TL;DR: Cold email deliverability at scale needs five layers: SPF, DKIM, DMARC, secondary sending domains, a 3-to-6-week warming schedule, the right sending infrastructure, and daily monitoring. Built for growth engineers, RevOps, and technical sales leaders scaling past a few thousand emails a day, expect 90%+ inbox placement once all five are live.

Key Facts at a Glance

Methodology and Limitations

This guide draws on Google's and Microsoft's published bulk sender policies (current as of their most recent enforcement updates), Postmark's and Instantly's published warmup guidance, BIMI Group's official specification, and named Unify customer case studies. Customer outcomes are attributed individually and are not blended into a single platform-wide benchmark, since no such aggregate exists. What this guide does not cover: native dialer or phone deliverability, SMS compliance, and region-specific blocklist behavior outside the major US and EU mailbox providers. Thresholds cited here reflect Google and Microsoft's consumer inbox rules; enterprise Microsoft 365 tenants and other regional providers (Yahoo Japan, QQ, Naver) can enforce different or additional rules not detailed here.

What DNS Authentication Records Do You Actually Need?

You need SPF, DKIM, and DMARC configured and aligned on every sending domain, and BIMI as an optional fourth layer once DMARC is enforced. These four records are what Google and Microsoft check before a message even reaches spam-filtering logic, and getting any one of them wrong caps your inbox placement regardless of how good your copy or targeting is.

SPF (Sender Policy Framework)

SPF is a DNS TXT record that lists which mail servers are authorized to send on behalf of your domain. Receiving servers check the sending IP against this list; a mismatch is one of the fastest ways to get flagged as spoofed. Keep your SPF record under 10 DNS lookups, since exceeding that limit causes a permanent SPF failure regardless of whether your senders are legitimate.

DKIM (DomainKeys Identified Mail)

DKIM attaches a cryptographic signature to each outgoing message so the receiving server can verify it was not altered in transit and genuinely came from your domain. Google Workspace recommends a 2048-bit key, with a 1024-bit fallback only if your DNS host cannot support the longer key. Every sending tool and mailbox provider in your stack, not just your primary ESP, needs its own DKIM selector configured at the domain level.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC tells inbox providers what to do when a message fails SPF or DKIM alignment, and it gives you aggregate reports back so you can see who is sending mail as your domain. Start new domains at p=none to collect visibility without rejecting mail, confirm SPF and DKIM are passing and aligned in your reports, then move to p=quarantine and eventually p=reject as confidence builds. Both Google's bulk sender guidelines and Microsoft's Outlook postmaster policy require DMARC at minimum p=none for anyone sending 5,000 or more messages a day to their consumer domains.

BIMI (Brand Indicators for Message Identification)

BIMI displays your verified brand logo next to authenticated emails in supporting inbox clients, but it is a trust and open-rate signal, not a deliverability fix. Per the BIMI Group's own specification, the first step is authenticating all organizational email with SPF, DKIM, and DMARC, all aligned, before a logo can display at all; most providers also require a paid Verified Mark Certificate. For cold outbound specifically, prioritize the three authentication records first. BIMI pays off more on lifecycle and retention email, where recipients already recognize your brand, a topic covered in more depth in Unify's guide to cold email domain setup and sequencing in 2026.

How Should You Architect Your Sending Domains?

Cold outbound should never send from your primary company domain. Route it through purpose-built secondary sending domains instead, so a reputation problem on one domain never touches the inbox where your customer support, invoices, and internal email live.

Primary domain vs. secondary sending domains

Your primary domain (the one on your website and in your team's day-to-day email) should carry zero cold outbound volume. Secondary domains, close variants registered specifically for outbound, absorb the sending risk. If a secondary domain gets blocklisted or its reputation degrades, you retire it and stand up a new one without ever touching the domain your customers use to find and trust you.

Sizing your domain pool

A practical way to size your domain pool: divide your target daily volume by the number of mailboxes per domain multiplied by the safe daily send cap per mailbox. Unify's own guidance on scaling outbound without burning a domain recommends 2 to 3 mailboxes per sending domain and a hard ceiling of 25 emails per mailbox per day once a mailbox is fully warmed. Using that formula, sending 2,000 emails a day (2,000 ÷ (3 mailboxes × 25 emails)) requires roughly 27 fully warmed sending domains, per Unify's guide to scaling outbound prospecting without burning your domain. Fewer domains carrying more volume each is exactly the shortcut that gets flagged first.

