Sending Domain Readiness Checklist

Launching cold email outreach on an improperly configured domain leads to catastrophic spam penalties, burned secondary domains, and blocked company inboxes. This free, interactive readiness checklist audits your outbound domain across domain architecture, SPF/DKIM/DMARC authentication, mailbox capacity, automated warm-up, and deliverability safeguards. Generate provider-tailored DNS records, track your live readiness score, and catch critical blockers before your first email is sent. Everything runs 100% privately in your browser with zero data storage or external server calls.

Why cold email sending domains get burned (and how to prevent it)

Every business email address sits on a foundation of domain reputation. When you send email to a prospect, recipient mail transfer agents (MTAs) at Google Workspace, Microsoft 365, Yahoo Mail, and corporate secure email gateways (such as Mimecast, Proofpoint, and Barracuda) do not simply inspect the words in your message. They query DNS to evaluate your domain identity, calculate the cryptographic authenticity of your sender headers, check domain age, verify historical sending patterns, and compare your complaint and bounce rates against strict mathematical thresholds.

Most outbound campaigns that collapse into the spam folder fail before the first email is even dispatched. Senders often purchase a domain on Monday, hurriedly add an SPF record, skip DKIM or DMARC, connect 10 mailboxes to a single domain, and blast 80 emails per day per inbox on Tuesday. Within 48 hours, spam filters flag the unnatural velocity spike. The domain is blacklisted by Spamhaus or placed in spam purgatory by Google's spam-filtering neural networks. Once a domain is burned, restoring its inbox deliverability takes months of remedial warm-up, and in many cases, the domain must be abandoned completely.

Preventing domain burn requires systematic operational engineering across five distinct pillars: secondary domain architecture, strict cryptographic DNS authentication (SPF, DKIM, DMARC), restrained mailbox density, automated peer-to-peer warm-up, and relentless list hygiene. This readiness checklist codifies the exact standards required to maintain pristine sender reputation in modern enterprise email environments.

The 5 pillars of outbound sending domain readiness

1. Domain architecture and secondary domain isolation

The single most catastrophic mistake in outbound sales is sending cold email from your primary corporate domain (e.g. acme.com). If your cold outreach triggers spam complaints, domain blacklists, or MTA rate limits, the deliverability penalty attaches to your entire root domain. Your internal executive emails, client invoices, password reset links, and calendar invitations will suddenly begin landing in junk folders or bouncing entirely.

Always isolate outbound outreach on dedicated secondary domains (such as getacme.com, acmeconsulting.co, or acmegrowth.io). High-reputation outbound teams maintain multiple secondary domains to distribute volume. Furthermore, secondary domains must look and act like legitimate corporate assets: configure an HTTP 301 permanent redirect from the secondary domain's web root to your primary website so prospects who paste the domain into their browser land safely on your brand's homepage.

2. The DNS authentication trifecta: SPF, DKIM, and DMARC

Since February 2024, Google and Yahoo have strictly enforced sender requirements for all inbound business and bulk mail. Sending domains lacking proper authentication are rejected outright with 550-5.7.26 error codes or routed directly to spam. Outbound sending domains require three interrelated DNS records:

• Sender Policy Framework (SPF): A DNS TXT record declaring which IP addresses or mail services are authorized to send email on your domain's behalf. Domains must have exactly one SPF record (multiple records cause a fatal PermError) and must stay strictly below the RFC 7208 10-DNS-lookup limit.
• DomainKeys Identified Mail (DKIM): A cryptographic public-key system where your mail server digitally signs outgoing message headers. The receiving server fetches your public key from DNS to verify that the message genuinely originated from your server and was not modified in transit. A 2048-bit RSA key length is mandatory.
• Domain-based Message Authentication, Reporting, and Conformance (DMARC): A DNS policy record published at _dmarc.<domain> that links SPF and DKIM together. DMARC specifies what receivers should do if authentication fails (p=none for monitoring, p=quarantine for spam folder, p=reject for outright rejection) and provides an aggregate reporting mailbox (rua=) to detect unauthorized spoofing.
• Custom Tracking Domain (CTD): When cold email platforms track email opens and link clicks, they rewrite hyperlinks through a tracking proxy. Using the platform's default shared domain bundles your reputation with every other customer on that platform. Setting up a dedicated CNAME record (such as track.yourdomain.com) equipped with SSL ensures link tracking reflects only your own domain reputation.

3. Mailbox provisioning and capacity engineering

Mailbox infrastructure is not created equal. Sending cold outreach via low-cost shared cPanel hosting or unvetted private SMTP servers guarantees poor inbox placement because those IP subnets share bad actors and lack historical trust with major email providers. Dedicated business mailboxes hosted on Google Workspace or Microsoft 365 Exchange Online provide the cleanest IP pools and highest inbox delivery rates.

