September 2026 · Marketing operations · 3 min read

The Technical Setup That Keeps Cold Email Out of Spam

SPF, DKIM, DMARC, domain warm-up, and sending limits explained the way I actually set them up for market entry campaigns.

Türkçe oku →

When I scanned 476 job postings across 379 companies to build a 51-company target list, the list was only half the job. The other half was making sure the emails I sent from that list actually reached an inbox instead of a spam folder, because a perfect list sent through a broken domain gets the same result as no list at all: silence.

Here is the setup I actually run before any outreach goes out, in the order it needs to happen.

Set up a separate domain and authenticate it

Never send cold outreach from your primary domain. If tunahangamgam.com is where your website and business email live, do not send cold campaigns from that domain. A handful of spam complaints on a cold campaign can damage the sending reputation of the domain your actual business runs on, including invoices, proposals, and normal client email. Buy a lookalike domain instead, something like tunahangamgam-outreach.com or a close variant, for around $10 to $15 a year from any standard registrar. This is the single most common mistake I see, someone burns their main domain's reputation on a first campaign that gets flagged, and then every legitimate email from that domain gets filtered for months.

Set up SPF, DKIM, and DMARC on the sending domain before sending a single email, not after. SPF (Sender Policy Framework) is a DNS record listing which servers are allowed to send mail on the domain's behalf, it takes one TXT record and about ten minutes if you already know your sending provider's SPF include value. DKIM (DomainKeys Identified Mail) signs each outgoing email with a cryptographic key so receiving servers can confirm the message was not altered in transit, most email tools (Google Workspace, Apollo, Instantly) generate the DKIM record for you, you just paste it into DNS. DMARC (Domain-based Message Authentication) tells receiving servers what to do if SPF or DKIM fail, start with a DMARC policy of p=none while you monitor, then move to p=quarantine once you trust the setup. Skipping any one of these three does not just risk spam folder placement, several major providers reject mail outright from domains with no DMARC record at all as of policy changes in the past two years.

Warm up the domain and keep volume in check

Warm up the domain and mailbox for at least two to three weeks before real sending volume. A brand new domain with zero sending history that suddenly sends 200 emails on day one looks exactly like a spam operation to Gmail and Outlook's filters, regardless of content quality. Warm-up means sending a small, increasing volume, starting around 10 to 15 emails a day to real, engaged addresses (colleagues, past clients who will open and reply), increasing by roughly 5 emails a day, reaching normal sending volume by week three. Tools like Mailreach or the built-in warm-up features in Instantly and Smartlead automate this by having a network of mailboxes exchange and open emails with each other. This step is the one people skip most often because it delays the campaign, and it is the one that determines whether the campaign works at all.

Keep sending volume per mailbox low even after warm-up. For a single mailbox, 30 to 50 cold emails a day is the realistic ceiling before providers start throttling or flagging the account, regardless of domain reputation. This is why serious outreach at any real volume uses multiple mailboxes on multiple subdomains under the same root, three to five mailboxes sending 30 to 40 each gets you 100 to 150 a day without pushing any single address into flagged territory.

Check placement before you trust the setup

Check placement before trusting the setup. Send a test email to a checker like Google Postmaster Tools (free, if you have a Google Workspace sending account) or mail-tester.com (free, gives a spam score out of 10 with a specific breakdown of what is missing) before running a real batch. A score under 8 out of 10 on mail-tester almost always points to a missing or misconfigured SPF, DKIM, or DMARC record, fixable in minutes once you know which one.

None of this is complicated technically, it is closer to filling out a form correctly than writing code, but it takes a day of setup and two to three weeks of patience before full volume, and skipping it is the reason a well-researched, well-written email campaign gets zero replies while the sender assumes the message itself was the problem.

A great email from a broken domain never gets read. Fix the pipes before you worry about the words.

Updated: September 2026