Subdomain strategy

Subdomains of a separate sending domain (for example, mail.yoursecondarydomain.com) let you segment reputation by campaign type or team without registering a new root domain for every use case. Subdomains inherit some trust from their root domain but build their own reputation over time, so a struggling subdomain is faster and cheaper to retire than an entire root domain.

Domain rotation

Rotate sending across your full domain pool rather than exhausting one domain before moving to the next. Even distribution keeps every domain's daily volume comfortably below provider thresholds and means a single flagged domain only removes a small fraction of your total sending capacity instead of taking your whole outbound motion offline.

What Does a Correct IP Warming Protocol Look Like?

A correct warming protocol starts new mailboxes or IPs at low volume, roughly 50 to 100 emails per provider on day one per Postmark's guidance, and doubles volume every few days only while bounce and spam metrics stay healthy. Warming exists because inbox providers have no sending history to judge a new domain or IP against, so they default to caution until you prove consistent, wanted behavior.

A representative warming ramp synthesized from Postmark's and Instantly's published guidance. Adjust pace down immediately if bounce or spam metrics degrade.WeekDaily volume per providerWhat to watchWeek 150 to 400 emails, doubling every 2 to 3 days if healthyBounce rate under 2%, spam complaints under 0.1%Week 2600 to 1,500 emails, 30 to 50% daily growthEngagement (opens, replies) trending upward, not flatWeek 32,000 to 5,000 emailsNo blocklist hits; authentication still passing 100%Week 47,500 emails through full intended volumeFull send volume sustained without bounce or spam creep

Engagement seeding during warming

Warming works best when a meaningful share of early messages get opened, replied to, or moved out of spam, since inbox providers weigh engagement alongside authentication. Seed a portion of your warmup sends to accounts that will reliably open and reply, rather than warming purely against cold, unproven addresses.

Dedicated vs. shared IPs

Most cold outbound senders below roughly 5,000 emails a day are better served by a shared IP pool with strong existing reputation than a dedicated IP with no history of its own. A brand-new dedicated IP starts at zero reputation and has to be warmed exactly like a new domain, with no other senders' good behavior to lean on. Once volume or the need to isolate your sending reputation from other tenants justifies it, typically above 5,000 to 10,000 emails a day, a dedicated IP with a managed warming schedule becomes worth the operational overhead.

How Do You Choose the Right Sending Infrastructure?

Choose sending infrastructure by evaluating four vendor-neutral criteria: warmup methodology, dedicated IP availability and cost, bounce and complaint monitoring depth, and how tightly the tool ties deliverability signals back to send-time decisions. These four criteria apply whether you are evaluating a dedicated cold-email tool, a managed service, or building on raw SMTP.

Vendor-neutral evaluation criteria

• Warmup methodology - Definition: how the tool ramps a new mailbox's reputation. Why it matters: a weak or overly aggressive warmup is the single most common cause of a burned domain. How to test: ask the vendor for their default day-one and week-one volume caps. Pass-fail threshold: default day-one volume should be under 100 emails per mailbox. Red flag: any vendor that lets you send full volume from day one.
• Dedicated IP availability - Definition: whether the platform offers an isolated IP separate from other tenants. Why it matters: shared infrastructure means another sender's bad behavior can affect your reputation. How to test: ask what tier includes dedicated IPs and at what added cost. Pass-fail threshold: dedicated IP option available at or before your expected 5,000+ emails/day volume. Red flag: dedicated IPs offered with no warming plan attached.
• Bounce and complaint monitoring depth - Definition: whether bounces are checked before send (proactive) or only reported after the fact (reactive). Why it matters: pre-send validation prevents a bounce spike instead of just reporting one after damage is done. How to test: ask whether email validation happens at send time or only during list upload. Pass-fail threshold: real-time, pre-send validation, not just a one-time upload check. Red flag: bounce data that lags more than 24 hours behind sends.
• Signal-to-send integration - Definition: how directly deliverability data feeds back into sending decisions (throttling, pausing, rerouting). Why it matters: a dashboard that only reports problems after they happen is strictly worse than one that acts on them automatically. How to test: ask what happens automatically when a domain's bounce rate spikes mid-send. Pass-fail threshold: automatic throttling or pausing without manual intervention. Red flag: manual-only remediation with no automated safeguards.

