TL;DR: Maintaining cold email deliverability at scale requires five infrastructure layers working together: correct DNS authentication records (SPF, DKIM, DMARC, and optionally BIMI), a deliberate domain architecture that separates sending domains from your primary domain, a structured IP warming schedule, a carefully chosen sending infrastructure (dedicated IPs and the right ESP), and a live monitoring stack that tracks inbox placement daily. Teams that set up all five layers consistently see inbox placement rates above 90% and avoid the reputation resets that kill outbound programs overnight.
Most deliverability guides stop at "set up SPF and DKIM." That advice was sufficient in 2018. In 2026, with Google and Microsoft tightening authentication enforcement and spam filters running on machine-learning models trained on billions of signals, surface-level DNS hygiene is the floor, not the ceiling.
This guide covers the full technical stack for cold email deliverability at scale: DNS authentication, domain architecture, IP warming, ESP selection, and the monitoring dashboard your ops team should check every morning. It is written for growth engineers, RevOps leaders, and sales ops managers who need infrastructure-level answers, not surface-level tips.
What DNS Authentication Records Do You Actually Need?
You need four DNS authentication records to reach inbox reliably at scale: SPF, DKIM, DMARC, and ideally BIMI. Each record does a different job, and misconfiguring any one of them can tank your sender reputation without any visible warning.
SPF (Sender Policy Framework)
SPF is a DNS TXT record that tells receiving mail servers which IP addresses are authorized to send email on behalf of your domain. A correctly configured SPF record looks like: v=spf1 include:sendgrid.net include:_spf.google.com ~all. The ~all softfail is preferred over -all hardfail for sending domains because aggressive hardfail can cause legitimate mail to be rejected when forwarding is involved. Critically, you should never have more than one SPF record per domain, and you should avoid exceeding 10 DNS lookups in a single record, as both conditions will cause SPF failures regardless of the sending IP.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to every outbound message, letting the receiving server verify that the email was not altered in transit. Your ESP generates a public/private key pair. You publish the public key as a DNS TXT record under a selector subdomain (e.g., selector1._domainkey.yourdomain.com), and the ESP signs outbound mail with the private key. Use 2048-bit keys rather than 1024-bit keys. RSA-2048 provides significantly stronger authentication and is required by Google and Yahoo's bulk sender guidelines published in February 2024. If your ESP only supports 1024-bit keys, that is a signal to evaluate a different provider.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. A DMARC record has three policy modes: none (monitor only), quarantine (send to spam), and reject (block the message). For cold email sending domains, start at p=none with an rua aggregate reporting address, analyze the reports for 30 days, then move to p=quarantine. As of February 2024, Google requires all bulk senders (5,000+ emails per day to Gmail addresses) to have a DMARC policy of at least p=none. Senders without any DMARC record will see increased deliverability failures to Gmail inboxes. Moving to p=reject eventually is the gold standard because it prevents spoofing of your domain entirely, but only after you have confirmed all legitimate sending sources pass DKIM and SPF alignment.
BIMI (Brand Indicators for Message Identification)
BIMI is the newest layer and often skipped, but it is worth implementing for your primary brand domain. BIMI displays your company logo next to emails in supporting inboxes (Gmail, Yahoo, Apple Mail). To qualify, you need a DMARC policy of p=quarantine or p=reject and a Verified Mark Certificate (VMC) from an accredited authority like DigiCert or Entrust. BIMI does not directly affect deliverability metrics, but it increases recipient trust, which raises open rates and reduces spam reports. Higher open rates and lower spam report rates feed back into inbox placement algorithms positively over time.
How Should You Architect Your Domains for Cold Email at Scale?
The right domain architecture for cold email at scale is to never send cold outbound from your primary company domain. Use secondary sending domains and subdomains exclusively for outbound prospecting, and protect your primary domain for transactional and marketing email.
Primary Domain vs. Secondary Sending Domains
Your primary domain (e.g., yourcompany.com) carries your entire brand's email reputation. A single spam complaint spike on your primary domain can damage deliverability for product emails, billing receipts, and marketing campaigns simultaneously. Cold email at scale generates spam complaints even with perfect list hygiene, because some percentage of recipients will always click "report spam" regardless of message quality. Keeping cold outbound off your primary domain insulates your brand reputation.
