Cold email infrastructure decisions made at domain setup determine the programme's deliverability ceiling. The programme that sends cold outreach from its primary business domain (@company.com) risks contaminating the domain reputation that serves marketing email, transactional email, and inbound email simultaneously. The programme that uses fresh domains without warmup generates complaint rates that blacklist those domains within weeks. The correct cold email domain strategy uses a dedicated infrastructure — separate from the primary business domain, correctly authenticated, properly warmed, and monitored continuously — that contains the reputation risk of cold outreach while enabling sustainable sending at commercial volumes.
Why Cold Email Must Use a Separate Domain
Cold email generates complaint rates significantly higher than opt-in email — typically 0.08-0.50% depending on targeting quality, personalisation, and list hygiene. These complaint rates are incompatible with the reputation requirements of marketing and transactional email programmes, which need to stay below 0.05% to maintain High Gmail domain reputation. Sending cold outreach from the primary business domain means the higher cold email complaint rates drag the domain reputation used by every other email the business sends.
The practical consequence: a sales team that starts sending 500 cold emails per day from @company.com in Q3 may find the marketing newsletter experiencing declining inbox placement by Q4 — not because anything changed with the newsletter, but because the domain reputation built over years of good newsletter practice is being eroded by the cold email complaint signals. The marketing team cannot diagnose the problem because they have not changed anything — the change happened in a different team using the same domain.
Separate cold email domains contain this risk. When the cold email domain @company-hq.com generates a complaint spike, the reputation damage is confined to that domain. The primary domain @company.com remains unaffected. The newsletter and transactional email continue delivering at full quality while the cold email team investigates and resolves the domain issue in isolation.
Choosing the Right Cold Email Domain
Cold email domains should meet several criteria to maximise deliverability and minimise suspicion from recipients:
Brand-adjacent but distinct: The domain should be recognisably associated with the company without being the primary domain. Examples: if the primary domain is acmecorp.com, acceptable cold email domains include acmecorp.io, acmecorp.co, acme-corp.com, getacme.com, hellofrommacme.com. The recipient should be able to verify the company's identity from the domain without the domain being identical to the primary domain.
Age requirements: Newly registered domains (less than 30 days old) start with zero domain reputation and the highest spam filter scrutiny. Purchase cold email domains 60-90 days before needing to send from them — this gives the domain age that reduces some initial spam filter suspicion before warmup begins. Alternatively, purchase aged domains (1-2 years old with no previous sending history) — the age provides a reputation foundation without any negative history.
TLD selection: .com TLDs are generally the strongest for cold email deliverability. Other common TLDs (.io, .co, .net) are acceptable but may receive marginally higher spam filter scrutiny at some ISPs. Avoid TLDs with high spam association (.xyz, .top, .click, .work, .live) — these TLDs are disproportionately used for spam and receive elevated spam filter scrutiny regardless of the specific domain's reputation.
Number of mailboxes per domain: Each domain can support multiple sending mailboxes (SDR-1@company-hq.com, SDR-2@company-hq.com, etc.). Limiting mailboxes per domain to 2-3 primary senders per domain (or up to 50-100 total sends per day per domain) keeps per-domain sending volume within the range that warmup has prepared the domain for. Exceeding this ratio accelerates reputation degradation.
Subdomain vs Separate Domain for Cold Outreach
Cold email programmes often consider using a subdomain of the primary business domain (outreach.company.com) rather than a completely separate domain. The subdomain approach offers brand association benefits but introduces reputation contamination risk that separate domains avoid.
The subdomain problem: Gmail's reputation model groups subdomains under their parent domain's organisational reputation. A bad reputation event on outreach.company.com can affect company.com's domain reputation in Gmail's evaluation, because Gmail uses the registered domain (company.com) as the primary reputation attribution unit. This means that subdomain isolation provides weaker reputation protection than separate domain isolation — the reputation damage from cold email sending at outreach.company.com can still bleed through to affect company.com domain reputation.
When subdomains are acceptable: At very low cold email volumes (under 100 emails per day) where the complaint signal from cold sending is small enough to be absorbed by the primary domain's positive reputation signals. At this volume, the reputational risk is low enough that the brand association benefit of the subdomain may outweigh the isolation benefit of a separate domain.
When separate domains are required: Any cold email programme above 100 sends per day, any programme sending to unverified lists with expected hard bounce rates above 1%, or any programme where the primary business domain reputation is commercially critical. At these levels, separate domain isolation is the correct infrastructure choice regardless of the brand association benefit of the subdomain approach.
Authentication Setup for Cold Email Domains
Cold email domains require the same authentication configuration as any commercial email domain — SPF, DKIM, DMARC — and must now comply with MAGY requirements for any programme sending above 5,000 messages per day to Gmail. Authentication setup for each cold email domain:
# SPF record for cold email domain (company-hq.com) # Include the cold email platform's SPF mechanism: company-hq.com TXT "v=spf1 include:spf.instantlyplatform.com include:_spf.google.com ~all" # DKIM: Generate and publish a 2048-bit key for the cold email domain # Signing with d=company-hq.com (not d=instantly.com or d=google.com) mail._domainkey.company-hq.com TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY" # DMARC: minimum p=none for MAGY compliance, rua= for report monitoring _dmarc.company-hq.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@company-hq.com" # MX records: required for bounce processing and DMARC report receipt company-hq.com MX 10 mail.company-hq.com
Cold email authentication must use the cold email domain's own DKIM signing key — not the primary business domain's key, and not a shared key from the cold email platform. Using the platform's shared signing domain (d=instantly.com, d=lemlist.com) builds reputation on the platform's domain, not the cold email domain — which is contrary to the entire purpose of using a separate domain.