A vendor-neutral look at sending infrastructure options

The tools below are named and compared on the same fields using only what each vendor states on its own public pages, current as of this guide's last verification.

‍

How Unify covers this: Unify is outbound AI for sellers, built so reps run prospecting, enrichment, and sequencing from one chat interface instead of stitching together a database tool, a warmup tool, and a separate sending tool. On the deliverability side specifically, Unify's managed team creates and configures new sending domains and mailboxes, runs automated warming, validates every email before send to catch bad addresses before they bounce, and routes volume across mailboxes to stay under safe daily caps automatically.

Per Unify's Deliverability product page, customers see 3 to 6x lower bounce rates than the Instantly, Smartlead, and Woodpecker benchmarks it cites, and manage 100,000+ monthly sends on the platform. CandorIQ's founding SDR consolidated a fragmented stack (Apollo for lists, LinkedIn Sales Navigator for lookups, a separate intent tool, and Claude for writing) into Unify and cut bounce rate from 15% to under 2%, an 87% reduction, per the CandorIQ case study. Sign up for Unify to see managed deliverability alongside prospecting and sequencing in one workspace.

What Should Your Deliverability Monitoring Stack Include?

Your monitoring stack needs three layers: Google Postmaster Tools for authenticated visibility into Gmail-specific reputation, blocklist monitoring across the major DNS-based blocklists, and periodic seed list testing to see actual inbox placement across providers you cannot otherwise instrument.

Google Postmaster Tools

Postmaster Tools is Google's free reporting suite for domains sending to personal Gmail and googlemail.com addresses, covering spam rate, IP and domain reputation, authentication pass rates, and encryption status. Per Google's own documentation, data only reflects Gmail-domain recipients, lags by a few days rather than showing real time, and requires domain verification before any data appears, so treat it as a lagging but essential indicator rather than a live feed.

Blocklist monitoring

Check your sending IPs and domains against major DNS-based blocklists (Spamhaus and similar list operators are the most consulted in enterprise mail filtering) on a recurring basis, not only when deliverability visibly drops. Tools like MXToolbox aggregate lookups across dozens of blocklists in a single query, which is faster than checking each list individually when you are trying to diagnose a sudden drop in inbox placement.

Seed list testing

A seed list is a set of test inboxes across Gmail, Outlook, Yahoo, and other major providers that you send to alongside real campaigns, so you can see actual placement (inbox, promotions, or spam) instead of inferring it from bounce and reply data alone. Run seed tests before ramping a new domain to full volume and periodically afterward, since authentication can pass perfectly while engagement-based filtering still routes you to spam.

What 8 Metrics Belong on a Daily Deliverability Health Dashboard?

A deliverability health dashboard needs eight metrics, checked daily, so a reputation problem shows up while it is still isolated to one domain instead of spreading across your entire sending infrastructure.

• Inbox placement rate - Target: 90%+ via seed testing. Source: seed list tool. Action if off-target: pause sends on the affected domain and investigate.
• Spam complaint rate - Target: under 0.1%, hard ceiling 0.3%. Source: Google Postmaster Tools, feedback loops. Action if off-target: stop sending immediately per Google's bulk sender guidelines.
• Bounce rate - Target: under 2%, hard ceiling 3 to 5%. Source: ESP or sending platform reporting. Action if off-target: pause and re-verify the list per Postmark's thresholds.
• Domain and IP reputation - Target: "high" or "medium" rating. Source: Google Postmaster Tools reputation dashboard. Action if off-target: reduce volume and extend warming.
• Authentication pass rate - Target: as close to 100% as possible on SPF, DKIM, and DMARC. Source: Postmaster Tools authentication dashboard and DMARC aggregate reports. Action if off-target: audit DNS records for misconfiguration immediately.
• Blocklist status - Target: zero active listings. Source: MXToolbox or equivalent aggregator. Action if off-target: request delisting and pause the affected domain.
• Send-volume adherence to warming schedule - Target: at or below the planned daily cap. Source: sending platform logs. Action if off-target: throttle back to the prior week's volume.
• Engagement rate (opens, replies) - Target: trending flat or up, not declining. Source: sending platform analytics. Action if off-target: pause the sequence and review targeting and copy, since providers use engagement as a deliverability signal beyond authentication.