Equally critical is mailbox density. Attempting to save licensing costs by creating 10 or 15 user inboxes on a single secondary domain creates an aggressive footprint that triggers registrar abuse investigations and email provider suspensions. Best-in-class outreach infrastructure enforces a ceiling of 2 to 3 mailboxes per domain. If your outreach strategy requires 1,000 emails per day, you scale by acquiring 10 secondary domains with 2 inboxes each—never 1 domain with 20 inboxes.

4. Automated peer-to-peer warm-up and ramp pacing

A newly registered domain has zero historical sending data. To spam defense algorithms, a sender with no history that abruptly transmits 50 unsolicited emails looks identical to a hijacked botnet. Email warm-up is the process of generating artificial positive engagement before launching real outreach.

By connecting your inboxes to an automated peer-to-peer warm-up network (such as Instantly, Smartlead, or Warmup Inbox), your accounts send and receive scheduled emails with other warmed mailboxes. These automated peers open incoming emails, remove them from spam folders if caught, mark them as important, and reply to them with realistic text. This generates high engagement metrics (95%+ open rates and 30%+ reply rates) that build positive domain reputation.

To safely ramp a domain:

1. Wait at least 14 days after domain registration before beginning warm-up.
2. Start warm-up at 3 to 5 emails per day per mailbox.
3. Increment volume gradually by +2 to +3 emails per day.
4. Allow warm-up to run for a minimum of 14 consecutive days (21 days for brand-new domains) before sending any cold prospect emails.
5. Maintain automated warm-up at 20% to 30% of total daily volume even after campaigns go live to balance out prospect silence and protect engagement scores.

5. Deliverability telemetry and compliance safeguards

Even a technically perfect domain will be burned if your prospect list contains invalid email addresses or your messaging generates spam complaints. Hard bounces occur when an email address does not exist, the user account is closed, or the receiving server blocks your domain. When an outbound campaign exceeds a 2% hard bounce rate, Google and Microsoft immediately throttle your sending speed and divert subsequent messages to the spam folder.

Every prospect list must be scrubbed through a dedicated email verification service (such as ZeroBounce, NeverBounce, or Bouncer) immediately prior to campaign launch. Furthermore, every outbound email must provide a frictionless opt-out mechanism (a polite single-sentence unsubscribe reply prompt or one-click unsubscribe header) and display a valid physical company address to comply with CAN-SPAM, GDPR, and CASL regulations. Keeping your user-reported spam complaint rate strictly below 0.1% (one complaint per 1,000 sent emails) is non-negotiable under Google Postmaster Tools monitoring.

How the readiness score and grade are calculated

The readiness score in this tool is calculated from a weighted point model across 20 technical and operational criteria, totaling 118 raw points normalized to a 100-point scale. Unlike superficial calculators that treat every checkbox equally, this audit assigns heavy weighting to fundamental architectural and cryptographic prerequisites.

Readiness Pillar	Criteria Count	Raw Weight	Share of Total	Key Focus Areas
1. Domain Architecture & Isolation	4 criteria	20 points	17.0%	Secondary domain separation, reputable TLD, WHOIS privacy, 301 redirect
2. DNS & Core Authentication	5 criteria	37 points	31.4%	MX records, strict single SPF, 2048-bit DKIM, DMARC policy with rua, custom tracking domain
3. Mailbox Provisioning & Capacity	4 criteria	19 points	16.1%	Business Workspace/M365 tier, max 2–3 mailboxes/domain, sender avatar, clean HTML signature
4. Automated Warm-Up & Ramp Schedule	4 criteria	23 points	19.5%	P2P warm-up network, 14–21 day buffer, +2–3/day ramp velocity, continuous live warm-up
5. Deliverability Telemetry & Safeguards	3 criteria	19 points	16.1%	Google Postmaster Tools setup, <2% verified list bounce rate, clear opt-out compliance

The total raw score is calculated as Math.round((passedPoints / 118) * 100). However, to reflect real-world deliverability physics, the algorithm enforces a Critical Blocker Gating Rule. In outbound cold email, missing core authentication (such as SPF or DKIM) or sending directly from your primary root domain causes immediate failure regardless of how many other items you have checked. If 3 or more Critical Blockers remain unverified, your score is capped at 58 (Grade D). If 1 or 2 Critical Blockers remain, the score is capped at 74 (Grade C).