Secondary sending domains are domains you register specifically for cold outbound (e.g., getyourcompany.com, yourcompany.io, tryourcompany.com). Register multiple variants that are recognizably related to your brand but clearly not your primary domain. Aim to have at least one secondary domain per 500 emails sent per day. A team sending 5,000 cold emails per day should have at least 10 active sending domains rotating through their sequences. Spreading volume across domains limits per-domain sending rate, which is one of the strongest signals spam filters use to identify bulk outbound campaigns.
Subdomain Strategy
An alternative to secondary domains is the subdomain approach: using mail.yourcompany.com or outreach.yourcompany.com as the sending identity. Subdomains inherit some of the primary domain's age and authority while maintaining separate reputation pools. The tradeoff is that a severe reputation event on a subdomain can bleed through to the primary domain in some mail server implementations. For most teams, secondary registered domains provide cleaner isolation than subdomains and are preferred for high-volume cold outbound programs above 2,000 emails per day.
Domain Rotation and Mailbox-to-Domain Ratios
Limit each sending mailbox to 25 to 30 new outbound emails per day. Tools like Unify manage mailbox rotation, domain health scoring, and per-mailbox sending limits automatically, so your team does not have to track these ratios in a spreadsheet.
What Does a Proper IP Warming Protocol Look Like?
IP warming is a structured schedule for gradually increasing email volume from a new IP address over 4 to 8 weeks so that inbox providers build trust in the sender. Sending high volumes from a cold IP on day one is the fastest way to land on blacklists.
Engagement Seeding During Warming
During the warming period, prioritize sending to addresses most likely to open, click, or reply. High engagement signals during warming tell inbox providers that recipients want your mail. Seed list services like GlockApps or Maildoso let you send to a pool of real inboxes across providers and measure exactly where your mail lands. Running seed tests once or twice per week during warming gives you data to adjust timing, content, or volume before a reputation problem compounds. Do not wait for a bounce rate spike to discover a deliverability issue. Seed testing surfaces inbox placement changes 1 to 2 weeks before bulk metrics show degradation.
Dedicated vs. Shared IPs
Shared IP pools mean your sending reputation is partially determined by the behavior of other senders on the same IP range. Dedicated IPs give you full control of your own sender reputation, but they require maintaining consistent volume. An IP that sends 10,000 emails one week and 200 the next looks suspicious to inbox providers. Dedicated IPs are the right choice for teams sending more than 5,000 emails per day consistently. Below that threshold, a high-quality shared IP pool from a reputable ESP is often more reliable because the pool maintains consistent warm volume automatically.
How Do You Choose the Right Sending Infrastructure?
The right sending infrastructure for cold email at scale combines a reliable ESP with proper SMTP relay configuration, and in some cases a secondary deliverability-focused SMTP layer to handle high-volume outbound separately from marketing email.
ESP Selection Criteria for Cold Outbound
Evaluate ESPs on five criteria for cold outbound at scale: dedicated IP availability, DKIM key strength (2048-bit minimum), built-in bounce and complaint handling, real-time reputation monitoring, and API-first architecture for integration with your sequencing tools. ESPs designed primarily for marketing email (newsletters, campaigns) are not always optimized for cold outbound patterns. Cold outbound involves higher recipient-to-engagement ratios than marketing email and requires tighter bounce handling. Every hard bounce that is not immediately suppressed damages sender reputation. Every spam complaint above 0.1% triggers Google's spam rate dashboard warnings.
SMTP Relay vs. Full ESP
Some teams separate their outbound email infrastructure into two layers: a dedicated SMTP relay (Postmark, Mailgun, or a self-managed Postfix server) for cold outbound, and a marketing ESP (Iterable, Braze, or HubSpot) for campaign email. This separation means a deliverability event on the cold outbound layer does not affect marketing email, and vice versa. The tradeoff is operational complexity. For most growth teams under 20 people, a single high-quality ESP with separate sending domains is simpler and sufficient. Teams above 50,000 emails per day often benefit from the two-layer architecture.
Unify's sending infrastructure runs on dedicated IP pools with automated per-mailbox throttling and real-time spam rate monitoring, removing the need for teams to manage SMTP relay configuration manually. Rather than building and maintaining this stack in-house, many teams at the 10,000 to 50,000 email-per-day scale use Unify's platform to get dedicated infrastructure without dedicated infrastructure ops headcount. For more on how the right toolchain affects outbound efficiency, see our guide on cold email automation tools and domain reputation.