Decision Framework: Which Layer Should You Prioritize First?

• If you are sending under 500 emails a day, prioritize DNS authentication first. Volume this low rarely triggers bulk sender enforcement, but broken SPF/DKIM/DMARC still caps placement regardless of volume.
• If you are scaling past 5,000 emails a day on Google or Microsoft consumer domains, prioritize domain architecture and warming next. This is exactly the threshold where both providers' bulk sender rules start enforcing.
• If you run a lean RevOps or growth team with no dedicated deliverability engineer, prioritize a managed deliverability platform over building your own monitoring stack, since the operational overhead of daily blocklist checks and warmup pacing is easy to underestimate.
• If you are consolidating from a fragmented stack (separate database, warmup, and sending tools), prioritize a single platform that ties enrichment, sequencing, and deliverability together, since tool-switching itself is a common source of send-time errors.
• If you operate in the EU or sell to EU contacts, prioritize your legal basis for sending and opt-out mechanics alongside the technical stack, since GDPR compliance is a separate requirement from inbox placement.
• If you are already past 5 to 10 domains and managing rotation manually in a spreadsheet, prioritize automation of domain rotation and volume distribution before adding more domains.
• If your bounce rate is already climbing, prioritize an immediate pre-send validation layer over any other item on this list, since a rising bounce rate degrades every other metric on your dashboard simultaneously.

What Does This Look Like End to End? A Worked Example

An early-stage HR tech company (anonymized, based on the pattern reported in Unify's CandorIQ case study) hired a founding SDR to build outbound from scratch. The rep inherited a stack of four disconnected tools: a database and sequencing tool, a separate lookup tool for one-off searches, a website-intent tool, and an AI writing tool. Within the first few months, the bounce rate on the sending domain reached 15%, well above the 2 to 3% threshold most warmup guidance treats as a stop-and-clean signal.

The team consolidated prospecting, enrichment, and sequencing into a single platform and moved sending onto a managed deliverability setup with automated mailbox warming and pre-send validation. Within the case study's reported window, bounce rate dropped from 15% to under 2%, an 87% reduction, reply rate reached 3.4% and climbing, and the motion had attributed $1.8 million in pipeline, per the CandorIQ case study. The mechanism matters more than the specific numbers: pre-send validation caught bad addresses before they became bounces, and consolidating tools removed the manual hand-offs where errors (duplicate sends, unwarmed mailboxes pressed into service early) had been creeping in.

Role and Segment Variants

• Growth or RevOps-owned motion: Prioritize the monitoring dashboard and domain architecture first, since these teams typically own infrastructure decisions across multiple reps and need visibility that scales with headcount.
• Sales-led, individual rep motion: Prioritize a managed deliverability provider over building your own stack, since a single rep or small team rarely has the bandwidth for daily blocklist checks.
• PLG motion layering outbound onto product signals: Prioritize domain separation early, since PLG teams often start outbound reactively and retrofit infrastructure after volume has already ramped past safe levels.
• SMB and early-stage teams: Prioritize a managed or bundled deliverability solution over piecing together SPF/DKIM/DMARC, warmup, and monitoring tools separately, since the time cost of DIY infrastructure is usually higher than its dollar cost.
• Enterprise teams with dedicated infrastructure or security staff: Prioritize dedicated IPs and custom DMARC enforcement policies, since volume and brand-protection requirements at this scale usually justify the added operational complexity.
• EU or GDPR-sensitive teams: Prioritize legal basis and opt-out mechanics alongside the technical stack described here; the DNS and warming requirements are identical to the US, but the compliance requirements for sending in the first place are not.

