How to set up cold email infrastructure that lands in the inbox: domains, SPF/DKIM/DMARC, warm-up, and inbox math. A step-by-step 2025 setup guide.
If your cold emails aren't getting replies, the problem usually isn't your copy. It is your infrastructure. Around 17% of cold emails never reach the inbox, and a broken setup is the leading cause. You can write the best email in the world, but if your domain isn't authenticated and warmed, it lands in spam and nobody ever reads it.
Cold email infrastructure is the technical foundation that gets your messages delivered: separate sending domains, authentication records, warmed inboxes, and the volume math to scale safely. Set it up right and you protect your primary domain while reliably reaching the inbox. Set it up wrong and you blacklist yourself in a week. This is the exact 9-step setup top outbound teams use, in order.
To define it, cold email infrastructure is the system of sending domains, authenticated inboxes, warm-up, and deliverability controls that gets cold outreach into the inbox instead of spam. It separates cold sending from your primary domain to protect brand email, and uses authentication and reputation management to maximize inbox placement.
Deliverability comes before persuasion. A message in the spam folder converts at zero, no matter how sharp the writing. Infrastructure is what gets you into the inbox so your copy can do its job.
Inbox providers like Google and Microsoft decide placement based on sender reputation, authentication, and engagement, all of which are infrastructure concerns. Reps obsess over subject lines while ignoring the SPF record that is silently dumping their email into spam. Fix the foundation first, because everything else compounds on top of it.
Never send cold email from your main company domain. If deliverability tanks, you don't want your team's real email and your domain's web reputation caught in the blast radius. The first rule of infrastructure is isolation.
Register one or more secondary domains that resemble your primary, for example getyourcompany.com, tryyourcompany.com, or yourcompany.io. These carry all the cold-email risk. Redirect them to your main site so they look legitimate. Buy them at least a few weeks before sending, since slightly aged domains warm faster.
This is non-negotiable. Configure three DNS records for every sending domain. SPF authorizes which servers can send for your domain. DKIM cryptographically signs your emails to prove they are genuine. DMARC tells providers what to do with unauthenticated mail and lets you monitor abuse. Without these, providers distrust you and Google and Microsoft bulk-sender rules will filter or reject your mail outright. Verify each record after setup.
Create one to three mailboxes per sending domain. The math is simple and strict. Cap each inbox at 30 to 50 cold sends a day, so three inboxes per domain is about 90 to 150 sends a day per domain. Need 500 sends a day? You need roughly four domains and 10 to 12 inboxes. Scale with more inboxes and domains, never by overloading a single mailbox. Overloading is the fastest route to the spam folder.
Run a two to three week warm-up on each new inbox before real sending. Start at 5 to 10 emails a day and ramp gradually to 30 to 50. Use automated warm-up tools to build engagement, then blend in real sends. Warm-up builds the reputation that keeps you in the inbox.
Infrastructure delivers email; data determines whether it bounces. A single send to a stale list with a high bounce rate erases weeks of warm-up. Keep bounces under 2% by sending only to verified contacts. Connect a database with high deliverability so your infrastructure isn't wasted on dead addresses. A 280M-contact source at 98% deliverability protects the reputation you built.
Use a custom tracking domain rather than your sending platform's shared one, because shared tracking domains carry other senders' bad reputation. Monitor deliverability, opens (a softer signal after Apple MPP), replies, and bounces. You can't manage what you don't measure.
Include a clear opt-out in every cold email and process it instantly. Google and Yahoo bulk-sender requirements expect easy unsubscribe and a spam-complaint rate under 0.3%. Maintain a suppression list and scrub every send against it. Compliance here is also deliverability protection.
Continuously watch your sender reputation and deliverability. If an inbox's placement drops, pause it, diagnose the cause (usually data or volume), and let it recover. Rotate sending across healthy inboxes. Infrastructure is maintained, not set-and-forget.