What Should Your Deliverability Monitoring Stack Look Like?
A complete deliverability monitoring stack for cold email at scale includes four components: Google Postmaster Tools, blacklist monitoring, seed list testing, and a daily health dashboard. Each component catches a different category of deliverability failure before it becomes a pipeline problem.
Google Postmaster Tools
Google Postmaster Tools is a free dashboard from Google that shows your domain reputation, IP reputation, spam rate, and delivery errors for email sent to Gmail addresses. Gmail is one of the dominant business inbox providers globally, and because Google publishes explicit spam rate thresholds and domain reputation signals in Postmaster Tools, it provides the clearest window into how your sending behavior is being scored by a major inbox provider. Set up Postmaster Tools for every sending domain in your rotation, not just your primary domain. Check it daily. The spam rate metric is the most critical signal to monitor. Google's published threshold for "high" spam rate is 0.1%, and they begin throttling and filtering email from domains that exceed this level. At 0.3% or above, you will see significant inbox placement degradation within days.
Blacklist Monitoring
Major email blacklists (Spamhaus SBL, URIBL, Barracuda, Proofpoint) are used by corporate mail servers to block or filter inbound email from flagged IPs and domains. A single blacklisting event can reduce inbox placement to near zero for recipients at companies running those blacklists. Check all sending domains and IPs against major blacklist databases at least three times per week. MXToolbox provides a free blacklist monitor that checks against over 100 lists simultaneously. Set up email alerts for any new listings so you can begin the delisting request process immediately rather than discovering the problem days later when reply rates fall.
Seed List Testing
Seed list testing sends your actual outbound emails to a pool of real mailboxes across Gmail, Outlook, Yahoo, and corporate mail servers, then measures what percentage land in the inbox vs. spam vs. promotions folder. Unlike aggregate deliverability metrics that show you past performance, seed tests give you real-time placement data for your current content and sending configuration. Run seed tests before launching any new sequence, after changing any DNS records, and at least once per week during normal operations. A placement rate below 85% in seed tests is a signal to investigate before sending to your full prospect list. Tools in this space include GlockApps, Maildoso, and Litmus.
What Is a Deliverability Health Dashboard and Which 8 Metrics Should You Track Daily?
A deliverability health dashboard is a single view of the eight metrics that predict inbox placement before problems become visible in reply rates. Most teams only notice deliverability issues when reply rates fall, by which point the reputation damage has already been accumulating for weeks. Tracking these eight metrics daily allows you to intervene at the signal, not the symptom.
The inbox placement rate and spam complaint rate are the two leading indicators. When inbox placement drops, it usually precedes a complaint rate spike by 5 to 10 days, because recipients who cannot find expected replies eventually mark prior messages as spam. Monitoring both together gives you a 7 to 14 day window to course-correct before a reputation event becomes a reputation crisis.
DMARC alignment rate is the most frequently overlooked metric in cold email deliverability monitoring. It measures what percentage of your outbound mail passes both SPF and DKIM alignment, specifically whether the domain in the "From" header matches the domain that passed authentication. A DMARC alignment rate above 98% is healthy. A sudden drop in DMARC alignment rate almost always means a new sending source, such as a new ESP, a marketing tool, or an automation, was added to your stack without proper DNS configuration. Catching this early prevents the authentication failures from accumulating into a domain reputation hit. DMARC aggregate reports are emailed to your rua address daily and can be parsed with free tools like Google's DMARC report reader or MXToolbox's DMARC analyzer.
Teams using Unify's platform get automated alerts when any of these metrics cross warning thresholds, including per-mailbox spam rate tracking and per-domain inbox placement monitoring. Instead of checking eight dashboards every morning, the alerting layer surfaces the signal when action is needed. For context on how deliverability connects to outbound program outcomes more broadly, see our breakdown of how to scale outbound prospecting without burning your domain.
How Does Unify Handle Cold Email Deliverability at Scale?
Unify is the system of action for revenue that handles the full cold email infrastructure layer so GTM teams can focus on pipeline generation rather than DNS configuration and inbox monitoring. The platform provides dedicated sending infrastructure with automated IP warming, per-mailbox sending throttles, real-time spam rate dashboards, and domain rotation management built in.