The final numerical score maps directly to five deliverability tiers:

• Grade A (90–100): Launch Ready · Hardened & Safe. Zero critical blockers. Full authentication trifecta active, secondary domain isolated, minimum 14-day warm-up observed, and verified prospect lists. Approved for live outreach at planned volume.
• Grade B (75–89): Good · Minor Gaps to Resolve. Maximum 1 non-fatal blocker. Secondary domain and DNS configured, but minor items such as Google Postmaster Tools verification, avatar profile, or ongoing warm-up ratio need completion.
• Grade C (60–74): At Risk · Complete Auth & Warm-up. Domain is not ready for live outbound campaigns. Core elements such as 14-day warm-up buffer or DMARC reporting are missing. Live sends must be held.
• Grade D (40–59): High Danger · Missing Core Authentication. Fatal gaps in SPF, DKIM, or MX records, or domain registered less than a week ago. High probability of landing in junk folders or receiving provider rate limits.
• Grade F (Below 40): Unsafe · Severe Deliverability Risk. Sending from primary corporate domain, multiple SPF records, unverified lists, or zero warm-up. Outbound sending will cause immediate domain blacklisting.

DNS configuration blueprints: Google Workspace vs Microsoft 365

Configuring DNS records correctly is the most common technical barrier for outbound teams. Below are the exact hostnames, record types, and values required for Google Workspace and Microsoft 365:

Record Type	Host / Name	Google Workspace Value	Microsoft 365 Value
SPF (TXT)	@ (root)	v=spf1 include:_spf.google.com ~all	v=spf1 include:spf.protection.outlook.com -all
DKIM	google._domainkey (Google: TXT) selector1._domainkey (M365: CNAME)	v=DKIM1; k=rsa; p=MIIBIjANBgk... (Generate in Google Admin Console)	selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com
DMARC (TXT)	_dmarc	v=DMARC1; p=none; rua=mailto:[email protected]; sp=none; aspf=r; adkim=r	v=DMARC1; p=none; rua=mailto:[email protected]; sp=none; aspf=r; adkim=r
MX	@ (root)	ASPMX.L.GOOGLE.COM. (Priority 1) ALT1.ASPMX.L.GOOGLE.COM. (Priority 5) ALT2.ASPMX.L.GOOGLE.COM. (Priority 5)	yourdomain-com.mail.protection.outlook.com. (Priority 0)
Tracking (CNAME)	track	prox.your-cold-email-tool.com	prox.your-cold-email-tool.com

Worked domain audit scenarios

To illustrate how technical choices impact deliverability scoring and real-world inbox placement, consider four common outbound setups evaluated by the checklist engine:

Scenario	Configuration Profile	Score & Grade	Critical Blockers	Deliverability Outcome
1. Unprepared Founder	Sending from primary domain (acme.com), default SPF only, no DKIM key generated, no DMARC, unverified prospect list, 0 days warm-up.	24 (Grade F)	6 blockers	Severe burn risk. Emails land in spam within 48 hours; primary company domain risks blacklisting, disrupting internal business communication.
2. Fresh Secondary Domain	Secondary domain (getacme.com), Google Workspace SPF and MX configured, DKIM not enabled in admin console, no DMARC, warm-up running for 3 days.	58 (Grade D)	3 blockers	Fails Google/Yahoo 2024 authentication rules due to missing DKIM and DMARC. Sending cold emails now will trigger bulk rate-limiting.
3. Ramping Outreach System	Secondary domain, full SPF/DKIM/DMARC active, 301 redirect in place, 14 days warm-up completed, list verified with ZeroBounce, 2 mailboxes configured.	88 (Grade B)	0 blockers	Safe for initial campaign launch. Recommended to verify domain in Google Postmaster Tools and maintain 25% continuous warm-up ratio as volume scales.
4. Hardened Enterprise Setup	Secondary domain, full authentication trifecta with DMARC aggregate reporting, custom tracking domain with SSL, 21 days warm-up, <1% bounce rate, 2 mailboxes at 35 sends/day.	96 (Grade A)	0 blockers	Maximum deliverability posture. High domain reputation, zero authentication faults, and optimal mailbox longevity across enterprise filters.

Honest limitations and browser constraints

• No raw UDP DNS socket access: Web browsers operate in a secure sandbox without direct access to UDP or TCP port 53. Consequently, this client-side tool cannot perform live, authoritative DNS lookups across global root name servers without a third-party proxy backend. It validates your domain syntax, formats RFC-compliant DNS records, checks TLD risk, and guides manual verification.
• WHOIS registration privacy: Browsers cannot query port 43 WHOIS servers directly. Domain registration age must be verified through your domain registrar dashboard (Cloudflare, Namecheap, GoDaddy).
• Blacklist and Spamhaus checking: Real-time IP and domain blacklist checks (DNSBL queries against Spamhaus SBL/XBL, SORBS, or Invaluement) require reverse DNS queries not supported in client-side JavaScript. Use dedicated tools such as MXToolbox or MultiRBL alongside this checklist.
• Spam filter heuristics are probabilistic: A 100/100 readiness score certifies that your technical domain architecture, authentication records, and ramp safeguards are properly configured. However, inbox placement also depends on copy quality, subject line framing, spam trigger words, and prospect engagement. A technically perfect sending domain will not rescue irrelevant, spammy cold copy.