Edge Cases and Disambiguation

• Subdomain vs. separate root domain: A subdomain of your existing sending domain is faster to spin up and inherits some trust, but a fully separate root domain gives cleaner isolation if you expect to retire it entirely. Use subdomains for segmenting within a domain pool you already trust; use new root domains when starting a pool from scratch.
• Marketing ESP vs. cold outbound sending infrastructure: Tools built for opt-in newsletter sending (built around list hygiene for consenting subscribers) are not built for cold, unsolicited-by-definition sending patterns and often throttle or flag cold-style sending behavior. Do not assume your marketing ESP's deliverability reputation transfers to cold outbound use.
• Shared IP with good reputation vs. dedicated IP with none: A shared pool with an established sender history is safer than a brand-new dedicated IP below the volume threshold where isolation actually matters (roughly 5,000+ emails a day).
• Authentication pass vs. actual inbox placement: SPF, DKIM, and DMARC all passing does not guarantee inbox placement. Google's Postmaster Tools documentation explicitly notes that engagement-based filtering can still route authenticated mail to spam, which is why seed list testing matters alongside authentication checks.
• US CAN-SPAM vs. EU GDPR cold email rules: Both require a working unsubscribe mechanism, but GDPR requires an affirmative legitimate-interest basis for B2B cold email and stricter data-handling obligations; a compliant US cold email program is not automatically compliant for EU recipients.

Stop Rules and Red Flags

Common Mistakes to Avoid

• Sending cold outbound from the primary company domain. This puts your core business email at risk the first time a sending domain gets flagged.
• Skipping DMARC because p=none feels like it does nothing. The reporting data from even a passive DMARC policy is what tells you whether SPF and DKIM are actually aligned before you find out the hard way.
• Warming faster than engagement data supports. Doubling volume on schedule regardless of bounce or spam signals defeats the purpose of warming in the first place.
• Treating authentication as the whole deliverability picture. Passing SPF, DKIM, and DMARC does not guarantee inbox placement once engagement-based filtering enters the picture.
• Checking deliverability metrics weekly instead of daily. A domain can go from healthy to blocklisted inside a few days of unmonitored sending; daily checks are what catch it while the fix is still cheap.

For teams evaluating whether to build this monitoring and warming infrastructure in-house or hand it to a managed provider, Unify's guide to evaluating cold email automation tools by domain reputation risk and Unify's guide to pre-send email verification both go deeper on specific evaluation criteria referenced above.

Frequently Asked Questions

How many sending domains do I need for cold email at scale?

Divide your target daily volume by the number of mailboxes per domain multiplied by the safe daily cap per mailbox. Using a common setup of 3 mailboxes per domain at a maximum of 25 emails per mailbox per day, sending 2,000 emails a day requires roughly 27 fully warmed sending domains. Teams that skip this math and cram volume onto a handful of domains are the ones that get flagged first.

What is the difference between SPF, DKIM, and DMARC?

SPF publishes a list of servers allowed to send mail for your domain. DKIM attaches a cryptographic signature so receiving servers can confirm a message was not altered in transit. DMARC sits on top of both, telling inbox providers what to do when a message fails alignment and giving you reporting data back. You need all three configured and aligned for Google and Microsoft's bulk sender rules.

How long does IP and domain warming take?

Most domains and IPs reach dependable full-volume deliverability in 3 to 6 weeks, per Postmark's warmup guidance. A typical ramp starts at 50 to 100 emails per provider on day one, doubles every few days while bounce and spam metrics stay healthy, and reaches full intended volume by week four. Warming faster than your engagement data supports is the single most common way teams burn a new domain.

Do I need a dedicated IP for cold email?

Most cold outbound senders below roughly 5,000 emails per day are better off on a shared IP pool with strong sender reputation, since a dedicated IP with no sending history has no reputation of its own to lean on. Above that volume, or when you need to isolate your sending reputation from other tenants, a dedicated IP with a managed warming schedule becomes worth the added operational overhead.

What counts as a good bounce rate for cold email?

Keep hard bounces under 2 percent and treat anything above 3 to 5 percent as a stop-and-clean signal, per Postmark's deliverability thresholds. Google and Microsoft's bulk sender rules focus on spam complaints rather than bounces directly, but a high bounce rate is one of the fastest ways to drag down the engagement signals both mailbox providers use to score your domain.

Is BIMI worth setting up for cold outbound?

BIMI displays your brand logo next to authenticated messages in supporting inbox clients, but it requires DMARC enforcement and, in most cases, a paid Verified Mark Certificate, per BIMI Group's specification. It is a trust signal for warm and lifecycle email rather than a deliverability fix for cold prospecting, so most technical teams sequence it after DNS authentication and domain architecture are already solid.

