Outbound Deliverability: Domains, Warmup and the Arithmetic of Volume

A team doubles its outbound target, buys more seats in the sequencer, and imports a list. Three weeks later replies have stopped, and it takes another month to find out why: the mail has been arriving in spam for a fortnight. Nobody noticed, because the sequencer reported everything as delivered.

Delivered means accepted by the receiving server. It says nothing about which folder the message landed in, and that gap is where outbound programmes quietly die. Everything below decides it, and it is almost always someone's side project until the week it becomes an emergency.

Never send cold mail from the domain your invoices come from

The primary domain carries invoices, password resets, customer notifications and recruiting. Cold outbound risks all of that for a marginal gain in perceived legitimacy. One bad list and the domain finance relies on sits in spam folders for months.

So: secondary domains registered for the purpose. Buy close variants a human would recognise and not suspect. Prefixed or suffixed forms of the brand on a mainstream TLD work: try-, get-, -hq, the .io or .co of an existing .com. Strings of hyphens, appended numbers and the cheap new TLDs that spam operations favour do not, because receivers weight TLD reputation.

Register two to four, then leave them alone, because domain age is a signal and three to four weeks before first send is the minimum. During that window point each at something real: a redirect or a small page, a valid MX record so replies arrive, a working postmaster address. The readiness audit treats this as a layer, because it is one.

The DNS records that actually decide whether you land

Three records, each failing in a specific way.

SPF publishes which servers may send for the domain. One TXT record, never two, because a second invalidates both. The trap is the ten DNS lookup limit: every include: costs lookups, and includes have includes. Cross ten and evaluation returns permerror, which many receivers treat as a failure. Count yours with a validator, remove providers you no longer use, and end with ~all or -all.

DKIM signs the message cryptographically. Use a 2048-bit key where the provider supports it, published under a selector so keys rotate without downtime. Rotate annually and immediately when a sending platform changes. A key unchanged in DNS for four years across three vendors is a liability nobody owns.

DMARC ties the two together by requiring alignment: the domain passing SPF or DKIM must match the visible From header. Publish p=none with a rua reporting address, read the aggregate reports for two to four weeks and find the legitimate senders you forgot about, then move to p=quarantine and finally p=reject. Leaving p=none indefinitely is not a policy, it is monitoring with no protection.

The ten minute check: send one message to a Gmail address, choose Show original, confirm three PASS lines for SPF, DKIM and DMARC, then confirm the signing domain matches the From domain. Almost nobody runs it before a campaign.

What mailbox providers now require, and the number that matters most

Google and Yahoo formalised bulk sender requirements in 2024 and Microsoft has followed. Authentication with SPF and DKIM, a DMARC record, alignment on the From domain, easy unsubscription honoured within two days, and a spam complaint rate below 0.3 percent, with 0.1 percent the healthy level.

One-click unsubscribe, meaning the List-Unsubscribe header with List-Unsubscribe-Post, is required for bulk marketing mail. Whether individually addressed B2B outbound counts as bulk is argued about endlessly and the argument is not worth having: include a plain opt-out line a human can act on and process it into a global suppression list within hours. Complaint rate is the number to watch above all others, because it is recipients telling the provider directly that your mail is unwanted.

Warmup does one narrow thing, and buying a network does not do it

Warmup builds a sending history at the receiving providers, so a new domain and mailbox have a track record before real volume arrives. Three to four weeks at minimum, six to eight for comfort, ramping from five a day toward target.

Warmup networks are mailboxes that send to each other and mark each other's mail as important. They produce a pattern: reciprocal traffic between accounts in overlapping infrastructure, opened and replied to with a regularity no human exhibits. Providers detect exactly this. Treat a warmup service as a floor against cold-start effects, never as reputation. What builds reputation is people who receive your mail and reply, which makes list quality a deliverability variable rather than only a conversion one.

Scale by inboxes, not by sends

The working range is twenty to forty new cold contacts per mailbox per day, and conservative operators sit at twenty to thirty. The arithmetic is unforgiving.

Three mailboxes per domain across three domains gives nine inboxes. At thirty a day that is 270 contacts, roughly 5,400 a month before follow-ups. A thousand a day needs something like thirty-three mailboxes, meaning more domains, continuous warmup cycles, more signatures, more monitoring and a real cost per seat. Outbound volume is a capital decision about infrastructure, not a number you raise in a settings panel.

Within that, spread sends across working hours with randomised intervals rather than firing a batch at nine, cap totals per domain and not only per mailbox, and reserve daily capacity for follow-ups. The outbound spec records these once, the only way they survive a quarter.

The four numbers worth monitoring, and where to read them

Hard bounce rate first: under 2 percent, investigate at 3, stop at 5. Verify lists before import and put catch-all domains, which cannot be verified, in a separate lower-priority bucket rather than pretending they are clean.

Complaint rate second, as above. Domain reputation third, from Google Postmaster Tools, which needs a DKIM-signed domain and enough volume to report, and from Microsoft SNDS for your own IPs. Blacklists fourth: check sending domains and link domains against Spamhaus and the other major lists weekly, because a listing on a link domain damages you as much as one on the sender. And watch reply rate as the leading indicator: halving with no change to copy or targeting is usually a placement problem, visible weeks before anything else moves.

Deliverability is a constraint you manage, never a problem you solve

No configuration finishes this work. Reputation decays with silence and with volume spikes alike, provider rules change without notice, and one careless campaign against a stale list costs a domain several months, with recovery consisting mostly of waiting.

More importantly, no amount of DNS correctness rescues a list that should not have been contacted. Perfect authentication delivers unwanted mail reliably to the inbox, where people mark it as spam. Deliverability engineering buys the right to be read by people who might want to hear from you. It cannot manufacture those people, and teams that treat it as a technical fix for a targeting problem burn domains at a predictable rate. The copy side of that boundary is personalisation in outbound.

Frequently asked questions

Why should cold email never be sent from your main company domain?

Because the primary domain carries invoices, password resets, customer notifications and recruiting, and a damaged sending reputation affects all of them. Cold outbound produces complaints and bounces at rates normal business mail never does, and recovery takes months. Use secondary domains on mainstream TLDs, aged three to four weeks before first send, each with a real MX record and a page behind it.

What SPF, DKIM and DMARC settings does cold outbound need?

One SPF TXT record per domain, under the ten DNS lookup limit and ending in ~all or -all, since exceeding the limit returns permerror and many receivers treat that as a failure. DKIM with a 2048-bit key under a rotatable selector, rotated annually and whenever a sending platform changes. DMARC starting at p=none with a reporting address, read for two to four weeks, then p=quarantine and finally p=reject, with SPF or DKIM aligned to the visible From domain. Verify by sending to Gmail and reading Show original.

How many emails per day can one inbox send?

Twenty to forty new cold contacts per mailbox per day is the working range, and twenty to thirty is what most healthy programmes use. Scale by adding mailboxes and domains, not by raising the per-inbox number: nine inboxes at thirty a day is 270 contacts, and a thousand a day needs roughly thirty-three mailboxes, each with its own warmup, signature, cost and monitoring.

Does an email warmup service fix deliverability?

No. Warmup builds an initial sending history so a new domain is not cold-started, but warmup networks generate reciprocal traffic between accounts in shared infrastructure, a pattern providers detect. Real reputation comes from recipients who open and reply because the mail was relevant. A warmup service is a floor, not a substitute for a list worth sending to.