A secondary sending domain is the foundation of B2B cold email. Set it up right and it runs for years; set it up wrong and it takes 4 to 8 weeks to recover the first time deliverability goes sideways. Here is the complete setup, from domain purchase to first live send.
Step 1: Choose the domain name
The domain name matters more than most teams think. A good name reads as "the same company" to the buyer; a bad name reads as either spam or a typo.
Patterns that work:
- yourco-outreach.io
- get-yourco.com
- hello-yourco.com
- yourco-team.com
- talk-to-yourco.com
- yourco-app.io
Patterns to avoid:
- Anything with "deal," "free," "save," or "discount" in the name.
- Numbers in the domain (yourco2024.com reads as spam).
- Hyphens stacked (yourco-out-reach.com is too long).
- Lookalike TLDs (.email, .biz, .info). Most inbox providers down-weight these.
Use a .com or .io when possible. These are the most trusted TLDs for B2B sending.
Step 2: Purchase the domain
Buy from a reputable registrar. Namecheap, Cloudflare Registrar, Google Domains, and AWS Route 53 all work. Avoid registrars known for hosting spam (the cheapest providers).
What to buy:
- The .com (or .io) variant.
- 1 to 3 year registration. Longer registrations slightly improve sender reputation.
- WHOIS privacy enabled. Standard at most registrars.
What not to buy:
- Pre-owned domains. Some have spam history that follows the domain forever.
- Bulk-discount domains. The savings are not worth the risk of inheriting reputation problems.
Step 3: Set up the mailbox provider
Two viable options: Google Workspace or Microsoft 365. Both work for B2B cold email. Pick based on your buyers:
- Selling to startup or tech-forward buyers: Google Workspace.
- Selling to enterprise or finance buyers: Microsoft 365.
Cost: $6 to $25 per inbox per month depending on plan.
For each inbox you create:
- Use a real person's name: firstname.lastname@yourco-outreach.io. Generic addresses (sales@, info@, hello@) get filtered more aggressively.
- Set up the inbox with a real first and last name in the profile.
- Add a small profile picture (real photo, not the company logo). Increases deliverability subtly but consistently.
- Configure the email signature: one line, name and role. Nothing else.
For most outbound programs, 2 to 3 inboxes per domain is the sweet spot. More than 5 inboxes per domain looks suspicious to inbox providers.
Step 4: Configure DNS records
Three records to set up, all in DNS at your registrar. Verify each one before sending.
SPF record. One TXT record at the root of the domain.
Type: TXT
Host: @
Value: v=spf1 include:_spf.google.com -all
If you use Microsoft 365 instead of Google Workspace, the include changes:
v=spf1 include:spf.protection.outlook.com -all
If you send through additional services (Sendgrid, Mailgun), add their includes. Order matters: list each include before the -all.
DKIM record. Generated by your mailbox provider. Google Workspace gives you the public key in Admin Console > Apps > Google Workspace > Gmail > Authenticate Email. Microsoft 365 gives you the key in Defender > Email & collaboration > DKIM.
Publish the key as a TXT record at the specified selector. The selector for Google Workspace is typically "google."
Type: TXT
Host: google._domainkey
Value: [the long public key from Workspace]
DMARC record. One TXT record at _dmarc.yourdomain.com.
Type: TXT
Host: _dmarc
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourco-outreach.io; pct=100
Use p=quarantine for cold sending domains. p=reject is too aggressive. p=none is too permissive.
After all three are set, verify via MXToolbox. All three should return green before you proceed.
Step 5: Add the unsubscribe header
Required by Gmail and Yahoo for high-volume senders as of February 2024. Two parts:
- List-Unsubscribe header: Includes a mailto link or an HTTPS link to unsubscribe.
- List-Unsubscribe-Post header: The one-click unsubscribe support (value: List-Unsubscribe=One-Click).
Most cold email tools configure this automatically once you connect the mailbox. Verify it is present by sending a test email to yourself and viewing the raw headers.
Step 6: Connect to the cold email tool
In your cold email platform (Smartlead, Instantly, Outreach, Salesloft, ReachIQ), add each new inbox via OAuth or SMTP credentials.
Configure per inbox:
- Daily sending cap: 30 to 50 emails per day.
- Sending hours: 8am to 5pm in the recipient's time zone.
- Random delay between sends: 90 to 300 seconds.
- Warmup network: Enabled.
Step 7: Run domain warmup
Do not send live messages for the first 14 days. The warmup network exchanges automated messages with other domains in the network, building sender reputation gradually.
| Day range | Warmup volume per inbox per day |
|---|---|
| Days 1 to 3 | 5 to 10 |
| Days 4 to 7 | 10 to 15 |
| Days 8 to 14 | 15 to 25 |
| Days 15 to 21 | 25 to 40 |
| Day 22+ | 40 to 50 (sustainable) |
Keep warmup running even after live sending begins. The continued exchange of warmup messages maintains reputation.
Step 8: Register with monitoring services
Before first live send:
- Google Postmaster Tools. Add the domain. Will show reputation, spam rate, and authentication after 7 to 14 days.
- Microsoft SNDS. Add the sending IPs.
- MXToolbox blacklist monitoring. Set up an email alert if the domain or any of its IPs lands on a major blocklist.
Check these tools weekly. Most deliverability problems show up in monitoring days before they show up in reply rates.
Step 9: The launch checklist
Before sending the first live message, confirm all of:
- Domain purchased from a clean registrar.
- Mailbox provider configured (Google Workspace or Microsoft 365).
- Inboxes set up with real first/last names and signatures.
- SPF record set, returning green in MXToolbox.
- DKIM record set, returning green.
- DMARC record set, returning green.
- Unsubscribe headers verified in a test email.
- Domain warmup running for at least 14 days.
- Cold email tool connected with caps and sending hours configured.
- Postmaster Tools and SNDS monitoring enabled.
- List validated, bounce risk under 5 percent.
- Sequence reviewed for spam triggers.
- Reply routing configured.
If any item is incomplete, do not launch. Each one represents a 30 to 90 day setback if discovered after the fact.
Step 10: First live send
Day 14 at the earliest. Send the first batch at 30 to 50 emails per inbox. Across 4 to 6 inboxes, that is 120 to 300 emails.
Watch the first 4 hours:
- Bounce rate stays under 2 percent.
- No spam complaints.
- Open rate above 30 percent at 4 hours (will continue to rise over 24 hours).
If anything looks off, pause and diagnose. Do not push through deliverability problems.
Common domain setup mistakes
1. Setting up only SPF and DKIM, skipping DMARC. DMARC is required for high-volume sending. Without it, deliverability degrades over weeks.
2. Wrong SPF syntax. Multiple SPF records, or SPF that exceeds 10 DNS lookups, both break the record. Validate with MXToolbox.
3. Sending from the primary domain "just for a few weeks." Even a short period of cold sending from the primary domain damages reputation. Always use a secondary from day 1.
4. Generic inbox names. sales@, info@, hello@ get filtered more aggressively. Use firstname.lastname@ instead.
5. Skipping warmup to "save time." 14 days of warmup saves 4 to 8 weeks of recovery from a flagged domain. Always warm.