Teams running cold outbound through Unify typically operate at 90%+ inbox placement rates within the first 60 days. The platform's domain health scoring surfaces at-risk mailboxes before they generate complaints, and the built-in sequence engine respects per-mailbox daily limits automatically, so volume is spread correctly across the domain portfolio without manual tracking.
For ops leaders evaluating whether to build this infrastructure in-house or use a platform, the build-vs-buy math is significant. A self-managed deliverability stack at scale requires: secondary domain registration and DNS management ($500 to $2,000/month in domain costs), dedicated SMTP infrastructure ($1,000 to $5,000/month depending on volume), seed list testing subscriptions ($300 to $600/month), blacklist monitoring tools ($100 to $300/month), and ongoing ops time to manage the stack (often 5 to 10 hours per week for a senior ops person). Most teams find that the fully-loaded cost of in-house deliverability management at 10,000+ emails per day exceeds $4,000 per month before factoring in engineering time. Unify consolidates the entire stack at a lower total cost while adding the signal layer that connects inbox placement to pipeline outcomes.
For a practical walkthrough of cold email workflow best practices that complement this infrastructure guide, see our article on cold email best practices for SDR workflows.
What Are the Most Common Technical Deliverability Mistakes at Scale?
The five most common technical deliverability mistakes at scale are: sending from the primary domain, exceeding per-mailbox daily limits, skipping IP warming, not monitoring DMARC reports, and neglecting to suppress unengaged contacts. Each of these mistakes is invisible in your ESP dashboard until it has already damaged your sender reputation.
Exceeding per-mailbox daily limits is the most frequent mistake among teams that scale quickly. When a sequence tool is configured to maximize sends per mailbox, individual mailboxes often send 100 to 200 emails per day, which is 3 to 4 times the recommended limit. Inbox providers score per-mailbox sending patterns, not just per-domain volume. A mailbox that sends 150 cold emails per day looks statistically different from a human sender and triggers spam filtering at the mailbox level, even if the domain-level reputation looks healthy.
Suppressing unengaged contacts is a deliverability lever most teams underestimate. Contacts who have received 3 or more emails without opening any of them are significantly more likely to mark future emails as spam. Removing contacts from active sequences after 3 unopened emails reduces spam complaint rates and improves the engagement-to-send ratio, which feeds positively into inbox placement algorithms. This is not just list hygiene; it is active reputation management.
Summary: The Cold Email Deliverability Technical Checklist
Maintaining cold email deliverability at scale requires all five infrastructure layers to be in place and monitored continuously. The following checklist covers the minimum viable technical setup for teams sending more than 1,000 cold emails per day.
- DNS Authentication: SPF record published with no more than 10 lookups. DKIM configured with 2048-bit keys. DMARC at minimum
p=nonewith aggregate reporting enabled. BIMI implemented on primary domain if DMARC is atp=quarantineorp=reject. - Domain Architecture: Cold outbound sent from secondary domains only. At least one domain per 500 emails per day. 3 to 5 mailboxes per sending domain. All sending domains have complete DNS authentication (SPF, DKIM, DMARC).
- IP Warming: All new IPs and domains warmed over 4 to 8 weeks following the progressive volume schedule. Engagement seeding used during warming. Seed list testing run weekly throughout warming period.
- Sending Infrastructure: Dedicated IPs for teams above 5,000 emails per day. 2048-bit DKIM key strength confirmed. Per-mailbox daily limit set at 30 to 50 emails. Bounce handling automated with immediate suppression of hard bounces.
- Monitoring Stack: Google Postmaster Tools configured for all sending domains. Blacklist monitoring active with email alerts. Seed tests run at least weekly. Daily dashboard tracking all 8 health metrics from the template above.
Frequently Asked Questions
What DNS authentication records do you need for cold email at scale?
You need four DNS authentication records: SPF, DKIM, DMARC, and ideally BIMI. SPF authorizes which IPs can send on behalf of your domain, DKIM adds a cryptographic signature to every outbound message, DMARC tells receiving servers what to do when authentication fails, and BIMI displays your logo in supporting inboxes like Gmail, Yahoo, and Apple Mail. Use 2048-bit DKIM keys and start DMARC at p=none before escalating to p=quarantine or p=reject once all sending sources pass SPF and DKIM alignment.
Should you send cold email from your primary company domain?