Once you are live, four metrics keep your infrastructure healthy. Bounce rate under 2%, the data-quality gate. Spam complaints under 0.3%, the relevance gate. Deliverability above 95%, the overall health check. And consistent daily volume, because erratic bursts look like spam. Cross any threshold and providers throttle you, so watch them weekly.
It helps to picture the setup as five layers stacked in a specific order. Isolate with a separate domain. Authenticate with SPF, DKIM, and DMARC. Warm with a gradual ramp. Feed with verified data. Monitor reputation and compliance. The order matters, because each layer assumes the one before it is solid. Authenticate before warming, warm before sending volume, and never feed any of it dirty data. Skip a layer and the whole foundation cracks. Cold email infrastructure isn't one setting. It is five layers, and the inbox punishes you for skipping any of them.
The feed layer is where a database earns its keep. InboundLabs gives you 280M verified B2B contacts at 98% deliverability, so your carefully built infrastructure sends to addresses that actually exist. The cleanest data is the cheapest insurance for your sender reputation. See how InboundLabs protects deliverability
A few setup errors sink new senders: sending cold from the primary domain, where one bad campaign hurts your real email; skipping authentication, the silent killer that gets mail filtered before anyone reads it; overloading one inbox, since 200 sends from a single mailbox screams spam; running no warm-up, which lands new domains straight in spam; and feeding dirty data, where high bounces erase reputation gains in a single send. Each is fixable before you launch, and none should make it to your first real campaign.
Cold email infrastructure is the unglamorous work that makes everything else possible. Isolate a sending domain, authenticate it, warm it, feed it verified data, and monitor reputation, in that order, and your emails reach the inbox where your copy can actually win.
Start by getting the data layer right, because it is the one that erases all the others if you ignore it. Try InboundLabs free and send to verified contacts that won't bounce
What is cold email infrastructure?
Cold email infrastructure is the technical setup that gets cold outreach delivered: secondary sending domains, authenticated inboxes (SPF, DKIM, DMARC), warm-up, verified data, and reputation monitoring. It isolates cold sending from your primary domain and maximizes inbox placement so messages don't land in spam.
Do I need a separate domain for cold email?
Yes. Always send cold email from secondary domains, never your primary, to protect your main domain's reputation. Register variations like getyourcompany.com, authenticate them, warm them, and direct all cold-email risk there. If deliverability drops, your real email stays safe.
How many emails can I send per inbox per day?
Cap each inbox at 30 to 50 cold sends a day, even after warm-up. To scale beyond that, add more inboxes and domains rather than overloading one mailbox. Roughly, 500 sends a day requires about four domains and 10 to 12 inboxes.
What are SPF, DKIM, and DMARC?
They are three DNS authentication records. SPF authorizes which servers can send for your domain, DKIM cryptographically signs emails to prove authenticity, and DMARC tells providers how to handle unauthenticated mail. All three are required, because without them inbox providers filter or reject your cold email.
How long before I can start sending cold emails?
After setup, warm each new inbox for two to three weeks before real cold sending, ramping gradually from 5 to 10 up to 30 to 50 emails a day. Buying domains a few weeks ahead and warming properly means roughly three to four weeks from purchase to full-volume sending.
Why do my cold emails go to spam?
Usually missing authentication, no warm-up, sending from your primary domain, overloading one inbox, or a high bounce rate from dirty data. Around 17% of cold emails never reach the inbox for these reasons. Fix authentication, warm up, and use verified data to land in the inbox.
How do I keep my bounce rate low?
Send only to verified email addresses and never to scraped or stale lists. Keep bounces under 2%, because every hard bounce signals spam behavior and erases warm-up gains. Use a contact database with high verified deliverability to protect your sender reputation.
Where Lusha’s speed and Chrome extension shine, what it really costs, and the data accuracy catch to know before you build a pipeline on it.
An honest look at Lusha's data accuracy: the 98% claim versus a real-world 60 to 70%, where it slips, and how to use Lusha without bouncing.
A no-spin breakdown of whether Cognism is worth its premium price, who should buy it, and who should choose a more flexible database.
No commitment. No credit card. Just 50 free verified contact lookups.