Cold Email in 2027: The Complete Deliverability Setup (Domains, Warm-Up, SPF/DKIM/DMARC)

You can write the best cold email of your life and get zero replies because nobody ever saw it. Deliverability, whether your email lands in the inbox or in spam, is the foundation of outbound. Get it wrong and nothing else matters.

The good news: deliverability isn’t magic. It’s a set of technical steps and sending habits that anyone can follow. This guide walks through the complete setup, from buying domains to monitoring reputation.

A note on compliance: cold email is legal in many places when done right, but rules differ by country. In the US, CAN-SPAM requires accurate headers, a non-deceptive subject, a physical postal address and a working opt-out honored within 10 business days. In the UK and EU, GDPR and PECR set stricter conditions. Always check the rules for where your recipients are.

How inbox providers decide where your email goes

Gmail, Outlook and other providers look at three broad things:

1. Authentication: is this email really from who it claims to be? (SPF, DKIM, DMARC)
2. Reputation: how have recipients treated email from this domain and IP before? (opens, replies, spam complaints, bounces)
3. Content and behavior: does the message look like spam, and does the sending pattern look like a real person?

The setup below addresses all three.

Step 1: Use secondary domains, not your main domain

Never risk your primary domain (the one your team uses for customers, invoices and partners) on cold outreach. Instead:

• Buy 2–5 secondary domains that clearly relate to your brand. If your company is acme.com, options include getacme.com, acmehq.com or tryacme.com.
• Redirect each secondary domain to your main website so anyone who checks it lands somewhere legitimate.
• Avoid odd TLDs and spammy-looking names.
• Let new domains age a little before heavy sending, if you can.

If one domain’s reputation suffers, your main domain and other outreach domains are unaffected.

Step 2: Create real mailboxes

On each domain, set up mailboxes with a reputable email provider (Google Workspace or Microsoft 365 are the most common):

• Use real names (sarah@getacme.com), not “sales@” or “info@”.
• Add a profile photo and a professional signature.
• Plan 2–3 mailboxes per domain to keep volume per domain modest.

Sending capacity comes from adding mailboxes and domains, not from pushing one inbox harder.

Step 3: Set up SPF

SPF (Sender Policy Framework) is a DNS record listing which servers are allowed to send email for your domain.

Example for Google Workspace:

v=spf1 include:_spf.google.com ~all

Rules:

• Only one SPF record per domain. If you use several services, combine their include: statements in one record.
• Stay under SPF’s 10 DNS lookup limit.
• Include every tool that sends on behalf of the domain.

Step 4: Set up DKIM

DKIM (DomainKeys Identified Mail) adds a digital signature to every email so receivers can verify it wasn’t altered and really came from your domain.

• Generate the DKIM key in your email provider’s admin panel.
• Add the provided TXT record to your DNS.
• Turn on signing in the admin panel and send a test email.
• Use a 2048-bit key where supported.

Step 5: Set up DMARC

DMARC tells receiving servers what to do if an email fails SPF or DKIM, and sends you reports.

Start with a monitoring policy:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Then, once you’ve confirmed legitimate email passes:

• Move to p=quarantine, and eventually p=reject for maximum protection.
• Make sure the “From” domain aligns with the SPF or DKIM domain.

Google and Yahoo’s bulk sender requirements (in effect since February 2024) expect a DMARC record to exist, alongside SPF and DKIM.

Step 6: Set up a custom tracking domain (or skip tracking)

If your sending tool tracks opens or clicks, it rewrites links through a tracking domain. Shared tracking domains can carry other people’s bad reputation.

• Set up a custom tracking domain (e.g. track.getacme.com) with a CNAME record, or
• Turn off open and click tracking for cold emails. Many experienced senders do this anyway, since open tracking relies on images and is increasingly unreliable due to privacy features.

Step 7: Warm up before you send

New domains and mailboxes have no reputation. Sending hundreds of cold emails on day one looks exactly like a spammer.

Warm-up means gradually building positive history:

• Weeks 1–2: send small volumes of normal, real emails; use a warm-up tool if you wish, which exchanges emails with other inboxes and marks them as important.
• Weeks 3–4: start cold sending at low volume, increasing slowly.
• Ongoing: many teams keep a light warm-up running in the background.

Be patient. Two to four weeks of warm-up can save months of damaged reputation.

Step 8: Respect sending limits

Behavior matters as much as setup.

• Keep cold volume modest per mailbox, often a few dozen per day, and scale with more mailboxes.
• Spread sends throughout business hours, with random intervals, rather than blasting all at once.
• Avoid sudden spikes in volume.
• Keep total volume per domain modest, too.

Step 9: Only send to verified, relevant contacts

Bounces and complaints are reputation killers.

• Verify every email address before sending with a reputable verification tool. Aim to keep bounce rates very low (many teams target under 2–3%).
• Be careful with catch-all domains, which accept all addresses and hide bounces.
• Target tightly. Irrelevant emails get marked as spam; relevant ones get replies. See How to Build a B2B Prospect List That Actually Replies.
• Honor opt-outs immediately and suppress them across all domains and tools.

Google has stated that senders should keep spam complaint rates below 0.1% and never reach 0.3%. Relevance is the best way to stay there.

Step 10: Write emails that look human

Content isn’t everything, but it matters:

• Plain text, no heavy HTML, no images, no attachments in the first email.
• One link at most (or none) in the first email.
• Short: 50–125 words is a good range.
• Personalized for real, not just {first_name}.
• Ask for a reply, not a click. Replies are a strong positive signal to inbox providers.
• Avoid spammy phrases and excessive punctuation or caps.
• Vary your copy (spintax or multiple variants) so thousands of identical messages don’t go out.

Our cold email templates that book meetings follow these rules.

Step 11: Make unsubscribing easy

Even in cold email, give people a simple way out:

• A short line like “Not relevant? Reply ‘no thanks’ and I won’t follow up.”
• Or a one-click unsubscribe link where your tool supports it.

People who can easily opt out are far less likely to hit “Report spam.”

Step 12: Monitor and react

Set a weekly routine:

• Google Postmaster Tools: add your domains to see spam rate and domain reputation for Gmail recipients.
• DMARC reports: check for authentication failures.
• Bounce rate and reply rate per mailbox and per campaign.
• Inbox placement tests occasionally, to see where emails land.
• Blocklist checks for your domains.

Warning signs: rising bounces, falling reply rates with no copy change, or replies saying “found this in spam.” When you see them, slow down: reduce volume, review list quality, and check authentication.

A deliverability checklist

• Secondary domains purchased and redirected to main site
• Real mailboxes with names, photos and signatures
• SPF configured (one record, under 10 lookups)
• DKIM enabled with a 2048-bit key
• DMARC published and monitored
• Custom tracking domain, or tracking disabled
• 2–4 weeks of warm-up completed
• Per-mailbox daily volume kept modest
• Every address verified; catch-alls handled carefully
• Plain-text, short, personalized copy with variants
• Easy opt-out honored across all domains
• Postmaster Tools and DMARC reports reviewed weekly

Related guides: Cold Email Low Reply Rate? How to Diagnose It and Fix It Step by Step and How Many Follow-Up Emails Should You Send in Cold Outreach? (Plus a Sequence You Can Copy).

The bottom line

Deliverability is infrastructure. Set it up properly, send like a human, only email people who’ll find your message relevant, and watch your reputation every week. Do that, and your copy finally gets the chance to work.

The Lead Engine handles all of this for you: domains, authentication, warm-up, verified lists and campaigns that land in the inbox and earn replies from real decision-makers.