No. Cold email at scale generates spam complaints even with perfect list hygiene, and complaints on your primary domain can damage deliverability for product emails, billing receipts, and marketing campaigns simultaneously. Use secondary registered sending domains (for example, getyourcompany.com, yourcompany.io) with at least one domain per 500 emails sent per day. This insulates your primary brand reputation from cold outbound complaint volatility.
How long does IP warming take for a new sending domain?
IP warming takes 4 to 8 weeks. Start with 50 to 100 emails per day from a new IP in week one targeting engaged contacts, then increase by 50% to 100% per week: week 2 at 200/day, week 3 at 500/day, week 4 at 1,000/day, week 5 at 2,500/day, week 6 at 5,000/day, week 7 at 10,000/day, and week 8 at full volume. If spam placement rises above 0.3% or inbox placement drops below 85% during warming, pause for 48 hours and resume at the prior week's volume.
What is a healthy spam complaint rate for cold email?
A healthy spam complaint rate is below 0.08%. Google's published threshold for a "high" spam rate is 0.1%, and Google begins throttling and filtering email from domains that exceed this level. Rates above 0.3% cause significant inbox placement degradation within days. Monitor complaint rates daily via Google Postmaster Tools across every sending domain in your rotation, not just your primary domain.
Do you need dedicated IPs for cold email at scale?
Dedicated IPs are the right choice for teams sending more than 5,000 emails per day consistently. Below that threshold, a high-quality shared IP pool from a reputable ESP is often more reliable because the pool maintains consistent warm volume automatically. Dedicated IPs require maintaining steady volume — an IP that sends 10,000 emails one week and 200 the next looks suspicious to inbox providers and can trigger reputation damage.
How many sending mailboxes and domains do you need at 5,000 emails per day?
At 5,000 cold emails per day, you need 100 to 166 sending mailboxes across 20 to 55 secondary domains. Limit each mailbox to 30 to 50 new outbound emails per day, and run 3 to 5 mailboxes per domain. Spreading volume across domains limits per-domain sending rate, which is one of the strongest signals spam filters use to identify bulk outbound campaigns.
How often should you run seed list testing for cold email?
Run seed list tests before launching any new sequence, after changing any DNS records, and at least once per week during normal operations. Run them once or twice per week during IP warming. A placement rate below 85% in seed tests is a signal to investigate before sending to your full prospect list. Seed testing surfaces inbox placement changes 1 to 2 weeks before bulk metrics show degradation, giving you lead time to course-correct.
What is DMARC alignment rate and why does it matter?
DMARC alignment rate measures what percentage of your outbound mail passes both SPF and DKIM alignment, specifically whether the domain in the "From" header matches the domain that passed authentication. A DMARC alignment rate above 98% is healthy. A sudden drop almost always means a new sending source — a new ESP, marketing tool, or automation — was added to your stack without proper DNS configuration. Catching this early prevents authentication failures from accumulating into a domain reputation hit.
Sources
- Google Postmaster Tools documentation and bulk sender requirements: https://support.google.com/mail/answer/81126
- Google's Sender Requirements & Postmaster Tools FAQ (February 2024 enforcement update): https://knowledge.workspace.google.com/admin/gmail/sender-requirements-and-postmaster-tools-faq
- Spamhaus Block List (SBL) lookup and blacklist database: https://www.spamhaus.org/sbl/
- MXToolbox Blacklist Monitor (100+ list simultaneous check): https://mxtoolbox.com/blacklists.aspx
- RFC 7489 (DMARC specification): https://datatracker.ietf.org/doc/html/rfc7489
- RFC 7208 (SPF specification): https://datatracker.ietf.org/doc/html/rfc7208
- RFC 6376 (DKIM specification): https://datatracker.ietf.org/doc/html/rfc6376
- BIMI Group standard and VMC certification requirements: https://bimigroup.org/implementation-guide/
- GlockApps email deliverability testing platform (Inbox Insight): https://glockapps.com/
- Yahoo Sender Requirements (2024 bulk sender policy): https://senders.yahooinc.com/best-practices/
- Unify GTM platform: https://www.unifygtm.com
About the Author
Austin Hughes is Co-Founder and CEO of Unify, the system-of-action for revenue that helps high-growth teams turn buying signals into pipeline. Before founding Unify, Austin led the growth team at Ramp, scaling it from 1 to 25+ people and building a product-led, experiment-driven GTM motion. Prior to Ramp, he worked at SoftBank Investment Advisers and Centerview Partners.
.avif)
