Cold Email Domain Setup: Step-by-Step (2026)
Cold email domain setup is the process of turning a freshly registered domain into a working, authenticated sending channel. The sequence is fixed: register a dedicated domain, point its DNS at a mailbox provider, create an isolated tenant, add mailboxes, publish SPF, DKIM, and DMARC, warm the mailboxes, then connect a sequencer. Each step depends on the one before it, so skipping ahead breaks the chain.
Step 1: Register a dedicated sending domain
Never send cold email from your main domain. Cold outreach wears down sender reputation, and damage to your primary domain affects every email your business sends. Instead, register one or more secondary domains used only for outreach.
Most operators buy variants of their brand — a .com lookalike, a hyphenated version, or a country variant. Pick a registrar you trust, and favour established TLDs (.com, .co, country domains like .de or .co.uk) over cheap, abuse-prone extensions that receivers already distrust. Our guide on how to choose cold email domains covers the trade-offs, and secondary domains for cold email explains why separation matters.
Step 2: Point DNS at your mailbox provider
Once the domain is registered, its DNS has to direct mail to the right place. This usually means delegating the domain to your provider’s nameservers or editing records directly at the registrar.
The records that matter at this stage:
| Record | Purpose |
|---|---|
| MX | Routes incoming mail to the mailbox provider’s servers |
| CNAME / TXT | Verifies domain ownership and enables provider services |
| SPF / DKIM / DMARC | Authentication — added once mailboxes exist (Step 5) |
The MX record tells the world which servers accept mail for the domain. DNS changes are not instant; they propagate over minutes to hours, so verify each record resolves before moving on. See DNS records for email for the full set.
Step 3: Create an isolated Microsoft 365 tenant
Cold email runs best on real mailboxes, not raw SMTP relays. A Microsoft 365 tenant is the isolated environment that holds your mailboxes, users, and policies. Giving each sending domain its own tenant keeps reputation contained: if one domain burns out, it does not drag the others down with it.
Microsoft 365 is a common choice for cold email because it provides genuine, OAuth-capable mailboxes. If you are weighing platforms, Microsoft 365 vs Google Workspace for cold email SMTP compares them, and the Microsoft 365 tenant explained covers what a tenant actually is. One timing note: Microsoft has been retiring basic authentication for SMTP and pushing customers toward OAuth, so an OAuth-native setup is the safer path forward — check current Microsoft announcements for the exact timelines that apply to your tenant.
Step 4: Add mailboxes with distinct sender names
With the tenant in place, create the mailboxes. A practical ceiling is up to 100 mailboxes per domain. You do not have to start there — add more as your volume grows.
Give each mailbox a distinct human sender name — a real-sounding person, not info@ or sales@. Identical or near-identical senders across mailboxes look like a list, not a conversation, and receivers notice. For how the per-domain mailbox count interacts with volume, see how many mailboxes per domain, and what mailbox provisioning is for the underlying process.
Step 5: Publish SPF, DKIM, and DMARC
Now that mailboxes exist, add the three authentication records. Since February 2024, Google and Yahoo require bulk senders to pass SPF and DKIM and publish DMARC, plus one-click unsubscribe and a low spam-complaint rate (commonly cited as under roughly 0.3%). These are no longer optional.
- SPF lists which servers may send for the domain — one record, under ten DNS lookups. See SPF records for cold email.
- DKIM signs each message so receivers can verify it was not altered. See DKIM for cold email.
- DMARC tells receivers what to do when SPF or DKIM fails, and where to send reports. See DMARC for cold email.
The SPF, DKIM, and DMARC setup checklist walks through testing all three with a real send, not just confirming the records exist.
Step 6: Warm up the mailboxes
A brand-new domain and brand-new mailboxes have no sending history, so providers treat them with suspicion. Email warmup builds a track record gradually — the mailboxes exchange low volumes of mail that get opened and replied to, ramping up over time so the domain looks like a normal, active sender rather than a cold start.
Skipping warmup is the fastest way into the spam folder. Warmup typically runs for several weeks before mailboxes are ready for real campaign volume; how long email warmup takes gives realistic timelines, and what email warmup is explains the mechanics.
Step 7: Connect a sequencer
The final step is connecting the warmed mailboxes to a sequencer — the tool that sends your sequences, handles replies, and tracks engagement. The mailboxes connect over a real, authenticated path (OAuth for Microsoft 365), not raw SMTP.
Respect the sending limits Microsoft enforces on each mailbox — check Microsoft’s current published limits, as they change over time. In practice you will send far below any platform cap to protect reputation — see how many cold emails per day. For how the sequencer fits the rest of the stack, read the cold email sequencer explained.
Setup checklist at a glance
| Step | What it does | Common failure |
|---|---|---|
| Domain | Dedicated secondary sending domain | Sending from the main domain |
| DNS | Routes and verifies mail | Records not propagated yet |
| Tenant | Isolated Microsoft 365 environment | One tenant shared across domains |
| Mailboxes | Real senders, distinct names | Generic or identical senders |
| Auth | SPF, DKIM, DMARC | Wrong source listed in SPF |
| Warmup | Builds sending history | Sending at volume too early |
| Sequencer | Runs the campaigns | Connecting before warmup finishes |
How Mailionaire approaches this
Mailionaire runs every step above as a done-for-you flow: a dedicated domain gets its own isolated Microsoft 365 tenant, distinct human sender mailboxes, automatically written and verified SPF, DKIM, and DMARC, and automatic warmup — all at a flat $50 per active domain per month, with no per-mailbox metering. Monitoring and self-healing replace mailboxes and domains as they wear out. See how it works for the full provisioning sequence.
FAQ
What are the steps to set up a cold email domain?
Register a dedicated sending domain, point its DNS at your mailbox provider, create an isolated Microsoft 365 tenant, add mailboxes with distinct human sender names, publish SPF, DKIM, and DMARC, warm the mailboxes for a few weeks, then connect them to your sequencer. Each step gates the next.
How long does cold email domain setup take?
The technical setup — registrar, DNS, tenant, mailboxes, and authentication — can be done in a day, but DNS changes take time to propagate and warmup runs for several weeks before the mailboxes are ready for real volume. Plan for roughly three to six weeks from registration to first campaign.
Should I use my main domain for cold email?
No. Cold email wears down sender reputation, and a damaged main domain affects all your business mail. Use dedicated secondary domains for sending, kept separate from your primary domain, so any reputation damage stays contained to domains you can afford to retire.
Does correct domain setup make cold email legal?
No. SPF, DKIM, and DMARC are technical authentication, not legal permission. Whether you may send depends on the recipient's jurisdiction — Germany's UWG §7(2) generally requires prior opt-in for advertising email, including B2B. The sender remains responsible. This is not legal advice.
Mailionaire provisions real, isolated Microsoft 365 mailboxes for cold email — built in Switzerland, with optional EU/Swiss data residency — then monitors and replaces them as they wear out. One flat price per domain. See how it works →