Frequently asked questions

Why should I never send cold email from my primary business domain?

Your primary business domain (e.g. acme.com) carries the reputation for your day-to-day operations: customer support tickets, sales replies, employee onboarding, calendar notifications, and investor updates. If a cold outreach campaign triggers high spam complaints or hits hidden spam traps, major providers will down-rank or blacklist your entire root domain. Using dedicated secondary domains (e.g. getacme.com) isolates this risk, ensuring your core operational email is never compromised.

How many secondary domains and mailboxes do I need for 1,000 cold emails per day?

To maintain long-term inbox placement, best-in-class outreach teams adhere to two fundamental limits: maximum 35 cold emails per day per mailbox, and maximum 2 to 3 mailboxes per secondary domain. For 1,000 cold emails per day, you need approximately 28 active mailboxes (1,000 / 35). At 2 mailboxes per domain, this requires acquiring and warming 14 secondary domains. Attempting to send 1,000 emails per day from 2 domains will result in swift domain reputation burn.

What is the difference between softfail (~all) and hardfail (-all) in an SPF record?

The mechanism at the end of an SPF record defines how receiving servers should treat emails from unauthorized IPs. A softfail (~all) instructs the receiver that unauthorized emails should still be accepted but flagged as suspicious or routed to the spam folder. A hardfail (-all) instructs the receiver to reject the message outright with a permanent 550 delivery failure. Google Workspace recommends ~all, whereas Microsoft 365 often defaults to -all. For cold outreach, ~all is standard because it prevents accidental message loss if email routing passes through intermediary relays.

Can I launch campaigns immediately once my SPF, DKIM, and DMARC records are verified?

No. Correct DNS authentication is a mandatory prerequisite, not an all-clear ticket. Authentication simply proves that you own the domain and that the message was not forged; it does not give the domain positive reputation. A newly authenticated domain with zero sending history that suddenly sends 40 unsolicited emails will still be routed to spam. You must complete a minimum 14-day automated warm-up period to build positive engagement before sending any cold prospect messages.

What happens if my cold email bounce rate exceeds 2%?

A hard bounce rate above 2% is a universal red flag for automated spam defense filters at Google and Microsoft. It signals that the sender is scraping outdated directories, guessing email formulas, or using unverified lead lists. When bounce rates exceed 2%, ESPs throttle sending throughput, route subsequent campaign emails to junk folders, and may flag the sending domain for permanent suspension. Always verify 100% of prospect email addresses through ZeroBounce, NeverBounce, or Bouncer before uploading them to your campaign tool.

Why is a Custom Tracking Domain (CTD) necessary if my email platform already tracks clicks?

Cold email platforms track link clicks and open rates by rewriting URLs to route through an HTTP proxy. By default, platforms route this tracking through their own shared domain. When thousands of other customers send low-quality outreach through that shared domain, anti-spam engines blacklist the tracking URL. If your email contains a blacklisted link, your email lands in spam even if your sending domain is pristine. Setting up a dedicated CNAME tracking domain ensures your tracking links reflect only your own domain reputation.

How does Google Postmaster Tools work for a secondary sending domain?

Google Postmaster Tools (GPT) provides direct telemetry from Gmail regarding your domain reputation (High, Medium, Low, Bad), user-reported spam complaint rates, SPF/DKIM authentication pass rates, and delivery errors. To set it up, visit postmaster.google.com, add your secondary sending domain, and copy the provided TXT verification record into your domain's DNS host. GPT requires a minimum volume of emails sent to Gmail users (typically hundreds per week) before data appears on the dashboard.

Should my secondary domain forward to my main website?

Yes. Setting up an HTTP 301 permanent redirect from your secondary sending domain root (e.g. https://getacme.com) to your main corporate website (e.g. https://acme.com) is essential. High-value B2B prospects frequently inspect the domain portion of an outreach email address. If typing the domain into a browser produces a registrar parking page, a hosting 404 error, or a security warning, credibility evaporates immediately.

Related deliverability tools

• Cold Email Subject Line Grader — Grade subject line length, spam triggers, and personalization before sending.
• Spam Word Checker — Scan your outreach email body for aggressive promotional keywords and spam triggers.
• Deliverability Risk Scanner — Audit hyperlink counts, uppercase words, image ratios, and email weight.
• SPF/DKIM/DMARC Record Generator — Generate custom DNS authentication syntax for your mail servers.
• Warm-Up Schedule Planner — Calculate step-by-step daily sending ramps and mailbox volume targets.

Next step

Need help architecting a scalable, multi-domain cold email infrastructure that consistently reaches the primary inbox? That is what mizanursguide.com specializes in. Explore our cold email and outbound deliverability systems to scale predictable pipeline without burning your domain reputation.