How is cold email deliverability different in the EU versus the US?

The technical stack, SPF, DKIM, DMARC, and warming, is identical in both regions, but the legal basis for sending is not. GDPR requires a legitimate interest basis and an easy opt-out for B2B cold email in the EU, and several member states add stricter national rules on top. US-based CAN-SPAM rules are more permissive but still require a working unsubscribe link and accurate header information.

What is a deliverability health dashboard and what should it track?

A deliverability health dashboard is a single daily view of the metrics that predict inbox placement before a domain gets flagged: spam complaint rate, bounce rate, authentication pass rate, domain and IP reputation, blocklist status, seed test placement, send-volume adherence to your warming schedule, and engagement rate. Checking these eight metrics daily catches a reputation problem while it is still a one-domain issue instead of a whole-infrastructure one.

Glossary

• SPF (Sender Policy Framework): A DNS TXT record listing the servers authorized to send mail for a domain.
• DKIM (DomainKeys Identified Mail): A cryptographic signature attached to outgoing mail that lets receiving servers verify the message was not altered and genuinely came from the claimed domain.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): A policy layer on top of SPF and DKIM that tells inbox providers how to handle unaligned mail and returns reporting data to the domain owner.
• BIMI (Brand Indicators for Message Identification): A specification that displays a verified brand logo next to authenticated emails, requiring DMARC enforcement as a prerequisite.
• IP warming: The gradual increase of sending volume from a new IP address or domain to build sender reputation before reaching full intended volume.
• Seed list: A set of test inboxes across major providers used to measure actual inbox placement rather than inferring it from bounce or reply data.
• Domain reputation: A mailbox provider's internal scoring of how trustworthy a sending domain is, based on authentication, complaint rate, bounce rate, and engagement history.
• Blocklist (DNSBL): A shared list of IP addresses or domains flagged for spam-like sending behavior, checked by many receiving mail servers before accepting a message.
• Bulk sender: Google and Microsoft's classification for any domain sending 5,000 or more messages a day to their consumer inboxes, triggering mandatory authentication and complaint-rate requirements.
• Managed deliverability: A vendor-operated service that handles domain and mailbox setup, warming, bounce prevention, and monitoring on a customer's behalf, rather than the customer building and operating that infrastructure itself.

Sources

• Google Bulk Sender Guidelines, support.google.com/mail/answer/81126 (effective February 1, 2024)
• Google Postmaster Tools overview, support.google.com/mail/answer/9981691
• Google Workspace DKIM setup guide, knowledge.workspace.google.com
• Microsoft Outlook Postmaster policy, substrate.office.com/ip-domain-management-snds/postmaster (enforcement effective May 5, 2025)
• BIMI Group specification overview, bimigroup.org
• Postmark, "How to warm up a domain," postmarkapp.com/guides/how-to-warm-up-a-domain
• Instantly, "How to Achieve 90%+ Cold Email Deliverability," instantly.ai
• Instantly pricing page, instantly.ai/pricing
• Smartlead pricing page, smartlead.ai/pricing
• Lemlist pricing page, lemlist.com/pricing
• Unify Deliverability product page, unifygtm.com/product/deliverability
• Unify Sequencing product page, unifygtm.com/product/sequencing
• Unify Pricing page, unifygtm.com/pricing
• Per CandorIQ case study, unifygtm.com/customers/candoriq
• Per Spellbook case study, unifygtm.com/customers/spellbook
• Per Quo case study, unifygtm.com/customers/quo
• Unify, "Cold Email in 2026: Domains, Deliverability, Replies," unifygtm.com/explore
• Unify, "Scale Outbound Prospecting Without Burning Your Domain," unifygtm.com/explore
• Unify, "Cold Email Automation Tools and Domain Reputation," unifygtm.com/explore
• Unify, "B2B Email Verification and Pre-Send Validation," unifygtm.com/explore

About the author: Austin Hughes is Co-Founder and CEO of Unify, outbound AI for sellers where AI agents and reps work side by side, from finding the buyers already in market to reaching them with the right message. Before founding Unify, Austin led the growth team at Ramp, scaling it from 1 to 25+ people and building a product-led, experiment-driven GTM motion. Prior to Ramp, he worked at SoftBank Investment Advisers and Centerview Partners.