Warming Up a Cold Email Domain
A cold email domain requires warmup before production sending begins. The cold email warmup process differs from marketing email warmup in one key aspect: the warmup tool (Warmbox, Mailreach, Lemwarm, Instantly's warmup feature) sends automated engagement emails between the warming account and a seed network — building positive reputation signals without requiring real opt-in recipients during the warmup phase.
The cold email warmup protocol: (1) Register the domain, set up authentication records, connect to the cold email platform and warmup tool. (2) Enable warmup at 10-20 auto-sends per day for the first week. (3) Increase warmup sends to 30-50 per day by week 3. (4) By week 5-6, the warmup tool should be sending 50-80 automated exchanges per mailbox per day. (5) After 6-8 weeks of warmup with consistent warmup tool engagement and no real cold outreach, begin cold outreach at 10-20 real cold emails per day per mailbox. (6) Continue running the warmup tool in parallel with cold outreach to maintain positive engagement signal density around the real cold sends.
The warmup tool limitation: automated warmup generates positive signals but does not generate the kind of genuine engagement that ISPs weight most heavily (replies from real people). A cold email domain warmed exclusively by automated tools may have adequate warmup for low-volume sending but reach its effective reputation ceiling faster than a domain whose warmup includes some genuine positive engagement from real recipients. Monitor Postmaster Tools during warmup and calibrate volume increases to what the reputation data shows, not just the warmup tool's scheduled progression.
Domain Rotation Strategy at Scale
At scale (sales teams with 5+ SDRs, each sending 100+ cold emails per day), managing domain reputation across multiple domains requires a systematic rotation strategy. The rotation approach: each SDR uses 2-3 domains in rotation — rotating between domains on a weekly or bi-weekly basis. When one domain shows reputation degradation (spam rate increase, blacklist listing), it is paused and rotated to the backup domain while the degraded domain recovers or is retired.
Domain rotation prevents any single domain from accumulating complaint signals fast enough to damage the overall cold email programme's effectiveness. A programme with 5 SDRs each sending 100 cold emails per day (500 total/day) using 3 domains in rotation has each domain averaging 170 sends per day — manageable for a well-warmed domain. The same volume concentrated on a single domain (500 sends per day) would exhaust the domain's reputation capacity much faster.
The domain rotation infrastructure: a cold email platform that supports multiple sending domains with automatic domain selection per send (Instantly, Smartlead, and similar platforms support this). The platform should distribute sending across domains in the rotation pool, not assign each SDR to a single domain — this prevents any single SDR's list quality issues from concentrating on one domain in the pool.
Monitoring Cold Email Domain Health
Each cold email domain requires the same monitoring as any commercial sending domain: Gmail Postmaster Tools (register each domain), blacklist monitoring (all sending IPs), and DMARC aggregate report review. The warning signs that a cold email domain needs to be rotated to recovery mode:
- Gmail Postmaster Tools spam rate above 0.08% (cold email has higher baseline spam rates than marketing — 0.08% is warning level, not emergency)
- Any MXToolbox blacklist listing (especially Spamhaus) — immediate rotation to backup domain
- Reply rate below 0.5% sustained over 100+ sends — may indicate spam folder placement rather than deliverability to inbox
- Hard bounce rate above 3% on any single day — indicates list quality problem generating reputation signals
Domain Retirement and Replacement
Cold email domains have shorter useful lives than marketing or transactional email domains. The accumulated complaint history from cold outreach eventually degrades domain reputation to the point where inbox placement falls below the level that makes cold outreach effective — typically 6-12 months of active use for a well-managed cold email domain. When inbox placement at Gmail consistently falls below 60% (measurable through seed testing), it is time to retire the domain and replace it with a fresh warmed domain.
The retirement protocol: (1) Route all new cold email sends to the replacement domain (which should have been in warmup for the preceding 6-8 weeks). (2) Keep the retired domain in warmup tool maintenance mode (continuing low-volume warmup to prevent total reputation collapse, in case it recovers to usable levels). (3) After 30 days of maintenance mode, re-assess inbox placement — some domains recover usable inbox placement after a rest period with only warmup tool traffic. (4) If the domain does not recover to 70%+ inbox placement within 60 days of retirement, the domain is fully retired. Keep the DNS records active (to capture any incoming email on the domain) but discontinue outreach from it.
Cold email domain infrastructure, managed correctly with separate domain isolation, proper authentication, systematic warmup, rotation strategy, and continuous monitoring, provides the sustainable sending foundation that makes cold outreach commercially viable at scale. The investment in infrastructure — domain costs, warmup tool subscriptions, monitoring setup — is small relative to the revenue generated by effective cold email at scale, and it is the infrastructure difference between a programme that maintains consistent inbox placement and reply rates over time versus one that cycles through repeated reputation events that reset its effectiveness every few months.
Cold email domain infrastructure is a maintenance programme, not a one-time setup. Register new domains in advance of needing them; warm them before the previous domain needs retirement; monitor each domain's health continuously; and rotate proactively when reputation degrades. The programme that treats domain management as ongoing infrastructure investment rather than a reactive fire-fighting exercise will maintain consistent inbox placement and reply rates indefinitely -- which is the operational foundation that makes cold email a reliable revenue channel at any scale.