, but you’re at the mercy of the other senders sharing that IP—if one company on the shared IP suddenly spikes volume or gets lots of spam complaints, your delivery rate can suffer even if you’re playing by the rules. For most teams sending under 50,000 emails a month, a shared IP is the pragmatic choice. As your volume grows and you hit that 30,000+ threshold, evaluate whether the added control of a dedicated IP justifies the extra warm-up time and monitoring overhead.

Conclusion

Building cold email infrastructure that actually lands isn’t sexy, and it’s definitely not a set-it-and-forget-it task. I’ve seen campaigns fail because someone skipped DMARC setup, others crash and burn when they tried to warm up a domain in a week instead of a month, and many more waste money on dedicated IPs they never needed. The checklist above is the result of sending two million emails and booking 300+ meetings a quarter: follow the domain strategy, authenticate fully, warm up gradually, monitor your metrics, and iterate based on what the data tells you. If you’d rather spend your time writing sequences and closing deals than troubleshooting deliverability, OutboundLeadPro handles the infrastructure side so you can focus on the outreach that actually converts.

Frequently asked questions

What is the ideal warm-up timeline for a new domain?

Most teams we see start with 10–20 sends per day and ramp up 10% every 3–4 days until hitting 100–150 per day over 3–4 weeks.

Can I use my primary business domain for cold outreach?

We advise against it; using a separate, aged domain protects your main brand reputation if something goes wrong.

How many email addresses should I keep per domain?

Typically 3–5 mailboxes per domain keeps volume manageable and makes rotation easier to track.

What’s the fastest way to get blacklisted?

Buying a list and blasting without authentication or warming up the domain.